{ "Event": { "published": true, "date": "2023-05-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-11", "timestamp": 1683849781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f399c606-82a5-4cb5-9caa-307fcfe847cd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1d2832-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683829968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829968, "uuid": "078f65eb-8160-4fa5-91f9-87ae90d40e96", "comment": "Malware payload", "value": "973c6cb04a55cabeae3b4fce133f868e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829968, "uuid": "c78181a6-24c1-47cb-9759-405982d9bf66", "comment": "Malware payload", "value": "00939e25e104ed776c705ef7bbafe2aaf3f684a77a55385597f319b364241196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829968, "uuid": "6c73b924-dab6-4533-9b16-82c4369ff0a3", "comment": "Malware payload", "value": "12595455744e94316ca6098af62087a79959e66f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829968, "uuid": "7ff26529-3f96-4d8c-8f01-c9c1ddaf5c92", "comment": "Malware payload", "value": "f19ec5dbb9836a688b1d15e95d1865852b00dc6f0531e3bfb1bdbaa6ea0a4fae0ec8e419d28e55d22c043b0034d167a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829968, "uuid": "38ce0a89-5a58-4403-b3bb-2e5b82588f1e", "value": "T1D49633CFFAC0BE54CD91C0B75A40FAF005725EC6928E57A151E23AD029E658FD93A7E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829968, "uuid": "6255fa3f-e739-4f44-a2e8-097e594c2f1d", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829968, "uuid": "1154888d-9ca8-4252-8bf0-58c621015f85", "value": "196608:7qJPJcDzws5qvyP9jJ2g72e5cwK3nRFzfhjGTlTsanS:2JPnCqEjR5y3nRFzksanS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829968, "uuid": "b831bc45-5e81-4788-b846-58f1038aac0f", "value": 9136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829968, "uuid": "8a4f579e-0073-44b6-9701-58879aa277ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829968, "uuid": "efc47a5b-9018-43fb-959a-ee414419fcb0", "value": "SecuriteInfo.com.Win64.CoinminerX-gen.21081.2689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26c6264-efd4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683793232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793232, "uuid": "9d8411cb-6d8c-481d-8e18-ba447e4ed8ff", "comment": "Malware payload (RedLineStealer)", "value": "45988f5b66955f5c78b1710af207eb33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793232, "uuid": "fa8f0b94-2ccc-4bcf-a0d4-8ed4eb29cc3f", "comment": "Malware payload (RedLineStealer)", "value": "00cb1e076eadc486166ce91e9e7532c742078fc1989f1c05aeb7cf6e0707cb4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793232, "uuid": "4ea74b1a-e9d7-4a16-be1a-c7b4ee276247", "comment": "Malware payload (RedLineStealer)", "value": "68921c14d43ffe552c25585b0ea69dda5cc0e891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793232, "uuid": "47940f76-484e-4430-8593-15cfb3a54ba8", "comment": "Malware payload (RedLineStealer)", "value": "2b3351d25bc8d5d7c50e925cc0374fa1e9ed9a04ba604337cbd0a147e83b24bf874ab56708f8343f3920e1da3de507b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793232, "uuid": "1f739f57-32bf-44e2-ac31-a5eca8f0533b", "value": "T16E052246F3D880B2E9B257301CFA13D30B797C639C34866E7799291B0C72AD4A87572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793232, "uuid": "8f2abc04-a404-41b1-a1fe-9dc7440f77ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793232, "uuid": "67911f97-4cd0-42a8-8376-ba79a401c511", "value": "24576:AyrnVE+uaSF0zUSjS49LewMTMVDt0rY+Ta7:HZfuaSF0fjzLJr0ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793232, "uuid": "950af316-cd96-48d3-8bd2-bff4be7363a2", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793232, "uuid": "ddd9f0c6-e08a-491f-b1e0-7aa55cf78dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793232, "uuid": "170182e9-cadb-4f4c-ab32-a5d10d2a4c61", "value": "45988f5b66955f5c78b1710af207eb33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47542a1-efa1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683771358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683771358, "uuid": "a1515509-c4b8-4c16-90c1-8ca11eedd936", "comment": "Malware payload", "value": "9159179bd212f6c76121473d6d2465fe", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683771358, "uuid": "79e32e5a-eb62-4f20-b36c-65278da48aa2", "comment": "Malware payload", "value": "0121e555be6023ef689f3f0c1a5c9b1941cff26d391eba2501738988b8ea5c18", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683771358, "uuid": "a9c071fc-fbd4-4345-b107-2db1c9d64a52", "comment": "Malware payload", "value": "1b07bb748fd71acf596fc31c689b7411d945da26", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683771358, "uuid": "c7c75721-dac6-493c-8635-956a26915a5d", "comment": "Malware payload", "value": "46b4ffbe7bb60dc928b2b286589a84598d2d49a63693546b0418fc6c0ecae1dc81fc87ff881f6469d93f74bfe3154313", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683771358, "uuid": "5c16307c-9a96-4a5d-97b7-d667cf59686a", "value": "T1AFD633D3BD9DD93AE08BE53460E0D127A938451842A6FA477580D05F0AF3C816BB7FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683771358, "uuid": "709aee3a-7e27-4914-99b0-7c912a261cc6", "value": "393216:nFy/h1RMsEG7rA9XVuSsSqOEqEvMlww5vpNL3NrjrxhZ6wcxGYP07bS:nFqMevUX4SsSqOEqVlp5vpNLN/d6NFcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683771358, "uuid": "dd1c9b4a-558a-4b72-88e8-683ededcaeda", "value": 13436899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683771358, "uuid": "43b6727e-90f3-4d05-a220-762bc3dd4c8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683771358, "uuid": "019c3b61-9d4c-4722-a3af-c5b5e16b6def", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5ed9c8-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683789839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789839, "uuid": "efb3d0c2-95fc-42b1-a18c-0bc49d4eebd2", "comment": "Malware payload (AgentTesla)", "value": "7453f3a30b07b29bf7d753ffa32ef6fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789839, "uuid": "d3c1d60e-636f-4d9a-b137-05ef8b4d3426", "comment": "Malware payload (AgentTesla)", "value": "02114be9f27d7243f98b7d6017392f25733ef38a473f4f0003cc26d731d07e1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789839, "uuid": "4a81698b-b5c7-457e-b375-27eb6d47f2aa", "comment": "Malware payload (AgentTesla)", "value": "a7f6b960b477c4796d33053f27ccf4d26173e516", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789839, "uuid": "c09599bb-5f4b-4e01-9e14-f0a6c2285575", "comment": "Malware payload (AgentTesla)", "value": "3ec64d0e6374a1f00405a34ce960872b41a02f451b9951d8dce5cbeb7fd6f222619c79548fe4b800b6be2951d3eff67c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789839, "uuid": "3a08f870-fbe8-4f84-8776-a0b71bac0a3e", "value": "T1D9522B15EFF8C227CABD4BB2E5E383640379D36675A6EB174D882DAAAD017D80C013D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789839, "uuid": "50e3f591-11c5-405c-859c-e83282edc5dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789839, "uuid": "6493c988-21c8-4f7a-bb7f-256bee31ba20", "value": "192:P/S1d7dfalNKoCfLB95qLUz0Zl4sf+LeQFSwkal6VOp3rXso:PqrdCBCfLB95qLUz0AvLRQw1rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789839, "uuid": "1d77a19e-9c39-45b0-8956-f4626859feac", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789839, "uuid": "2a3a390e-6bc4-4427-b0d7-6ec8ac676788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789839, "uuid": "897dbe98-ee25-48b3-a56f-d05f100f3ad2", "value": "Orden de art\u00a1culos.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ef241a-efba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1683781856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781856, "uuid": "6847f528-9e6a-45ba-8a9c-8f57fc3d7b8e", "comment": "Malware payload (STRRAT)", "value": "a23a97ce82fe4696d2325b681bf969cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781856, "uuid": "7a4771d4-b9b6-440c-b4ae-81532ac64d26", "comment": "Malware payload (STRRAT)", "value": "02387056d290c252a350156a1e711c7977fe3a60ea23ff72240accfc740f04f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781856, "uuid": "a20894bf-f2aa-497f-bef2-a4809f7c9449", "comment": "Malware payload (STRRAT)", "value": "288fdbee3dd50224cfa6d29ac25055592cf66240", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781856, "uuid": "0d84f54c-26dc-44d7-bfe5-b2ba1b5f85cd", "comment": "Malware payload (STRRAT)", "value": "9ba7be664412e3bc8fadf8b1687ac999de9f4bd8a1cbac8b79aad1d035ebcbd300b041b81372f2225634ba879ccb1759", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781856, "uuid": "b8ede5c6-fc08-4f46-8f9e-5e72a3b7dba8", "value": "T1C58449AA9246073AA8F454B270FF9B335794A7272094BC7F15674FDF9B16A0A103D2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781856, "uuid": "c0bbce21-3a53-43a0-956a-1d0139308fdd", "value": "6144:0McoFXZEVaJWQZC0X5Y03HphMLsJCYdIYOqEtyFPBFWG5pNvEiw5iIy2LeOeet7:iCOwJLr3HfGZyRjos7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683781856, "uuid": "1392161a-672d-4359-bf88-26e02bd75c5d", "value": 372678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683781856, "uuid": "f3b82840-4dcd-4cc0-b884-28554ceeb1c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781856, "uuid": "770f1ea9-38e0-49cf-bac4-b9847281c22c", "value": "PO-29387923823001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987f23c7-effc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683810368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810368, "uuid": "d731fe2f-82af-4238-8a8f-525129e19d77", "comment": "Malware payload (RedLineStealer)", "value": "2d86108e95809333696cdc40549c4a6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810368, "uuid": "3e90702a-6cad-48fc-851e-8be7c689e214", "comment": "Malware payload (RedLineStealer)", "value": "03042961ebc91064d7e9da04ba292158b34656bf7a05bc868c8f478efa0247df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810368, "uuid": "f02c65af-a4df-47ee-a97d-3adcec05a607", "comment": "Malware payload (RedLineStealer)", "value": "b269a5d0fbdd16ea0b091edd9a518b35c3f63132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810368, "uuid": "86017bb9-8938-4a75-b244-b8df87e0beb2", "comment": "Malware payload (RedLineStealer)", "value": "fce21702409763e4326bf59afa3f0233e6d175586cd5a368875329afea7e88a55f9a1c06be0d8030fab73d6dc07c929f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810368, "uuid": "4b2eca64-7634-443d-ae3c-d1eadcc05943", "value": "T1F2E4D02393A17C54E9264B328E2FC6EC761EF3508F597B762219AE5F04B02B1C673B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810368, "uuid": "901b6d33-c2e1-49e5-9ace-1df0462c6481", "value": "796ee4764b976b073ef697d148f4671b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810368, "uuid": "0cfc10ae-90c4-4216-8c8e-324bbc1eaf64", "value": "12288:T/ss9xcGO0+EBx/qVHyd4wqNnlXzP0qf73knC1xciP894:Th9GGmE4a4HPX4qAnC1BP894", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683810368, "uuid": "61cfcacc-5e3e-415d-a10f-8d0d2d9263aa", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683810368, "uuid": "3e4b0811-4597-4f3a-b959-849d7aa09bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810368, "uuid": "b37f1268-2542-4db3-a073-b677fbf076d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a096b0-f016-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683821448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821448, "uuid": "7aaae10d-3fbd-40ed-bfb3-1885a099125e", "comment": "Malware payload (Quakbot)", "value": "6d0aab1f794a3442d7d9fb257eb9882b", "object_relation": "md5", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821448, "uuid": "c3359226-8452-454a-a29d-86602e4975a1", "comment": "Malware payload (Quakbot)", "value": "0487a3c0917e9552bfc18bd87eef605bf9d449070e0d45f8c295b9e10b57a65c", "object_relation": "sha256", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821448, "uuid": "83ca361c-caf0-4231-bdd2-83793b47471b", "comment": "Malware payload (Quakbot)", "value": "fd084496b02c006f36c9cf4870aff73168925e5a", "object_relation": "sha1", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821448, "uuid": "31bff352-60a6-4a2f-be81-25af8beb8826", "comment": "Malware payload (Quakbot)", "value": "db339bf12b2d210d3015114568e35191d9a3cc1e32368b91c3770871831c330f45e5235d2946ee76e642c24a555b6d6c", "object_relation": "sha3-384", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821448, "uuid": "64c62f60-ac17-4be0-8586-d9d0a2a28688", "value": "T146947E93A052CC30E16746FBA2445A678BB8FF2253467CF3839F8685DA57470962E372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821448, "uuid": "a95a2698-6e97-4b37-bcd6-ada1a06fd41f", "value": "8a51c68b360795fa270153789c839dc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821448, "uuid": "6b0bf1ed-db9d-4e54-ba8f-a8426231f98b", "value": "6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8H:9/Cw6Z4nilhFX8mCXDckOPeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683821448, "uuid": "11a0494f-0cc9-4dc3-bd95-802c7d06dc8f", "value": 428668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683821448, "uuid": "7deb917d-b39a-4c37-a536-ce53890a8de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821448, "uuid": "3e5d6a85-dbc5-434e-aa26-5d92e022782c", "value": "dropThaTGhettoBlasterBoris.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bc8785-f033-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683834040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834040, "uuid": "bbfbd5f5-740b-4eb1-8d1b-40181888ab50", "comment": "Malware payload (RedLineStealer)", "value": "0c0c767f8d146a9dc4bc413373898d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834040, "uuid": "331f6d19-7559-4955-b031-63490ee60b77", "comment": "Malware payload (RedLineStealer)", "value": "048ade0e2763eeec746bdd88d5888cbf0530516f72348a177fa2ac08af4d7c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834040, "uuid": "92f12895-cb45-4bef-af99-d0b00be11d20", "comment": "Malware payload (RedLineStealer)", "value": "970d6010ab6f7ab5eec70e8e54af24a8541b0d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834040, "uuid": "4cc06c27-a215-4e2f-ad8b-71cb1b504def", "comment": "Malware payload (RedLineStealer)", "value": "9f1937df8dcffad033d38e4094a6cd0008965b6cd6e4e848815ab523b129cd50cfaa7ea10751c18abc17956729c40bfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834040, "uuid": "ad434de9-2714-4c9c-966c-2dbf20cb484a", "value": "T117252306B7E840B3DA740B3058FA03931E75BCA2DD68538776A678466C73B81E87573E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834040, "uuid": "3c4dbb39-1317-46bd-ba28-2593f9f845f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834040, "uuid": "7ac9ae10-73f2-4442-b770-cda5d12285c0", "value": "24576:Ey6/4RZMB7KDytAgWIz46egke/EJVRl2901n3VMi8QC1pkt:T84e2UWIs6egkvr2w3V8Quk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834040, "uuid": "a5ee0ede-b874-4474-98df-63d2ab45e46d", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834040, "uuid": "3c2275e0-5827-42a5-a83f-268e8d39abe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834040, "uuid": "7b1cfbe5-a3c7-4559-91cf-34eb0c29c28d", "value": "0c0c767f8d146a9dc4bc413373898d3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750c3cd8-efd2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1683792270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792270, "uuid": "433baa67-b60c-43be-88da-999a803d50ed", "comment": "Malware payload (IcedID)", "value": "8d232b32d41758b05f965f26877b2c59", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792270, "uuid": "ceed76e1-9a6d-4a93-a6a0-a84bfc76b618", "comment": "Malware payload (IcedID)", "value": "067876cdc229e18c61eefd5e11f7803285d770f7eaaba89949c63a1703337b34", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792270, "uuid": "f39e06fc-d889-47ba-90f8-09aea0c33e34", "comment": "Malware payload (IcedID)", "value": "af0a12b3728c73c8afa70bd4b44236fc7c4cc24e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792270, "uuid": "e0d070c8-ed9e-4a9a-8896-133cb9c1f5cc", "comment": "Malware payload (IcedID)", "value": "5f92036e20f1125d6776bafc7ee813d6af9afdcb2c5388de65ae69d182b0b96239b47b76f44a9a628acbf69076692dd3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792270, "uuid": "524b8648-1401-40fa-9252-ce0b5f421982", "value": "T11713F13D69E22D0DE55C657D18B531E528353A3003AAFD0E4C6CD5A08A721FBF51BBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792270, "uuid": "73af1dcc-423f-4992-8071-7fb9babb8f49", "value": "768:CcJPUEAOto5sal5jiH/22DyINnGPmkV5xcP1pY612EcPsnycgTdIwaDO5lKyDraV:4EAO+skNiHTnFErcP1+61fcPsdOKyDrO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683792270, "uuid": "4cc2f230-a3e9-4a9d-9d0e-fbbcfdab9239", "value": 45139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683792270, "uuid": "59596448-ce6f-4ddf-85a4-b80ade504436", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792270, "uuid": "04fdc9f1-4e7c-4c17-aa45-ca9447c101e2", "value": "InvCopy#20.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdf179b-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828983, "uuid": "1f0c8d4a-2fb8-4e77-9d4f-95144c8f0b0d", "comment": "Malware payload (Mirai)", "value": "ceca1b1dc6b006044a434aa946d14ce7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828983, "uuid": "3da9c373-61ed-4be2-b3c9-72f8ac6fe153", "comment": "Malware payload (Mirai)", "value": "071b3389f81e7620217f4e93d25e8be8b6a9a900139524ac240b8766289a74bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828983, "uuid": "d262491c-13a1-4268-9c33-cd8a272dab7f", "comment": "Malware payload (Mirai)", "value": "9db56296061770aa183ae0ff1fb6d5f51f03e1bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828983, "uuid": "b9077690-fab4-4e7a-98ca-8971106dc4a9", "comment": "Malware payload (Mirai)", "value": "e92548d26fdcf57cda9ae9169cfc66afc08100c39be715327c9faabec8e9864ca790e5d7bfb1607174bfe8fbc8918a2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828983, "uuid": "f042812d-2e97-479f-89b1-d5c2bcfcecfc", "value": "T159933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00376EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828983, "uuid": "8417a680-89eb-48bc-a98f-77b90d508468", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8MNYumXxVqDrstKfz9e:Q97vk51RcG7ACqumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828983, "uuid": "532eea25-31e9-404c-871b-dfd0656965bd", "value": 93904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828983, "uuid": "81acddf3-5b1e-4120-b8d6-46450e862484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828983, "uuid": "97b619b1-8fd2-4931-b800-de62f213ef91", "value": "ceca1b1dc6b006044a434aa946d14ce7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf640dff-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1683837089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837089, "uuid": "b8867ca4-f78e-447c-beeb-4d683df3f350", "comment": "Malware payload (NetSupport)", "value": "5d5a21ec86ad5f40a4c9b961544dd0c9", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837089, "uuid": "cba23f26-4b6a-4801-b4e5-b0b5c664c715", "comment": "Malware payload (NetSupport)", "value": "07aae6d3b269e977d9d40c23bae87b4af1e37913165a635c29a2f3a9e9be25a9", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837089, "uuid": "894b77a6-ffcc-4dbd-8daf-35068b22c46c", "comment": "Malware payload (NetSupport)", "value": "ad648cee1279f568dd729f4c0b05ae81d8abcdb4", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837089, "uuid": "c496a504-5fad-4830-8dec-bcda30b8af2b", "comment": "Malware payload (NetSupport)", "value": "f85cc95a8882a3e731d90b809ab671a59e9547df8e54c16ec3f5c15f0e0629715106f5c55b8fb32154d05682a5dc5dbd", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837089, "uuid": "125331ec-db66-447e-ba7f-de043daca214", "value": "T1A1E2AD9C66D36053966FF03AB2BE98C6E65649181BD2540FB91C7234FF91C3CCE60B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837089, "uuid": "0a0b9aa6-296d-4dc8-91e3-995fa07f6e0e", "value": "384:M7n5iQkkcogtytck4OUKbmT1+e568gUI9juOdnVxkdJVo1W0eMoI1DA4ef+C98KL:9hWRKzzMf6DxUNiiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837089, "uuid": "9a3371ad-3e81-4fce-aa91-94eca7eec258", "value": 32240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837089, "uuid": "62a19d44-0f3e-41f0-956a-95f3d82348bc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837089, "uuid": "3fdfa2b7-c615-476d-8fb5-361587f2cefc", "value": "Versandbestaetigung14864_14864.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843e059b-efc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683788430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788430, "uuid": "4ec7661a-8b2f-46d2-8e93-c36004182eef", "comment": "Malware payload", "value": "113d6da8fdefb00f3f4c8e078f63a430", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788430, "uuid": "89057fd8-21c6-4d0e-a7ac-3db96cf44e16", "comment": "Malware payload", "value": "07ecdc6af7a9b80ce2a77e57e41a14504720a1871e32fb1aa2454467b265c25e", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788430, "uuid": "df724e7b-16e9-4578-a58f-4fc83152f3b6", "comment": "Malware payload", "value": "a7fdee25f3887b4ceffb3d3018da88f9e79211ab", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788430, "uuid": "07cdc2f7-b283-4563-bec0-fd9d73ff1ff8", "comment": "Malware payload", "value": "73830a69a94c8562809aa78442905182c0a42185de8072c2ef8020d1d04c512e12f88d1b10cc482be4193baaed28356c", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "pw - 2023", "colour": "#DD6AC4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788430, "uuid": "c191c9da-431f-42cb-8983-8965aa9b36d4", "value": "T1C6853365FF8F7FCA025388681DAD289618CC07B99501BD64ED2AFD36309FD418C9E5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788430, "uuid": "af283564-2d5d-419d-a9f9-5a46ea9d355f", "value": "24576:cIdOR8g1oC3kazsAT+IJZoGLOTbn5/Ej5Rb8HqlLRZIgi4ALaWsRygfuyZrS8Xw:cKC3Rz2GZefIv4HILDIzTmWgLxZm8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683788430, "uuid": "6ec230fc-d801-4a4a-9232-683b5406f6e7", "value": 1820691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683788430, "uuid": "e3e11699-70cf-4aa3-905a-b2dccde22e78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788430, "uuid": "646bca54-900c-469f-aec2-7be5c38b8d07", "value": "Ofac_compliance_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beea5ae-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1683836761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836761, "uuid": "ce5abe35-6c0b-4b10-b9ba-c4844e77a727", "comment": "Malware payload (Tofsee)", "value": "b101be318ab44ddbbabf025ef02e9a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836761, "uuid": "986fe995-7bd9-4eee-ab4b-41652d6ce368", "comment": "Malware payload (Tofsee)", "value": "0967dfa48bd1d2d0e282f762e9be80315cc6ea75b6e1b34d73f066c47ab46612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836761, "uuid": "300d0b32-8317-42df-a902-144a736f1fc9", "comment": "Malware payload (Tofsee)", "value": "0e3d67a5c6f97f6f1d23a9540336b3ded4eaa13f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836761, "uuid": "3904a724-b6da-48ca-93b7-f6bb8a436218", "comment": "Malware payload (Tofsee)", "value": "9b70164a5a4c0fc8362d4b4cab7de75c07592a897d497c1459f601020b52b03f8583d037e2c3c542528e4a0f3e8bb890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836761, "uuid": "17aad0a8-6455-4554-b0a2-fc547f44242e", "value": "T16F644C2383E17D94E9264B729E2FC6EC765EF3504F597B6A12199E1F04B02B2C173B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836761, "uuid": "776ed6b4-103d-4f30-b282-3dcd0e328768", "value": "4d0a7f70eaa3e152ceda1701c7d8bbd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836761, "uuid": "eb834a4c-b7ca-4ede-9159-0f7dfd527112", "value": "3072:TpXtNfDL3hmn5585BYMpYEvLDWPS5Z2wg3z2zxBUb5EpMYNY0lKRfeJ:RnLL3h45VMpYi2czjlpxPcQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683836761, "uuid": "cb10e76c-1af1-46c3-9e22-5f9d3a3fe4f1", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683836761, "uuid": "48b79424-9b5e-41b7-bb5f-e7dbf16cff9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836761, "uuid": "ffb211ea-6e36-4868-b8bf-5775f3236a1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6bf3e7-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828952, "uuid": "f1522aa1-6e71-48d0-ba1a-db823d1b1798", "comment": "Malware payload (Mirai)", "value": "85b256bbe0afe1fd09e0c9a48c384b86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828952, "uuid": "f5ffa3cd-da4f-4ad1-92e3-922574875def", "comment": "Malware payload (Mirai)", "value": "0af7a9ba15d76e80a81f3377eb54569029735f23709fbfe17ddff9bf5b0f9355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828952, "uuid": "41bd9d17-3e75-43b2-a809-3c6a1b549fd3", "comment": "Malware payload (Mirai)", "value": "a949be8b30bf90a8dc9d2b201e5b62e6eec52008", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828952, "uuid": "366a2055-8fe0-497e-8185-0d2c416e4fed", "comment": "Malware payload (Mirai)", "value": "5195afd536a3bd044ecc195355015831d6470467defb1a359a25125510072ee4a2e21318b2962aca3ebbd831f1b358b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828952, "uuid": "cd4e3b96-f443-456a-abf8-9d09ead2137f", "value": "T1F1B31945F9408727C3D327BAE78F478D3B36679467DB33116938BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828952, "uuid": "d4d48b03-61fa-419d-bb01-f0dbd88141fc", "value": "3072:MSY+46m1qOzssrFPp2HAmkZrQAhPDCXFke:06mgOzJrFPJmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828952, "uuid": "d81b734d-fae9-4cfa-b0eb-3c24dc7e0fd0", "value": 108414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828952, "uuid": "6c130ec6-a3eb-4e8f-8bd7-dd0f6e99f62b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828952, "uuid": "e644148a-c762-48fc-9e33-e401f199bdd0", "value": "85b256bbe0afe1fd09e0c9a48c384b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0494697b-eff8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683808402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808402, "uuid": "cf8b213e-7649-4f4b-8756-51ecdb9b01bb", "comment": "Malware payload (RemcosRAT)", "value": "a282a0123bbe48f4ec747f6d5d6f80ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808402, "uuid": "8e61825f-a4ed-465e-bf58-1719f917a8d2", "comment": "Malware payload (RemcosRAT)", "value": "0b0c9d572a0cab44d772d31616656c6429b46e2632d74ed6ff36c62ad8d82419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808402, "uuid": "04f636a9-b305-4516-b0df-feca263e8304", "comment": "Malware payload (RemcosRAT)", "value": "a98868bef5681f8978497de8863418ad7615d923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808402, "uuid": "153a6d02-08ac-4281-8b03-8dee050af4bd", "comment": "Malware payload (RemcosRAT)", "value": "f5b6aeeba572eaaf934929f1cc4028f96adc4d3aa76f741e1c2ade9226a49cfb7dd433abaa4898d760e3733603930f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808402, "uuid": "d602420d-a160-4d52-9b4c-bc4e11faec39", "value": "T1A0B401117E62E4A3C4D28932195ED66F3F607CE114225BAB3335B36E2C713A0C91A77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808402, "uuid": "d3dfba4d-85df-44a3-a4d9-1b68d1095d93", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808402, "uuid": "05e9f06d-f90f-4d37-892f-310ec416585f", "value": "12288:Jzd8UZp23iIhd5xm1zJAMPyLSevihGhR/CXNa2zVK:JRBZpk1hzQtzM5hwXNpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683808402, "uuid": "58bd02a7-f057-491e-abf4-906d239e95c1", "value": 520296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683808402, "uuid": "c0570018-7892-4725-84ae-3e0cd86d1252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808402, "uuid": "bddca8b1-8a0b-40f0-9e7e-310979f785ea", "value": "RFQ 96673761.05..2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893aeb0c-efc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683785432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785432, "uuid": "e64587e9-084b-4d75-bec9-70ffd7eefb0c", "comment": "Malware payload (AgentTesla)", "value": "af9d64b3cb425653da884826c96cde03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785432, "uuid": "ad7f5746-5ef9-4cf9-bfe1-3535acb7ffee", "comment": "Malware payload (AgentTesla)", "value": "0c0de658cc1409dddb75bd3149de4f0bfa90b74296d8d1cb909e3189f8ed2260", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785432, "uuid": "a851d44e-9e75-4e09-943f-230db1986f11", "comment": "Malware payload (AgentTesla)", "value": "4bbe5cec5c4c4046a9ef98c2b773a917d1f09237", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785432, "uuid": "86b7eea8-a23e-401d-846e-02f2f4fb110c", "comment": "Malware payload (AgentTesla)", "value": "a18c060fabf265342b984a17d0e13b07ac796d3dfad7a0be12f408bed2ec2c93fa1398ff6ea038b87ab7be8d42d09eb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785432, "uuid": "0c02197f-fb10-4a8c-a797-039ffc194b15", "value": "T1DAE4E145433BBED2DA9417B1261438434E3DE12A75F8B4FCB91BB848C9AE9114BE4B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785432, "uuid": "b6c4e782-c050-473b-a3fa-7f4f38da9903", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785432, "uuid": "e7321bd8-e492-45ab-bb96-8306dbbceaaf", "value": "12288:CdmzNKzfcpmmMKqRO32zlMt/kIPt9Vqgc3y13GOATMhNSsHDJp+uIZH5dc2VzPhF:mmzozfcptMdRzmpkIVPq522OATSZHDJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785432, "uuid": "77e10a1c-c25c-419a-b71e-503a1743fddc", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785432, "uuid": "f1e61c7a-2d51-4305-b844-fda65896255e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785432, "uuid": "62c15374-61d9-4166-b15b-352999ea9fa9", "value": "Import Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fd74be-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683789589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789589, "uuid": "8ff7a750-33da-4de7-bd85-bae27973548d", "comment": "Malware payload", "value": "d01fa93efa131511e5de7a0ae5cf2784", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789589, "uuid": "fcfa6789-94c4-4769-a370-a8b860e35a99", "comment": "Malware payload", "value": "0c1ab4d0c8bbcd92c3bbc5d316a75360a46413036f14433ac0d1529b1a641828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789589, "uuid": "1b8db528-4854-40f1-a9fd-894f852aa20c", "comment": "Malware payload", "value": "6c73bc4ef612053492d30f154e15cc3aeefd2532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789589, "uuid": "5b72c72a-258c-46cb-812d-23be1cebafd0", "comment": "Malware payload", "value": "0dd97be7d626dad9ab45658d4e7d4b10e4963e856e0a30491bc6971dbcdc775657897db5fbac804975cd10a5f2df346f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789589, "uuid": "51d3346a-9717-4510-b910-3b4b885f8c84", "value": "T10C151251F6D288F2E4731736493AAB20697D7D701E34D52EA3D879399A335C1A230FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789589, "uuid": "f54a7bd4-b6d8-465f-b417-bb0f291f9472", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789589, "uuid": "ec11648e-10d2-4080-8f9e-c1868da99b29", "value": "12288:NcrNS33L10QdrXjDDnuNtYXWhaEfvZ3IHjhr/Rmj8fSUlZP2qwivLBGg7Nwekw:wNA3R5drXfDuU8v6VmwfSpqwONNVkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789589, "uuid": "21b4c17b-ebb1-48dc-bcec-17169fe1ed2c", "value": 938360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789589, "uuid": "c2347021-2de2-4eb9-aaeb-f9c5a9caa4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789589, "uuid": "2e0b33e5-ba89-43d4-9071-a9efb7eaaf41", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e170ab68-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828959, "uuid": "bcdde55f-0424-44a0-acb1-2e3c7f056e24", "comment": "Malware payload (Mirai)", "value": "e67b64356a7d705c0ed7fa9025b62825", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828959, "uuid": "8a649359-8041-4dbc-9431-4d3fcc09513b", "comment": "Malware payload (Mirai)", "value": "0e2a81dccb0d9f05e2c02b9ba83ca2eb4c6fb6bd1ab3cd88ce37ad58b1554e26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828959, "uuid": "06e7f516-bba5-43e9-b9f0-029864304050", "comment": "Malware payload (Mirai)", "value": "12fc82bd1e78acd909563a9714a03a26e40bd8aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828959, "uuid": "e31db4c1-09f4-420b-aafd-0a8decde1e3d", "comment": "Malware payload (Mirai)", "value": "d762221c378b4c8715f31ffcda33304f36c9d0e779befc3a7d290eb5312dc21048b9e256d7872468ff85ab4f58931ddc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828959, "uuid": "640a0ba7-76a8-41bc-bda3-943671a9d662", "value": "T1A8832B47E9A19FB7C0866AB565AB5E300B13E9912B4F1A4A313CA7F4434F4CD780EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828959, "uuid": "ce3cd2e3-8bf5-4bea-82ff-3e9890a15dee", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCAS2pNmkxVqOEeofzee:g7OXmMSr4krG3J3/mkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828959, "uuid": "2de2ca28-d9a2-4e4e-9e89-7fbdfbf8277d", "value": 88730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828959, "uuid": "8af025b4-fe6f-4799-9d6e-68420a5a47f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828959, "uuid": "b9e5b210-6737-4383-ac7d-fdea70309fdc", "value": "e67b64356a7d705c0ed7fa9025b62825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feedf5e2-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829867, "uuid": "a8d443be-6918-4162-bef2-eb963f504463", "comment": "Malware payload (SnakeKeylogger)", "value": "8f42d4ca6d06a02cc27a8866e645f5eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829867, "uuid": "ce07821b-c8fe-4e3b-8731-4c1f0b6ba356", "comment": "Malware payload (SnakeKeylogger)", "value": "0f58f85ab0efa3f0bfc29e709be86ffae888cbec851e761bacb3303ab74a29ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829867, "uuid": "3f66d8b9-94d1-4321-85b6-6b606407040e", "comment": "Malware payload (SnakeKeylogger)", "value": "e2ea19623adfcdea82215296e609555be079f091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829867, "uuid": "a5726860-8719-42b1-980b-3b392d8102f4", "comment": "Malware payload (SnakeKeylogger)", "value": "5f88abaeaaf571f67205afe5e8bab4d4aea6d325ef5b89a428026787bf7bfc590ceb226e0804635d1785d8277ba775f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829867, "uuid": "d8d4f7c1-03c3-4e04-bfad-d0ce602b5b1d", "value": "T19FE4D089433BBDD2DA541B70221438534F3DE15675F8B0BCBC1B7888C99B9215BE8BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829867, "uuid": "20a05fce-9d5b-4791-8284-7145708a3aa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829867, "uuid": "5a4d9da8-6056-4bb0-8106-b5465ea37656", "value": "12288:SpmFPM89YfeOfBlZv285j9JoEwuqt/hDjJXq+XwK7+e7pK:ymF0feMWo/oELq9m+XwA+e7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829867, "uuid": "1a5d8748-cc61-4b22-8427-29959c2a9b8d", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829867, "uuid": "3fd91e37-5b5a-4b3c-b983-0cbdc6a95e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829867, "uuid": "d43b69cb-9f08-47e0-8308-0e493a4bc779", "value": "documento.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857f7425-f03b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683837395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837395, "uuid": "5e7fc131-66f9-4752-88e8-3fcd013f7440", "comment": "Malware payload (RedLineStealer)", "value": "c9e2ee39f9899dcbb8b51de798971892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837395, "uuid": "30d941e0-5b3e-4b49-a51a-ca5dcf423fd6", "comment": "Malware payload (RedLineStealer)", "value": "0f99eef3431f8f04eef23ccab335afcd7129e1ca69728ba2bfc929de3010e402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837395, "uuid": "3cb0c64b-3534-4925-8976-9bbbb83abcca", "comment": "Malware payload (RedLineStealer)", "value": "9104f6cd9b9fa5f7269ed70a8355fc553275bdd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837395, "uuid": "81c9d80c-4172-49c3-9097-7ea54bb0c41a", "comment": "Malware payload (RedLineStealer)", "value": "cb837e5e8c5eaadab1334c0fd19b3e771d234865ee01c96597bc0353a0fa32d53e18a50e8eef0841ea34ad9d897871d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837395, "uuid": "bcbf8e32-7ccb-479c-8581-1a5fbeafe361", "value": "T165E4CF2352A13C64E5634B729E2FC6EC761EF3604F597BAE12149E5F05B02B2C273B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837395, "uuid": "281a0ce5-d3dc-46c6-8fd5-766a0bb38815", "value": "7ce2ea0672659bde73ebe3337265c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837395, "uuid": "77a940d8-8acc-4ebd-9a26-329b967539f4", "value": "12288:ACxHDIAphovDRNKA4N058amG6JtR6wfTbTxwjfwxt:A2H0Apwnr4NuVqgowjfwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837395, "uuid": "ecc1487a-e648-4f32-8aa7-8c534ad2882b", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837395, "uuid": "a7db7db2-63e5-418b-8fa0-0eeefcad130e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837395, "uuid": "cab1b20a-f56f-4a45-bbb4-7df1cdfbe3b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4c36ce-f018-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1683822350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822350, "uuid": "6a670046-ac4c-43b1-bd63-8a35ce96e58f", "comment": "Malware payload (LgoogLoader)", "value": "1fc4b7d9c8cd525a29e2c9e4f811c9dd", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822350, "uuid": "2fedc004-b495-4c4d-87b7-710da82a75fc", "comment": "Malware payload (LgoogLoader)", "value": "111d6bd8088e8de3b52cb8ee838e0af2c2de59401451e06f068d9bee0c740440", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822350, "uuid": "195b766c-5fe0-493e-944a-ce2c59ba858a", "comment": "Malware payload (LgoogLoader)", "value": "cd96cff1e72ffddbc0eefc7558f4d100182ae541", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822350, "uuid": "f77b1fac-c307-4bf0-9a9e-eb396104387e", "comment": "Malware payload (LgoogLoader)", "value": "cc34599d3c771e0062a2e4f0c456a7ab969890992cf89f037e233a37bc4ad446511cf07e97d9adb6beed257bd9b7db0e", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822350, "uuid": "50de404e-efd5-4746-87ee-797ab5e600d7", "value": "T1F455393439FA501AB173EFA65BE8B996DA2FB7733707A42D109003864723E81DDD153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822350, "uuid": "c50a88c1-913a-4930-97c1-73eb0b300428", "value": "12288:zGFL0JOstrdzLurI7HchVgDquQz1h/bLO9uycii/ffOKYSbjlDdB0uN0IOoVyhrv:kbuRAnfd3ZjbyCWTUD9Q3800Taz4pTva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683822350, "uuid": "79615799-f2e3-4897-9dfa-94e0596c4c0c", "value": 1339776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683822350, "uuid": "35f5449b-1d7b-405a-ab54-6095ab8cf26f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822350, "uuid": "583f7a1f-6d0e-4fbc-82e8-5cd53062c955", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5aee5ae-efe1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683798848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798848, "uuid": "6a879e5b-f65d-4146-8222-7b295c59f54d", "comment": "Malware payload (Formbook)", "value": "945f37b8d3a3570ed1cc712ab423c864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798848, "uuid": "1fcc0ffd-caf4-4ce9-b596-497dd1acb8c6", "comment": "Malware payload (Formbook)", "value": "12b2b7e0563a96b7a8d1909d7e43d1b78445a99097242616bc141ba4a4c38449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798848, "uuid": "a4aaaed3-168b-4a35-9691-eb32fb1166c0", "comment": "Malware payload (Formbook)", "value": "aecc1c60ec7b20106cd51864d6f8b11d71ca7c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798848, "uuid": "26fb7e01-1dc7-417c-815a-61f84bf83e3a", "comment": "Malware payload (Formbook)", "value": "b33d8231cb28ecdc7c32a353193e1e4b003fbd79db4e9ea17c99b4e1c9589c12abfd8c212575d414714bb7cb83b5e059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798848, "uuid": "f4f6db4d-6f5c-4ced-856e-5d6cff29df9c", "value": "T1924423199330C4EBD0A3C7720D7E1F17EEB9D51110F6B34B7BA09A997632597960E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798848, "uuid": "09c076fc-448b-4538-9340-8ef56407f951", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798848, "uuid": "7d941cfa-ef0d-4b3e-94b0-f2c0c832d508", "value": "6144:/Ya6bLEmOXGo+wY6Gv6DFLjexx9FjxmRJ30g9/+W9I2LybDKqiDSsyPVmVBsL:/YpLEBWo+wY6xxIFjsPvxI22DKqNMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683798848, "uuid": "eee7acb9-a53a-4f23-954f-740e5d40e5ed", "value": 254346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683798848, "uuid": "8ce051c1-4b83-4d54-8e5a-b0dc95378dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798848, "uuid": "a6201283-f7f2-4641-b598-9aeec67d4c06", "value": "Nowe_zamowienie11523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fc606a-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829824, "uuid": "5ae4e792-e7f1-4ae3-bce3-95ea4043f65d", "comment": "Malware payload (SnakeKeylogger)", "value": "f88b8f27a17ab6a5a0ccec4d6420e0b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829824, "uuid": "a5726489-d428-44f7-9012-e1050e1bf248", "comment": "Malware payload (SnakeKeylogger)", "value": "12cb7bbf9a1795a33f24e45ab2147d8e1f1dbcd5d26feb6ac5a27f228bed61dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829824, "uuid": "7449f2dc-5613-46ff-8784-2f8bad5d816e", "comment": "Malware payload (SnakeKeylogger)", "value": "ab35bbcbdcd52f5d6d1e7d002f5bbccec5bfd642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829824, "uuid": "a4b086cb-04c6-449c-99dd-5e992743125d", "comment": "Malware payload (SnakeKeylogger)", "value": "6e382a5f3b7ac7e615473abfd9fc0b8a4e3ff72de0879788318f4eff1a4923a7dbdf618eb025cca38eb77c01b9dfeefe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829824, "uuid": "1d59159d-c35e-4963-a1b9-af5ad230f024", "value": "T1E4054AC1A161CDD6EC6B06F17C2A643015AFBE5D64B4C01C6A9FBA5A65F330220DEE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829824, "uuid": "55929825-51d3-4e1e-b089-722f2874fafc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829824, "uuid": "84c2f05c-af75-4b4b-99d7-f4bcaa71a5ea", "value": "12288:3qU08m7DQ8ecGNKeA5xFKYeO4LNDWfgqQ4loQutTHcwBuxN:/vmPRKKlxQYrqNWgwo7Tc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829824, "uuid": "f37f7b85-a22d-4e20-a1d3-fea7290268d3", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829824, "uuid": "d9d90cad-b482-46eb-b7cf-824dee080e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829824, "uuid": "67391349-d6f4-4cb5-8771-2ece210f747a", "value": "PO #4500082142.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e57106e-f016-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683821438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821438, "uuid": "4dd25737-6322-454f-867f-ebeda38e6eb6", "comment": "Malware payload (Quakbot)", "value": "c2f4c0cbf39ccff6bfe11090eb699b55", "object_relation": "md5", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821438, "uuid": "26049ad0-b0de-4641-b7d1-4b53755984d6", "comment": "Malware payload (Quakbot)", "value": "132622a40b458915d70977fbdf94ec1dc10979dcecad2e6bd2f2c0ef7ead007f", "object_relation": "sha256", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821438, "uuid": "135d0020-2dfe-4039-a61c-58b0af24ac66", "comment": "Malware payload (Quakbot)", "value": "b9489eb8f51abda5e318aae480b7a3d55788d54b", "object_relation": "sha1", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821438, "uuid": "6b587d8d-d0ea-496a-b18f-fa78ed04c8ee", "comment": "Malware payload (Quakbot)", "value": "8b90d004bd4000baae0ac3fe52c972edb55c56166849c6b2b05469b52421d5a2d2bb60c3a8c4426bd407c791e010b302", "object_relation": "sha3-384", "Tag": [ { "name": "1683816541", "colour": "#BD0BB2", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821438, "uuid": "0d6eaa8f-a479-445d-b9b4-f5d239db68d2", "value": "T153F3DA404365186B9B1B7F66BB2874B5EEE60EBCC258829FF42B739572CF68CD8D0051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821438, "uuid": "80a19ba0-907e-4dab-989b-ff23e60d6a07", "value": "3072:LrFWJjfNTYR3JZwWcwDtPEdcQdiCMb1NHgdyY7zEjtM:nFWJjFWJr4dWbAIwEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683821438, "uuid": "37f3d09f-e98a-4af9-b24e-1b7a439f8e56", "value": 172519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683821438, "uuid": "aad5a913-2308-42cc-a351-ce1423e6ab82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821438, "uuid": "680a4682-bde4-41dd-b317-eeb839ca7149", "value": "Mlhega.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a839d9-f033-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683834038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834038, "uuid": "14901809-3153-4d01-aed2-d4de1602086c", "comment": "Malware payload (Amadey)", "value": "b57078a2b92791c996af08f3302196a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834038, "uuid": "f1ddc4b4-80a6-4d71-9ad6-316f7e1e89eb", "comment": "Malware payload (Amadey)", "value": "133982c977d3b579e903a9ca11159acc05cf60b4ce30ba56e2d0e79e2efd7a2f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834038, "uuid": "28eb954b-04a1-463f-9370-d58628cc8d13", "comment": "Malware payload (Amadey)", "value": "7e6bd45558cafaacd817bbfd244c3989347c7301", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834038, "uuid": "5a122c2e-3115-46e8-8601-757b5b0ee96a", "comment": "Malware payload (Amadey)", "value": "f3089ee766fe41fa52a2deaa84d946835f02510bcb096b69e1fcb37bbad897647bd4980c95983cc96e77cc37931e120c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834038, "uuid": "2702482d-ca45-456c-8e76-571cecbe6146", "value": "T163252321A7D54836D5B127B02CFA03831A35FDA09DB18B5B3B55BC8E4C63B90697137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834038, "uuid": "ae36b9aa-5fd0-4220-986b-87bb7997dddf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834038, "uuid": "8fce1063-d9c7-4475-82fe-fcb84e6dc965", "value": "24576:Ny/w88t9ar9qZgWhQAlceCwRb/S8+qXkdY41evb:o/w849aEeWhueCi+8+qXki41ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834038, "uuid": "52e93229-5333-4f29-9f95-33db3edaa023", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834038, "uuid": "32aa8dd0-7873-48f8-82b5-2aa8293db98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834038, "uuid": "56d0a4c2-09d0-4f37-bd7c-46642fd75726", "value": "b57078a2b92791c996af08f3302196a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249e81d6-efd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683793853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793853, "uuid": "0c37a224-eece-4e94-87de-1b5639a1cc32", "comment": "Malware payload (Mirai)", "value": "6d7cca48a6660975122911226a61ae4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793853, "uuid": "b138093e-9d95-4b5c-a2a1-65cc122995ca", "comment": "Malware payload (Mirai)", "value": "135aee1cb29bdc1cc1bb3f6684234406c2a5627495dc9a2f26dda06e1998f847", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793853, "uuid": "9141f15d-2e84-4a66-b1dc-1625a58ab348", "comment": "Malware payload (Mirai)", "value": "c41366f385b44edf0b1ae2d22ff7c70bee0bf3c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793853, "uuid": "3d46e676-5d83-4939-bb82-90e62d2348b5", "comment": "Malware payload (Mirai)", "value": "cd70de19a950122f22bdcefdf44025007882a4db70cf3cc3748dc0e37fe3322be86ba2ad4b50e2973a443d990f406d7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793853, "uuid": "3950e397-83d0-44dd-90f9-3e3f326c1457", "value": "T187C2D05427410895EA16C2FD47C90BC23F730F95C583AD9BE01EEAD78C117AEA94AEE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793853, "uuid": "dc825c88-891a-4002-b27d-932e43810287", "value": "768:KdSFchfpzQAPjHPCaI0q+qJgGlzDpbuR1Jt:xcVtPTzI0TOVJuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793853, "uuid": "a58db34b-9304-4a7d-9b9d-20452712229e", "value": 26120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793853, "uuid": "6ccfd607-f268-42e0-94f8-efeafdf0a96c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793853, "uuid": "646b3ce5-2aee-4f0b-9969-08ea89bc2aff", "value": "SecuriteInfo.com.Heur.20230511084125776573232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f696a7-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683789743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789743, "uuid": "99202d53-0761-425e-a3c9-4e378a0efe44", "comment": "Malware payload (RemcosRAT)", "value": "3befc4a016420fda3b2146e42510d447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789743, "uuid": "2a8552df-3f50-4b60-81ea-717d2fa3c4c8", "comment": "Malware payload (RemcosRAT)", "value": "1426c1d64ca7c22ccca58c2ccd872e2ed13049c2fe25111192d6de048d9cba80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789743, "uuid": "2c7e809b-8bb0-41a4-b631-bcb44d7bd32c", "comment": "Malware payload (RemcosRAT)", "value": "9b7c1770afa13221a3167a822063f9f3c1f6207e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789743, "uuid": "8e577889-ef3b-4129-9e5d-a1a3071ccd15", "comment": "Malware payload (RemcosRAT)", "value": "da7f7ce0de146c650b580ac41061e07745671e8170422021108dbc6c43bcf5fd5c35982461a8fcab7d5d99de81ddaf7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789743, "uuid": "c6d476cf-8f6b-4d7a-8111-9d1c080b4214", "value": "T1A5A423502321C973D8E207F1B937FC676E32B1049FC0B95F53D439C9BA26A626A1A75C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789743, "uuid": "29fe9308-3056-4be9-8b1d-154f71d9fd27", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789743, "uuid": "e04c58ed-50d2-4be2-ac19-a728067645ee", "value": "12288:7YGrZtdseDSk96oQAXfcOOlhj7M2lQoarIzbd4Hg:7YGtgepDQWf4sYurIzmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789743, "uuid": "f091ef02-9e38-4bd1-9630-a1819aa6656e", "value": 463632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789743, "uuid": "7f3cee92-b506-46cc-ae93-183e002e5d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789743, "uuid": "7cb47e64-bc87-4e2f-b5d4-4b2c1efdcdf3", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c80c450-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683789625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789625, "uuid": "4aedef84-d92f-4699-8795-6656bbf68778", "comment": "Malware payload (RedLineStealer)", "value": "9aad32fd171eeaebd0a42178ebe6dfdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789625, "uuid": "54a9c140-f067-40b0-be6d-692349cf61e7", "comment": "Malware payload (RedLineStealer)", "value": "144f3fdba7155954e78cbd95792a99dd4e5f1ed8470376a1431039351042353e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789625, "uuid": "4217ffa1-a2a1-4837-91ab-4bff5dedc3eb", "comment": "Malware payload (RedLineStealer)", "value": "866754e23f5dea66ff35a2ea8198bbef1cad520b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789625, "uuid": "119b07b2-11b5-4dec-be0c-9db425a93218", "comment": "Malware payload (RedLineStealer)", "value": "1d81450d6e5f86271e1be4dcd8b86abd1dc67ec65aab44bbed90a370699708972117647013d9c670dfbdbe08c391f5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789625, "uuid": "67a98ab7-e493-4565-8fe1-7cf57c7a6bb9", "value": "T18DF41246B7D88072C8B4737559F703A32E3A3DE05D79926B374A998D09B22E1F071B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789625, "uuid": "d53e0320-8721-4845-be25-2f1f1cf6ef0b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789625, "uuid": "e8e924d5-c898-4995-b50a-fd7fefe85d5c", "value": "24576:dys1iQ7ey+ndnO8oZcrY4HoLimIIDZMEMc6KtBfdGZ:41MeyentoUofMQ6YVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789625, "uuid": "670d6453-d4dd-4849-b2ab-317b03a60ebc", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789625, "uuid": "915c92a9-c477-4631-9a3f-9e0237f54c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789625, "uuid": "b7d9af80-040e-4b1f-9417-e56f184659c9", "value": "9aad32fd171eeaebd0a42178ebe6dfdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7803a9c0-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832218, "uuid": "194913f5-d70f-49c4-9922-32dee4143723", "comment": "Malware payload (AgentTesla)", "value": "482a55ee51d54759c163c78baa1fbfc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832218, "uuid": "979e348c-1019-4ffb-b780-132e7c6afa67", "comment": "Malware payload (AgentTesla)", "value": "14d2f29a80efcfe126628046ae8b02b78722c8bbd7c54c2c8900c44805455bd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832218, "uuid": "10f124f3-0164-400e-9ba8-c805cb7afb73", "comment": "Malware payload (AgentTesla)", "value": "b38816297c71c48deaa189458e6968b5513e9242", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832218, "uuid": "4bdda49d-54a0-45c1-81cb-acec395790d9", "comment": "Malware payload (AgentTesla)", "value": "4bddc643b3c2c8b16931873d592580907f9c9461a3fa7ac32734b34fa331aaace83d6c153bdaa995846235f638f5d987", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832218, "uuid": "4ea8e2ed-f15d-44d5-b56c-8a6c598be81a", "value": "T125D4E15A81B84F01CE6C4BFE5D53C6C60AF48A757C25E9311BCB34CD9DA392F68482AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832218, "uuid": "2ffd04f2-0f4f-44a4-a6a6-84d7a78b14dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832218, "uuid": "d482c11e-2443-4c02-9fa1-9d9513a8e75c", "value": "12288:YYAwhh2Y4YidInGGqtEmkGbNkpQsU7m0MmWXiBDCut3/WTNmm0s:cwhh29sukUJT7m0MmDBl+7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832218, "uuid": "e93efb31-03b9-46e8-9920-d03180ab2d2b", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832218, "uuid": "5cd91c02-693b-45e7-9a02-0e7e49b682e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832218, "uuid": "99bd599b-96b6-4f58-a525-8388681c3390", "value": "DHL AWB SHIPPING DOCUMENTS_35595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a08373-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683829333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829333, "uuid": "1ab015f8-1de7-4a1a-812b-ae69c5e6605c", "comment": "Malware payload (RemcosRAT)", "value": "cad377f243b54e3dddfe149f4cd54c8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829333, "uuid": "a035dce7-d526-4ed1-b9bb-f9f7d9de698f", "comment": "Malware payload (RemcosRAT)", "value": "14fb2daf697ee302647b7d63c26e94f443c9516a5a707b85952b1158e5ffe12a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829333, "uuid": "834e71b9-bc05-4e4b-b8f4-5adb40f96cbf", "comment": "Malware payload (RemcosRAT)", "value": "bb9e4fc981c04378758051885dc6e5062145b11b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829333, "uuid": "b448726d-1e40-42fb-92dc-9722a6410190", "comment": "Malware payload (RemcosRAT)", "value": "89983163b6ee2f0ed983da1d457422d0f42034a82325e1f89752925eb4fda4a2a8a5f74ed661048362fbb01ebca9c8e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829333, "uuid": "57585c20-6c41-4a1b-bcf7-b74dd08fe75b", "value": "T1D215025A82788F10CA5C4AFF5D93C2C906F599717C29DA706F8724CEADB3A2F14442BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829333, "uuid": "93f31a7a-b483-44d2-89a1-83bc246ea485", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829333, "uuid": "665eb7b6-7e71-4d1a-b370-b3f1e42f7362", "value": "24576:PdWUwhh26ZKwupWOZBSV/UXsiff0dFB0cK74aRlLMGZYWkV3M:PdWXKwIrZsVc8isK74aPM5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829333, "uuid": "c8ce103f-94e8-41f8-a4a0-6556cf68ccd4", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829333, "uuid": "5a2a239b-31e5-4eed-bfd8-0297b83b86c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829333, "uuid": "21a6ce6c-02c6-428e-b6a2-59adfe5d6918", "value": "cad377f243b54e3dddfe149f4cd54c8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8870d723-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784572, "uuid": "55b140a9-d3e0-4945-beca-97b660742f30", "comment": "Malware payload (Mirai)", "value": "d93933380eec63b95cbcd98cdcd7bb67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784572, "uuid": "e812a80e-a8f3-42bb-a769-e68b05aabe83", "comment": "Malware payload (Mirai)", "value": "15a17572b4facdfc5e21ee6e95029765c7a73fd7f153ccbc094fbe1a760d3492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784572, "uuid": "a3ad8e5b-e22e-4804-b646-9c877fbce935", "comment": "Malware payload (Mirai)", "value": "e71346d46d54f303677209b3531bbb1c1df8c08c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784572, "uuid": "388d82b3-4e6f-4733-97c5-d50e29a239be", "comment": "Malware payload (Mirai)", "value": "010f186182bf31f08377937a8b7227258753ca55e7ef07e4e13b579870dc621de4f09e8756fe14897f4d86098669f114", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784572, "uuid": "5c1a3576-2148-4fe8-a636-b837ce611423", "value": "T15333FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784572, "uuid": "bcc7bb27-2ecc-44f7-b1e8-b3784eb4d21d", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGv:r/hqaJMeteqK806MHdkfQX6HuCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784572, "uuid": "61c20ce3-f9c1-4144-83e0-9f14fe913322", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784572, "uuid": "54987897-ff2a-4994-b4f5-a263e92533bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784572, "uuid": "6dff7525-7f82-4835-b18e-c3ff50a3182e", "value": "d93933380eec63b95cbcd98cdcd7bb67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683eb7a9-f034-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683834339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834339, "uuid": "52b98656-04f8-451c-bc36-2d6815363110", "comment": "Malware payload (RedLineStealer)", "value": "bbd483182646a42b3699d23a99fa9955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834339, "uuid": "02cecf6d-953a-4c95-8d9f-7da25afaf6d0", "comment": "Malware payload (RedLineStealer)", "value": "15f846632a9b7679331a479f2cf35b53ccc6e0b00dbfb981ee10c9473bd51af8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834339, "uuid": "f5b775b5-4ae4-4435-bb49-26a54acb223a", "comment": "Malware payload (RedLineStealer)", "value": "7d8e61cbe524c16d136fa7ce63f2daace3c2adc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834339, "uuid": "30f4a75c-0fa0-464b-88d7-a36fc8f82a98", "comment": "Malware payload (RedLineStealer)", "value": "e55777b027b34160aef83b591e1076e9a2f942965c38a06f607cb2764bec9f148defda77d1d5664a77e01bd40cbf196c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834339, "uuid": "74ef237e-fccd-478b-9fa2-0f21f689c8a4", "value": "T1E3252301A9DC5432D6352FB5E8F216830B757DB24972412FBB91AE4A1C73784B4B273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834339, "uuid": "93d69d89-526e-431f-9e1b-914534284875", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834339, "uuid": "4b585edd-d3b6-4ec9-8935-b69f35c52ae6", "value": "24576:dyk0t0sfAgW8/Qo0+Y6/6VLLH9qjJ389StaXtsh:4k8BW8oo0P9H9Wx89S0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834339, "uuid": "f09272a1-fc1d-4fa6-bc9f-4a70531de765", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834339, "uuid": "35b79ac6-cd17-4adb-901b-d6ac8fe540b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834339, "uuid": "da388612-c230-4c49-9359-28c070aa2767", "value": "bbd483182646a42b3699d23a99fa9955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cff08b-efbe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783495, "uuid": "1b41245b-7917-4181-af39-ea907aa8c07a", "comment": "Malware payload (Mirai)", "value": "a6eac00f942556fc85170c5f866ac087", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783495, "uuid": "26b52925-5e91-4402-b315-420eb6338ac6", "comment": "Malware payload (Mirai)", "value": "16538e2757bf89bb19a697be5b1e6c9e34ed1567845c520953d10afbfe507871", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783495, "uuid": "eb353035-fc9f-4764-88d1-f4d6315d6353", "comment": "Malware payload (Mirai)", "value": "aa9ee7e6a3be0c995025dbd5b34d279edb20c08c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783495, "uuid": "c2211d1a-787e-4f90-bd58-bf071b08587d", "comment": "Malware payload (Mirai)", "value": "c1764848b50370dc3065b2833463c53791e6427916aacb9224668a9f20ba3e5690652adcbdf00823e383b9392d522e27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783495, "uuid": "291ac215-ca6d-48d5-95f0-01cbf78edc1b", "value": "T10F532AC8A0D3E8F5EC14097D307AAB629E73F13FB176E99BC7E86573A901202910665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783495, "uuid": "6c1ea359-325f-4fa2-940f-9c5aafccf9a4", "value": "1536:bz/pWlXJcf4slZQLkAl+t7SWY/Pfd+700ngkMje:bAXJcf4slZQLkAl+t7SWY/Pfd00+dMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783495, "uuid": "1c3882c7-8b3c-4885-8cf3-0618cefad673", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783495, "uuid": "f9e72623-fd92-4df3-a063-9556f703cdfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783495, "uuid": "71c6f6a2-cfda-4626-b747-c1ddd99037db", "value": "a6eac00f942556fc85170c5f866ac087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331d2b62-efd9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683795166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795166, "uuid": "ed08853d-63a8-405e-86cf-a0420df4d14b", "comment": "Malware payload (AgentTesla)", "value": "6f075ebb854a4cac21ce6862c9669335", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795166, "uuid": "bd5c0a3a-3340-4993-a173-4121c968d448", "comment": "Malware payload (AgentTesla)", "value": "167ea427613672844817e73ce587a325bbce315affd1636c249249cecbada4b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795166, "uuid": "e1909369-b501-4c8e-8eba-4e9a487ec94f", "comment": "Malware payload (AgentTesla)", "value": "92a18824b59ed0a075eb8aaf2dd809e54eb18695", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795166, "uuid": "82fe32e0-fc51-4234-a770-19f33d690940", "comment": "Malware payload (AgentTesla)", "value": "50b6cf0658fc302b838087bb6c495f32ebbae90cfbefa5937e121a9657bcba5f6c2b0dba95227036a98f23e6e5f56297", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795166, "uuid": "409cd0c7-e62e-4a25-8cb9-05abcd24e6c4", "value": "T16CD4DF84123BBFE2D96417F1225434524B7DE01A75B8F0BC7D6B78CAC89AB114BE4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795166, "uuid": "3a03e86e-96c4-4e0c-9917-f86b514c9001", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795166, "uuid": "e9b453a0-ed2f-46e9-90de-88ad98c38a58", "value": "12288:/qUUDmUhIXjfJEjKNfVuDogUbAfXWkhoJOioSFzqPW7a:XqmUyjBwKNfVIFfGkMOCzqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683795166, "uuid": "e7b87286-0fa2-4ed6-bca2-794e06cf0ff8", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683795166, "uuid": "fc2a5584-d5fd-4aa2-9f60-8e5b26a3df63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795166, "uuid": "287a99c8-eb9c-4aaf-aa72-c495dedddffb", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a3ec62-f018-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1683822356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822356, "uuid": "b01a5a8d-a74a-44a5-a5e7-7dbc671550c5", "comment": "Malware payload (LgoogLoader)", "value": "28d0ddf80c4726bda7c111e0bf64873e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822356, "uuid": "4a449597-2712-43fd-948f-e18c3f0621e4", "comment": "Malware payload (LgoogLoader)", "value": "174d999d0e0c9661f94b8ee97ec6ee224941ec42c0830e4e34a20d1384efafef", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822356, "uuid": "cdedcbda-7e3e-4391-9b60-e3bd158575da", "comment": "Malware payload (LgoogLoader)", "value": "325f2e81165c310a6b6ca30418640a63afc798be", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822356, "uuid": "c2e08636-86f9-4332-a48a-91557f541653", "comment": "Malware payload (LgoogLoader)", "value": "83d68aae9b56e7222cb824cc6b012ad4e329c4d391f321538d95a6648c89f8420f7315a44e66d708d92a25d2088d1af0", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822356, "uuid": "c25d7d35-107b-4b3c-b84b-af3859021a16", "value": "T1E85539243DFB6019B173EEAA8BE478A6DA6FB7733B07645D109103864723E41DEC153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822356, "uuid": "849b08e0-2ddb-426c-948c-eaf75b6c8bb7", "value": "12288:76pQRGlptdzxur6nkca4UtPaCZ0z3vtw8Cl3ODdfJmOF6lZsg1ovMNvkOVVca89A:ELNy5L+XfD6TNcmdyxtYtCQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683822356, "uuid": "79be4f67-7257-4d3e-98c5-e0fa319302c9", "value": 1339776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683822356, "uuid": "49116f14-6f3b-4ad2-a676-37e9960b630e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822356, "uuid": "54fe9976-a5e1-4fb0-88dc-4f2c62e5384f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1de7745-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829819, "uuid": "26b25ffc-97a4-479b-a3e1-79de42aa5437", "comment": "Malware payload (SnakeKeylogger)", "value": "4d5ab04ad0bc66b1b7c4daed53932e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829819, "uuid": "a9fe82e5-96d3-448b-bd55-4fd5c4e44778", "comment": "Malware payload (SnakeKeylogger)", "value": "17bdafa051fda4bc7b9d9aeacd211dcc47622b2977d3feda560bc08b4ed6e7ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829819, "uuid": "6b938840-d2bf-40ff-964a-3ea91a845537", "comment": "Malware payload (SnakeKeylogger)", "value": "9d69694a8f62475e38f169320091dad87908fe81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829819, "uuid": "3232409c-210e-4b7d-9b87-7439ab0ca839", "comment": "Malware payload (SnakeKeylogger)", "value": "f1e0805356a542322361991af959f61a08159029b859fd6ba2464315aaac6a92d3d3e60d06d8671cbc09943065df2b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829819, "uuid": "73d7d45c-d111-487c-86f2-80e4c4371883", "value": "T11EC4CF89523BAFE1DA6407F0211438424B7CAD1A75B8F0B87D57B8C9C8FAB114BD4B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829819, "uuid": "09ed40b2-5aec-4aff-be78-b4cba9e673f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829819, "uuid": "d9c9d4e3-0f2c-4948-bef5-b1969f8af1c1", "value": "12288:KqU3mdoBWqKisw6OJ2wB1o0S3PG+8e5pN/8sEb6:03mCBWqz2dn/V/8/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829819, "uuid": "e9663db3-0db2-45e1-a5cd-36e593092bc9", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829819, "uuid": "695dda8a-847f-463c-8ba9-d0df08f79c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829819, "uuid": "9e75c4cc-ba49-454b-9289-e7b485d90293", "value": "PO #V-23-IPY-078-D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87be564f-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832244, "uuid": "fae38883-4c14-418b-98dc-886c93cf37e0", "comment": "Malware payload (AgentTesla)", "value": "8178ab7287d320612c5a6e013940d90f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832244, "uuid": "c3309a27-fee2-4172-a592-78515bb36c16", "comment": "Malware payload (AgentTesla)", "value": "17c5d7bfc953c5859f2ddcfba33038b2ba4260d5f69c0416a6760700050fc91a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832244, "uuid": "789611fc-c882-47ce-a561-ebb6d4155e06", "comment": "Malware payload (AgentTesla)", "value": "9209c7af4bfea07bce7a647fef066e618b88288c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832244, "uuid": "efdb10f3-80e3-46f1-801e-aa5011570c35", "comment": "Malware payload (AgentTesla)", "value": "7cf1c577a112192a68226b5e74607e80c78108222b1f8db2965ae7c29560aa480dbe574cd291286349954563367297af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832244, "uuid": "ab6c0e5c-6ac0-4ff1-9755-10d5c4089e38", "value": "T134618D1447E6020CF3F3AB3A99BE66554E3B7946AD31C74D0054814EA2F1A40EC76F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832244, "uuid": "fd3c1f89-67af-47c8-88a3-c4afe8eb5a9d", "value": "48:8v5aZU9Dmel0iglZ+1pQfYj1sAT1rTRRSJxo9AIH:8v55B0+16YZsErTR0/SAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832244, "uuid": "a2902085-ed3b-45f4-95c9-8f0fbdc13155", "value": 3446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832244, "uuid": "64cfe16f-93ed-42b2-9a0e-e0e7b92e9f07", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832244, "uuid": "0ec30e5d-b1ec-4b12-9752-9ac045878601", "value": "Payment.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09760131-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829885, "uuid": "956c5239-12e4-4529-8cbd-316476e62416", "comment": "Malware payload (SnakeKeylogger)", "value": "c3f3cc1309d55808401ae55d7caddc55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829885, "uuid": "974e6098-7768-4bea-8087-86b11060b2a6", "comment": "Malware payload (SnakeKeylogger)", "value": "1828a6afda383a1f6f48f9bab91e7f0d648fcef99f959b406618847c168e5325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829885, "uuid": "14d8fe5c-1fb0-48a6-8630-e25529f123bf", "comment": "Malware payload (SnakeKeylogger)", "value": "6bb05440303c2b81dc129438129038a878fbe733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829885, "uuid": "c8f4bc81-ac4c-4427-b295-33a31ef2ebc2", "comment": "Malware payload (SnakeKeylogger)", "value": "88bbbe961767fbfba4b23af7e8cf50c00d738ce9280b96952e9b19006e3d431601a8a1543c1574bfd1d544342199f1c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829885, "uuid": "8b1e3a09-008e-40b1-9b54-daf00243c1bc", "value": "T1E6057B3C22DA5C26C75573FA8549C9E103356F10AEABD26A22BE30CC8D71BA3ED5154F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829885, "uuid": "3d030f82-ab59-4fdf-bec7-a1c522254a76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829885, "uuid": "f259e6f8-f259-4b0a-b30b-373fb413664d", "value": "12288:yaV0aI+ZfO/UXyAnYAYaMeTLKBdmPUxM28ThhtnwEfIbsf2DRoQMalg9/b:y80aI8SUXrn19TLKBVBOqEfI4IBMa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829885, "uuid": "5804f820-3c6b-4dba-976b-9834b8dc0cb1", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829885, "uuid": "f3a94265-30b2-4a9d-87d5-395869a937e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829885, "uuid": "d9b924a7-d2d5-4b6b-b32c-a2392aaab62a", "value": "0U3CJWS4fTFO0KZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755446a1-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832214, "uuid": "77f035f9-b2a3-457a-816c-22d682dadb2c", "comment": "Malware payload (AgentTesla)", "value": "6555453e6af8145b1d5f787677e09912", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832214, "uuid": "c7deaf22-dddf-4107-95fb-62d4157d72ff", "comment": "Malware payload (AgentTesla)", "value": "18c210cbf7f5cb44b48a911fb820439debc1184237f4f19d6ccf375511fe401a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832214, "uuid": "ee1a3bed-0970-4f5e-b412-cf8442fa9da8", "comment": "Malware payload (AgentTesla)", "value": "e7af938f4113787d29adbcc27997d0bdd6d99cd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832214, "uuid": "5a8108ca-64a6-43a7-a770-b66363a07d1c", "comment": "Malware payload (AgentTesla)", "value": "39dd4ff49bf024403c30fe2fa26f89814ec112fe80d0c4e1f7f2de61d7b99cbe1f72b7920f0656731581837633bba7c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832214, "uuid": "1932e510-db17-42c0-bbab-b0f209864e45", "value": "T1B79486D2BB0885A4E85916759C2EC9590527BC29BC70781F349FB23FEF73392306A917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832214, "uuid": "a5d405a9-1d91-48c6-a169-81545f715340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832214, "uuid": "dce551cb-56d7-4cb5-a7e4-d6e3b8c6a58f", "value": "3072:eyMdJDaHo4ZeGr3K56KoB6l40Sl63umU:p5UTGAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832214, "uuid": "90555a15-4caf-4e86-bd01-bfcb44945bb6", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832214, "uuid": "96a7d214-4fca-425e-80c8-e2fbcb864fbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832214, "uuid": "e2b359bf-f446-44a5-a975-0c6c12cd5d1f", "value": "DHL KULI500796821__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48716af6-efcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683790048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790048, "uuid": "fb58a570-3f4a-4f18-9866-287e0886bfe6", "comment": "Malware payload (Loki)", "value": "4f2c4888d96b93317d0f9078f35ab9b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790048, "uuid": "5ac14a49-549e-45b8-83d2-6ec3cf938a48", "comment": "Malware payload (Loki)", "value": "197495b95102594b65202155efa2c1d4705c945170a8ce296516b6d69b22f7f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790048, "uuid": "bf17af53-2bd3-421a-a6d9-c903b9c6d958", "comment": "Malware payload (Loki)", "value": "f3575e96d32ca0ffd928b0108af2540412f8cf1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790048, "uuid": "b2f9404c-47c3-4c0f-8405-9717dee0b284", "comment": "Malware payload (Loki)", "value": "570b294fdb0ef8b3d09134b5cf0668a9e7f87ad6ce5b53f712554acc4f946d6082749bf1c2523796cd9d71b17187c000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790048, "uuid": "2a45264f-e419-4f54-ba7b-b84718eba930", "value": "T192548E8327EC42C1DE69453E0C6C74A38EBAAD36053ADD4D7F59308994D0B9A09B3B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790048, "uuid": "3119a302-b8d2-4190-89a5-44dc3347a655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790048, "uuid": "79a502a2-7d30-486e-b6c0-7380d6e5b203", "value": "6144:H1XQakQL4ZF0LaOy/D1ZlsHflKSpOtGV4elYiHS+gueomauq:VXQaGrBn+KS8JelYB+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683790048, "uuid": "35c4e481-1953-4ead-9172-21a375f5234f", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683790048, "uuid": "4f95c37a-2aa4-42c5-8051-dd56e82e4f91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790048, "uuid": "9e0c5f03-39f7-4102-bb01-3839ed8543ca", "value": "IMG_9820_520pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de77b93-f022-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683826618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826618, "uuid": "aed69e64-4178-49ca-aa78-cb6a4441ee57", "comment": "Malware payload (Formbook)", "value": "d69978ee786f6147a550257cd69fd0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826618, "uuid": "14306061-6f4a-4830-951a-805d969130b8", "comment": "Malware payload (Formbook)", "value": "19a7140e84227b4d9af59569af23a0a5a1edd34c45b24691348f227f2c540712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826618, "uuid": "94781200-c46e-4322-b297-be5d7c397c85", "comment": "Malware payload (Formbook)", "value": "078e0712acf4866fa946f18aa849670809b62de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826618, "uuid": "0b7e60a3-f62e-4446-8c3b-2a2c5a272416", "comment": "Malware payload (Formbook)", "value": "828af88894872dae1d5b50e67116361393ca446668d7e52925fa8d71b76ba6832328a3a982401ef98b96173f703eaa03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826618, "uuid": "74a2daee-d13f-4d0f-b18e-253c92328ea3", "value": "T1FEE4E19A86784F00CA684BFF4C93C28516F495767C25EA311FC724CD9DB3A3F68486AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826618, "uuid": "1f7194e1-ff76-4158-be6a-d98b4a6a3be8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826618, "uuid": "d8c9db59-f1b3-4645-836e-6c1f1959f50b", "value": "12288:jrtm4aAwhh2Y4YuV2DC5wPdbou+9iRpmEoolfef82GcFz+Fm5Ka:ftmkwhh2NVv+Pdbou+QmEogGE2Z4OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683826618, "uuid": "d50b4d75-c9c8-44f2-a6cd-5b3c68c9300f", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683826618, "uuid": "5f7eedee-0682-491f-b1e7-fd3a26a1155c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826618, "uuid": "06c204e5-9dfe-4814-97a3-cd36e6d160eb", "value": "SecuriteInfo.com.Win32.PWSX-gen.23513.21318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cbd771-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829825, "uuid": "977c5d87-6553-4f4c-a492-613abf481ade", "comment": "Malware payload (SnakeKeylogger)", "value": "3786c6c27067ae1b21ebd0ad9569ee5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829825, "uuid": "e5a3341c-ffc2-4b1d-9dd1-4a81ab200685", "comment": "Malware payload (SnakeKeylogger)", "value": "1a0ffc17583a6b31dead35d7afa49248b3fc970c77dba990367aa130f8ac4a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829825, "uuid": "193404e6-6fac-4f80-931e-fb86febd8d18", "comment": "Malware payload (SnakeKeylogger)", "value": "64662321642ba7ab2bc0e8536454e3e9e573786b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829825, "uuid": "317485c2-06ad-4962-b8dd-b6f0cdcb18bf", "comment": "Malware payload (SnakeKeylogger)", "value": "666702897a666096f10b186c54f3ace1277c51fb0a0776e3f36cac2eac1145824b7ce3d77297d107f4be11c721cf7143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829825, "uuid": "8ccfe558-c4df-4ce4-abe5-687f6b7a1608", "value": "T108C4CE85123BBFE2DA6417F0210534924B7DA11A35B8F0BC7D5BB4CAC8EAB115BD4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829825, "uuid": "27bc0cc1-6391-4473-a8f9-cf693e2f5af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829825, "uuid": "6070800d-6916-4d78-8b4d-0bccbd17d15c", "value": "12288:5qUgmEcfPefSHHAUkxmoISx5oYavvdAz7TqVVigwd5i:ZgmEcCSHuDfodvvmzKVVigwdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829825, "uuid": "f7024c9f-dd04-49d9-a693-dda31e1f6f6c", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829825, "uuid": "5ff741e0-d0ae-452c-9e84-0d1b8334d07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829825, "uuid": "f159fb73-03c2-4678-aded-fbb2d8b70aff", "value": "Doc 45 AAB 979 - 45 AAB 850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f97768d-f01f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683825332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825332, "uuid": "39a9dfd9-a026-4757-be9c-7838501568da", "comment": "Malware payload (Amadey)", "value": "7e75af90b8283d77dd2bb2375bbdfda9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825332, "uuid": "9dcb058d-0a0f-440e-bef4-f0086bfe85c1", "comment": "Malware payload (Amadey)", "value": "1a6cb6a3ae4f0530a57855656c2d7a95fb89d222736aec9ba1471ef05d8ab82f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825332, "uuid": "69b78fa9-2370-47da-a5d4-58bb83315f6e", "comment": "Malware payload (Amadey)", "value": "fa11e8288cf8034497891ac02bc0002d6d368489", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825332, "uuid": "61197c03-3595-48a1-a795-e2d77b916005", "comment": "Malware payload (Amadey)", "value": "d3693e19cdbdcedacb484863d506c8de96fdb5655bbb07be5bec48a83a7d44b02f78ee4b227aebaf9cecf4b845c51b6c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825332, "uuid": "d56b2f1c-2f15-41a7-807c-a2b48d1a5583", "value": "T12915220AB3D94433C9B423B09CF60683073ABDA48974A31B6691BD5B2572394B476B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825332, "uuid": "c9e7508f-113a-423d-8ee8-a01e6555e98d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825332, "uuid": "35cbbddc-f4a3-48b4-b0d8-f1a86aca9b1c", "value": "12288:bMr8y90We0Xzdn1U31/ykwcRT3HAdHuN/+KWOp/aQCYWnoEo5Y8oFAyaMvPMhGAI:/ya0i1omjA+dp/aNWnhazLnteIqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683825332, "uuid": "e5aeca8c-0fdd-4b8a-8248-c9eae4205173", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683825332, "uuid": "df9c2da5-c3b7-462a-a19a-a72977bb8add", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825332, "uuid": "ae744946-6b74-4c24-80bf-f34f1ed1f5e5", "value": "7e75af90b8283d77dd2bb2375bbdfda9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f568e11f-f00d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683817826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817826, "uuid": "33e3f8c4-2c7b-4655-af48-f8d1c30186a3", "comment": "Malware payload (RedLineStealer)", "value": "99813365623e7653557d5dd41018b136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817826, "uuid": "39425a28-dfa9-45dc-affa-4db15db751a4", "comment": "Malware payload (RedLineStealer)", "value": "1b3f3bd0bb4dc5dbee39dd76f746ea342aa5e155ed529077ca7680ef504a914b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817826, "uuid": "d2600ff7-77b0-4521-9ebc-edc1a4528684", "comment": "Malware payload (RedLineStealer)", "value": "168408b215636948ddce6b1e16f719fa9d33bd43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817826, "uuid": "ef057186-9d6e-4769-98ad-682944af5360", "comment": "Malware payload (RedLineStealer)", "value": "202006c1065743b4f77859df6ad43062edaf021195535151019ddce4df40a0563f1ceb31bc50a8f8f8aec945a3b07c35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817826, "uuid": "e5cdd9cd-833a-4d7a-b081-a9a5c5c0dc31", "value": "T15EF41216A7C88422ECB52B7428FB43D30F3A7C5189B4439F2758686E5DB3794A83573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817826, "uuid": "92215d39-8d46-4ecb-bb7e-8871e8e12b8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817826, "uuid": "2f0c008f-545a-49a6-981f-2708ad1e708d", "value": "12288:kMrJy90PxGFYu28UTw3APMyG91HmIwM6LNFk7H1fOH5YAJZwkgMQ6ReWAyhfNlK:Nyedu2ZNPc9x05QG2RMahQfDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683817826, "uuid": "e208c059-16d4-44be-8d2c-f90620a142f1", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683817826, "uuid": "0a4208c4-e18c-4707-8b6e-ecfc1813fb60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817826, "uuid": "42273e55-2cc6-4043-9df8-5412e856bef7", "value": "1b3f3bd0bb4dc5dbee39dd76f746ea342aa5e155ed529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72feeb5d-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832210, "uuid": "ec1659c3-eea3-4e40-abd2-ef08407f4729", "comment": "Malware payload (AgentTesla)", "value": "4dcce96ed7a8933c254db02ebdf0cccd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832210, "uuid": "638ecb6c-a8db-4ed7-a114-9cbf0645a392", "comment": "Malware payload (AgentTesla)", "value": "1c3e5e288a27425088c86cd526e006ecee211534a222b6ddd6ab4a2adb6c911d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832210, "uuid": "a0bbe17c-7dec-40f7-8b4d-779ad94b0102", "comment": "Malware payload (AgentTesla)", "value": "bcd5fb258ff2a87d8c61f12b3c2932636463d4f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832210, "uuid": "623b3489-bdaa-4280-a0e2-d64527858ad1", "comment": "Malware payload (AgentTesla)", "value": "17227ca79f9d8b5d86c015e1890f2107119c0e8386a8392d0fd6d462e0034633d6a3a709cf0c253b0df0c8bd9634ba01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832210, "uuid": "218f00c9-f6a7-4dfa-9c33-1062849626a7", "value": "T15F9487D2BB0885A4E85816759C2EC9590527BC29BC70781F359FB23FEF73392306A917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832210, "uuid": "53680ac3-b1d4-4f53-beda-c959b3083ef4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832210, "uuid": "41ea3cca-1357-4103-bd82-dfeb6872e710", "value": "3072:JxydJDaHo4ZeGr3K56KoB6l40Sl63umU:D5UTGAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832210, "uuid": "c5963018-61e8-481d-af79-8c09839777f2", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832210, "uuid": "cc1345fc-084d-40dd-a599-e34cbf1cae31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832210, "uuid": "e3321e49-ede0-43f8-89c9-73696c4a763f", "value": "DHL KULI500796821__SCAN DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d873bd-efc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683784827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784827, "uuid": "0709cd97-2e22-4473-ab74-7af1eb54cb52", "comment": "Malware payload (RedLineStealer)", "value": "23647adad5063f7e73496d8898c894fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784827, "uuid": "81fa194f-c173-40df-a8fd-6938f42a5c19", "comment": "Malware payload (RedLineStealer)", "value": "1c504777b4068ad1f5dfded8d823fd3b8ae72430285bb4085cb3c0723e29c4b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784827, "uuid": "70f51b93-d998-47db-8b44-9937c853daeb", "comment": "Malware payload (RedLineStealer)", "value": "e5a54e77f25512cf86df398dd63949d5e1bf18a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784827, "uuid": "61017d38-7139-47bf-a646-82208c6b473f", "comment": "Malware payload (RedLineStealer)", "value": "5e6324cd8ed83fc33275d6cd60e907184e74b7a20d33d7d52ed731bdaabd66ebc4729de2d4da8dc65a453bc87a1531e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784827, "uuid": "c1b07ec4-1a66-4ec6-8efd-ab56d7dffce9", "value": "T18EF42312A2E48432D8F92F7184F70BE3063EBD91993483772796BA1F5D731A0A53573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784827, "uuid": "63b17be5-8bec-4318-b238-4bb9e2945d85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784827, "uuid": "8ca7266b-2632-4d85-8513-5ce5c47695ca", "value": "24576:My9yfDGkRL8JJhZvojkyspA6pzh2srhdQRHhV:79WLwJvvojkysG6ptdrHQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784827, "uuid": "2268ea1d-ff23-4616-a596-8bf1b38ab5ea", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784827, "uuid": "015870ca-ae93-4224-948c-2726e1ee30d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784827, "uuid": "8e0c05e6-a504-40a9-8d97-5bc97ba5b48a", "value": "23647adad5063f7e73496d8898c894fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f49386-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828965, "uuid": "dba60a2d-cff1-4425-a761-3b4fb7b28127", "comment": "Malware payload (Mirai)", "value": "5bf03b049dd89d96b8b0b5c9c365687c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828965, "uuid": "84eb60e6-1422-4b79-94c7-b1b04749bc7d", "comment": "Malware payload (Mirai)", "value": "1ffddccacec528e48a9abde61624b55b2d4cd7d1ec2fb5dc6fda038a56c6415c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828965, "uuid": "0a552b13-0d94-404c-b8c4-90e129976841", "comment": "Malware payload (Mirai)", "value": "6cc1788cbae78e17afa6753edd99b9758c575709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828965, "uuid": "2b6e3f2b-241a-42b6-bc5e-c655cbda4940", "comment": "Malware payload (Mirai)", "value": "7e688430fac9ff09ad71f4ee037b99e7296675bdbb299e106de829a9d8cfce0e341d162175f39c5c4348cb1306148741", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828965, "uuid": "0f941d42-4cc0-4ab7-94f6-910f624633a6", "value": "T115F33905E6408B57C1E2277AE6CF824D33338B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828965, "uuid": "b99bc2db-df42-4463-ad9b-fcc22e81505f", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBgYnyLRM/9HNmFwfBxKQodn:hg2hNNlzIkk/MOa/OYnydM/9tmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828965, "uuid": "f2ce7dae-5b70-4a97-906b-1ec473af75f0", "value": 159885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828965, "uuid": "daf356aa-0f06-4a3b-85cc-8902d7cf949c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828965, "uuid": "553ca879-2c48-4c1e-9501-abfd4b8fd88e", "value": "5bf03b049dd89d96b8b0b5c9c365687c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76ac966-efdd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Expiro)", "timestamp": 1683797133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797133, "uuid": "0033caf2-4322-43f0-a509-6a0887b1cc4a", "comment": "Malware payload (Expiro)", "value": "54449cb838ba6a7de0d11f73de31c1af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797133, "uuid": "27e54b5e-71f0-4420-a24c-6f04742ec72c", "comment": "Malware payload (Expiro)", "value": "2062e48bd178d835beb3c39a878ea0da87aae5a4a34e3322a12bc3e9e96bf52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797133, "uuid": "1fa33942-27ce-4679-bf90-8c9b8c093717", "comment": "Malware payload (Expiro)", "value": "4fa134aaab1517fc86d77de166e8cb5dc65943df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797133, "uuid": "ddb8d69a-bd3a-427f-a563-fe31b2be0ae6", "comment": "Malware payload (Expiro)", "value": "49496706e2056cb78d7a6844cd88eee8660ddc0a3873db712a15e002253e55861601fcd9926ee23f918727622f2e9964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797133, "uuid": "2808c80e-60fe-4f08-b70c-b4a8a0a83e14", "value": "T195650284123FBFE1DA6817F0215438534B7DA11A71B4E1BC7C57B8C9C89AB258BD4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797133, "uuid": "7a7b56ce-9a15-41a4-8dca-e6083a1da33d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797133, "uuid": "52392aa1-3601-42eb-a9fb-3a9d9e6aa7fc", "value": "24576:KRmht8BU5wGMUq6HxSzB793rWyxLV08a5XwE7uWhDVzeWhWGAUlCwUY/l:3l5MUqF99TxLG8aJ3lZLeUlv/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683797133, "uuid": "ae6f663b-52b4-4331-87a6-b4b88f758e75", "value": 1484800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683797133, "uuid": "14f10b37-d27a-4af5-957a-fb88fa8af21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797133, "uuid": "084fa448-cb8d-4c79-b3e9-44c155350b5b", "value": "Purchase order 3500354689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a2aee7-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683830258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830258, "uuid": "d4619cfa-22bc-4f29-a03c-1fcdc26fe150", "comment": "Malware payload", "value": "f4ebdeda487e621cc9d5dfbd13ff4beb", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830258, "uuid": "2319a197-977f-4f29-8941-d489121ee226", "comment": "Malware payload", "value": "20cae0cee444dafb0f67bd5e81444d981644a7f638017f2893f959968a212e54", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830258, "uuid": "cf7d1dcc-997d-44ad-b4cd-bb2a16edc1ab", "comment": "Malware payload", "value": "0bc39c997a89e339af3c4cab68de3918f9b4f892", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830258, "uuid": "2319105d-1099-4890-be75-e145441e36ce", "comment": "Malware payload", "value": "7fc028cd4246f1113d462344884c69ce2e9de48ea73bebe51afc9daa1430c4c562adeee3592ec76e3a1da2c8205ff38d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830258, "uuid": "28281de2-7537-44a4-83ad-a7ed29a2a4b0", "value": "T13D54E0137114CF43E09AC7F5BF978C8A1B0ABF04AA8631EB2154779F7B7094259CA61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830258, "uuid": "703574ce-02be-4346-bcf9-ea52fb1a33cf", "value": "6144:fZaFJkKXiDU7w5v5RGokB3zQhbdsYR/z0gXp4zxyFC5DtUH8YYy9:fZaFiKXK7Hn5dsYVX4UaZUH8YT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830258, "uuid": "ba483b92-8cc3-4f0e-be21-3bab2669e609", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830258, "uuid": "24de5fa6-e2cc-45cd-96e8-36ce8e4d7ed2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830258, "uuid": "ad187dd6-9a06-4710-9c8e-1d083f7a6d8e", "value": "DOC_NEW ORDER #548889.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2996aeea-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683829939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829939, "uuid": "c1636dbd-998e-4e74-acd8-93706b24b491", "comment": "Malware payload (AsyncRAT)", "value": "ddbd96637f15d9cfaa062b35a88b4f7f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829939, "uuid": "4dacd7f6-594c-43e8-a541-ddaad8156775", "comment": "Malware payload (AsyncRAT)", "value": "23108ee718a783a09baf4ada9834f4fb1b75be363b534cef6f8a63de0a292d69", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829939, "uuid": "28a62682-d5f6-4091-afcb-f5fba66f2a9f", "comment": "Malware payload (AsyncRAT)", "value": "f16ab45b1096d63b827911de84866c68baa9657b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829939, "uuid": "fde80cb9-510f-4cbc-a141-75b745bd78c5", "comment": "Malware payload (AsyncRAT)", "value": "3129b69be5220a94bd00ac1c915d60f2f3521fd4b136d95a8750eb6a7dbc512c826a93c6c7187dd312bf86450bc855ac", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829939, "uuid": "e9d2566c-4954-4437-8669-92cfb624a89e", "value": "T17C2794F9E7E347E7F8321A35C652523461323EC5A4E5AEF545C8B62C49302DEE21AD2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829939, "uuid": "57da1314-30a5-4df9-9c05-89f321e68c07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829939, "uuid": "0574a1ec-ae3f-4d7d-a1c1-98289ebd4ef2", "value": "6144:7fQTkfGlJz/us5e2jKFFRavrXQ1SHbboDr21dP:7fQTkfsJL9aS7sfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829939, "uuid": "451f14b0-216f-434d-b3a3-f46249003530", "value": 20965026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829939, "uuid": "05cbe499-8117-4d90-9b88-3b6c5261b49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829939, "uuid": "e3ef89da-cb34-45c5-a25c-40eb353f565d", "value": "ddbd96637f15d9cfaa062b35a88b4f7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09960114-f02c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1683830744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830744, "uuid": "ba01f878-4929-4c05-bd7c-1e4c55e683e1", "comment": "Malware payload (NetSupport)", "value": "f66e44609be04b6b259edc9f0d594ffc", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830744, "uuid": "71a56da4-5fb0-457c-8dd0-b607ae223cdf", "comment": "Malware payload (NetSupport)", "value": "23e9d7d9409b022e6996ade3d661136363aa739439b1c3ed404b0073e8a86bdd", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830744, "uuid": "97874162-0f1b-48b6-84d6-2779a77e309e", "comment": "Malware payload (NetSupport)", "value": "e12f73e0bb54dfb559d32fd089225c7d0657bd7a", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830744, "uuid": "b9686261-a3ba-49cd-a3f6-6990f133d88f", "comment": "Malware payload (NetSupport)", "value": "f51eb36c487bd00c7b72b004a7f72245108f4ae5c9d85c8cbf6e9158fab7b84448095ba0c630455d0513b4b6a8429462", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830744, "uuid": "e7516690-2672-486f-85c9-601f4991ce2d", "value": "T1BBF2AE9866D3A053565FF03AB6BED8C6E55A44041BD2140FB91CB234EF96C3CCF61B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830744, "uuid": "cc32424b-3e60-47d3-b018-72666be956c8", "value": "384:b0rOo7VEemcroprQUoF0quTA0gT+fKo0jec9VU4avoE5fgYPvxQ4le2V5x303WRP:WjjAsYftfl3R571", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830744, "uuid": "3e19a442-0a6e-4f1b-8819-50fa65e093ae", "value": 34596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830744, "uuid": "b2b24d91-1fd6-4931-9079-efa1520be036", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830744, "uuid": "8c1c639c-7f1a-4dd0-b4b7-796cc99be532", "value": "Versandbestaetigung_28052_52933.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8804a71-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683837078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837078, "uuid": "c50d66a2-cf76-4b05-bde6-966c17f8c181", "comment": "Malware payload (AgentTesla)", "value": "4677c29916237a928d40cce06e8733d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837078, "uuid": "21aabce0-5bf0-4480-aa21-6029d73c5357", "comment": "Malware payload (AgentTesla)", "value": "2492388a2635baa1438388add6c7c6c71d1793bb8b84757daf0b06f787543b39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837078, "uuid": "17ec6e17-db90-428b-9e88-0edc30609f6e", "comment": "Malware payload (AgentTesla)", "value": "1c7974df3ae9d45b092475f940d5cf4956d5f288", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837078, "uuid": "1a5c76df-8460-47b0-a2d6-c82a97f21ba0", "comment": "Malware payload (AgentTesla)", "value": "8c3495c2af31e3097a043a47aff09992cae917ea6f7cb2f27c2d1beeb153008aec563be853a57f8bcba17a27132ac0ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837078, "uuid": "c4a43aac-08ac-4abb-a144-2d6bc2cf5450", "value": "T16FE4CF85423BAFE2D9A413F1211438524B7DAD1A74B8F0BC6D6B74C9C8FAB114BD4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837078, "uuid": "b9910ab7-ce57-4134-a25c-0e92c2baf6b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837078, "uuid": "06a050d3-57f7-4842-87ec-98bf88a3f2c7", "value": "12288:wqUNymU43Q7vYZNxrq+m4pwiCS/x50oAKuN2c2+qQH:CwmUhkxrqCX48Q2c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837078, "uuid": "951d247f-3101-461e-a031-1ff9819e50bd", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837078, "uuid": "f185482d-5dfe-4f5e-9653-e5336b67b86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837078, "uuid": "08f7ee3d-2703-4b13-a718-0eff6b2e4ccb", "value": "fiyat ve teslimat bilgisi_QS20202310109051__40GP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d524aa2f-f020-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683825932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825932, "uuid": "118bb53a-c65c-4cb0-aa2b-2e297544bbef", "comment": "Malware payload (Amadey)", "value": "b62fabc253895ff6cf33ac4764382994", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825932, "uuid": "26f080b5-99e0-43f0-b54f-a722659d0798", "comment": "Malware payload (Amadey)", "value": "25622e93e61116c3f973342219321891473820af450bbdbae9377827695955d6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825932, "uuid": "c22a880e-5422-496c-b055-011991fcf048", "comment": "Malware payload (Amadey)", "value": "c4b0bca2d8d8fc2ebe004ce6b9a6887617ab1003", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825932, "uuid": "bf47da5f-4f8e-4e5b-ae6c-b94f15fcbc3c", "comment": "Malware payload (Amadey)", "value": "e6d5b777695c4b5d00b7557e3c44b82e890693613a067e8d3375ab4b36cd8d6fcbf090473c64fcb5e51caf795c266d28", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825932, "uuid": "d283fcd4-a9d6-426b-abc2-aeab3bc00923", "value": "T187152356B6E49031DCF91FF05CFA43C70A39BED59CA9022B2751DA4B4C72B14A871B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825932, "uuid": "c4fe9fae-ca42-4538-9ca0-499580b7bfa2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825932, "uuid": "5f00ae9e-371c-4c5a-a99b-d555bdcf7bda", "value": "24576:4ypOzZS92xtK2eDHur1uxpf6zruqm3vj0:/pON02bcAi+yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683825932, "uuid": "efff13f1-e0b2-4245-baf1-41d3e12ef71d", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683825932, "uuid": "9b23976f-6156-476a-88d5-299bfce3d277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825932, "uuid": "b765feef-9561-4c3e-bbd9-063aafdb626a", "value": "b62fabc253895ff6cf33ac4764382994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca46df9e-f03c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683837940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837940, "uuid": "b5861a50-0b4b-455f-95ae-8babb0892334", "comment": "Malware payload (Amadey)", "value": "3b71db94d6fe993b2ec6a6e8a71cc4d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837940, "uuid": "775abc46-5795-47d7-b4d4-b7222d611621", "comment": "Malware payload (Amadey)", "value": "26385e9520fd59abd3d9a85fd2b548696de43f5f03bbee7e9d1eb9ed308b10bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837940, "uuid": "1d4c0f54-e7f0-4503-9298-c2875da37dc3", "comment": "Malware payload (Amadey)", "value": "921e2c250a064f8065d257a7492c80c100e7135f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837940, "uuid": "9fd2a1a3-0a4f-4c5d-acf7-6b14db3f5cc4", "comment": "Malware payload (Amadey)", "value": "9b43ff0026cf2ffe504d9a6f99772ceeff4b2be904271d6d363ec6531c5d76e1393858637b9c0610182c76144f078d96", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837940, "uuid": "8b8cce34-c63b-4d9a-9fda-1cedf5d4b403", "value": "T1F4152226FBD88031E6F61B7899F307D31337BC629878836B6746866E5C723569032727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837940, "uuid": "71540540-94da-444a-a9f0-85cad5b0757f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837940, "uuid": "54d1db97-3535-4c4e-9c21-043881a42e29", "value": "24576:FyhvgN8ED3LpCQedr85AnxA1YukPtpyeCNfsAEJ:ghvU7pbeVW2umhCNfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837940, "uuid": "a07ede0f-d0ac-49bd-9182-87069d02f087", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837940, "uuid": "35b52695-accf-4904-a5c4-cf542c613a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837940, "uuid": "642c98ba-2fb2-4ef0-8b36-0f5d571a2a74", "value": "3b71db94d6fe993b2ec6a6e8a71cc4d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a36d7dd-efc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683788440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788440, "uuid": "767b0838-36c1-41ca-85d1-1cb0c8418488", "comment": "Malware payload (njrat)", "value": "d4ad0a3a939fc756206fdd9bef3ee019", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788440, "uuid": "9a7955b4-d7e7-4061-89fc-bc20a4752829", "comment": "Malware payload (njrat)", "value": "26b04dea5db4331d936046dd5cfd46930f21f6f75a567140a78b723ea0cfa5e5", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788440, "uuid": "88c16b4c-d658-44e0-8c80-0b6f51ec6411", "comment": "Malware payload (njrat)", "value": "1504872dd303c47eb8ef488505276792f6da4c55", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788440, "uuid": "f8640f63-ef8b-4ac0-b037-5707102c4ed5", "comment": "Malware payload (njrat)", "value": "697c8e79a7e024eff48952e742a923c16b6bc3bd570bfa4abac31e60708b5f3e6f49435570d31b62ca8e373c4098edf4", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788440, "uuid": "c41e644f-ce5c-487d-938b-bedef1674817", "value": "T16CE208467BE58219C6BC2AFC9CB313110772E3438532EB6F5CDC88DA4BA76D00641EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788440, "uuid": "141be170-426f-4f41-a167-556a9aca4c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788440, "uuid": "e336c80b-8ae5-4c05-b242-bec74ffca531", "value": "384:j0bUe5XB4e0XbOhmANuiEO0YatWTatTUFQqzFvqObbO:wT9BuiIguiEYK8JbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683788440, "uuid": "28ef617c-e7ca-40b9-927a-11891451dd7d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683788440, "uuid": "dd0ee316-5d15-4175-b0bf-35a91710fdea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788440, "uuid": "8fc52590-140d-4ee2-bbfb-f3f6bd93fe33", "value": "Lime.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d91fed4-efcb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683789090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789090, "uuid": "b273d929-d4d5-4442-a714-1e44d379190c", "comment": "Malware payload (RemcosRAT)", "value": "127c0238e65be12864f4babe92f2b069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789090, "uuid": "6aef12fd-b3b2-43c2-856a-ba3fec45020f", "comment": "Malware payload (RemcosRAT)", "value": "28100101069ebe8b83ff5a91f8ef75b72cb22ac66ac93b00c2f6831359f2763f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789090, "uuid": "b37e02e0-1916-4102-b82c-721e3c816ac2", "comment": "Malware payload (RemcosRAT)", "value": "10baebbe3dff281cca412c158e3a9e38da51b2c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789090, "uuid": "c53078ff-be10-4250-bfa9-70412cfd2f42", "comment": "Malware payload (RemcosRAT)", "value": "783afa01caf20aeeaf1476df15adfc05853c5100b346273851fd0959e3813f3626a89097f7e5809244a2a8e03a2a9999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789090, "uuid": "91579125-70c2-4bcb-9c0d-799c225b29eb", "value": "T130A401127E61F4A3C4DA4A31594FD66F6F207CE424511BAB3774B72B2C712A0C61ABBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789090, "uuid": "5ec065e6-cb75-4ed1-a92b-77679c1a8e39", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789090, "uuid": "39eb143d-2073-469a-9991-d6ef87fa7dc9", "value": "12288:Kzd8UZp23muTe664ne/umyUNa8N94NpG:KRBZpkG66keaU/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789090, "uuid": "e50e757e-4bb0-45bf-83a6-28bab2836cf6", "value": 484888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789090, "uuid": "00b2ff61-e110-4107-b6cc-3ac373269d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789090, "uuid": "31b44f9f-f8d0-4104-996d-ddfbfd64f2d2", "value": "PO 009661721..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ea12c5-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683832238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832238, "uuid": "cf0a0125-8b3b-495f-8058-ec583a2fc570", "comment": "Malware payload", "value": "81da86627dc6dd1b6c4131736cdf686b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832238, "uuid": "f47e3c0b-f15d-429c-80c2-cf731587fc8c", "comment": "Malware payload", "value": "285ce0e5bbbe2d2f72c24762d2a7579f5a397b38efa6e60de6dd89bc00a0125f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832238, "uuid": "fa5b1e02-8266-4bca-8912-0d6d31a5e7e0", "comment": "Malware payload", "value": "726ddeaca22517bd13c7af50330543f017e1e1ff", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832238, "uuid": "2acea9aa-9bc9-4127-9e4f-212f73381fd9", "comment": "Malware payload", "value": "8fe4d12aba2d053d48697fe555d47f9b85792b28f7ff50c72e8cbbac3cae557f9332fa8670a5d9dfb2de0425677eabb8", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832238, "uuid": "3c4a45cc-8240-42de-8da7-81619d3e74ff", "value": "T1A2618D144BE6020CF3F3AB3A99BE66554E3B7946AD31C74E0058814EA2F1A40EC72F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832238, "uuid": "cc9fa543-8376-406d-87d3-1cb095867af4", "value": "48:865aGU9Dmel0iglZ+JpQfYj1sAT1rTRRSJxo9AIH:865IB0+J6YZsErTR0/SAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832238, "uuid": "423648ff-3a8f-4e45-b822-75747f9d037b", "value": 3444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832238, "uuid": "027be43a-b8de-4f46-abd9-cf7fc55f2d05", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832238, "uuid": "cf41fbbb-af80-4ae3-99a1-51fbc7f61218", "value": "Invoice.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88721a5-efca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683789055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789055, "uuid": "18180f41-c5b0-4cd1-b4a4-b6616c051587", "comment": "Malware payload (Formbook)", "value": "698ece3f55fab3c8da2f4bdd70aa8d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789055, "uuid": "1063c5bb-1d1f-4e1b-9e81-8a86e2e29150", "comment": "Malware payload (Formbook)", "value": "28e38353ff672ef3b3e324d86532ea4b887762b0c74a0cf3a4e8f9a04c844bd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789055, "uuid": "5dd7859a-da14-406d-a7d8-639e13111b38", "comment": "Malware payload (Formbook)", "value": "1155e9883b513d9936fb125ef0f0ee061270f2ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789055, "uuid": "5d39895a-3839-40da-8f90-c7f74149fea8", "comment": "Malware payload (Formbook)", "value": "5daed479f5331a4ffb7bc39fd458a57da4457e54b01de9891e9c4e1b5dc74c3bbcd934d5cc1cc34060ed77d7cc03657d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789055, "uuid": "34308c42-dc21-44e2-8caf-5ef7d594d41b", "value": "T1B664121BE7471412C56BCB32E55082122F72E7C13A73DA873650C11EAB433DE3B999EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789055, "uuid": "3e049ef7-223a-45dd-bce1-74816531ff8d", "value": "6144:b0sBEin4JDEu7g7DSjLMUlOhiU7FR9em28hUdUXaH4KadOB6soRn4:bBBEin4hEuEqLHoom02KYKadOB6so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789055, "uuid": "7dbb23da-cd29-4f40-89ab-f4f758f2b7be", "value": 322632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789055, "uuid": "bc7806f1-5800-4af9-b1dc-d9fdfee01acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789055, "uuid": "18058d47-6774-4dab-abee-c2e0214260a9", "value": "OVERDUE INVOICES.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d1ad04-f010-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683818789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818789, "uuid": "9761d0d1-a709-4a4c-9ba7-dee023797897", "comment": "Malware payload (RemcosRAT)", "value": "14ac6f908ca2112dae932a9bff75d574", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818789, "uuid": "5ee5cf13-9789-4305-835b-3716e887f2d4", "comment": "Malware payload (RemcosRAT)", "value": "291755c89bb6d77dd43c74cb0413df8037244debd6bedd2a869edf7dfd090d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818789, "uuid": "c4843fb8-68d8-4f0d-8530-594544bd4871", "comment": "Malware payload (RemcosRAT)", "value": "25e53a950c8284167d25f99f171a03f9d6bf9ac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818789, "uuid": "24fd6629-9a55-4513-997c-7c8abffcbf75", "comment": "Malware payload (RemcosRAT)", "value": "93f16ad488b55357b01f2643099333d5dca3864e61985a0801ed82bc59393761e78aeb9fab1d9162dc006075afbb219f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818789, "uuid": "bd4b8e79-4610-468c-a71b-664ff0e1ea8b", "value": "T1D225F18A033FBED1D6541B70264438574B3DB11775F8B0BC791BB888C9AFD218BE8666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818789, "uuid": "400eabeb-b92d-4d01-a318-2fafb0cd67c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818789, "uuid": "5d8e68f4-894a-4233-9a7c-c0b05b288036", "value": "12288:5Tmv2msrnakLq4TuePtJlKvc0L4wnapV1gccz7LIoJfgPLxIZf2Fz+oub6u:dmaXLjuWtvEL4eQVXyvIoNoKom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683818789, "uuid": "05d69533-a3ed-44bb-b4f9-099dc6238819", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683818789, "uuid": "e0e9ad59-8f87-4dcc-9a2f-75ed59c5928c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818789, "uuid": "0990cfb2-226b-487e-bb91-b70f6a6a4285", "value": "14ac6f908ca2112dae932a9bff75d574.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e727971c-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829828, "uuid": "ccb73622-ddc6-46ba-be08-1734262cd2e1", "comment": "Malware payload (SnakeKeylogger)", "value": "fa4fb7b2b984ba67297985696bc2f393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829828, "uuid": "c0484904-15db-494d-8309-42b547e3703d", "comment": "Malware payload (SnakeKeylogger)", "value": "29eab90d00959df3bc7e2699823e8521eec34be6a967e52fe6d71f519ed16ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829828, "uuid": "a7ce0619-48e3-46b4-9d00-019b223bf20c", "comment": "Malware payload (SnakeKeylogger)", "value": "747fd5fd2f007269cd437dc5d91956d66cce8d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829828, "uuid": "a0db38dd-ab53-43ed-9841-b240c0b218e1", "comment": "Malware payload (SnakeKeylogger)", "value": "08620ba03236d3aa4cf8ea29b95994486feec9a666149deabac22da856a8807cd38aff1995c6cb6d76ec54c10056cda1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829828, "uuid": "0ac7ddf7-5732-41d5-91b1-0ea1608ad2b4", "value": "T1CCD4D088223778DEC555967226443C539E3CB12766BD60BCB91B74CCC98E862CFE46B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829828, "uuid": "c65d4b2c-7878-4765-a570-8cb9244dfebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829828, "uuid": "9a11ec80-0eea-4ed4-a368-ab6631f025c3", "value": "12288:jmYCfCFzee/cqoTvl3FIcca27p8knmp/dlBlhdGa6vJt:jmNqRoFTt3FIfanknML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829828, "uuid": "3e92fd0a-c032-497d-8195-2468cfa12794", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829828, "uuid": "5f7b752a-70ef-4d90-9a5c-af21ed6064b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829828, "uuid": "e4016e51-0135-486e-a458-6c251733bdef", "value": "order details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780630ce-f011-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683819333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819333, "uuid": "020f74fd-9081-4b6a-ab91-5e011a8eff91", "comment": "Malware payload (RedLineStealer)", "value": "390281942db7d7e06b0cf969c9c19bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819333, "uuid": "db2e76b3-e37d-43a4-93a5-1e36f5122620", "comment": "Malware payload (RedLineStealer)", "value": "2a21da802e26b2d828b38b3ce2fe3ffce5153e6c6a113f1a091ec874211bc890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819333, "uuid": "de84e242-745f-49ff-bc3c-e1c30c4253b3", "comment": "Malware payload (RedLineStealer)", "value": "20fcad7cb64e2eeb4a5f5e76efcd9b470c212f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819333, "uuid": "20c82668-1b6d-4421-b97c-48b28529d6a4", "comment": "Malware payload (RedLineStealer)", "value": "34d9b7c9587774316b8381cfb53517cb40c9090b12d28b7a3b9f664e7ed2bcd84cdea8813433f070dadeb0e2cc22025f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819333, "uuid": "a6d7f514-58a4-4e93-b106-77d7bd8fbd77", "value": "T134F42212D6ECA473C8B51B302DFB03931B7A7CA02D3857632B94995B5DB31E4A43972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819333, "uuid": "b575d0bd-586e-4422-abae-32953a79a1ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819333, "uuid": "a9ab6f92-e4b8-4226-a7e6-3f09a3120332", "value": "12288:dMrty90vzO15USA+oEb7wVr9otMTxJg9mTt62oMSIwzZxMacfBkmZMR+T/u/+:wyuzaUw/7KLJPnwzZxMTBkUMT/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819333, "uuid": "bd11f3c4-0b93-4c05-b83c-4698fa141f9f", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819333, "uuid": "5255b747-f572-49fd-af85-0a1fc980e9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819333, "uuid": "7808bebc-8be1-4261-8bec-63621233ecba", "value": "390281942db7d7e06b0cf969c9c19bc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a7d1b7-efd3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683792912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792912, "uuid": "b94a17e3-46af-430e-80c0-1c54fad26225", "comment": "Malware payload (NanoCore)", "value": "7a6d17a799821dfcccf27ece2f4dfffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792912, "uuid": "fbc6d0d8-d7ab-4622-bc9f-f84a830e8082", "comment": "Malware payload (NanoCore)", "value": "2b56e825cc2e772bc4fc4ba70da59ecdb9ff305982bcef1af9f577ff6cd07875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792912, "uuid": "557d145b-b4c0-448e-a1d2-bfc143a24701", "comment": "Malware payload (NanoCore)", "value": "14ea103b91082e2f89c2c6c5ff8a5475e22ab331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792912, "uuid": "64938e2b-3583-48b7-8fb6-e87948a5bd87", "comment": "Malware payload (NanoCore)", "value": "3c5f3f9852c2a186167ea4bdb3bc958a7b28c174fb6f81596e1c22af3a40167a796f15996dd17c6068ca80140d66c11f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792912, "uuid": "ca24d764-ae99-4a0c-9bde-8326ef91424d", "value": "T19E45D0731AC3FEF997A54E94E84116048DC07CBB5B2CB0A4FC8CB1AA76E45649A5DCF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792912, "uuid": "8354e5f2-bf46-4029-bcd3-e493b3f0f98c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792912, "uuid": "99ef8cab-c9c5-42e5-949c-b09869b46f53", "value": "24576:wBdtHRL5sgP5+LZ5Wc25Wjndr1bUA+hGZ6jEsQR83f:yHl5+L85WjZS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683792912, "uuid": "1eab8b9a-35de-4979-b04b-416ebe2a71c3", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683792912, "uuid": "6c18d738-fa62-450f-a8a8-f2a97536233a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792912, "uuid": "9006e4f4-9f90-4087-8e24-8880e8e2424b", "value": "confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1286936-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683837065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837065, "uuid": "5efa32d3-e50c-48ef-9c36-1d24bd063c8f", "comment": "Malware payload", "value": "60939f99b688e11e532d18050d0c823b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837065, "uuid": "797200d6-b864-4043-87c9-b9970d5e61ac", "comment": "Malware payload", "value": "2b8cda9767ac9b5d297ae5e2a82ae01db77313e100bb728c5f293e6c9529da90", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837065, "uuid": "cb5ab299-7e36-4b44-b5cb-b568aef85c69", "comment": "Malware payload", "value": "6229c0b98ea0855c6a74017e183c6d6310ecf999", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837065, "uuid": "6f62517c-ce51-41e0-9806-508b0110fe94", "comment": "Malware payload", "value": "146b7906e1a6d59431753079650d16e1980a17cc34599e8cb6f7a60240a92d43ff11689b58fcd72e205b5f4d465d775f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837065, "uuid": "44d9e766-660f-4c62-b199-ae09470cd7ad", "value": "T1B86533AE0B61082152D96E3FAD685F0CF3204059EA148699FDF54E5F37BAF02B5C2F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837065, "uuid": "f538f2ce-5170-4d31-a248-56ccbed38e9a", "value": "24576:IfUIXmDTH1ezTi/fk1B/715/KpVDESl8Sv3KxV1W+8jvdLTHhYD9N:+UWmTVETi/fkjfi7DExS/KH1WXjvd3BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837065, "uuid": "5a0516a1-f8ea-4c58-baa8-5e5b99492a49", "value": 1476142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837065, "uuid": "45d48bcb-bcaa-46e8-b924-b4b107efe7ec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837065, "uuid": "e39e468e-510d-4432-b672-cdd2ade8bc6b", "value": "Download Tracking Reference_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f17d79-ef93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683765156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765156, "uuid": "f11b4c3a-7962-4156-86e6-092bdf23b4da", "comment": "Malware payload (CoinMiner)", "value": "632bffe7bf3bb5477a6627605dad9960", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765156, "uuid": "b1a183bb-e096-440f-a48e-110b19c0d0eb", "comment": "Malware payload (CoinMiner)", "value": "2cb4f54c95cd9f9f60761974613969f5923be7e247282a6369557730a42a4ef2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765156, "uuid": "7c64ccdd-daa7-4932-bcb6-b8cde9553021", "comment": "Malware payload (CoinMiner)", "value": "31cb12b1cfd8036c705fc94d93199ab51b04c4ff", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765156, "uuid": "fc526a93-0e9b-4d5c-9530-8da015d6f32c", "comment": "Malware payload (CoinMiner)", "value": "9d2d1272ad0760886d6f2cdebec4a5847ef8922f0f5598ae57e9fafac2f7bfceb21909d56d5cca47095e677505827139", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765156, "uuid": "ee641c6b-e165-423a-a1b0-9894d7a3f18e", "value": "T124E41355B38B9B01C1985274D6D7990E03F6E38F2A33D7227AC41BD3A9067F0DA45B8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765156, "uuid": "b30f977b-0b46-41fa-910d-95154da564d6", "value": "12288:UTNcP5vvvd1gHHsD4MfGkodVtc+lWHG+/sDjIxiA44CNcx8:jP5vvvYHlkodVewARFxi540cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683765156, "uuid": "222ffdfb-1cfa-4546-841c-09bc27571069", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683765156, "uuid": "cfeccca9-8e6c-4bbd-8760-0cd9ac796ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765156, "uuid": "d011fc38-a8c7-4396-bddb-84666b32f5b7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46861e24-f014-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683820539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820539, "uuid": "e517abe1-5e4d-462c-b3f7-af4ceca265d1", "comment": "Malware payload (RedLineStealer)", "value": "7f7d127294ffc58543e0197866ba1371", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820539, "uuid": "d3c551f1-5ca0-4e7d-96de-8001259ed8e8", "comment": "Malware payload (RedLineStealer)", "value": "2ec70d9f876394b1cdf6ee39582788abe1be43e4d349c52f5f5c42dfc942bb6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820539, "uuid": "3e87c474-662a-4ec7-821a-ce546fa0bffe", "comment": "Malware payload (RedLineStealer)", "value": "e2ffe6da7f2c8c7fbac81ade6fa19262d9163d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820539, "uuid": "e48e6227-7807-4176-b89a-d578ab9f4a7c", "comment": "Malware payload (RedLineStealer)", "value": "c5973052c13f6560ea5f216eb10e18f82eb8ccc26c146089bb120e670f164123f6cfc0f1c168097455b5fd00f5370947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820539, "uuid": "23ef79b9-4e4c-45f9-adde-9ab87800e0e4", "value": "T154947D2393E17C54F966CB729E2EC6ED762EF3504F19776A12149E1F04B02B2C263B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820539, "uuid": "0d79d001-3e21-464b-ae99-0a33018e521c", "value": "4062e3723fc172742e77f31966f99ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820539, "uuid": "e3fb91ba-4cf9-43f3-95ac-402b0b471e56", "value": "6144:FGrfLlAL3DNP9map9ylHRP5MrCVW4Tv3L9sOAq+V08ZeQh:wTpAL3DNPDctRPiCI4Tv5F+VZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683820539, "uuid": "41663dc8-124b-4993-b713-e864288f2080", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683820539, "uuid": "f55fdcff-029f-447a-b808-103e2639766a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820539, "uuid": "2c083d38-1e14-4b78-b6cc-9ff0400ab696", "value": "7f7d127294ffc58543e0197866ba1371.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b47239-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683830273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830273, "uuid": "32e00eb7-ebe3-46f6-a05a-c01dc2752cf0", "comment": "Malware payload", "value": "264bd5a30eaddb58a52a8c7011f8ff7f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830273, "uuid": "b88974a8-dbf4-4900-be5c-68f7b1ffa63c", "comment": "Malware payload", "value": "2f6c9dd0708936661ed8f87e37655e8071527fac198eba7c04d0eacbd1acb09c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830273, "uuid": "86f2e217-74c3-4090-a18d-f6c37505e563", "comment": "Malware payload", "value": "13f7fd890d1e36607c4260337b7ba1e6f49948f4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830273, "uuid": "450c5424-c8ea-4234-8fed-76e2fb1d9bb3", "comment": "Malware payload", "value": "5bf92dbe6040a136ed37f0fb92169a65d53fdf2c632d61040ddbe1b6d05fd308bc9be62fc913a9c8b3e04973a076860e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830273, "uuid": "b12ec646-3d8f-4566-94dd-fc0aa1c986cf", "value": "T194350102A188CD4AE18183FA7B63B84D430DBF7276C4A0D63A5CB74B9B31E7B559B50D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830273, "uuid": "f5d377fb-98db-4b07-bcc6-73edd51c4b59", "value": "24576:eLKkWQmmav30xWWJWQmmav30xy/b+MXUF+MXUUS8MLOJWGk94p74TX:eLK5QmmQ30SQmmQ304+MXi+MXL0OJWVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830273, "uuid": "b9edc092-64ae-4d22-9b85-8fd50a5786a8", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830273, "uuid": "67a29819-52ed-47c0-a2ae-5f8dadc1ed64", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830273, "uuid": "cc2939ac-2b05-43fc-a06a-a0e6de599f4a", "value": "GTS&LC DRAFT USD35600.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a416f4-f035-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683834654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834654, "uuid": "95b5fee5-f6d4-4595-b6fc-e9ea9720fe65", "comment": "Malware payload", "value": "c86144dd67688f5b7dcb72bbecc96cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834654, "uuid": "aba9ae97-cbb4-4dfa-8748-661853c8154b", "comment": "Malware payload", "value": "2fa9ce048f2aef4542de0f78a824ef4576c435e4275ada3ab8fa3b6db84ac16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834654, "uuid": "24e31e47-dc8d-4e85-86b0-5d78ce4a2fae", "comment": "Malware payload", "value": "55dbfa6ccebe2f80ac9793bdb80502469640a06f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834654, "uuid": "6125bacd-9413-47f4-8445-8413f40282e9", "comment": "Malware payload", "value": "34830c4002236bf21ba6e9a3ea9eb5ea50de5064c91719a22e507009e030143917f50dda8f63ee297f1152046be4ac1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834654, "uuid": "2d801c28-d29e-4dd2-bfb6-a5462b77b1ff", "value": "T1E84412A25FC08CF3EE972EB05ABA9F1B5977F6200020AB4F97285C463D523916D1D379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834654, "uuid": "7ba9c01b-fd2a-469f-ba1b-7c867f040dfd", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834654, "uuid": "19919dd6-60d8-4e39-bc54-d36d2aa90d99", "value": "6144:HMrudbcDdcP8Vf29VdpbIWKVl6OXRxzRiMZpP3Mc9wjoq1Tv:HfN8Z29npozRFRR+c9wjoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834654, "uuid": "626082bc-c188-43a7-83e0-b35254d92c07", "value": 267920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834654, "uuid": "4d0f4cbf-fe85-4c85-aec3-12652a058f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834654, "uuid": "94a32b1f-040c-4611-83bc-ea070ee19a1d", "value": "2fa9ce048f2aef4542de0f78a824ef4576c435e4275ada3ab8fa3b6db84ac16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb70ab26-efe6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683801085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801085, "uuid": "53c25fb3-a5a0-4485-976d-9edcc7ecf5aa", "comment": "Malware payload (SnakeKeylogger)", "value": "78fe6ec8f582a8d82b45e21f9145e87d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801085, "uuid": "1ddeb20b-daa9-4c1f-b4f7-5bc8839a1486", "comment": "Malware payload (SnakeKeylogger)", "value": "307f012f74f209e4b8371400455ee296585a6d6a0d4c2195df2186ecaf0acd79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801085, "uuid": "ac7db241-1340-4c56-b838-2403b992b259", "comment": "Malware payload (SnakeKeylogger)", "value": "ab0684bd54f83799cb5b5c77211e016b9496a12b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801085, "uuid": "906bcc1f-bec9-4e9f-bbba-ce4c95e4b054", "comment": "Malware payload (SnakeKeylogger)", "value": "213aad12da67881b58b9598b8bd48befdde10efd53620dcf72295fc93372309dd334dfd3ff4843b94f30731f7ccaac5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801085, "uuid": "7b804665-ca45-4107-8328-9f74ed697e7c", "value": "T15FC4CF44523BBFE2D96407F0215438438B7DA11A74B8F1BCAD97B8C9C8EAB115BD4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801085, "uuid": "62704168-4e94-4070-8ee7-33718d104e91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801085, "uuid": "9b5bc33f-9867-4600-9cff-997aef1b0dd4", "value": "12288:9qULmHUhdRrbowip2J/zQHYEZE91VFjfvjE23s:9LmHYdh0d60HYYE9rZps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683801085, "uuid": "d89861f8-16af-4d0c-b4d9-79306c351a03", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683801085, "uuid": "e3a0e367-e9d3-4efb-a83c-340b0ca05c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801085, "uuid": "1bc547e0-da59-4b40-953c-de7dfae8cb21", "value": "rHalkbank_Ekstre_20230321_080804_358439.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326c270a-efd1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683791729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791729, "uuid": "eff69934-2b0a-46cc-b646-0538311f02bb", "comment": "Malware payload (Amadey)", "value": "d1c1273cb2400a1c95afd867c3894904", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791729, "uuid": "abe4c289-4323-4f39-a94c-1d3a22115a1c", "comment": "Malware payload (Amadey)", "value": "31ab0319478a1610b24da018712f9985536f027d72c0f1dd4be8643d7eb40aa0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791729, "uuid": "32e64a7e-83bc-4f03-9a13-8bacdc94743c", "comment": "Malware payload (Amadey)", "value": "c59f465f6bac7bfeb304ddaf82db422511a247bd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791729, "uuid": "2ba18b7f-8de8-4131-95ff-17e3285c0e7f", "comment": "Malware payload (Amadey)", "value": "8b2c563f5bc48f863adca6a7270e3829205dd067064cd4624500c54c9d42edf89e8c19fcf32ca911aca57a8886a481ba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791729, "uuid": "4a2dba34-1840-4cad-987e-7a7d65686f49", "value": "T17EF41392B3D85473D8B56B7418F706970E363CA1A97483673781AE6A2CF3A84607173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791729, "uuid": "10a5b844-3a8a-4ca4-b2c4-e02a17b5968a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791729, "uuid": "866c0703-a12d-44a0-8734-0dae709713d7", "value": "12288:xMrEy90WgL2Q2B745tDw1/tLOXkGr3xX2KAp2ENbqIbDmglJop38ubtYhXxVv:hyu2QfDwRh8p2Z/YmQ3h6Fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683791729, "uuid": "4aca36da-b21f-480f-b9dc-631e67682595", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683791729, "uuid": "e1bfd2c0-f0c4-49b2-8503-f235ca9712cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791729, "uuid": "f1360835-b176-40d3-8b9a-32a8f3f3eecc", "value": "d1c1273cb2400a1c95afd867c3894904.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e93cd8-efdd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683797202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797202, "uuid": "9bea11f3-4285-4a15-9fda-7757a622e671", "comment": "Malware payload (AgentTesla)", "value": "65f71df7b2621627437f8e0d30374766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797202, "uuid": "62b6896a-da4f-4958-9ba9-d289c91d3977", "comment": "Malware payload (AgentTesla)", "value": "3298c3e6f25b777c9f772fb1d5123472df0b1046000598d9ed00bd369a56124d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797202, "uuid": "33499857-f243-4cf5-a114-04e7f7df6944", "comment": "Malware payload (AgentTesla)", "value": "875d611145baea3825298a33b3ec3f5080ff4f27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797202, "uuid": "c1604fc0-2b45-4077-8913-c53b94fae8cd", "comment": "Malware payload (AgentTesla)", "value": "fc88f43d46b6366154252588e98719e25b58fad3f23bd58649e8b37dd31ed3d508ace048b433ff5b6ce9e6e1afa67a8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797202, "uuid": "91492a11-8108-4947-93f5-ef12650c3fd7", "value": "T1B8D4CF88133BBFE2E9A417F0215434524B3DE11A75B8F0BC6D5BB8C9C99AB114BD4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797202, "uuid": "e9dbc1aa-2eed-4ef6-a480-a3035147944e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797202, "uuid": "e13b9264-49a1-4098-9fa5-12e9eefdb561", "value": "12288:jqULmQVF15ylsYtFwuZdYLdsVVc9g0qPWu3zycsuVKJ9ELmzRcEz:rLmQVZSRXUxsVGmP/OcsuExFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683797202, "uuid": "5a664ccd-3eb8-4f91-8851-fe70a7f00d3c", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683797202, "uuid": "c5e06ed6-5f40-40b7-9a8e-d49c5c9a62fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797202, "uuid": "e5c318ae-f292-4e1d-aabd-ca2ff8875128", "value": "Swel-Lista av f\u00f6rem\u00e5l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b5479-efca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683788725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788725, "uuid": "81a69704-d855-424b-af80-f52f5e04bd78", "comment": "Malware payload (RedLineStealer)", "value": "85020f96e8eff3443b89de192e51c53a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788725, "uuid": "9df2bb36-9606-4e8e-8488-4a7695ee866c", "comment": "Malware payload (RedLineStealer)", "value": "32c7c9dd6ceb2fd8e565617f0e33615c72727f907ca62ffee1e30f6693d35d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788725, "uuid": "07d743b3-c5a0-4550-a533-0728b63fa1e0", "comment": "Malware payload (RedLineStealer)", "value": "910e1db879e0a07d84e3b88db4ff8a566e00dbbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788725, "uuid": "639fd438-98c6-4d37-b9a8-87835ae4bff5", "comment": "Malware payload (RedLineStealer)", "value": "3224173dab6ed89a4c047670eed7772eadd01aecaa016ac3425b8afd1f717d14443583255642775c0c4b002751d648a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788725, "uuid": "2ac43a90-f0d1-4568-acce-2f9e90fe55c5", "value": "T1CEF42263B6E89173C8B127B0A9FB03871B36BC708D7A839B1795A45A0C731E4E174767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788725, "uuid": "a11b6f02-c62f-4ca4-82c5-b2a517214598", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788725, "uuid": "dd06dc45-8b86-40ef-882e-f67942478cc5", "value": "24576:qyh4g8W1VRKhSIfxNYUYwAabLV2g3oTAkwWKgzk:xW934kYwfQg3oTEWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683788725, "uuid": "681916f4-bb55-4a91-9d3c-9cd7be9bbb87", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683788725, "uuid": "91750a25-852a-4a54-8345-de16f9758ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788725, "uuid": "7ef1b7a7-264c-47cc-9958-efa8588736c7", "value": "85020f96e8eff3443b89de192e51c53a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cdac7d-efc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785540, "uuid": "d82ee65d-52e0-4305-bcce-1bacc1e600a6", "comment": "Malware payload (Mirai)", "value": "da6cd860f8e26565f7fdfedb8e902f0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785540, "uuid": "1493e840-735d-4d25-beaa-809b52e2ac7b", "comment": "Malware payload (Mirai)", "value": "34777205d0a4b980defe8e436ac7ddb72ca0e9c193f4bc75ef04ef0967683b47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785540, "uuid": "85723fd2-e4c1-460d-87a9-7fb77976c7b4", "comment": "Malware payload (Mirai)", "value": "81c93faed7c3c031e022877daf2182df9f912a4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785540, "uuid": "a1c3961f-cc90-4ee4-8cb3-c61b9247b935", "comment": "Malware payload (Mirai)", "value": "86eb37bc9b2d8b55131c25d593d3788b1000540d6ea6241777b84c141e123288c848f486d81c60f393dd46e08f783e07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785540, "uuid": "cb4c0095-a371-4b43-a16d-fd2b06bf59fd", "value": "T1F74319827C81AA39C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785540, "uuid": "ba0a0397-548e-4958-8f78-3fe579793c78", "value": "1536:VX3kcPLAR10ydj/BTLU8GYQ0zYJBb07N5z2yYceZW8eXiM:VnXPLJ0R5z2tcws7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785540, "uuid": "38dd2241-a621-4e18-89b8-1bb53ad71dd5", "value": 60180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785540, "uuid": "ed99ef11-5d37-44a1-8964-e708e2b6c7e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785540, "uuid": "756caa14-9061-44cc-bb96-ea28736a810f", "value": "da6cd860f8e26565f7fdfedb8e902f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c1ad63-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683832189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832189, "uuid": "04424299-cf21-40fd-befe-a1a340d5dd8e", "comment": "Malware payload", "value": "38d6f9627aa965e2498e2be0b157202d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832189, "uuid": "78ab2fb8-5e40-4f0c-995e-95def18599a5", "comment": "Malware payload", "value": "349dbf9109282970719625a4a96694afc15aa4d89d6575627184471c8920678f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832189, "uuid": "b6f83fd2-77d8-45a2-b3f5-1126c761d0aa", "comment": "Malware payload", "value": "c280fb3a15df85f7a1cfd5bbf339e52506800c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832189, "uuid": "ebe3040c-4256-40ab-a6c8-740a01e1bf66", "comment": "Malware payload", "value": "4eacc9eb1da7b57250e417fe87e3273826cc5f8eba4376e8099d146678be3b204318dcbc14539dd41fdec0254a262304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832189, "uuid": "bc663105-a789-4c26-bdeb-1cc30fd1cf33", "value": "T1B5151202F6D1C4B2D1730A325927A721B9BD7D701E38DB1FA398792DCA316819226F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832189, "uuid": "69a77412-7868-4d4b-b67e-91caf7908c9c", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832189, "uuid": "c4a83e76-c2f4-414a-8c55-8760c34ba3d1", "value": "24576:aNA3R5drXJHIUc+kuuUF0MZxQewqJV2XyHYT2+wVxqbgHim:T5+ClVHmkVkl2+wVx3im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832189, "uuid": "7963236c-b4f6-4047-a2b8-d9282fb0f502", "value": 942036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832189, "uuid": "02f323c6-f97f-431e-a90e-5e40529c441f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832189, "uuid": "e039cf78-72f7-4b49-a30d-d717c771b794", "value": "revize_odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6654ed-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832227, "uuid": "255bc3ed-1266-4b83-9765-b84cd70af830", "comment": "Malware payload (AgentTesla)", "value": "2890e8c5716be6b434dd42f71868daa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832227, "uuid": "ff69a4fb-f130-4f35-b7ab-9dd1b89a477b", "comment": "Malware payload (AgentTesla)", "value": "34ecca4a7e5a01eb8382e6695c9478b1906e1874d3922aad852c32716fa05902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832227, "uuid": "4caa151c-a6bc-416b-88d0-82eec1ec2bf6", "comment": "Malware payload (AgentTesla)", "value": "bbb25c5c464052db37d9eeed70ef14df2abf7581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832227, "uuid": "d424d790-0120-4cfd-b0fe-acdc062dd33c", "comment": "Malware payload (AgentTesla)", "value": "767aa36ff4d440b72c0ca2f7ac15b1ba5cde63f9753369c7440fe7fc0388860b803585fbd7fa7c552a885be852583e41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832227, "uuid": "b2b4a82b-b8c6-48e0-b37d-91b0f4b124b5", "value": "T173E4E085437BADD2DA581B70321439534E3DA11B78F8B4FC7C1FB888C99A9215BE4B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832227, "uuid": "1419b0d3-addb-4d34-b355-c84e7896a373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832227, "uuid": "ed0bd577-0882-4c78-8215-bebdd0ed7b96", "value": "12288:O6mNvVeyNsjny8SJvwVThcW9ZWh/Dq+rFp527SN3RqQhRSy9tOH+89UHr+cp4:xmxVeCApSAgh/Dq+rFvbNBqQhRSwOe8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832227, "uuid": "d5e8e406-12b6-40b9-995a-1839314be356", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832227, "uuid": "d0c1814a-919a-489e-9679-2b4fe5a45f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832227, "uuid": "89d2d467-e799-4150-905b-5b64b71ac630", "value": "Lista de embalaje 94367.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21be1d1-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683837067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837067, "uuid": "f4a50a78-6c67-4a7b-8b64-4e99c8f7776d", "comment": "Malware payload", "value": "eef0f98c55e5402b6e5e34337a6f4aaa", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837067, "uuid": "a5f91211-1ede-48c5-a502-ce3389051e74", "comment": "Malware payload", "value": "378d51b2e9ca12be0a270f7ae3c5a4853d7c1a3a82071298750992d8b08998a9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837067, "uuid": "7d3658da-5c8e-4bbe-a726-f4f96eafcb41", "comment": "Malware payload", "value": "b823be7731b7f3f3dd62a0a42a8525e835f4af4c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837067, "uuid": "9072ca4d-9009-4b64-ba52-40868329e64b", "comment": "Malware payload", "value": "ed0d064dea4cc6c8986db532b2d6dfbd8ae29e5a2f2b5d765c53dfdddcb45989f3acbf095e4f0ed40c6ac8aaaf04d0b4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837067, "uuid": "f624b531-639c-491a-bf19-893fb2f11f36", "value": "T14CC423EC64102B9D5B2D6316C6AEB605763776A74020883B64D12F4E47E69EF2CFF138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837067, "uuid": "a4ff3a7b-a845-41d7-8731-7c5f4ad342fa", "value": "12288:24zHhvJemfFcHHKmdnqLRxegA75cR5FdKnDssDdHkFB7Kh:2iHjemcHFGRM79cR5bKDsUdEFYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837067, "uuid": "7b63b35f-1c19-4196-b238-01b235186bd0", "value": 590054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837067, "uuid": "1423d428-9b8f-4008-855b-bc087830e2a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837067, "uuid": "ba8a5ae0-dd93-41ff-86df-9a77dc75b57b", "value": "Download Tracking. Reference_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09c2e9d-f007-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683815133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815133, "uuid": "4f862f2b-5f93-4342-9d2c-e9c7f3113e33", "comment": "Malware payload (Quakbot)", "value": "f06a54b8549fec8b988da37e049fa23e", "object_relation": "md5", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815133, "uuid": "8a818b9d-0702-4273-92e1-808e94fd3a55", "comment": "Malware payload (Quakbot)", "value": "380b8a70cef9604929177aa519ab7f02658648bde02892aa107e123764df8d54", "object_relation": "sha256", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815133, "uuid": "04a6d171-86ca-47be-a63e-30226411bb22", "comment": "Malware payload (Quakbot)", "value": "89f7eb1aea54573834a37c45617848c7ca721a56", "object_relation": "sha1", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815133, "uuid": "d7b1d47c-9fb6-40d2-9b8b-e9e234963973", "comment": "Malware payload (Quakbot)", "value": "60d2c49611e04f6b19d8db25a7f85d9f7986d3ef71a6104070704fc5e73724e5b1a654644354d08560b8cdbcd9d16aca", "object_relation": "sha3-384", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683815133, "uuid": "af6a8a8f-a851-4576-95a0-6d77343e6ba8", "value": "T141D48E22E5E04837D2731A7C9C2BA66C9C3A7D002D68A54A3FE4AD1C5F797903767393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683815133, "uuid": "52b5bb71-4fb0-442c-a7cb-5f815cc47120", "value": "30504a86732cb7421f941c222a93d194", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683815133, "uuid": "a5598a35-7af2-49f6-8df2-0ec6f462421a", "value": "12288:qzbDRgCdJy+vKjt/hp2JIdK6DOAj/di+I/dzAwuFQ5fC:qXVgoy+YdbKh6DOAjVi6wuFQ5fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683815133, "uuid": "09dababf-c148-40ca-b635-be0a3ee91a03", "value": 648915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683815133, "uuid": "6951314b-24bd-4c33-82f1-a7c73e752af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683815133, "uuid": "ec8323d2-b5a7-447b-a25a-111a648fa39d", "value": "beautydomPorrigo.Reargument.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0470a92-f02e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683831937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831937, "uuid": "572a767c-b03a-4158-85a6-ebfa9efe1fc6", "comment": "Malware payload (RedLineStealer)", "value": "f23a74ed290d70abdf4cceab50d6ce38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831937, "uuid": "2a50e633-834c-49ec-9c1c-fb9d2bc53457", "comment": "Malware payload (RedLineStealer)", "value": "38630dd2d7a4fbcba87bd9dfc2d8e7fb70b559aa520879a50697ca0fe4c9bab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831937, "uuid": "17fc9e3a-4d76-4a47-ad7c-5dd9d4598180", "comment": "Malware payload (RedLineStealer)", "value": "0fca5e910ab4b1777e499c17d7fde43487ba081f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831937, "uuid": "f0030940-1356-4ead-a2cd-bfee2e538998", "comment": "Malware payload (RedLineStealer)", "value": "84f3aad623f5cf80e4faac390dde9f8afea3c4da3940c16c9d946df04a8a949412197473c4c1b818ac1a5f2cbf6ae339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831937, "uuid": "0886758f-5d39-4c29-ba9e-565c1a18fc66", "value": "T1AF252302BAE48572E8B50BB048F647C71A3ABDD19C74877F2704599A8CB3764E5B8337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831937, "uuid": "36e63011-a422-423b-aaf1-a5d291c0c037", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831937, "uuid": "f749961d-881d-459b-8b56-554c9d47d10a", "value": "24576:HyYZNPf08lKzanE33hxsSxjMxuBXir1d853:Syls8lRnEnTsSxiup5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683831937, "uuid": "db4f00c7-468a-41ed-8d39-d797a0018863", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683831937, "uuid": "7fc83ad3-67a7-469f-96cd-f0ae88847f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831937, "uuid": "14f7b311-74bd-4067-90b8-73057bbc4e95", "value": "f23a74ed290d70abdf4cceab50d6ce38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbb94da-f030-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683832550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832550, "uuid": "eddcfeb6-1611-456f-97bf-6c677fd549b1", "comment": "Malware payload (njrat)", "value": "76d82b9f91cbdb15698734988de9b6a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832550, "uuid": "97c27e79-69c6-4b1c-a1ad-6ac0cf332641", "comment": "Malware payload (njrat)", "value": "3ac56c0fecec8c29a0d46760d4e1f0b02c7e51976e65ac1a8982c7363bde3e98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832550, "uuid": "12d08e11-d266-4e24-bc38-e6b15783d531", "comment": "Malware payload (njrat)", "value": "fde07d1f3d9f725428c394a27c8c7bfbc0b5f519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832550, "uuid": "e28bcbf0-ae96-48c5-bd8b-5e654d799ada", "comment": "Malware payload (njrat)", "value": "6fd88906608c88f2d6835dc194947b63275eb4b4e736d881a33522fd39d1ecc1d40fb27319732655310b7fb37ea46a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832550, "uuid": "28afb4d4-4c01-423c-9a0a-b8eb2852b90a", "value": "T1F3033A4D7FE18168C5FD157B06B2D4120BBAE14B6E23D90E8EE564AA37735C08F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832550, "uuid": "377f479f-8f3d-4e0d-8b3f-ae60e29ae42e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832550, "uuid": "30957e85-bd0a-48ba-bd7a-8a81d93370bd", "value": "384:HVCKMizd3jnBhFbJ8ycPj93tRwympwrAF+rMRTyN/0L+EcoinblneHQM3epzXVN7:1Cg3lLJfcPj9XNmSrM+rMRa8Nujvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832550, "uuid": "1540d4fa-b597-44d8-9c73-9ddf97f1f7cf", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832550, "uuid": "d13a9a95-e2bc-4659-9558-942fdb49259d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832550, "uuid": "69d612c0-7ff6-4800-bd34-a8623aab8773", "value": "3AC56C0FECEC8C29A0D46760D4E1F0B02C7E51976E65A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b134917-efc8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683787824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787824, "uuid": "83a4df4c-3113-4c7b-b41e-3cbe69d94d88", "comment": "Malware payload (RedLineStealer)", "value": "7136fa717f5da96cc5e4a03f5aef674a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787824, "uuid": "aeafe7c3-6407-4f24-8db5-fae8d4817c21", "comment": "Malware payload (RedLineStealer)", "value": "3be410255c0b945c92f4250353e13ec6aa07577ac89fee71a5a4cbaa4edd20e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787824, "uuid": "d7ad6d4f-0196-4d4a-a7d1-1596c853ed63", "comment": "Malware payload (RedLineStealer)", "value": "430e07b7ee67bfeb964ac0bb5d9a5474ed1cbb38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787824, "uuid": "add0a60a-6049-45df-806f-b8a4bc67634e", "comment": "Malware payload (RedLineStealer)", "value": "18ba032a843adeb12b6dbe3e8190a14e00961c0753684a6529414609df595790130b0e035c78ff9815ada1795635a355", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787824, "uuid": "00cdcbf1-9c66-42c5-ab63-53e8a8e3b68c", "value": "T143F41282B3D840B2D9F427B049F617871A7CBCA14578874B0394A95F58B33A4A673B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787824, "uuid": "b6dee031-7454-481d-8624-a43dfd5b90b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787824, "uuid": "3dd6d837-5292-4f00-804a-6cebfdc99eca", "value": "12288:TMrzy90JprOgnqK/jXBolufexKYOCFa5Ro+OshNJDIeUIqA432OjxuJh:oy0nF/7BolufhCFa5RHObfIq14Jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683787824, "uuid": "08db0eab-5f21-4d61-9550-7252d17bc6ea", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683787824, "uuid": "7e564605-6ebf-4821-a47d-00d7e56d0a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787824, "uuid": "2482507b-e2fc-403f-85d3-520b2221f09b", "value": "7136fa717f5da96cc5e4a03f5aef674a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96fcef0-efc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683785110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785110, "uuid": "824faf3d-55a0-49b5-9f13-2a8b07da4081", "comment": "Malware payload (RedLineStealer)", "value": "3b7c4ed7320cba5b371e4fe611895bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785110, "uuid": "d0904d06-6fc3-4bd1-8d3e-f3bd526439fd", "comment": "Malware payload (RedLineStealer)", "value": "3c11dac0621f47c72e6a68d8530a2be70fa11a2cffc05d04344d49f2b837f3bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785110, "uuid": "e2995106-35e4-401f-bcdb-3024db81d868", "comment": "Malware payload (RedLineStealer)", "value": "73cc126f5d2849b466c9fb8ecc359ec163de63ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785110, "uuid": "756833c9-05e1-4fdd-bc0d-f75306ebc96c", "comment": "Malware payload (RedLineStealer)", "value": "a90987b9b3d045b77ddfe80e91bfdbc1fc349b03fc82ad7f76113cb7c8e8feebf4b2c8ef2cd0c46b276c3d25b462c12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785110, "uuid": "96eaa2a7-2e2b-41da-b0f9-83d27b324de9", "value": "T16A747E1392E13E56E62A8B72CF3FC6F8761EF1548F597B6622289A1F06B01B1C173750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785110, "uuid": "cf2093a6-4748-4422-8ecb-d27cecec4443", "value": "5b5b32ca901545df58f1a75cd0391736", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785110, "uuid": "802b7848-5596-4896-8fe8-03a999469ab6", "value": "6144:KkjOiL1xWjICFwoed6BkAkr586fVdRO8W5U9xlAJ/L:KqOiji3eAkFdEd/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785110, "uuid": "0c81c5f3-99ed-48f4-81ae-7f13404c5480", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785110, "uuid": "852fb00d-75fc-4722-bd26-7058fcd28e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785110, "uuid": "49c645fb-4c23-4993-9814-551dfca209ce", "value": "3b7c4ed7320cba5b371e4fe611895bd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763f508b-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683829209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829209, "uuid": "1459cd8d-ca19-4c6f-9a63-2258e6604dba", "comment": "Malware payload (AgentTesla)", "value": "f06d37d2a8f957cc2d8ae40de5f77cec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829209, "uuid": "d5945032-d8d0-47bc-a4dc-dec9198c9382", "comment": "Malware payload (AgentTesla)", "value": "3c402f83ae81af1a60c8d6c14e35bd466ae54f2b97e25c36df7be898e46736e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829209, "uuid": "2e1b8fe1-7e89-407d-aa39-34aadae80c70", "comment": "Malware payload (AgentTesla)", "value": "1eda84366d33f7516e5890d2251d128510445b0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829209, "uuid": "5e68d95c-d4d6-48d9-a8ea-a7ae0fbe08d0", "comment": "Malware payload (AgentTesla)", "value": "49d9273e341915a3a6d4ba00a27465dcecf6b2ef2db0e98863716428cae9ee5a5bdd52b1eabc7dea5a65f61f90e2af53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829209, "uuid": "2d59f183-8706-40f3-aa14-4e06e3da525e", "value": "T153D4E15582B88B01CE6C1BFE4C93C6851AF49A75BC29E9311FC764CD9D7392F24482EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829209, "uuid": "ff509643-9cd6-45d7-bf7f-d1b0bde9ca08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829209, "uuid": "522fa017-be85-4969-8977-5a499e544433", "value": "12288:gcAwhh2Y4YBunCq5Qe/ezRYEtHbUVgpkkiP8XjBu/GQ:Uwhh2YuVmzRH72gaEs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829209, "uuid": "bff582b9-ce86-441d-bf6d-de4711dc352a", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829209, "uuid": "a3ff6ef9-d245-45cd-8814-db40adc1a8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829209, "uuid": "ac014dfd-4bbd-4942-a3aa-56f9ea670d20", "value": "z916AiYzNdvPyIi9jj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae03919a-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683785923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "fe34e1ca-29e2-4ee2-b2b9-f033a4c36264", "comment": "Malware payload (RedLineStealer)", "value": "ce9ff0f9cc8b7059f4cad8def9eba128", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "f349d57f-e0db-4f87-b9df-aff8857ae179", "comment": "Malware payload (RedLineStealer)", "value": "3c5a7b5464443501aa99ce3540c6cba4e6640080c20ca3a85566fefe03b085b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "7c64d0a2-ac4e-466b-8488-94d536ac735f", "comment": "Malware payload (RedLineStealer)", "value": "97836bbb55d236169164849ff99ef8e359925d03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "a944c172-4241-4de6-9109-fba5bf246497", "comment": "Malware payload (RedLineStealer)", "value": "112a09e6246d4d67a0901a8e5f5b7cef8b374148ebe2c4f529ce8f8d0cb6e01d94fd03b33138b19eceb94700afd2f6c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "6c7aa022-1c76-4279-98f0-fcb96460b5be", "value": "T1BBF42341EDF88423F9B9777098FA0B971A3A3CA169B4932B6350AC1F6CB31C47471766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "31949b3a-2ae1-4151-930d-83584049ca27", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "9358ca44-9c69-4877-a0e0-fc7b037d2a1f", "value": "12288:6MrAy90yLqRRGrROKmuawDzjuWsspbyACwPnafsnei7iRIpiBPbzOst1O:uyxqRaRxmmDWWBTCwPnJnee0wqTz/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785923, "uuid": "d4d03b83-db8a-4637-83e2-1cd663d4c661", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785923, "uuid": "e3b11bd6-d0cc-4d87-915f-983340491df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "053f4c23-c874-4ff3-85c2-5bf8434e993f", "value": "ce9ff0f9cc8b7059f4cad8def9eba128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37a8f54-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828989, "uuid": "ddb31437-0ee1-4fa2-9557-b10c4aee8381", "comment": "Malware payload (Mirai)", "value": "b04006ab3ff6587396ee91d13ca52f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828989, "uuid": "97debd4f-3fe5-4db2-9454-e70c3a3eb47e", "comment": "Malware payload (Mirai)", "value": "3d4c54e873e9ab5804d5c7a405640a1220307ce6119485701b981d8e28f4adf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828989, "uuid": "b20b7c85-0c54-47b2-9165-58b3753cb1d4", "comment": "Malware payload (Mirai)", "value": "75a535373bcf3f4772846cb971e12c62d03af95b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828989, "uuid": "c4c34e3b-0201-496f-8ecc-b69ea4a0915f", "comment": "Malware payload (Mirai)", "value": "0acc8d7f5228b61bf4f420d2b8b85a7027bfefda3d7b3bfafc27e11bb9e10238d6e9585fb3d9b8194b42064d75dd8b67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828989, "uuid": "3ed182d3-c066-40f0-97a4-6e98f3e4d873", "value": "T1DAC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828989, "uuid": "240a0996-e4b8-4154-9680-e09a837300bb", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBelEdaAW/GrmW+IR:Ted0W0MZQHxdaAW/GrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828989, "uuid": "e7e68980-ad2c-40e9-84f9-00a03c78dd5a", "value": 125959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828989, "uuid": "6b68d147-467c-4e01-9b81-fcae8f2f3422", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828989, "uuid": "f69f4418-a611-45b2-a0f1-e821c56cab6c", "value": "b04006ab3ff6587396ee91d13ca52f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947d2d29-efbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683782874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782874, "uuid": "7d98dade-8118-4a49-b681-b558f780d3a7", "comment": "Malware payload", "value": "f032e51a1dabc0f84ee00623ba77837c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782874, "uuid": "57502e46-241e-483b-94b1-7d4202b145af", "comment": "Malware payload", "value": "3d8a3a50bea9cb76347fb4e10a406ba60a7ccd6e591326ca656d393282d1a3a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782874, "uuid": "2fa92287-5b7f-40cf-a2b4-09fc970c61f9", "comment": "Malware payload", "value": "2800224f61e8ed800c133616e98d234b6b48fdb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782874, "uuid": "58ce61c1-51e5-4073-9c3b-48f894d49d70", "comment": "Malware payload", "value": "e167ae36d8064982e8c54550b4a5f48297deed7208ec502f89815afb3cb581692a164269581c0dcc177d8d4320499438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782874, "uuid": "918b9169-6e72-4114-a170-138ff1ef87f4", "value": "T1BA056B827E8ACB71E354A1309572C7BE26216DF44BD186C37274791B7A323B2B63534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782874, "uuid": "7ba95e71-3fb2-41d5-806f-4cbbd39e7d29", "value": "a9b8f84ed7e3b395834ca51370b2661f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782874, "uuid": "24a160ee-dea9-4b13-83c3-a8b1f67ab5bc", "value": "12288:yB/DCfc9EMrUIWSdSBDh7Op4QP2QVbf1xk9IrENzgd:m/DYhIWSd6Dcp4kzkCIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683782874, "uuid": "5aa699aa-bc01-44d0-b1d3-0e20be321ad8", "value": 874480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683782874, "uuid": "6410dcab-1110-421c-b126-5e9e51dbc42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782874, "uuid": "8bb0a420-e28d-4351-9ca5-0f47d9e60e4f", "value": "SecuriteInfo.com.SPYW_KEYLOGGER.4297.23770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7f4402-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683837088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837088, "uuid": "e501062e-738b-4fae-a6da-5913f794684d", "comment": "Malware payload (SnakeKeylogger)", "value": "6108af13ed1f0088ef83770f45a4f7fa", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837088, "uuid": "05b4d7f7-9d57-458e-b721-9ba897291224", "comment": "Malware payload (SnakeKeylogger)", "value": "3dcc309f4fab91164d99cdbd1b528e1c0ed77626ca5ce74e36ec599c39131e09", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837088, "uuid": "41630aa7-760f-4511-8cd4-163a58da6e69", "comment": "Malware payload (SnakeKeylogger)", "value": "d568e95561a8159d1c345dae2e3a7976a33d0c3f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837088, "uuid": "1791d35b-91d4-44df-ba85-df3dac911322", "comment": "Malware payload (SnakeKeylogger)", "value": "bf30fff427f413dde537afd88bccebd88474cc1849627a0a28b5389f2a7384ff61459a39749850e08419e91cb17c9deb", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837088, "uuid": "447e64da-8fee-4ccb-a660-11924831d17c", "value": "T19CA4237D870FB09D84A3FDDD217EA6F9F1404155C4542CDCAA1E8470EF918ED899EE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837088, "uuid": "3030ec0c-e804-4ac7-ab9b-ae0f37ae0653", "value": "12288:uDpmNm3lvMk44cFTGA9pn5+qVnXh+7P5RdBX3:yYNm3lkkuTGy5rnxmB13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837088, "uuid": "d60ebb76-7899-4901-aa31-986063ffc55a", "value": 474961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837088, "uuid": "fe974b8a-cd92-468b-9166-346197816c89", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837088, "uuid": "830fbdc5-6093-465c-933e-be9f4769a4fa", "value": "ticari fatura.bz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c52800a-f022-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683826534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826534, "uuid": "488f14ca-2521-4167-98a1-a31faf21f875", "comment": "Malware payload (Amadey)", "value": "0890ea1a2d5530be2b51bbe17e345808", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826534, "uuid": "91eab54c-2b32-46c0-9842-11f834de5590", "comment": "Malware payload (Amadey)", "value": "40bdc5c0b9dd9d1def9423ef3823d5d92f45129cec3084adda88026eb482d80c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826534, "uuid": "1a4fc7a1-7843-4223-bf69-33a49f1b0474", "comment": "Malware payload (Amadey)", "value": "1e5beade72594627751645157d19a9b2a9b238a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826534, "uuid": "c6630123-a092-43da-85f4-b56d71f8db26", "comment": "Malware payload (Amadey)", "value": "99d73f2afdbf484feb3a88ba4939be5dae18439bef9dac91a267d9fe7749a7b90591bb8e1d16b88c15e9f88d6f0d96e3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826534, "uuid": "39a178f2-ac3c-48f5-81d2-b1c8a7b8c1ce", "value": "T1DD151242E6E501B2D8B61BB055F702A30B7EBD929A74862F7745481B0DF3294F93372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826534, "uuid": "ccdf2058-fc84-4e8d-b1c0-b610c1e3bd10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826534, "uuid": "feecf657-ae45-4b4f-b8b5-cd539bfbb944", "value": "24576:mw5vPex1emK6qaK6qaK6qaKXH3nXH3nXH3nXH3nwgQAwgQAwgQAwOyN4kteOSxB5:8NXeXxSXx9eGv/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683826534, "uuid": "30dba87e-6449-4cfd-8ea0-36b97323691a", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683826534, "uuid": "3c684ef5-5582-48e1-b5a0-1197686b407d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826534, "uuid": "faae833c-f1cf-4a5b-b15e-88a57f65718f", "value": "0890ea1a2d5530be2b51bbe17e345808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfe6a9e-f019-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683822642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822642, "uuid": "266df619-b967-4069-a328-db12de7e23bc", "comment": "Malware payload (RedLineStealer)", "value": "17e059b21c59de0a03b88fe4d307d855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822642, "uuid": "10a97fd2-1f44-441b-adc3-aeb836265dfc", "comment": "Malware payload (RedLineStealer)", "value": "40cd6ce9a780da2bf98d5c80a40557104b213690d4357f2cd5691772038c6b3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822642, "uuid": "beedbe08-67fc-4eff-a57a-fd3294dd205b", "comment": "Malware payload (RedLineStealer)", "value": "909a830721a39e4fe727bb646542b80123019259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822642, "uuid": "8bcb34ae-1dec-4902-b9a4-f61bff065057", "comment": "Malware payload (RedLineStealer)", "value": "e0d4cf8070958dfff081729beb441547f680e9193edde8ec9ed8264688874e7ac6f38ea2239cf4660215f436dbd4c6f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822642, "uuid": "f0282484-e4c2-4c1f-8ef0-d3b00ee56fcc", "value": "T15594C01272E0B972E6220B718E1AC7FC3A2EFC914F5526EB2B156A1F09706F1C572717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822642, "uuid": "0615aa73-aedc-4b79-8d63-2900b6f563bb", "value": "00bbabcc49bda3cf5b939545bfd2c2f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822642, "uuid": "9df33271-a5f4-45da-a6a1-88193d870bc6", "value": "6144:fFKNRvQhmwAywg2AQ+GiV6FjROeUPTvqH6veOke1qn6p49TL:dWvQhqyR28DIROeCbGLZ64L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683822642, "uuid": "e6b5a2c4-2abd-400b-bee6-88d9959f4ff9", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683822642, "uuid": "b2b062c5-f614-447d-8160-6dca956cfc51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822642, "uuid": "ac44bcc3-b92e-410b-9cff-352133a91bf9", "value": "17e059b21c59de0a03b88fe4d307d855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea4fddb-f032-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1683833732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833732, "uuid": "7df88df5-dd9a-470f-bb47-41f760f5eaad", "comment": "Malware payload (MassLogger)", "value": "d5445d98bdbd8a339bcafe31aa223d9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833732, "uuid": "4b749195-dbc1-4460-8fab-ca683847437d", "comment": "Malware payload (MassLogger)", "value": "413ec94d35627af97c57c6482630e6b2bb299eebf164e187ea7df0a0eb80ecc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833732, "uuid": "3f7c9f83-3d32-40cc-9418-5258b88b2a7e", "comment": "Malware payload (MassLogger)", "value": "c4036c0b438de8cf23fee5bcc564edc186b954db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833732, "uuid": "22addb00-b5c2-4dce-be71-0395d75d998d", "comment": "Malware payload (MassLogger)", "value": "af3c9a6531c7914ffa8d61f66bc036e50f47265fb967ee9c548406f837a09af8421b2e163fe438d308b4fbbe6cfe0bcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833732, "uuid": "f5c6ee1d-59e7-4b1a-9aac-e807a72c3e12", "value": "T1B334E00433FC4541E6BA6F7E69B492E10B36BD174E75E78D4D8934CD28E1B060AA3B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833732, "uuid": "a05242e0-75e2-405f-abdf-42c944971bd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833732, "uuid": "c559ef2f-a2b6-4dc9-8850-7b022afa5313", "value": "6144:X1XQakQjeFxbIBMPL3mtdKWYNRB4vF8VdTcNjj1xmauq:FXQawbB2t4WYXBD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833732, "uuid": "0bc69d83-d048-4fbd-8abc-66dad1e5759b", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833732, "uuid": "daf5cc57-1936-4618-bd24-bac78cda8137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833732, "uuid": "32ae1a2b-1221-4710-9539-21bd2b8b37db", "value": "d5445d98bdbd8a339bcafe31aa223d9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bd918a-efb4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683779200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779200, "uuid": "c195b992-fe34-4a0e-8a62-17e61563366d", "comment": "Malware payload", "value": "5c4deee739545d41beb252a155bb0b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779200, "uuid": "201f5471-038c-49ae-8051-e44ddf1ea899", "comment": "Malware payload", "value": "41f7182635bb4a6580fdc069816e0c6316f7ff2c449636798c1972373838a988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779200, "uuid": "b170c951-5a5d-4e57-a4ce-7886862ce77d", "comment": "Malware payload", "value": "7a88e35adf637a4b01600264350b8f35f9ae2f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779200, "uuid": "8752f451-6094-4c19-9553-0b7129a0fbd5", "comment": "Malware payload", "value": "2feeee766471ce58cbc62d1a91ad78b4188a83ebf2813cdb8171e78db975de22249a541009487f8b4119486cca0c50d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779200, "uuid": "43da8e98-1625-4b85-be09-e6570e23370e", "value": "T1C063016B77B1AAA9CA245D39874EC555381EBE3123D201733BD23E871E8F3F55928006", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779200, "uuid": "6538c11e-640f-4490-93aa-df26f3c43638", "value": "f9e5a68b669afa510c892e365af0f823", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779200, "uuid": "6946ebad-5eaf-41a3-9c21-de6f1affc5ed", "value": "1536:v6d+1W/kIXaUgNelU9OoYXwxbaUOGSkP+D3QKyK9VDAKFHn/a7jR:ScWMQaJ4IYXwxmUOGGyIVDjH/UjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683779200, "uuid": "31afe72b-f377-4b9a-b1ee-e030bfb8d4b3", "value": 71168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683779200, "uuid": "89a048c4-d73a-401c-ac2f-67b30065dde1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779200, "uuid": "47dc6fb1-26d9-4cba-840e-3ff534f09f29", "value": "SecuriteInfo.com.Trojan-Ransom.Mbro.1046.20431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44a7d4c-f034-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683834520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834520, "uuid": "a884149d-a6b6-4c60-8d2c-fa211b654236", "comment": "Malware payload", "value": "83cf0c73eb14f8c9ec825c0032156bb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834520, "uuid": "936dc26b-7074-40f8-a4fd-3a79488cbb7c", "comment": "Malware payload", "value": "42c37fbe3746791531befd9a80d8693d010965b0586f0c380b8a4b87ddcb87a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834520, "uuid": "6863a0c9-3dbd-4281-8214-f99ce7e12213", "comment": "Malware payload", "value": "7664ddd12537aa95bb7513b0c2afd0bd4a93e7de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834520, "uuid": "f1a3a4c5-2a9e-4ab4-a5dc-f55ac6b9070b", "comment": "Malware payload", "value": "9217586bcd669fb403e0c1077eb97530375370fb0647b300d5330fd7ccf6a113fce9540eab1cbc2320bf0c9e53ec5865", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834520, "uuid": "bfb32263-5f4f-4c6c-a524-1c1f03cd66eb", "value": "T1E3C412953B64C43FDAC25A7695A2B62B4A7D6D74346043132B987F0D3F3E4C0998E7A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834520, "uuid": "b38d9eea-36ee-408e-8c79-24b83a77aad5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834520, "uuid": "e1ae343f-1130-4248-be4c-3516a9eda39c", "value": "12288:K7YaMPI+XCGRhZFhysixyptNQKf4sP90Zd8f2LhxHC:1myRhxViYbAs6ZLLhNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834520, "uuid": "9e92e97d-1da2-4bce-882e-53cc5cc9e640", "value": 567623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834520, "uuid": "f78558de-d05b-490d-8dca-5f3a37f53740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834520, "uuid": "b24b34ab-b5da-45e7-a4b7-31d74fbbb906", "value": "42c37fbe3746791531befd9a80d8693d010965b0586f0c380b8a4b87ddcb87a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdae60a0-efc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785547, "uuid": "829ff5e7-c6e7-40b7-a275-48c06787144e", "comment": "Malware payload (Mirai)", "value": "0e81adc26eb2c1430cc3ebc79bb235a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785547, "uuid": "8a71c24c-62a7-4840-8a81-8879ad643d91", "comment": "Malware payload (Mirai)", "value": "43761ccbbed7e18574587b9d9f6b44195a0d7404e7a1a497855e34653b3de9f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785547, "uuid": "53234c7c-d5f4-41b8-abfa-717d4a626a31", "comment": "Malware payload (Mirai)", "value": "1bda53d88fdbc21ab0ed77221f48ba36193fd7b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785547, "uuid": "1ef12a57-6b8d-4866-b755-3b55f28a1cd0", "comment": "Malware payload (Mirai)", "value": "9b8664ca4af389ba0f7c89ffa4633bd05bc977d7004359f0872b717041aa3595004b7ef63a7309bf03ccf7bf38520c33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785547, "uuid": "476831b2-68cb-46e7-b994-8e4afaff9cc0", "value": "T108D33B86EA408E13C0D51B77FAEF41493322D755E3DB73068D189BB43F86A9E4E23649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785547, "uuid": "4e5e1a94-9b59-4410-914a-267ced3f2b55", "value": "3072:QybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8Jyve4hL5AJI4+3jJNx138:DbUEGniGQYtOR7aPk9mrsplDKZUmQBK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785547, "uuid": "34f2d9c3-7ba3-4456-a383-2a19bbaaea6f", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785547, "uuid": "30d11207-454c-4457-9af4-e276079ba4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785547, "uuid": "dafa22bf-f8b2-4aa5-8eb0-43098e8165fe", "value": "0e81adc26eb2c1430cc3ebc79bb235a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17096d2f-effd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683810581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810581, "uuid": "0113c111-1091-48db-b8ef-697c500aa89e", "comment": "Malware payload (AgentTesla)", "value": "5d9398a517bd82cb6b56951e017cb11c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810581, "uuid": "a7c9bbd5-6156-4e62-97f6-ba1e60f914fb", "comment": "Malware payload (AgentTesla)", "value": "43b2d95b4ca603f5007a2d5a389b02d19df2103077146ba3aef9fbd82f2e0770", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810581, "uuid": "c908b969-daff-48a8-bfe8-97e33eff9123", "comment": "Malware payload (AgentTesla)", "value": "66cd486a73d5678cc5e74c39d3bcc7e9baab6153", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810581, "uuid": "e0765e16-80bf-4c90-a31a-00f9e87c5627", "comment": "Malware payload (AgentTesla)", "value": "fa34408f0cd3efc079294f7967010356e114069afd920c45c0fd03d437e926d83a6477ad69e9a4ef200be100a5980f70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810581, "uuid": "086a38a6-57c2-4581-8bcf-6b218f2d904a", "value": "T1AE05BF45223BABE1D42903F1628929B2873C9C1734B8F47D7D273CCA96B5B444BD4E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810581, "uuid": "64f5d496-67f6-4eee-9178-4b79d1dcd393", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810581, "uuid": "1e0ebcc4-f275-4722-af90-804d2c61382a", "value": "12288:uqUxmYJCM/BSSfq/N6XL8PEFF7B448Xk1RtI4/VOcRmXqsksSgWiE9Y:oxmYDDCqocFF7uSRqbQaq7n9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683810581, "uuid": "da590cf8-b889-49ff-98f3-b8767d0c82eb", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683810581, "uuid": "d2ba7731-159b-4d15-a298-8dc11b5e6464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810581, "uuid": "5b3886c8-c582-4424-a89b-506b30df26f2", "value": "Invoice for Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7948bc3c-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784546, "uuid": "a4499d7c-2eb4-477b-a861-ac7569d6f13c", "comment": "Malware payload (Mirai)", "value": "9acd1137de88131a604bf21615e3c329", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784546, "uuid": "c4900a12-8f42-439b-bae0-ae7025dbae43", "comment": "Malware payload (Mirai)", "value": "4412c3c7b748705f878f1fa3680d95627ff4b8c2c60efb6adb5a87e743de82ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784546, "uuid": "a5b26fdb-77f3-4f42-948e-bafea02ddaf7", "comment": "Malware payload (Mirai)", "value": "89c849faea3ef181ca459fd1eedc2ef83bf29e01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784546, "uuid": "2d79451c-b8a4-4358-948e-513926803c72", "comment": "Malware payload (Mirai)", "value": "a7dcd438985edd8baaaf9a496f300cfcc53802081f64d54827e1684dc1edda209e0ccd813db9fbee2f8e0743faa28d46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784546, "uuid": "ecf0794e-fca7-4c73-b797-3f5889b54050", "value": "T101336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784546, "uuid": "ab0d98e8-16d6-4d53-b9ad-cda93eb41655", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784546, "uuid": "00ec5fa1-7bc1-4b1e-8eb5-1b4e7ae133d3", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784546, "uuid": "82c4ac43-9657-4a96-aa0b-5c8dbe48de77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784546, "uuid": "48a4195b-7dd4-4366-bbb3-4aebcd469f0d", "value": "9acd1137de88131a604bf21615e3c329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d9947a-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683832293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832293, "uuid": "f587a5e1-131b-423d-a112-cc1629a309b3", "comment": "Malware payload", "value": "a5f10a04e803606e86f6a486bfa1d2f5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832293, "uuid": "8d37786a-a776-4d0b-8312-9b428294bd11", "comment": "Malware payload", "value": "443131e7ebed699db77021a4e580f1a64d9ae67ed71f03340df7deb42b738777", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832293, "uuid": "564a730f-228d-497d-8454-e15cb11b8380", "comment": "Malware payload", "value": "04214403ada3f8e1a43644de1d5fc1657931dc0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832293, "uuid": "395e8ed9-b461-40c8-844d-a4e14bff850a", "comment": "Malware payload", "value": "097c28206e75f50acb7c323942bdb0c8ff95eef553e978887140a022d2bf54513142925a5806d39adf5efb37f391bb28", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832293, "uuid": "6e250a7f-4e7e-48b6-a132-36a4f26d0652", "value": "T14BC28C9C56D371914657F03E677FCC4AB264092B48989D1BB91DB210FF9A43CCBF09A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832293, "uuid": "ab7e777d-3165-482f-a863-baab1f83d998", "value": "384:RExUH3l2IRAfmUuT/sZrSxydXwk82ZdaNXRxEWT4Xdw:SxO7R1UuzstgydXYS/WTq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832293, "uuid": "9e60596e-17c9-4505-bf71-bb0d66dfe305", "value": 25871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832293, "uuid": "4c177d6b-bf5e-4a31-b622-8184e41d3fa3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832293, "uuid": "0e50d523-4b65-49b3-9a9a-dada1729ab1b", "value": "Stripe_invoice_payment_verification_required_74007.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f70096-f032-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683833444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833444, "uuid": "4a90504e-7ce4-462c-abe2-b2c8eadf19ce", "comment": "Malware payload (RedLineStealer)", "value": "8b13d8ce8507b2492aa1106a4f470b4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833444, "uuid": "d54e4dad-bb0f-4870-ba7e-d5850fde2cb2", "comment": "Malware payload (RedLineStealer)", "value": "4553d57cf419bf15f2e867b3269580925c9b0e56c8d2f487007b3a0e80fb4da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833444, "uuid": "b2cbd871-3cc4-490f-9546-348080a3f478", "comment": "Malware payload (RedLineStealer)", "value": "e1186362155c91c3eac8fcf98c297e3cabf43ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833444, "uuid": "3262af73-8efb-4d6e-b0ba-566f2b729ffd", "comment": "Malware payload (RedLineStealer)", "value": "3756e081cf1af2d773dfb1b020b0867b49ca43322ee271906ff426653c5ec7082073dc77dbc318733da878de74962f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833444, "uuid": "3a32e245-b451-4f6d-919a-d3cc31151fbc", "value": "T1BA64F80382E1FDC5FA264B729F2FC6E8B69EF2508F59776912189A1F44B10B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833444, "uuid": "90b0fd66-e2a6-4927-ab29-31df6032ee5a", "value": "e0ad233aaf9ebf0d2e326ac5df912cc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833444, "uuid": "5e6c830a-ac98-4ea0-a150-4112e42f7cd6", "value": "6144:sO9OY5LD2pjm1s44OTxZ247X6tWmPCYBpLyv:sOBkjmlTbgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833444, "uuid": "c1845485-555c-4bbe-b9f5-8245f511ee54", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833444, "uuid": "14060e49-da16-41ee-b0fb-0c77f348e71e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833444, "uuid": "3ab901a0-ab82-4c4a-88d2-f553daf5a74f", "value": "8b13d8ce8507b2492aa1106a4f470b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54261947-f035-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1683834735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834735, "uuid": "1bd53fac-699e-47c7-9b0f-12262c9bc69b", "comment": "Malware payload (MassLogger)", "value": "3a6d1f39ce919d000786bc0f22ab54ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834735, "uuid": "d65578ea-91c1-4451-a7d1-b45736a5e41e", "comment": "Malware payload (MassLogger)", "value": "4556dc1844933bbebcdc2b4753ec1596d637082b7016a0362657e3f1ce95038d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834735, "uuid": "574e0820-1039-43f4-98d6-ff97674d02bd", "comment": "Malware payload (MassLogger)", "value": "41b76fee58f22a5e2b84417ef1bf7a3a2382b585", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834735, "uuid": "e3435b50-a0cc-47ff-9ef8-808156a711aa", "comment": "Malware payload (MassLogger)", "value": "ce2f21f091cd92206af18684a629ad1d183972db60d8a610421851b388cb4ec7aba2ca849fa1b6521614831b7d928e7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834735, "uuid": "24239824-ffee-49ea-a957-ce43dde9f941", "value": "T167D4010823FC0440F2BABF76697451674B767E176871DE4D8A8E798D2E31F812921B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834735, "uuid": "8ba55bc6-9dbe-4829-9a58-409f5e37e8e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834735, "uuid": "ba99927d-f954-4425-82da-fa3461ecc108", "value": "12288:5feeXfZdfrXg+JwuKt/S/60bbBc3qB+yPiDmo:vfw+Jwz/S/6ebUqBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834735, "uuid": "58a574e8-4c98-4164-867a-273618bb49d0", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834735, "uuid": "2664e0b7-c1ac-424e-b2de-8f5c3d8f9ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834735, "uuid": "189a6a9c-6c24-4f67-9087-c11745b21e1e", "value": "3a6d1f39ce919d000786bc0f22ab54ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c165bf3-efbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783987, "uuid": "2267fd29-5019-4f91-af77-bee0578266f6", "comment": "Malware payload (Mirai)", "value": "9a7fed775d652fb086f8e74c3a7fd571", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783987, "uuid": "037f17bb-c6a0-4719-b960-dd62f9b00127", "comment": "Malware payload (Mirai)", "value": "45995d8bc37a7ec0fc6da8541f4492501d052f16a7dbb09dac3804698b83bb78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783987, "uuid": "3f32c038-cf5a-47fb-becf-5992d9420148", "comment": "Malware payload (Mirai)", "value": "eb1ecd7a98287d87c90c9e993cbb3e4999cc6bce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783987, "uuid": "b2304cf3-054b-49c8-ae54-b672fcd441fa", "comment": "Malware payload (Mirai)", "value": "a2c9a3329d9567a513decffd03b117d60ab5370f7bf67c0141375e2c9c2b7dc08aad059b830b12dc5f1601f72cd7f87d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783987, "uuid": "86dde8d2-72ff-4acb-a999-dc7c0d0829a0", "value": "T17C33198964112E6DEAD65CFD90624F0EDD505220B4A3171FA3AFFDC33933369EE62909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783987, "uuid": "7978aadc-5b53-48e2-8519-840df6b1ba8c", "value": "768:IxbcHPaxvlCsasYaMKdaeOwdmmQXy6oWq3GvM7AGZ7OjUQy+f1prR4jHZqBQeW8:YcHIvwsjYaMKIAhR8s7OjUDg1pt4Nqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783987, "uuid": "5dcda360-7463-4ffb-bc61-fa57e9025936", "value": 52960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783987, "uuid": "340c2b0b-51fd-4721-8e97-34ebf2b1a8bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783987, "uuid": "b980f192-32dd-4d41-9a6d-eae49bd104b2", "value": "9a7fed775d652fb086f8e74c3a7fd571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb784717-f015-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683821272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821272, "uuid": "4897472b-fc57-4b8f-9362-98d402865131", "comment": "Malware payload", "value": "480498df93151b7a2d64e5a810d3fd4d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821272, "uuid": "da1c4457-f2b3-472c-afba-c7683eeaf6a6", "comment": "Malware payload", "value": "45f05fe75b446a82ce998424b9c3bc8d32659c9fc2e922241a75b93d0d7ccb9a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821272, "uuid": "7644775f-3ec9-4a0d-98a1-e54e5ef0b991", "comment": "Malware payload", "value": "d531e4565ce75c897fb51489ae4774b37290bb83", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821272, "uuid": "c1a3e418-d60d-4f96-8707-1cd5cda0e177", "comment": "Malware payload", "value": "057182aa89c17ce5c4c4a58ab01f4efda4602f01f472e5b84b66157a56b501c6dff833a017f6bb3c0e746417132504b8", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821272, "uuid": "a62672e7-3f4b-47c8-9f72-d03d5c47a582", "value": "T15254EF137014CE93E096CBF13F97ADCA1B0ABF159982B5DB2080778F7F35681589A61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821272, "uuid": "1addf6af-5044-481c-a3f7-732dc77f130a", "value": "6144:oWoaFJkKXiDU7w5al+5wZTTB0TjyZ1UJT/ppJIB63LH+a0zSehY9:oWoaFiKXK1gnB0aEDpH3Lea0zSWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683821272, "uuid": "cbca6543-1266-4fe1-8ad0-dce353cb8bf6", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683821272, "uuid": "4d843730-47b3-4363-bf51-20c5d4ea2954", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821272, "uuid": "767466af-4fb7-4ea6-bc71-884e1227725b", "value": "T-124.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7e7989-efbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683782649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782649, "uuid": "ef90f903-a590-44ac-ae13-ef9de0b35b0c", "comment": "Malware payload (RedLineStealer)", "value": "2b2e4f7f77558c4454b7a637d53b95fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782649, "uuid": "c6f7927e-f91e-4a51-9f75-021a0e944f6b", "comment": "Malware payload (RedLineStealer)", "value": "47d722ff0a32f43c913b082ab5d6554b86a3b2908ef16581135b9c712c5f4001", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782649, "uuid": "1af699b2-95ee-468c-8c49-fe6d555d1d51", "comment": "Malware payload (RedLineStealer)", "value": "49dc8594b2fe13a417b3d023dbdaf0f3c4d41a67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782649, "uuid": "50ac6cb5-9188-42b0-9cd5-67de607fb7e4", "comment": "Malware payload (RedLineStealer)", "value": "64eafbc6064edb64719bbae77d94640efed4a42ca7ca3c982e1db59d0ac694d66f7b0ec9984465ed53ced0883bd55b38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782649, "uuid": "919c92ef-c56c-4b1b-8bb1-4d32e156db4c", "value": "T17DF42256E6E89033C5B93B7414FB07930739BEE6597847632790A9AB0CB36C4E431B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782649, "uuid": "5d8fd9e1-b7c6-47d4-9640-daa268b1fe7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782649, "uuid": "51f1689d-1fdb-49bf-9c51-31a9c20ad315", "value": "12288:SMrhy90OnmrC0vFdhqgbzuRtNR0m/srGg92apOpL9MD0fW7OWFyH2/nc2n7tGBn:Py4CidhqgUWDF93kMDzZyYnqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683782649, "uuid": "646779b1-67e1-4c0d-96a5-9a593c638233", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683782649, "uuid": "853572c8-0159-4b04-b1f8-f6fe34ec1d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782649, "uuid": "4d5c259c-a2bc-4031-8418-1af3a6ecadc3", "value": "2b2e4f7f77558c4454b7a637d53b95fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41cf06c-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683830279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830279, "uuid": "e31236e6-6e1d-4fee-af82-0a2958ceb047", "comment": "Malware payload (Formbook)", "value": "021d3d2be41af980c190c66d03a5be71", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830279, "uuid": "20312599-8c88-4bfe-a6b2-6789073fe9f2", "comment": "Malware payload (Formbook)", "value": "4926f071c3832ea3d8a954bf180df60514f7c2926973fd852fa01438f1f5e452", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830279, "uuid": "37287ad7-3826-4097-95bb-0bddf28e85bb", "comment": "Malware payload (Formbook)", "value": "ab801dfb90985c339bddfb042c6acda304f3fd15", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830279, "uuid": "88f6ba39-2065-489e-ab21-1842e4a7f1d3", "comment": "Malware payload (Formbook)", "value": "30b1f0423b546c5c22ef2f0acee5f085c2214347b9f5c469776bc62415387c07dcb4071cc1ec677e3d30a9da6eda6096", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830279, "uuid": "1224d5b1-ea11-4eb1-aef1-94ddd4bf5da9", "value": "T16E350103A58C8E8AE18147FA7B63B89D434DBF3271C570C63A5C734BAB31EBA455B509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830279, "uuid": "069264de-0560-4ee8-91b1-264f75f13506", "value": "24576:jLKeVWQmmav30x0WJWQmmav30xk/d+MXUI+MXUGgkccXFvFeWD2r5Rh8:jLKeUQmmQ30sQmmQ30A+MX3+MXPtteW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830279, "uuid": "98db36a7-c896-4070-919a-32dd9905b54a", "value": 1083392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830279, "uuid": "795bcc4c-e7f0-4987-9ee1-4cce0817efaa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830279, "uuid": "1f660052-f9a0-4676-bc88-e3a80fec5a65", "value": "GLTRCORE Cotizaci\u00f3n.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313048a2-efbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783996, "uuid": "2d0cc168-25c4-4e83-8986-37e995594796", "comment": "Malware payload (Mirai)", "value": "1a93007e24b4501fe78c0ac7f0a5be6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783996, "uuid": "e65121b5-1729-4a58-bba7-85b8dc08b2d3", "comment": "Malware payload (Mirai)", "value": "4b20acc75ab347316d2a7cc5801c014150c82ac4cd7ab885819d9cd4d333aafe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783996, "uuid": "188f3c2e-131c-454a-aec8-263a8974ebda", "comment": "Malware payload (Mirai)", "value": "8e29018f8207c8e6e876e611c45ef47533dc83ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783996, "uuid": "477b4644-73d5-47f7-aef0-5a104b3f9d98", "comment": "Malware payload (Mirai)", "value": "abf221f294d54298edf3d2e68d92b3f9a932de159475648d9bbd9d6cbda5100ea6e7848b19af05190052d0faba04768c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783996, "uuid": "654af0c8-0207-4b17-8948-1b3cae08031b", "value": "T1EA53AFB7C4A89D98DE255578F21088399723E008A5A73DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783996, "uuid": "a29dac32-9ab7-4800-91b9-17aa30fd7cec", "value": "1536:I/xN6GOJeaUV7Y3bQIf2sOqBqX4sUEfs3C+/sMDr3d3C0KEi:IJNsYjY3bQIgqBqXlf+/Lrt3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783996, "uuid": "180829d2-f088-490e-bd39-68d400d3b353", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783996, "uuid": "c5fe16d2-c4f2-4ceb-8b49-f55e8ef3309f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783996, "uuid": "eccc0203-af28-44a3-8b66-6b9b0b773611", "value": "1a93007e24b4501fe78c0ac7f0a5be6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9619f4db-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683830121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830121, "uuid": "fd4e54fd-ee2f-4e8f-a1fc-7cdb057e109a", "comment": "Malware payload (DCRat)", "value": "6388f518d48d2aff61ecc5042baf7c2a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830121, "uuid": "bb41c585-a02e-4c63-8a2d-bad427881edf", "comment": "Malware payload (DCRat)", "value": "4baf6243e0956de8f1bb0194e84bf182fb8277a84378d726399a8c52526d8950", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830121, "uuid": "ef45d4a8-b63f-4d2d-963d-6cfae9c40bc6", "comment": "Malware payload (DCRat)", "value": "f069485a71d7d385836c5a64dad2828efdd3e00b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830121, "uuid": "b7e6f138-add2-428b-b0ee-d2d166cd0a7f", "comment": "Malware payload (DCRat)", "value": "85167168a52435660dd1ee118b57b10fd2fc317c0759687ed30ae015717a7540da54a085edbb827be87f8cddd5482fc9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830121, "uuid": "29b23373-39f9-40de-986c-9fc7bc387f34", "value": "T1F1F5E002BF548A51F1281637D3EF850847B0EC516AAAE71B7ABD376D95123937C0CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830121, "uuid": "d43d3fe4-13db-4663-a47e-b5c9943c172a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830121, "uuid": "562e135e-f5c9-45ff-91f7-f2c67f14434e", "value": "98304:ubRgDY0629XaLG1AK6jJE4merDkMsfPii3Zna8lx:ueDY062daLiAbX/rD6zZaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830121, "uuid": "51097a63-f615-4d74-871a-a8160926b152", "value": 3599702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830121, "uuid": "22f36775-4940-4552-a9a1-aaddfaf21786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830121, "uuid": "1d2a2fa8-3d74-4524-bba6-bfa4f9b50765", "value": "6388f518d48d2aff61ecc5042baf7c2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00213dd4-efd4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683792933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792933, "uuid": "b9a61475-8a35-493a-bfa3-9539b913f13e", "comment": "Malware payload (Amadey)", "value": "43a265fdb684fc8955036eef618bafd7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792933, "uuid": "92d9f9dc-bb20-496d-85ac-bb2baa303cae", "comment": "Malware payload (Amadey)", "value": "4c5a8a8e93c6c178b3622f51b9380d42855e4b2964aa799a957c274fd5547ca0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792933, "uuid": "95c31c64-1323-4a89-89ac-eea6ae6f6fb8", "comment": "Malware payload (Amadey)", "value": "f043affa21e8561be17b67b90cfc6790b5e8a787", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792933, "uuid": "8d660975-3813-4b3a-8584-1be98294c144", "comment": "Malware payload (Amadey)", "value": "ac171fb6e4b3efa94d776e2bc3e2e9b727683c221ad45a3be61aca89c0509782c438dc19b318c3126348ffc49b103abb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792933, "uuid": "3f23aa55-eaa1-4f25-8b49-83fd8fe5c818", "value": "T168F42252E7E88533FCB627709CF613E30A3A7C606E7496672391A81B0DF26846572737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792933, "uuid": "414d4889-768f-438c-958c-e65e7231d07c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792933, "uuid": "f7c7e202-5e2b-4096-836a-81754da528f7", "value": "12288:CMr/y90PuyJR8MKjZ0RWmwsf9XPGpQbcdlp2eTBTGrYRRrup2MaOUy:RyAuyJa70wMXUQwt2eTFCYRRyp5PH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683792933, "uuid": "4ff79b57-cf6c-4d91-83ba-88c61be2b08c", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683792933, "uuid": "d5230b1a-70ec-4816-b15b-64121879a9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792933, "uuid": "95976aea-454c-4ccb-93f1-b6b4b0637b05", "value": "43a265fdb684fc8955036eef618bafd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5180956c-efc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784909, "uuid": "d9126f0c-52fd-4c1b-a8a8-0424c7dc2a0e", "comment": "Malware payload (Mirai)", "value": "54929888e343d2dbb7d476ce71478480", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784909, "uuid": "e000221c-b55d-4e51-8da9-3e7ca224c7d2", "comment": "Malware payload (Mirai)", "value": "4db8850050cb41d15e5a5d60d5087c18827b29ac7ba4a72724f1b54139e176bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784909, "uuid": "467b3500-72a3-470b-84d3-7803c3616c00", "comment": "Malware payload (Mirai)", "value": "9060c8a758dd8276924794383e787cd6c3dfb270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784909, "uuid": "cd7d0727-40ff-4446-add5-0d430bbf1efe", "comment": "Malware payload (Mirai)", "value": "9eff580314c1208038f0cc369f7c5d0563fc760225c021bb89c2763ab5a6b0e313cdc3cee350fb55676330ef12c9d024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784909, "uuid": "a718e0ea-c9e4-4c5e-bff7-696c6df8e129", "value": "T119A31A45F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C82E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784909, "uuid": "f1b5138c-1244-4eae-a563-6e7f31f6623c", "value": "3072:1Sd+e6mKaGP0NjD3PvWL+vmZuqQ4DPwXXtse:C6mxGP0jD3PBvmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784909, "uuid": "8cdf86bc-6dc7-4d22-9f84-19a68ed0d6b8", "value": 100868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784909, "uuid": "00fad40c-8b84-4015-b8db-0eb687c8a741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784909, "uuid": "a9f6c3ac-e96d-40e7-a310-910a5f0f040d", "value": "54929888e343d2dbb7d476ce71478480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d245829c-efdf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1683798010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798010, "uuid": "995317e3-29a7-445f-91f1-735146957297", "comment": "Malware payload (TeamBot)", "value": "c793d6abd7b650691d9225f453fb0ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798010, "uuid": "6b62fa70-f153-4bd7-afbd-e1de2ed2e41a", "comment": "Malware payload (TeamBot)", "value": "4df3c7555abcb8c377c24a2622b7b48e2f51db456ecd08f32354df1ae32b8de1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798010, "uuid": "b21c34ff-de41-45a0-bb53-88dd157d8f9b", "comment": "Malware payload (TeamBot)", "value": "8d01cea909006b60d5d1fd32a55567b0d13a025f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798010, "uuid": "dcfe4f96-928b-4807-8f2b-6bf7c6c20f2b", "comment": "Malware payload (TeamBot)", "value": "5352cf665d9147294f427037cf7ee3fcd10bef0e88e15525c766fc8560b2ad810f736ac31a81a329bb464e6b07d0fade", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798010, "uuid": "a1629dd6-c31a-43ee-af21-571d9ff46902", "value": "T1C1643C53E2D3BC63E5174A729E1EC6F4761EF9508E5537AF2214AE2F09700A1F162732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798010, "uuid": "bc1a1566-f40e-4f54-a91b-f2d208f2b85f", "value": "541976701da86ee44f78e36955c7f1d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798010, "uuid": "e70ca093-2f84-4991-84bb-3716096768fe", "value": "3072:SEKl5fHqzuecb4yRAU5TAstLf3kldnYFIqLi5AvyI5tsNoUp38wR:IPccprTAsxf3kldnUIqLirI6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683798010, "uuid": "985239a2-07c3-416d-8458-76a07ce0c826", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683798010, "uuid": "220cfcf5-8992-46c8-9b51-6970dfe62993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798010, "uuid": "a53320b9-1aad-4f93-9bb1-3d7a2b512f1a", "value": "c793d6abd7b650691d9225f453fb0ae9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a635270b-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785910, "uuid": "b19deb25-f637-467b-962f-958fa2b891da", "comment": "Malware payload (Mirai)", "value": "0518ae1d451efa64a8b91f1db36f8e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785910, "uuid": "90cd9729-ee4a-4158-9497-115ba119869d", "comment": "Malware payload (Mirai)", "value": "4e15e5939c7ff4d74ca9ed6639709168b0cfe072a537fc51063aef16ebf242af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785910, "uuid": "3e306b49-fdd0-4514-ac7b-efd3554f1123", "comment": "Malware payload (Mirai)", "value": "7bdd4bcf273a596d311d560da3bff33aefb6a843", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785910, "uuid": "ea007126-49e4-4baf-ad08-49a864dfdd3e", "comment": "Malware payload (Mirai)", "value": "e23156ea49b7972191216bf8d3dd404102120cb0f0fd5e8a5a326561778d9d421a115e5ac1f77a974c99d67b39f7d5ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785910, "uuid": "28a8404b-e46a-4563-bb78-868c67ae0dbc", "value": "T17AC2D0E07726FD31C420AC3DE52A4D8A3A510A7C91FF393664658D398FC169A63F84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785910, "uuid": "aaf8e9fd-4533-4b4e-b427-5f14b2b1c5d8", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrQ9q3UELuD:NKy4qfqoeJdXWgZL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785910, "uuid": "2edb1007-c8ad-4f34-b00d-429fc10d8c65", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785910, "uuid": "1bba7c88-cedc-4c3a-b644-0f85d9c7e325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785910, "uuid": "aa8a9e2c-9c57-427d-ad9c-199784864c7c", "value": "0518ae1d451efa64a8b91f1db36f8e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6024769-f010-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683819061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819061, "uuid": "035d666d-6924-4be6-a8e5-97a22d3b3089", "comment": "Malware payload", "value": "44ec9de7badd5729db81eb6e1465968d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819061, "uuid": "cc7b5546-b76d-44f9-a374-82db8566e43a", "comment": "Malware payload", "value": "4e65b119877a2c2dade280fd09b9006aa8dc837f9e8f9a46c9915c7170e6b59b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819061, "uuid": "0df1c639-45fe-4692-9c54-5c59a5f8a787", "comment": "Malware payload", "value": "cb7ff0f2ae8cca0c1ab01f0d6b955b649d5db55a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819061, "uuid": "36e509fe-582e-4f2c-aef4-66f74d50b70a", "comment": "Malware payload", "value": "6eea00a3f42989f36b2532befa9ba12855f95e4a0b4c0c83c5b465690a578074f929a369abac929dfea9d5b852524b6a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819061, "uuid": "d36dd750-38d6-4e8a-95d6-00989897b80e", "value": "T164052E6013E99A0CF2FB3F552DB952846F62BDE6BD7AC15D132024AE0D74E94C9B0732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819061, "uuid": "f550d22c-e2d9-4fbc-b50e-e4613aef161d", "value": "3072:OkfXkQK0JFUe7m3x/gDQ0af3Ta6DVMdzEJtxcAIkI6dYbxscvp8LC8S8rhRivV7v:Ju1KwxO61i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819061, "uuid": "8efecfd7-a17f-4de3-824b-dc93f3a9b00a", "value": 842142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819061, "uuid": "d0beaea2-3122-4cfb-afc1-374e838e4baf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819061, "uuid": "251ecd43-ad98-4720-86d3-7deae85f4fee", "value": "HQRZ0178_6008216.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598a31d1-f016-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683821430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821430, "uuid": "12e96df4-d1d4-4088-9173-07092cd38952", "comment": "Malware payload (Amadey)", "value": "32c64d8369cc6396096d00fd1892595f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821430, "uuid": "01513760-734b-4a5b-a453-d615ca0cfdc0", "comment": "Malware payload (Amadey)", "value": "4efd9345b81d93819658bf03353e8bb79e666682256eb551c77b7e9a9dd64a80", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821430, "uuid": "6b06d141-e951-4967-aecd-c9b2468902be", "comment": "Malware payload (Amadey)", "value": "df317fdc3352a66fae5f9cf9ec282231409c41ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821430, "uuid": "04985214-ea1d-4f01-8a50-0b6f62ac2d74", "comment": "Malware payload (Amadey)", "value": "7b5f59f394fabb8b1d3cd0080e682047986a8865a75f2a67d16b38f7671b27c197687342b592cd44f46cec937ab7a892", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821430, "uuid": "599f6ed8-d70d-4913-a70e-3fb700cae197", "value": "T135F42242EADC9032DCB817B068FA16871B36FCF2697803672755148E1D739C9A67933B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821430, "uuid": "ca5c53ad-d803-4b3f-bd46-7c77d4aa7524", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821430, "uuid": "ed871f7e-7aa8-4ebe-ad1b-510591eadf9f", "value": "12288:kMrPy90yt1G0AsfvmhxM2a0xNIyFZydXo7UlPT2+eJx72x0XX9beNd6Q8pnxeocU:zyPLvcO2PbkPyh9bvLcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683821430, "uuid": "24855875-162b-448d-91ac-be4f7af715af", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683821430, "uuid": "f9f8e967-2002-4e9e-928e-581a372dbf01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821430, "uuid": "85b23620-8380-4693-a584-15f07e9476f4", "value": "4efd9345b81d93819658bf03353e8bb79e666682256eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d011d06-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784552, "uuid": "c941ef69-49f1-4e2f-8898-388d4bc5b7f0", "comment": "Malware payload (Mirai)", "value": "0d8a1b83dbf03eccd21cf45dbdca7a1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784552, "uuid": "f2a568be-103f-46b8-9f66-5dac708fceaa", "comment": "Malware payload (Mirai)", "value": "4f483ba395bf1b6989401f9efcd2d4d24ef881cb8edc74bf351db2e406b896a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784552, "uuid": "a9e81057-727c-4fe2-a51b-838f49be45b6", "comment": "Malware payload (Mirai)", "value": "fbe1a3fa53c06db4b9bc1310c05e49ccad7de10b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784552, "uuid": "4e746ebe-3fcc-4e87-97e7-acce9fdfb757", "comment": "Malware payload (Mirai)", "value": "bb97e7ccf23425970236ac196391bbdb15433e9addfe34b3c2127718735390ce6a723b27020aaa7e7934494b4c8f0b06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784552, "uuid": "08b78f11-9530-4f98-ae76-fa08410ebdbf", "value": "T19DA2E0257F2DE98FCD36B278C7E5E4C693D07C24D3DCC9866681C11BAAA37846824E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784552, "uuid": "4edb1a45-69ad-4f65-b4c3-e0db52011726", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtJHSyp:O98o08kxofBE+ZkXaT47C2EpitJNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784552, "uuid": "60028ea7-c147-4e43-a404-5a27130e659b", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784552, "uuid": "96696035-12e6-458e-91f9-798ade861c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784552, "uuid": "c6e9fcfd-0dd7-415c-a53b-4bdf76026d3b", "value": "0d8a1b83dbf03eccd21cf45dbdca7a1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22461d34-f020-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683825632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825632, "uuid": "fa895d1f-d998-4996-8abd-86586cf0e355", "comment": "Malware payload (Amadey)", "value": "e3e7659ac872d0ed171de3b3c477369c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825632, "uuid": "bad02b2a-d439-4d14-93e2-2996b8e0756d", "comment": "Malware payload (Amadey)", "value": "50874f38fe203388e6b83c4db6140284099e53ef79b9e46e8dd15f135beb6eb7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825632, "uuid": "03864a1f-c32d-43c8-9540-3f7e194ecb3f", "comment": "Malware payload (Amadey)", "value": "b6dc6e402528fc4917c7db0dbb84687f06d4403b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825632, "uuid": "e9087131-a376-47ac-a399-9562bfb439f9", "comment": "Malware payload (Amadey)", "value": "bed686e6e33b1ef20a0146fb78f86f01b68e02763f77d16dec69628277635240855b794e0a0e6188581828227620b010", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825632, "uuid": "071b5550-6833-44ae-8e28-4865dfe63a0f", "value": "T17FF4235793E48436D8B52B3128F207970B3E7CE3A6784317379AA59B0C732456532BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825632, "uuid": "8546a47c-d181-49c2-8739-c6544bb94eb5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825632, "uuid": "c1346104-4a96-4eb1-be6d-8f4c8e3948c3", "value": "12288:sMr2y90MwexBYs6wRQa/Evdy+uhJxmFsu1fYcspn1S2xNH+YLJLS3X0Jcuyg:yylx3WhvU+mXSBYZ1NxNHMn0Jcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683825632, "uuid": "4bed634b-8e8e-4926-9cc6-3147ff5a0bbb", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683825632, "uuid": "2d77f395-20b2-43f3-bf2d-88c5ad7447e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825632, "uuid": "af0f1020-7b26-48fc-af15-68ab3d292eb8", "value": "e3e7659ac872d0ed171de3b3c477369c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b6c6a9-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683829235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829235, "uuid": "e763471d-54c5-45da-844b-82b54835cd2d", "comment": "Malware payload (Amadey)", "value": "d23d60e00061bd87cc0c09b55caec769", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829235, "uuid": "eea8c2cb-8100-423a-b32f-b022a3a4683c", "comment": "Malware payload (Amadey)", "value": "50c2c9ec4c94886cac486cfae467e57c683eb450c48a57688ca6054c1b8d2d4f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829235, "uuid": "d23d10f7-3d94-4514-bb7a-09fd3b864cf9", "comment": "Malware payload (Amadey)", "value": "e050fc49767ad2849b94980338e4a38c9e20e355", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829235, "uuid": "20f66993-39ce-43b2-8f95-25e9fc4d49f3", "comment": "Malware payload (Amadey)", "value": "e846a42aeb0471c953410295e0cc166999739ff49417164a599c4ea5bb09eed87f9f56ffd9d2d1f29cb8861c180f780f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829235, "uuid": "c89560e5-d21c-480c-bf7d-1150b5e81db5", "value": "T10B25239277EA8122DBB057F0C8FA42C30A34BDB25E7486173B8AA5495C727C4D83536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829235, "uuid": "4bae9bd1-66b8-4264-8b90-a3eea2322be5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829235, "uuid": "928f587d-88e7-4429-8a83-297da15c0c1f", "value": "24576:Iybu4Leq6NytHgWs++Y5kBnEd4kwevaOnrviWl:PbhLVFqWs+5qtEStMNnrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829235, "uuid": "274f5737-d8dc-437f-8d42-de8e75c05876", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829235, "uuid": "beec2bb3-c6fb-4793-b540-2d0af9fac6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829235, "uuid": "3b3b6c1d-5088-45e9-b53e-7da7ee83017f", "value": "d23d60e00061bd87cc0c09b55caec769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bf3ed3-f019-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683822930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822930, "uuid": "5ad37a71-c29c-45b1-881e-a161f15bee7c", "comment": "Malware payload (RedLineStealer)", "value": "b4593b8efe66e99080d4f0238d61279c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822930, "uuid": "d6c03fa7-46bc-462d-8363-ea002ad56b60", "comment": "Malware payload (RedLineStealer)", "value": "52711e5022af45f6a5b14fd88578d5216087b84f5a2f5ff329273cd46d6f3cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822930, "uuid": "b04d2731-89cf-4edc-96e5-b264d0080e2c", "comment": "Malware payload (RedLineStealer)", "value": "b1e166d008bec73efa404f2cf4a737238f405f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822930, "uuid": "965883a3-8c19-4d90-b449-28149ec696e5", "comment": "Malware payload (RedLineStealer)", "value": "ba0edb448539be076f0e12c1398d109cef3c08b9c525b66692dd6e470b41b4025e9b43ff0a80123514d952e199d5e2e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822930, "uuid": "f19dfb6c-e503-48e3-bf51-30f023357dfc", "value": "T11AF42251A7E88432E8B63B711CFB078B0B367DE15974435A2395BF0B0CB2681A57277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822930, "uuid": "86a1fbdb-19a3-435c-8247-4a74e45d80c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822930, "uuid": "2c106d09-5415-4e11-915e-b2fc231995ed", "value": "12288:cMr2y90PXw4ySkn2KeTepZc6MCzpptNI22G9WSNd12j/m/1axN+:Cy86NeTi2dCTt04dNC+C+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683822930, "uuid": "4e6243ed-3456-49bd-841f-8854f7c3440e", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683822930, "uuid": "06967b27-9b12-41f3-bdd1-01aadf55fcac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822930, "uuid": "9ce1589a-9eda-4659-b92b-d9d026f2e311", "value": "b4593b8efe66e99080d4f0238d61279c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a69107-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683830255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830255, "uuid": "91f0f615-7839-4b85-b106-65194c47b471", "comment": "Malware payload (Loki)", "value": "635b388aba446efd6d4c48c65cd2ed3d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830255, "uuid": "93431222-03ec-4312-940d-5255cf574cd5", "comment": "Malware payload (Loki)", "value": "53075ffa11d09556e2b2cce393dfe67255dfd0262f45cf9f529338706a6c1f98", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830255, "uuid": "18c76abe-2b95-4320-b4ba-bbf5554c1ae7", "comment": "Malware payload (Loki)", "value": "a026e0c484fcffe5e9d75b23da3562c377c84801", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830255, "uuid": "edbdfbd7-f075-4abd-854c-79ea49dae14a", "comment": "Malware payload (Loki)", "value": "b0db759fa11069f1dec440e8c946d7e8daab8d1001c62c77db1a922871b03848779de8908a03470373923d569631b829", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830255, "uuid": "dc50f368-19ec-4d73-87e2-fb601f3a477a", "value": "T160E2095AE78F12648F4113B6231B1E89AABDB23EB35055B2785C437433EDC3D06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830255, "uuid": "33912418-6654-4b1c-b028-3b3e72521d62", "value": "768:qFx0XaIsnPRIa4fwJMsHCDeQt4gNorK57urFeQ6gnb:qf0Xvx3EMKALWgl7IeQ6gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830255, "uuid": "b4ab7cb5-202e-42ed-b6f0-8576bc038fb9", "value": 33802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830255, "uuid": "e3988842-89c5-4d3c-ad01-3c15f1b5e0ea", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830255, "uuid": "99a3a4ce-8abd-40a6-b971-e118d8f98da5", "value": "Order Form.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27d4a09-efbd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783461, "uuid": "42e9e23b-d50b-4771-8260-2a7d51c5c3bb", "comment": "Malware payload (Mirai)", "value": "b5b8d2e0666b21e83a42cc0bad716f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783461, "uuid": "ba825ac7-f594-47cb-9508-5dab2fd00302", "comment": "Malware payload (Mirai)", "value": "533c200048b5838a28cc6efe469373ca8af16f71817f68883c6da20d85f683b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783461, "uuid": "6c8c9159-0485-48ff-988b-28181b038a2d", "comment": "Malware payload (Mirai)", "value": "679a3016a898e1a5959cf00b64fad75a739a355d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783461, "uuid": "a2c5266e-8653-4ea6-bdb8-25c528190d84", "comment": "Malware payload (Mirai)", "value": "eed0cace2e1ab512325a7ae77df7f33f591a300a7878081ac1097f211c3cc40c9a80aac8c8eeef5b800879e9306a8ad2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783461, "uuid": "7b327ed4-50fc-479c-b6da-a1ac8bdfbd4e", "value": "T1B083814A7F614FF7E89FDC3705A92B1224CD651B25A97F35BA30D818F20A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783461, "uuid": "820744e1-7cb7-408a-a2d3-bd22b831ca20", "value": "1536:4tHI0VzfKg4SfJfPuw/uu9PLp98GfjHghP1q5Ypc:2HI0Vz9fJfPZ9mhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783461, "uuid": "5da2dc84-4e2c-470b-afce-f6b9dee698a0", "value": 88736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783461, "uuid": "774e82c0-4333-416b-97d8-4b8fe363bbb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783461, "uuid": "e55a0b1c-3722-45c8-a3e3-e69a90d1dae6", "value": "b5b8d2e0666b21e83a42cc0bad716f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0842b234-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829883, "uuid": "93c49696-87bc-4009-9bc9-c11fe7351fa1", "comment": "Malware payload (SnakeKeylogger)", "value": "71efd60fc95724db45a5b03dae9f6685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829883, "uuid": "4850328f-ce74-4242-a720-5557338c7388", "comment": "Malware payload (SnakeKeylogger)", "value": "535d74b24a5ffb30a283e855cbfdfb3509e9c94c4f97baa2f62197b221cce54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829883, "uuid": "7c328f9c-423b-43d9-8f7e-702eab5bb4c1", "comment": "Malware payload (SnakeKeylogger)", "value": "f74d4ede7e9531664d7444afdb13458209128785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829883, "uuid": "4b38ab99-68ce-4230-b557-cddf1ff0bee4", "comment": "Malware payload (SnakeKeylogger)", "value": "5826d470b5e0bb45c8dbfcbaae14b8a3e96a4ec2ea67d929c1bf1aa5f92d10097ae49772a36afebc6dbef0006ca3b46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829883, "uuid": "0ac4e497-79f9-4734-bb7e-3f54512b20bf", "value": "T125058C3D21DA5C22C31577FA8999C5E103356F00AFABD26A267E30CC89B1BA3EC5554F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829883, "uuid": "dd51320a-973d-4978-a85a-1c2917c4074e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829883, "uuid": "661a4d8d-fd56-4fd6-b339-e6005fedc106", "value": "12288:6vyG5qZfitXyJbnYBt2UJkxtfj0/MiTubuVvBdqwLPVEGBHx3:6KMI2X6bnYXTJkT0/xs4qwTV3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829883, "uuid": "92365e2c-a3e6-4a65-b8ea-4062e6dfa789", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829883, "uuid": "d1fa406d-e419-4c3c-b52d-a53242d5b370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829883, "uuid": "6c73687d-79f3-4e22-bb6a-970fff24e4f1", "value": "4DyBH8UhSDexBIG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43f72f7-efb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683780001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780001, "uuid": "f2f12a7d-8cf8-4d2b-959b-5088a0ea2cd2", "comment": "Malware payload (GuLoader)", "value": "c6db01a5743d408fc4f0c37ba58a281f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780001, "uuid": "2dc53158-3dbc-46d6-9065-c836044e957a", "comment": "Malware payload (GuLoader)", "value": "55130719554a0b3dcbf971c646e6e668b663b796f4be09816d405cc15a16d7d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780001, "uuid": "e89901c8-b40a-4fd5-8919-cd1150b9dcef", "comment": "Malware payload (GuLoader)", "value": "992d98aa6f31ae6f8f42fac9866a19c2a2f879be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780001, "uuid": "fbf7799b-8e69-4e74-846f-7e4d3da0dd34", "comment": "Malware payload (GuLoader)", "value": "89df85a4746115df158d7eda382d5b01b12b340fd6ef72fe1af18f5f2ffc32e40cb50f60bfe380fde3e1f7d9a3c1e0e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780001, "uuid": "35a70095-fe9a-429a-b536-01b322872407", "value": "T1AF0402927AE0982BE947C73105AF6A76F7BFBD0119742ECF6710BF6E39321029556203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780001, "uuid": "8b51a4a6-df14-43f0-b2d9-fe0ac2f012fa", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780001, "uuid": "ebbcc133-86b1-4b51-9e8a-5779888edce3", "value": "3072:EwJ52Y7ZoH5XJaqKz8HIoLmM4jmrn+tt6JnShq3U2IAMJ3hL0yH3w:EwHysqKzL846r+v8noQU2lyvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683780001, "uuid": "f03c62b4-e223-4bae-953a-c75b2895bfeb", "value": 174682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683780001, "uuid": "e4b74c38-2940-4b7c-bbb7-cca248803efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780001, "uuid": "55613135-e34e-4062-b4fe-e49098552928", "value": "c6db01a5743d408fc4f0c37ba58a281f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830ace99-efc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683785421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785421, "uuid": "eab3b09f-2efb-4721-b5f6-e359810b2047", "comment": "Malware payload (AgentTesla)", "value": "2b22c42e5b8c433761274a8c443808e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785421, "uuid": "43eb97dc-1f9d-4ef3-9b00-bc779f4f5470", "comment": "Malware payload (AgentTesla)", "value": "55180bb1969ec8be114f2242e1a89222f8c773a0e6e522bca3fc8bdab8bc047e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785421, "uuid": "c1aac5f1-6c68-4ce6-a0d2-6fbe6ef194de", "comment": "Malware payload (AgentTesla)", "value": "529e5420a0f2baf230cc4aae003aec1ee2f3d871", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785421, "uuid": "d33b60c4-bf05-4018-af5c-68ce1f814150", "comment": "Malware payload (AgentTesla)", "value": "5c8e4a6e59ec22cf776f96460e46588c52845549ba66ef8ebdd86b643bf8f4ebf7ffd518432fd4018a95219e30a71eb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785421, "uuid": "ac97039b-c3ae-40b2-9747-d899b6080415", "value": "T14ED423CE1B633C081E8216B1414997839D7FD7EFBD490EAB2E85DE962B3DE992041371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785421, "uuid": "25c32e86-265c-4333-a014-856299d10035", "value": "12288:lTFN+zfcWnz/zFSacunVTHJ9Y/6fIs+ATqTNSKHDJp+uI/m+P36O9g:tFYzfcWnDzjc6VTHvY/6f+ATqTBHDJpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785421, "uuid": "cabcd32e-8eff-4cca-aaf2-7297308bfa09", "value": 607564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785421, "uuid": "e28edd6f-10eb-4487-9f94-2080cb8ac742", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785421, "uuid": "3c162747-3612-4fef-b7ca-60cc6ad56cbb", "value": "Import Docs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5630d30-f045-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683841851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683841851, "uuid": "50ee76f5-3456-41be-9ad7-38cbadbd9e60", "comment": "Malware payload (RedLineStealer)", "value": "3ceadd02b2ad7bd0fb074ec98f856832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683841851, "uuid": "14c85312-d8d4-48a4-9c9f-b491db4ee981", "comment": "Malware payload (RedLineStealer)", "value": "55d7d3ef13deed83e09e8a72b7fa8dc103edca90d6815da4157ee04dd9972dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683841851, "uuid": "f2b08007-5d94-44e2-a617-c0095a1b5b04", "comment": "Malware payload (RedLineStealer)", "value": "d426a8fbc90bf66dd127ded9f966948ce474a655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683841851, "uuid": "be739313-5421-4ee0-8bf3-1cd7e20ce5a8", "comment": "Malware payload (RedLineStealer)", "value": "e008bf0174aed0bf86ed21c321f9046eb2e411e2d9b97f7f25ee52c5221aab44de3d6efa1684416d05f3c2840141cccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683841851, "uuid": "f63b0bdc-a7dd-4e3a-b8b5-b2c8af6bb483", "value": "T1FF945AC1EA4555A4DD19AB71AA37CD3442237DFDA834A42C29DE3D2B3FFB7931026062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683841851, "uuid": "b768619d-be9e-4c22-ac80-ddcb5b93b8d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683841851, "uuid": "3cd25e26-57f5-4983-89d0-27d872ff8dac", "value": "12288:t+3UzRw/Toe/QV868P7r9r/+ppppppppppppppppppppppppppppp0G:tIpS8j1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683841851, "uuid": "d5210a47-d670-4276-a953-5873310081e6", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683841851, "uuid": "e98331ad-fd60-432e-9721-840ba7999771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683841851, "uuid": "9ae592d5-bc8b-4c83-823b-f93a7e938371", "value": "eReceipt document pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e482d009-f015-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683821233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821233, "uuid": "0606b937-dbfa-44ac-a34b-cc89a811086d", "comment": "Malware payload (Loki)", "value": "352cdc27fdb7138292c14c851cfe9239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821233, "uuid": "486556d4-4f91-4a95-b399-5a95adc2a604", "comment": "Malware payload (Loki)", "value": "55e3c71c40618505b890607e53a5f800aa154a909f911359b765933a8f2c0eb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821233, "uuid": "9ee4c998-364c-4551-8e23-50670715a281", "comment": "Malware payload (Loki)", "value": "95222ede6eef401b954fe3593fcc1a9a5f74b07c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821233, "uuid": "5101c893-a895-4245-b7a7-d3daddc1cd2f", "comment": "Malware payload (Loki)", "value": "5e711dc75c1baa8f9f9e82ea3e2cc33dafb7c616cc05b8669feef53666a11bb92762e59f1cbd6180d788cc672a553aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821233, "uuid": "5fae48de-bc06-4218-9a19-4e101f160e13", "value": "T1E3D4D0892237BCDEC445867166543C939E3CB12762BDA0B9A51B748CCD4E8A2CFE45F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821233, "uuid": "3db8c73c-0856-4422-8e42-e4c3271ad7b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821233, "uuid": "d26396b2-721a-49cf-b669-837a1767e9b1", "value": "12288:MmYCfCvbWxs+w3vq3NmRQTAY/OSnvsXYvzCMf:MmNqjWxsd3ANGSAYrnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683821233, "uuid": "a3de0997-1de2-4037-b906-91c3efdbcb2f", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683821233, "uuid": "6bd6d3d3-ca7c-4abf-98ca-41aa8957d025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821233, "uuid": "106032f4-78c2-4387-a05c-e388f14dcac0", "value": "RETURN PAYMENT TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f940b4a5-ef92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683765004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765004, "uuid": "ba5b2584-02df-4343-8a0b-04e4909e548f", "comment": "Malware payload (AsyncRAT)", "value": "e8ea750d77dcf1f44a224158274ca9f4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765004, "uuid": "81564944-5875-422b-b310-9eb88199e943", "comment": "Malware payload (AsyncRAT)", "value": "570d9cde15c653ba533ae9de31882d2befcab80399ec02a3bd21c654db32cb1e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765004, "uuid": "30b49227-45e4-4b32-9194-0193d4ec675c", "comment": "Malware payload (AsyncRAT)", "value": "df4383b9040477f65d4243a2eeedba6e244f1f1c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765004, "uuid": "d83640bf-93f6-4105-a220-676c36970ab1", "comment": "Malware payload (AsyncRAT)", "value": "1b36c25abea735c880b321cbf109993dc0c216d21947a4226ff90dfc228b91f86e6ab17a1a03e20ec92ec227b2d17ef9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765004, "uuid": "4faafe97-4ed6-4e9d-93e0-d86db0d2a9e3", "value": "T15D3633282354EFF2EE8D9F7432BE36946369DEB84225C7E92C4D1D401667082CDE65F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765004, "uuid": "a48141da-c49f-4ddc-8bfc-a5bb55b88769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765004, "uuid": "9e712b06-ea4a-46cc-be2a-476f23514dff", "value": "98304:/JsTmnIjv6zUxUGEYbT+OBoVU47XK9bUlm9ZHXR3DrqIhGoSCLk723Y31UdDTPNZ:/JlIGz0/VT++oV32xZRzrjhGD8u23S1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683765004, "uuid": "f96ab7c0-7765-4cb0-876d-58a4f4fca78f", "value": 5282304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683765004, "uuid": "7e1a94d7-89a2-4057-b2f0-5de4ff7503ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765004, "uuid": "075dbf75-716f-4d0b-b5cc-819a27601cea", "value": "Dachman_Ne_So_Zla.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5689eb-f02c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683830801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830801, "uuid": "9a92413c-59a8-465d-a301-ff0c2342268c", "comment": "Malware payload (Mirai)", "value": "6bbd99ac83daf30519b57027f69b37f5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830801, "uuid": "6909bdb3-be95-4a17-8390-15a333c94d2e", "comment": "Malware payload (Mirai)", "value": "57bd480b83b4397dbff40efcaa31e84f2e6a1aa273e46f27745d7ee277a4e170", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830801, "uuid": "2cd241a7-1b4c-41c1-8ac7-9054f0efaa80", "comment": "Malware payload (Mirai)", "value": "81dff4ca75809d9bd2d432922745a1791fb93272", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830801, "uuid": "4b9c95e9-d847-4750-ae51-12c28378a059", "comment": "Malware payload (Mirai)", "value": "a65d31dcd05c162bfd2dfb13a28c37779cd30e74b363d899ff7d835eb797e51152daa117f9d74863aec23c888d0ec6c8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830801, "uuid": "2071ca65-1b1b-4906-bf86-f6a66871ebe0", "value": "T1F2935D27F552C67BC08752B42BDBEA615933B4BD0B32720B33E47DA52B219C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830801, "uuid": "eb685f70-af29-4ccf-a73d-4231e1583970", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3+SZmA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKu+m/KWOXF7aR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830801, "uuid": "37772b99-c489-4106-bab3-2c613e845c07", "value": 94676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830801, "uuid": "903e4f61-8bb2-47ab-9a46-6a2111875a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830801, "uuid": "7c2a75c8-5d57-4067-a06d-80c41af2a988", "value": "6bbd99ac83daf30519b57027f69b37f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d90b11-efc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683785424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785424, "uuid": "45090a58-740e-42a5-aff6-3abb091eaeb6", "comment": "Malware payload (RedLineStealer)", "value": "42578caf4f341a3caa1b25cb9fe39d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785424, "uuid": "44516d8c-0ace-4132-a008-586ba157e1a1", "comment": "Malware payload (RedLineStealer)", "value": "57d7a1793d07ff7d9e06da04ae81b541309a98fe288308dcbdb17539d494f0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785424, "uuid": "4968e780-b0c9-458f-a70f-b9ba9cd499b7", "comment": "Malware payload (RedLineStealer)", "value": "c5444a56ee47a5ba9530b052c4ed9945f352b276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785424, "uuid": "d0e49be3-baf8-46d7-9b5c-86d63d049fb9", "comment": "Malware payload (RedLineStealer)", "value": "a78281b51652dd39e2331337ab385ed677e3733f2b69d17f721b5688e64a4e0d5cb275df09c7767d955666f08991302d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785424, "uuid": "af82b0d3-7a0a-464d-ba17-24adf664c03c", "value": "T15AF4130696E8D132DDF5377428F203930A7A7CA2597887B72386694B4CB32C4B93573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785424, "uuid": "f6f906f2-4404-4add-bf08-e74446bd2a01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785424, "uuid": "1667fe61-7d18-4af4-a781-88c916aa1f99", "value": "12288:EMrGy90Zt/HAU7Ed0U+cWqEXGZ1P8pW17riLEe3JxZZ7/45utyR74r:KyrU7JUpn1uQeJxX/4gkKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785424, "uuid": "aedf48bd-92fe-4658-8d04-cd86d8e63385", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785424, "uuid": "17cf5813-bb52-4801-9c14-ee631202c99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785424, "uuid": "78971fa7-7971-4265-b1d5-20f71c77312a", "value": "42578caf4f341a3caa1b25cb9fe39d61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b80ae7-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683789593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789593, "uuid": "ca653ba5-bc08-45b1-ac32-f7862bd5f220", "comment": "Malware payload (SnakeKeylogger)", "value": "3fb3b5203d30d4d646dc8132a2607e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789593, "uuid": "75d0f71f-8c04-42bd-8bfe-cd4090a91f2f", "comment": "Malware payload (SnakeKeylogger)", "value": "58dda17dafc74dd89d83c27483ef35cd298a205d543bb7d1e8305d231705277b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789593, "uuid": "2a828bd5-2cde-40a8-81fc-bd824bc4d974", "comment": "Malware payload (SnakeKeylogger)", "value": "dcc4f0888698013160f5159301bf2492b65b780e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789593, "uuid": "d771b294-87fc-48b3-afaa-36b3e6d24570", "comment": "Malware payload (SnakeKeylogger)", "value": "a30c0f0be34c964668604098fd2d7b27364a26a536f2fc97e1a7836d224b112557830ae69ca3669dac327d82e6ff2183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789593, "uuid": "8611b75b-b088-4c58-ae4a-638ff52ff23f", "value": "T10B054BC1A1619DD6ED6B06F17D2A643015AFBE5C64B4C00C6A9FBA4A65F330220DEF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789593, "uuid": "c53fc6b3-c54b-4f68-af80-d36810c713e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789593, "uuid": "3c451480-7e65-478a-8510-a2910ecb5979", "value": "12288:vqUhfm5g7o5zRmSD4GSj4vLkeQ24iitBT+6Y:HRm5gk5zBD4GBvLkeLFih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789593, "uuid": "bf954ad4-f93a-4c09-b0ef-0422fcfcb173", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789593, "uuid": "e6a7916e-b1f4-4e01-a1f1-c20550b64b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789593, "uuid": "c83750cd-622c-46bb-ad73-ffa434e3542e", "value": "00158007309125259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e035960-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784581, "uuid": "1828e6f7-9857-4a21-8daf-16cb31e289b6", "comment": "Malware payload (Mirai)", "value": "3fedd24ff0a915703a5a3de3dfa15a71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784581, "uuid": "fc1f9690-067b-4891-9771-67be74cdaa57", "comment": "Malware payload (Mirai)", "value": "597fa83ffe21a1a1b02038e604ae7bb4fa178cb5ed62591813f90a2bf7007002", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784581, "uuid": "6d600791-6b2f-4371-8344-4059dd9f8660", "comment": "Malware payload (Mirai)", "value": "2ab58883dba55c6d0a83261a00948bacee286d92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784581, "uuid": "969e843a-0c7e-432c-84ab-081aed9deb81", "comment": "Malware payload (Mirai)", "value": "75fd3ecea5b66f99e1f6d6acdea0e8b53481e384677615ebb06cfa0af5cdcf75644344767e7386d89d177242f299eee5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784581, "uuid": "88c31c61-9b92-44a1-b5ec-37c5d1717bc3", "value": "T15F23F19B070EAD80F071027A0C3E1EE6FFD8995628C22C25D8CBAD4D154F235BDD9E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784581, "uuid": "fcfe9048-6979-4bbd-83fe-b13595271963", "value": "768:32SarJuu8hjH38SCRnQdQ6wCgLGcoKvGxoXnYgGgIqrTQJKf1b/cPWj1HDlrTDVd:mSarJHWHzCRN9PoKvGxYYgGyMJ46o1H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784581, "uuid": "53fd403f-c883-471d-b8a3-d871e08480c2", "value": 46180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784581, "uuid": "9bc7c4e5-8f6f-4a70-99bd-1e89f54dec94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784581, "uuid": "fe394254-6890-4825-8556-4e687afd5baf", "value": "3fedd24ff0a915703a5a3de3dfa15a71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec9ec05-f000-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683811882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811882, "uuid": "666af1b6-7f2f-4754-a5ea-c69b312c036c", "comment": "Malware payload", "value": "c2e467302ee6d56e459b1181e7cd5fd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811882, "uuid": "57dcf4fa-5a84-4a61-8991-242143384444", "comment": "Malware payload", "value": "5ce9df04ac0b2241af1e7d9f95406dbfb628fdb0b1998667894c6e5812bcbffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811882, "uuid": "3226acde-e99f-4e91-b699-a44b38a91256", "comment": "Malware payload", "value": "496b5dbc1b2c978ac6ff22dd1bf174493a6315b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811882, "uuid": "ba2da191-21d9-4fbc-bda9-37d699e136e9", "comment": "Malware payload", "value": "9f50e0cf84a63b7d62fd0baa4a4ce078034f6abc61f35149747342588e34d5587d005d464cb9fac6c2d539f63f34f360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811882, "uuid": "7b075ae8-23a6-4856-ae8a-2196e0682d75", "value": "T1FFC633D9533118EAE8A48339D1838D30E7A1BC6607B4D7CB43D451BB2F135E9B976B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811882, "uuid": "19e68101-8418-4aa1-90db-435a5428894e", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811882, "uuid": "5f7e40b4-db6c-41e5-aea3-6439ebc883f5", "value": "196608:QjJXM8K/SzDIFQgluUxbAQvPwejuJDUX47dwdW0ZW9B6H2Wp9qfoYPOdfhJpkx+:EML/SwFXx3aUX47d4h72addb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683811882, "uuid": "d148a44f-0862-4543-b617-7084f513f685", "value": 12392890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683811882, "uuid": "92d3eef2-979d-4abd-aaea-2e3271a4f404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811882, "uuid": "6f7d2e10-6114-4e00-97f8-11bdba6a2169", "value": "5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240513f4-efd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683793852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793852, "uuid": "2e120683-60ce-4647-9f27-9a760c0b1219", "comment": "Malware payload (Mirai)", "value": "6f616dd7b0a539ddf79bbd6099e61b06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793852, "uuid": "87d3efe6-9415-4170-8647-5e41d3c4cab4", "comment": "Malware payload (Mirai)", "value": "5cfadaac91f91a85fe87b9626cde7c4cb758458a696066d5c83a7e23325a7f36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793852, "uuid": "4de072f7-7a73-4532-89cd-a2432ab26169", "comment": "Malware payload (Mirai)", "value": "0e086f7b0f98085bd2ba57aec6b449113d23f109", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793852, "uuid": "6cddf015-7a1f-40ee-a2fc-bc4bb6f8d0dd", "comment": "Malware payload (Mirai)", "value": "a23a6e631ef5236eb6f624f633f1b1ce559129a907fbbdc55eef80637f7d58ccaf20657f72466d8e0b199b6cac8a4084", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793852, "uuid": "077b8bbd-3a4b-4308-b55a-77fd6c41c0ca", "value": "T10ED2E0B19930A6F0C5112836EE3D56C77B172BB4D97EB826618406A872838DBF3BC950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793852, "uuid": "b850e55a-ecd0-4b1d-bd65-41b6cb447493", "value": "384:HdiU9hQan+IKi+QQjd/BodTyiBAbl7yQBof0lR5BqS4ch7qmdGUEpiaCy:HUU96iEJ/6dTabl7LifkHL9q3UELCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793852, "uuid": "c98ff550-89cb-4be6-9235-435bbfc1b603", "value": 29924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793852, "uuid": "712d6080-42fd-4cb1-a899-82acd58ce4dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793852, "uuid": "10bb659d-1adc-4f15-9967-327c622007b4", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.UDQ.10313.28485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4695b4f-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683830252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830252, "uuid": "00ab0a5e-ffed-4a73-ad29-7b910d6dc862", "comment": "Malware payload (Loki)", "value": "1fb825c2390c67ead535b244e63377cb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830252, "uuid": "6e578da5-1c7a-4563-80e2-50a2acefb804", "comment": "Malware payload (Loki)", "value": "5dc89729bc032e433b67bbd974c9631d97c23fee426b59accadb6352ea5947bf", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830252, "uuid": "6feab14a-c6b0-4918-a425-33e31ac3a146", "comment": "Malware payload (Loki)", "value": "7a11cda7b7dbc7f75e722fc39c192c2112095cc0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830252, "uuid": "b7101d9b-086b-4b91-9ce7-bf1e43231227", "comment": "Malware payload (Loki)", "value": "d011f40d970c73f59f8e4019ef63bb6cf3dd6e4d853455bc5263a99d2561b7fa227fbdacfac0cc59626e0074c2fa8aa3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830252, "uuid": "0a58af0a-9491-41c1-b319-cea4ffe357e1", "value": "T1E1350107A188CE4EE48287F53B67B84D430DBE7672C570D63A5C774BAB31E7A468B109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830252, "uuid": "3fa22886-d236-483d-b8c4-5fc883d436f6", "value": "24576:aLKMWQmmav30xICT+MXU6WQmmav30xadp+MXUpGrkucO3kBnuS:aLKhQmmQ30z+MXeQmmQ30M+MXdkuJMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830252, "uuid": "a6503bd5-8145-47c3-befd-7c097dd38546", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830252, "uuid": "414c755f-4c51-47e5-842a-5cf55ff93124", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830252, "uuid": "b5c834db-9428-4d1c-86c8-2a080c0979ee", "value": "SHIPPING DOCUMENTS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917ae760-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683829254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829254, "uuid": "f5a2fcfa-fdcb-4710-8513-0917e97ce7f2", "comment": "Malware payload", "value": "fe415fe7497faeb1c84614d9a267b2eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829254, "uuid": "2b4df558-697c-428c-b94d-0ed048307777", "comment": "Malware payload", "value": "5df82a2cbc00d2b5f2075a40eadd4e006569ffc96bf8eb597d7bdd366406e52b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829254, "uuid": "77312cc0-0547-4ca2-ae8d-b602f849a233", "comment": "Malware payload", "value": "a1e98c7779a5c399cd866226bd668e255dd7f346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829254, "uuid": "6e57d0f4-5421-4811-9599-89c0b1932621", "comment": "Malware payload", "value": "33894be40d155c9d9f22d3a9b4d9b4f2a0e2ad5cd4b7611789bf75dcaf4420ba603e456117be1f2f3811e6de4b116ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829254, "uuid": "a49ded99-336b-473a-8520-02145af8038a", "value": "T1FA85233AF5C1C13BD1711B3C8EA2C2D970BEBB143C2D584B70D94F1D4E3A6A79669286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829254, "uuid": "7aef145e-da59-4587-9448-0e477b24e69a", "value": "4afbc3ea79152c3f8469f1157ab7e53a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829254, "uuid": "b6365f68-6065-4c80-8c29-241d8d4625c6", "value": "49152:FsRXycULLv5AJOzWwKKswtrw2FZZytLJ917OFbH3Ck:FsRCcULLRiwPbM2vZytLvIHyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829254, "uuid": "7ad37a74-b2a8-4b87-84fd-31b797485d68", "value": 1857338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829254, "uuid": "1a9d460c-f3d6-4041-a43b-99bd179f04b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829254, "uuid": "cb1bfb7f-0c5f-426f-9005-060b94dcc9e0", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91014627-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785874, "uuid": "c8e4f6dc-ab39-40d9-b442-99e46209514a", "comment": "Malware payload (Mirai)", "value": "4d2e6034392c22399a2f990e76841ae1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785874, "uuid": "a95b412e-1dfc-4a7d-ba21-33fcb0aff545", "comment": "Malware payload (Mirai)", "value": "5e7c980cc87436a5c503f042847fa85c430111c9b41033e896f338995664d0aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785874, "uuid": "59a80278-9180-4634-96e0-1376584a3332", "comment": "Malware payload (Mirai)", "value": "5b69b1857903c1c2d8cd3e11ff22d25a297c19f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785874, "uuid": "4bc36b88-c218-42ac-802c-f161463f1473", "comment": "Malware payload (Mirai)", "value": "5e4a5fbd2fb2e21ad7d565074bc4e1f33373e9d6e01907d31f1ff3b6fdd0c5e8ae20b47a5ec620a0d0612cbc0d4314d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785874, "uuid": "9d9d1cf4-a7db-4f48-8a83-bd72c796edc2", "value": "T1926319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785874, "uuid": "a7650ec2-7021-4a38-ac01-3c2e600f33f7", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwbKnJeZWovjHJkKfM:at/LY0bKJwpvj3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785874, "uuid": "851e4613-976d-4e39-baa4-7c4618da4a2e", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785874, "uuid": "bd30c6c1-80b0-4151-88de-6a770ab7cd95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785874, "uuid": "46738ea2-e258-4002-9217-134af763964a", "value": "4d2e6034392c22399a2f990e76841ae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2b7da3-efd3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683792627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792627, "uuid": "4b10f113-f248-4f91-854f-9fc42abdb4bc", "comment": "Malware payload (RedLineStealer)", "value": "0674d6c5735829277b0b6a019f8c414d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792627, "uuid": "f5ee4f10-642d-4b08-ace7-c403f34c1a6b", "comment": "Malware payload (RedLineStealer)", "value": "5e97cadd04a17da3f4f87af7b3ac747d3faac664c3588f5d212965294b8900d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792627, "uuid": "9e1dfb22-b2dc-4a98-8d59-ff4ae6a660d9", "comment": "Malware payload (RedLineStealer)", "value": "21b598e15c52133e987dcb683e3dcb6491d224eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792627, "uuid": "a2904a75-2a19-4949-8aa5-34704a8b9062", "comment": "Malware payload (RedLineStealer)", "value": "acc6ee4f00360e7132839b43a4e6c1a5e787fc9c3bf5ccf1a2a8aca207c26cc8143be367c2f85fc844a460678f7d3d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792627, "uuid": "154dc021-31df-4165-a180-150195462bdb", "value": "T160F4134665D85473DDB9673029F603C30B367CD16C785AAB1386AAAF1C732C0963A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792627, "uuid": "1c985e74-dcec-4031-aada-ed1c0c8d5795", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792627, "uuid": "22ec6740-f435-4e24-ae7a-17a7140aa25f", "value": "12288:KMrJy90ZBNj/dBKZqk94WAw01XzOvxWJP33/xzDi+wBs4uZGhzn:jysBKp4x91XzXJPFD3w5uZmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683792627, "uuid": "dad5166c-cbfe-43be-bad2-df3275c2d844", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683792627, "uuid": "b1c54297-7bf6-496f-abfc-5532a29b3bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792627, "uuid": "1ad2250b-b20e-4397-b4c5-9beb90720600", "value": "0674d6c5735829277b0b6a019f8c414d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631e7e1d-efe7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683801259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801259, "uuid": "587f5e4e-934c-41f3-b382-58c40e309ed2", "comment": "Malware payload (AgentTesla)", "value": "8b1c5c53b11b149b23a2f67d0136e88d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801259, "uuid": "ece0139e-7d29-4a3f-b3d6-4f11d5533273", "comment": "Malware payload (AgentTesla)", "value": "5ea1052b8b85c9e2989c300d33843e4b952305aa1f3f43d4ab0d0ed8b2191bc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801259, "uuid": "5d7338fd-075c-4391-a6bf-7f66bdfd64b1", "comment": "Malware payload (AgentTesla)", "value": "1063ed5f957a75f2cca79d5b6b37c43635e2117f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801259, "uuid": "a328004f-fd60-43b3-8285-ce2753096971", "comment": "Malware payload (AgentTesla)", "value": "5ca1fa589fc9198f63862f1c0900c82bd07a44bc0c8b1a1b93118e7d091761167cd2a95f5887910efc744be7dacc66bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801259, "uuid": "03303a38-99ca-4f03-a9ff-70e4875a00a9", "value": "T15C0533BE33F21F7345A5B05284DCE139E2BA4D6420393A57EDE46484C6B09E4BD72B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801259, "uuid": "517100b4-f0f5-401a-99eb-8a1783f96fb0", "value": "24576:EBys3Da9sv3bafUcRN7KQe86SpYIHVPFO9Z:EL3DaybHwN7KB8VF1PAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683801259, "uuid": "11c99870-2d94-45e6-b86b-51c33bc1d282", "value": 872805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683801259, "uuid": "f80aea20-246d-427e-85a5-3960516ca0c5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801259, "uuid": "5a664c76-d581-44dd-81ac-57930eac7132", "value": "nEuro Swift Copy.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5b3940-f007-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683815128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815128, "uuid": "6037950a-10b6-40a1-8ff5-a3273d2088b3", "comment": "Malware payload (Quakbot)", "value": "1c2177dc8e9029d58dda06d7e122fcb1", "object_relation": "md5", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815128, "uuid": "ee34f2fc-169b-4ba0-9167-d02b676e0394", "comment": "Malware payload (Quakbot)", "value": "5fbf446e062e0bf1e7cf57fb2b9c1a6257e9c288744e2d35deda0fb18ce2cf6f", "object_relation": "sha256", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815128, "uuid": "f260249e-f871-4923-a12e-85ce880ebbfc", "comment": "Malware payload (Quakbot)", "value": "9a003626e8b2e6b2e10b6acc14b4361c0f09a678", "object_relation": "sha1", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683815128, "uuid": "e57e6885-3109-498d-a689-d05b3ad233e4", "comment": "Malware payload (Quakbot)", "value": "f0350c840b37c77bffd30aadaf8afc5bb6d2b07eb9e0cd394f661789004ec04fecb998350b0f857b4b19507c39f19eed", "object_relation": "sha3-384", "Tag": [ { "name": "1683811051", "colour": "#D35101", "exportable": true, "hide_tag": false }, { "name": "BB27", "colour": "#A506EA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683815128, "uuid": "ef3053ad-f3df-4b87-aa81-081aae3708f9", "value": "T1CB2464C00AA55477875BAE66763888B1D73D0A6082CC5D9FF86E71A0F6CE6CCD8D8731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683815128, "uuid": "827119f1-b0bd-4771-a14f-5d6568fd4250", "value": "1536:9PiqthBTUTzMLZQtI8yH3fw8GrWv1ptbBMU4eQCOgX5s9D8LQPCxo6J3jPzwX2Kp:NimgWFh5s9D/GKeuBCuSv7Avbt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683815128, "uuid": "06af9a89-6074-42e0-9405-9faf032c9be4", "value": 216701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683815128, "uuid": "ba8c73e0-c23b-4c1a-9f63-1e93e644c08b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683815128, "uuid": "a37746e3-0b25-4bd3-af78-34e0daa8d4d9", "value": "Qnpa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a3f4c8-ef93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683765231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765231, "uuid": "d066bf67-8650-4279-b7c1-5ccfab0765a5", "comment": "Malware payload (Amadey)", "value": "6095d4b452708690806be2f011737c1c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765231, "uuid": "f674fb25-9180-4786-85e2-9c5a650c14dc", "comment": "Malware payload (Amadey)", "value": "5fe1bc00d255691c7a2cd1a30f903538e3bce1cba7996d5b49bcf78dac1917ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765231, "uuid": "2dc913fe-da52-44de-93f4-28691c520d39", "comment": "Malware payload (Amadey)", "value": "3589bed87052cd95f6a86ba2ff35b0e3ecec35a6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765231, "uuid": "02c3a0d4-46fc-4733-96db-eff13b544e1d", "comment": "Malware payload (Amadey)", "value": "bc1986964323077b9b4c6484fa645ee5f6654f202f84810885c31deaa4f5f6d566b7e3eadeae306dfd18708967845274", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765231, "uuid": "efac78e5-be66-47e2-9e17-6535250f7351", "value": "T1AC052212E6DA4433E8F03BB16CF703C31E35BCA24974536B7749699A1C727A1A97132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765231, "uuid": "2a8cd67f-3db2-4193-876b-6b1f6774121f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765231, "uuid": "817c33f9-71ac-4a8f-94a2-abcabc0c70fc", "value": "24576:HydydOpTJBcIr2lFhYfTCBTUgjE2W27Io:SdydOpJHacTCBTtlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683765231, "uuid": "c7a30c2b-383d-40f9-b303-282ca2d83015", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683765231, "uuid": "1dbacfa9-3304-424d-9201-6a4f171f57ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765231, "uuid": "7c47a429-53e8-448f-a28f-5ec9499b1fda", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df9d270-efdd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683797063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797063, "uuid": "6449fa5e-ec22-4347-b4ce-0bfa67ff1c98", "comment": "Malware payload", "value": "6e48c62d75c15044b162ca5b2f78747b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797063, "uuid": "b63eca43-3058-4a5b-879b-d05f076c5178", "comment": "Malware payload", "value": "601421ad80704fa48cf10d3481751a17ae0a7970f0aa2903978fcfa34d270248", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797063, "uuid": "9d948ee6-9a3a-49d1-8cde-5be907fce369", "comment": "Malware payload", "value": "21e478e7ad791aecefb5e902ab03dd99bc28c2ec", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797063, "uuid": "0f3432ce-03a2-404a-be86-93cacabc13e6", "comment": "Malware payload", "value": "1ad8196e5c220daef470328760760734e16a5ad9cf1a65f4fbc17bfa7d4bfee26ca0f736fabdb15618ba0178885007da", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797063, "uuid": "5a8a962a-60bf-4835-929d-b1b3e41af867", "value": "T19BC4025EB809F2F4D935E7B44166BE608735A6121732A853802C6FA10B7DEEDD33349B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797063, "uuid": "00efe6b5-13ef-493d-8bee-b56de016dfb2", "value": "f4dc3f13ffb8967d78b4ec628390a774", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797063, "uuid": "f06913b7-c6ed-49b3-acd6-8ad37ce14375", "value": "6144:QaasgQks5F4dTEii6o+GTzzxC46pe9jugAZ/+GhzwM7gbmhzKcgA9K7UMrF7GaTW:QaavtddTi6cz1DoZlsk7cZD1v4ZMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683797063, "uuid": "e1b036bf-e364-4fb0-88f5-358a578536fb", "value": 554496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683797063, "uuid": "1761a987-1151-47a8-b7b3-ed9fcece14e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797063, "uuid": "09632fe2-9505-4b3d-9f1c-817a5ce6b5e9", "value": "RetirementPlan.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5e3533-ef9a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683768447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683768447, "uuid": "3cf56c1f-6a37-4d8e-a869-f851b60f1437", "comment": "Malware payload", "value": "1987b8ce233909021e877ea3408ccb70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683768447, "uuid": "3efd066f-0ad2-4387-81cd-891e8512a3d9", "comment": "Malware payload", "value": "6050c167bb78a8ebddc39497418ca02bf43fe9afce2a43a740f52f6600f6c380", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683768447, "uuid": "8f7eaf60-65b2-45a2-9f25-9e542264a16e", "comment": "Malware payload", "value": "b6ff13890de9d32f468b2b59ab183457a3af4837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683768447, "uuid": "fe51d024-d964-4bc2-b032-588c1f985090", "comment": "Malware payload", "value": "7c25f9475072be171d3b049ee32b3b09821e7b5965a99f9d36907b28afa11a10132142d5d562daaf3a8eabfd45ceb253", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683768447, "uuid": "9697106e-614b-4ef6-8a8b-38677617e5f0", "value": "T1A6A5336A326152F6E8D9C17C7805A3B8C44865273E21D0D8C7B90DDAFF336A64768DE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683768447, "uuid": "8aee29b5-b51a-4204-81cf-0c48f96c89db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683768447, "uuid": "bec1d54b-2c6b-4d33-a988-4f2c1cb2af02", "value": "49152:m+q9PMuqMHzmKqKX8HSFQ6kXQ6JH/54UAMwpUciOhE:dEP5qMTjGSWDQAR4UAMdciOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683768447, "uuid": "bb08ef50-ddb9-4618-ad61-57f38d80c3aa", "value": 2142208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683768447, "uuid": "ea2aae3e-bf13-422b-9299-14aef5c8917e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683768447, "uuid": "d9e08e64-caf9-4c73-b3c8-98b33d0634cc", "value": "1987b8ce233909021e877ea3408ccb70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed89ac61-f02e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683831986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831986, "uuid": "3250fe9c-c6e2-4aef-b754-f2759c1de58c", "comment": "Malware payload (AgentTesla)", "value": "64362533364a5d1de8ac7726151d4abb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831986, "uuid": "6b5a8fe5-5074-42aa-9de7-bc8f219c659f", "comment": "Malware payload (AgentTesla)", "value": "6234c83cf8e46f8e09fed9cbf0456be735dc8640c2df0ee4734b7fa730e0b8eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831986, "uuid": "da5523c6-a0f0-43b9-8f36-d7d204061080", "comment": "Malware payload (AgentTesla)", "value": "c3274fc66347520147b392a9ae5a0e46137a63c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831986, "uuid": "70740a52-edee-44d4-bedb-b695c49e4db7", "comment": "Malware payload (AgentTesla)", "value": "0efcea1cd46c3cf385089097815442896899ae1dd1aa3006207f18f8bd4fabe87824ab0245b054d8f98725459123b6a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831986, "uuid": "00be8378-b088-4bcb-80d4-a53248f1206e", "value": "T1B224AC5362E85CC4B1F22A13A8BB55314BFBB9959C3DC54C72C4C769CEE290C98A17E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831986, "uuid": "1c377aa2-f5bb-4b2b-a948-45284fc08c70", "value": "768:XnHGdUBDCKtfYjE3Luo4+eaWttYFPk9Wai2d:XHGd+CKtfSo4+YYFNai2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683831986, "uuid": "74c25277-742b-4083-8178-3c69ade20d40", "value": 227802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683831986, "uuid": "fe6e2804-8ea6-4efd-bfc0-a7e56d668096", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831986, "uuid": "d3998924-6cac-4bef-82c7-6c42521b9ce0", "value": "Doc#8927823838393990__________.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784e5f8d-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683829212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829212, "uuid": "e1947771-ecef-41e9-8d97-aed21e88a16c", "comment": "Malware payload", "value": "90ec31759eed5148fd4a3c58b16ccc8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829212, "uuid": "56490dfa-eb73-429b-aea5-8cdcd2669375", "comment": "Malware payload", "value": "628d1584a744b33d32ac8291ce235f1d389dfaaa4bc45a15826f02e34cc32e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829212, "uuid": "0e7bd3b1-fcff-47c5-b45f-c7a351081ddf", "comment": "Malware payload", "value": "3ea0868446a89a5d0298bfaccaa7e7668f5d83f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829212, "uuid": "c0620bb4-7cd8-41f5-8ac6-789e50d8d4a6", "comment": "Malware payload", "value": "6e57c537ed1636f1701c4ee95752e2063351a2b13a68743e7c9390cc99cc24886d189c65507a888c30a4ba3d87c8d001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829212, "uuid": "5bf8eb36-a638-436e-b966-99f8403e8e71", "value": "T12164AE03F6858475F477983C0CECD97196A864352B5F58E7B3C8262E793E7E2A53830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829212, "uuid": "195ee79d-dd38-4862-9e49-8d6cf4dc4e8d", "value": "ddcccd7f5247e71ea0dafd9c36729ea1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829212, "uuid": "878158fc-7e87-43cc-a49a-fad55505a096", "value": "6144:Qcg/LqEqjH3Ucm+ugP3bjhUcXo9O+JkMaQ6Q4X:Qc+FoUcm+VLjmfwEkMX6QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829212, "uuid": "4694762a-3847-4ed4-9d12-ffe1e8836665", "value": 320608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829212, "uuid": "8b052b66-2432-46b8-be50-cc3629563178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829212, "uuid": "54607d62-88b2-4766-b92e-4f647814cfcc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef4f6df-f010-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683818727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818727, "uuid": "e332d36b-3029-415b-b4fa-5697bdabc049", "comment": "Malware payload (RedLineStealer)", "value": "eec04a10c0a82763595b06408888ebbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818727, "uuid": "60f032a0-6882-4fcc-91f3-fc05c30b340c", "comment": "Malware payload (RedLineStealer)", "value": "63445e53b96bf629dae1d73a0a2237383c0b5413c6f853b8d391268c96634f5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818727, "uuid": "bc81724e-8cf4-4107-8d76-6b3eb6ea1db4", "comment": "Malware payload (RedLineStealer)", "value": "5449ef9341dbceda8e56870ec72194a8cf4e1c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818727, "uuid": "336924ac-0b1d-45ce-ba95-b5628323bbef", "comment": "Malware payload (RedLineStealer)", "value": "249c44320802a92c646cb1e430474c12b6cd7cea7f2b39819ffaf82ba021e5fba249514d609291420dbdf2b06892fd09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818727, "uuid": "a8ba9468-55ba-46b1-9531-078f3226d403", "value": "T1DE051395BAEB8027E8B567B418F317C31A367DA15831079B37446C8E0DB27C4A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818727, "uuid": "eab56985-9da6-4af2-9269-5f3d072efb3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818727, "uuid": "790fcc6f-7675-46af-ada8-7e10216cae70", "value": "24576:zyKXu0b2vSNCUYCubScYG9CMRMgH+P7bLhYm5d:GKXu06vSsUEboMRMgH+PLhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683818727, "uuid": "17b66f72-e015-4ec1-b86d-7813d1bf73ab", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683818727, "uuid": "4b6b4918-a8d0-425b-9f8e-63f7af0417d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818727, "uuid": "9f26f318-348a-40fc-b05a-c2c276a337cd", "value": "eec04a10c0a82763595b06408888ebbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7090443-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683837075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837075, "uuid": "8e8a0d6e-1bd1-4229-b50e-78c2ec41ed49", "comment": "Malware payload (AgentTesla)", "value": "9e5f9119e8ac465584e031d51e9c93b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837075, "uuid": "90bcf2f1-9228-4c8e-bbe7-ed1c3ef1ef44", "comment": "Malware payload (AgentTesla)", "value": "6404ca9ae102478e834286b4f20437942ee223a7405fb1fe40c58b3e5f7c1929", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837075, "uuid": "a3b4f86d-d151-471f-9ec5-61fd1f31d7b4", "comment": "Malware payload (AgentTesla)", "value": "0d09522fd91c6016686f92c31fa0f48ece8f20ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837075, "uuid": "87fdde15-4caf-411e-abe2-82534d549bab", "comment": "Malware payload (AgentTesla)", "value": "d6d9cfbe661b49371ab6506b73a5d329eca200a1fd9dfcd0654796ce7c36f122e1ce2088aeee3e8000e0ac11207df540", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837075, "uuid": "e45ea73d-94fa-4bdc-8b3b-c21f57a109a6", "value": "T112C423B2F54C1E65956662DA8CB1748D70D081A36E320297713EFF901682CEDE23DDBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837075, "uuid": "87fcbfe0-922b-4306-b9bf-ac2b95d74ad2", "value": "12288:GqU0gpTp+WQX7XrRPQVahYUUwCA0vrRGs641Wq+a9ef8h5qkaKNQX:GVp+WQX77hMA0lGs64ZBRXz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837075, "uuid": "ed76e64e-51fe-4c85-a126-65309e2a8a7f", "value": 567778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837075, "uuid": "bcc9096b-0a25-40d7-8eab-00442aae83c6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837075, "uuid": "be43b2bf-7ccd-45d5-abce-c8f400d1312d", "value": "fiyat ve teslimat bilgisi_QS20202310109051__40GP_1.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3375b3e8-efd1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683791730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791730, "uuid": "3a3f7975-2f91-447c-aa89-41a764b6e3b8", "comment": "Malware payload (RedLineStealer)", "value": "a80c46fa31b0da690d7db2339c23a08f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791730, "uuid": "cf525d34-1589-42f1-bbbd-d955d03c81d6", "comment": "Malware payload (RedLineStealer)", "value": "6418d24c83ce4e685aa9aa7b663f41eebffbbbbac76af77531ee2a559a8a5dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791730, "uuid": "c46c2533-64d1-4508-a65b-7c970ef4c468", "comment": "Malware payload (RedLineStealer)", "value": "294687b5314ad2cd022839573ac8bde3394731e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791730, "uuid": "68f0894f-61bf-4115-8170-255b4dc4d5ac", "comment": "Malware payload (RedLineStealer)", "value": "f1acc24c05c5be855aab1979bcf77898e138fb6ba7069f20b3bbc46a4e7c1cf32807d1706bb9122219feee780bb36310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791730, "uuid": "9c338ccc-2cf4-4daf-97ee-15db1d530c33", "value": "T16FF42355E2E48433DD712BB048F647530B39BCA18EB882B7275A7A8B4DB35C4B53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791730, "uuid": "daa6d42e-32a0-434b-8d79-77b02ee6582f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791730, "uuid": "2d3a7235-8ecf-44a4-9600-ce42ad469d00", "value": "12288:5MrNy90ENR/aO2CrxDZEmtDUICdCPZT8pEiWtsb50bqJJS4g2GGwYs/4A1w6R:My5R/z2oam1HHZ6U2b5aW04gDGAjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683791730, "uuid": "304b8c98-5bc6-4a53-a02b-5c03b6196485", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683791730, "uuid": "5a402e36-ff59-4c7d-8486-042c7dfa6ee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791730, "uuid": "5640010c-e6ac-4dda-be40-092de431312b", "value": "a80c46fa31b0da690d7db2339c23a08f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484f7398-efc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683786611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786611, "uuid": "b7234bdf-e8ee-4cbe-8b39-66b8de0c316c", "comment": "Malware payload (RedLineStealer)", "value": "5a498cc23642fb91f6c214d82308a53b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786611, "uuid": "88883d50-0c93-4088-a00e-3826d0fe2a66", "comment": "Malware payload (RedLineStealer)", "value": "665159ba5b8aab3fe2196934780c26ee1e191b262cecc200531821590e68c2ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786611, "uuid": "d7d7561d-6dce-4fff-b399-4c9f8397cb39", "comment": "Malware payload (RedLineStealer)", "value": "8107e577d76adb2ba4c2df3f634563d80178a8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786611, "uuid": "9c4d2729-2bd9-4214-8296-ffbbd026669e", "comment": "Malware payload (RedLineStealer)", "value": "a6da6a06a4b0623c053becb2a582f61ab93452708364a25d0f27d6628ee6dd1e4747003ef43df7ed07b235066fc04b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786611, "uuid": "b2f42712-47df-46c6-a7cf-22dd36def08d", "value": "T142947D13E2E37C51E5214A729E1EC6F4761EF9508E4737AF9214AE2F09731A1D1E2B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786611, "uuid": "b5f34324-fb7a-45aa-8880-d5750db654e3", "value": "541976701da86ee44f78e36955c7f1d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786611, "uuid": "f78ca983-72d1-4fb7-af65-df80e3c30ea8", "value": "6144:AblOpQz0DTWaNGzVbV1iOYp/s0Vzfvw4uI8QTFiq:ylOpcTaAzL10FVzfbuFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683786611, "uuid": "282e7c78-ac85-4d8d-96cb-bec5c52e5f90", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683786611, "uuid": "d3cc7622-cad1-4c82-aa5d-ddb8359b9b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786611, "uuid": "76ecbbfa-e02e-4e9d-810b-b4c19aaf4811", "value": "5a498cc23642fb91f6c214d82308a53b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc29537a-f012-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683819877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819877, "uuid": "3129d875-e6a2-43ad-b85f-64767b0763fa", "comment": "Malware payload (AgentTesla)", "value": "f22410b94d71a8e557965955eb9db952", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819877, "uuid": "2bb14952-376d-42a2-a148-c88bbfab6f9b", "comment": "Malware payload (AgentTesla)", "value": "6702eafd72ff8081618fc0ad6feaf194cd4fae7d5798184bd0a61fc7de4e01bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819877, "uuid": "7dee8a0f-574b-4912-bfab-fee238d1fc96", "comment": "Malware payload (AgentTesla)", "value": "ab871612a975d95f46bf33f8266238d144062cd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819877, "uuid": "105c632a-d4e2-4869-bf93-b491a9655694", "comment": "Malware payload (AgentTesla)", "value": "7d50aa3c22c1773116683f941dbf4690f48a0e6ca8192e6ff7c937c935b6797a6b11b7548b34128d5cb90da8136a6465", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819877, "uuid": "12e42249-449f-413b-a16e-e11f6b4bea9d", "value": "T188D4D05A86B88F01CA6C4FFE5CA3C2C606F496717C29E9315FC724CD99B392F14582AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819877, "uuid": "9939c391-8fd1-4b6b-a59e-4430f9e0c424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819877, "uuid": "f87b6e55-672e-4693-90d9-4fa1dfcf71d2", "value": "12288:c//c0zAwhh2Y4YLWjyp2PwfKKkasKz7sXwCtHnGtjKnkhnqau8m:s/cDwhh2WZp2/ToawCt/nksY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819877, "uuid": "84984cad-bca1-4e70-96a1-4f70f2e6bb49", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819877, "uuid": "a6498660-b850-4f50-8544-e0c07a4da842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819877, "uuid": "5be7f9f6-1430-44d0-830b-b61c2d84e0d7", "value": "Invoice No.23DF-46775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897db7b3-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683832247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832247, "uuid": "6f9b372c-534f-4532-a5ec-2ff128664e79", "comment": "Malware payload (njrat)", "value": "7f208b13fb96dd9dd74bdefbd7dff8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832247, "uuid": "beaaba7c-a55a-4165-8028-4b8cf4d9773c", "comment": "Malware payload (njrat)", "value": "6733857c42198bf05ff92cf51089bd031779ad13b2cb4107edea08e6b5e6c665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832247, "uuid": "3d512c65-2702-487b-8731-da20a27c8e17", "comment": "Malware payload (njrat)", "value": "b760fa41f0f80c2819aad5f997ab095d12c8884c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832247, "uuid": "d6412adf-2ad1-4f94-b33f-d8c9ef938e24", "comment": "Malware payload (njrat)", "value": "d9179f66f42211f90886cf9b4f0a567c28f706c7bc9e1918889d3dc89508e79640da628d31358802f8b60b0a2a0b56bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832247, "uuid": "426af48b-fe64-4678-be97-490f0b6adf8a", "value": "T12694F98C2021C433C9A71FF685A99F535614FD863723A42DE1917DA9BA76E840BF313B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832247, "uuid": "b396972f-f720-48c1-a1ab-e8ac687baa0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832247, "uuid": "81e67f20-121c-4be5-8831-11bed3efd60e", "value": "6144:hRItLCa73M9HAN7dNkcKxtJ8GlW3aXwHrhhw:bmkHAN7dNkcKxvAOwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832247, "uuid": "986cff00-03df-46a8-8191-66a42f9cb7ed", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832247, "uuid": "6fb667fb-581f-4a0e-a55b-d189260a9e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832247, "uuid": "2b726bbf-1b37-426a-858e-901681b4ec2f", "value": "6733857C42198BF05FF92CF51089BD031779AD13B2CB4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4074c6-f02b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683830430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830430, "uuid": "cb70dcab-55bb-4cbb-a5b1-5162f4045ed1", "comment": "Malware payload (DCRat)", "value": "19b1dc02146d5358c01094863b9e1c39", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830430, "uuid": "af3ef513-2d5c-48d9-86ef-31390691b339", "comment": "Malware payload (DCRat)", "value": "682a3a8e439b5c9d4f563eab109fb26bbeec146a5e2ed94956b8609fe8b7fd91", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830430, "uuid": "bb9da09c-e9ce-4e2f-ad86-f9be13faab98", "comment": "Malware payload (DCRat)", "value": "dafb8945aa60b3e609ee0eb55793a1ac46c51d24", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830430, "uuid": "a6ee79ac-b0b7-4f84-9279-86dcb694f1ed", "comment": "Malware payload (DCRat)", "value": "b07bb64ecc2fc27f5b3523c80313eda62a730728a1fa104769dd2d7db7a629ed0bf409e2e4bf050e262429f1642f5675", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830430, "uuid": "21649695-ed01-46d2-9779-a6e7001a4de0", "value": "T157D42913F6507055E1225030486BABB668297C3A1415DD0BFBC0BF4D297AAEBADB731F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830430, "uuid": "d5edd9d7-1075-49cc-a173-5aecba2865c6", "value": "71aba14af66da2246fc7c61c718c6c17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830430, "uuid": "6a615205-8c24-4246-b023-7060ee2a65ae", "value": "12288:6byb2Zi0Uyz4DNsiV5P9dQfObqPpQYUcx08BBq:6ut04NsiVRPQfObqR7vx9Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830430, "uuid": "c32b2d72-903b-4de2-8f29-5c6f1c8cac30", "value": 598698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830430, "uuid": "21e310ae-9eee-424e-b031-c2f07fe31c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830430, "uuid": "bc46ea54-6328-4efd-b5be-4f70be9354c4", "value": "19b1dc02146d5358c01094863b9e1c39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0372421-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1683837091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837091, "uuid": "1414049f-e84c-4ff9-b394-bc993afd8748", "comment": "Malware payload (NetSupport)", "value": "aacc50b6cb34a6464a811793fbbc9776", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837091, "uuid": "967a36ad-5fad-457c-ada3-bd49cef8dd93", "comment": "Malware payload (NetSupport)", "value": "684bd7367b7f3365a7420b767632c453fa2ae68a937723cfc9b38a2381097ad6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837091, "uuid": "93a3dcdb-7174-4ccb-aa5a-a00c3a27dabb", "comment": "Malware payload (NetSupport)", "value": "5e4bc0f6dcbd8687fd54d7c75584fc784e44cf3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837091, "uuid": "272fcc56-2c31-4294-bbec-c537681f6a02", "comment": "Malware payload (NetSupport)", "value": "357b1aa5eaaabfeba8008e30f6f4aabeeec5f4e6c860bd0036c644fa3d580194c11c3885323d843147b71bfd0d570777", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837091, "uuid": "1e6471ac-ceed-4786-97c5-0cd72de36379", "value": "T1DDE2BD9866C36043565FF03A727ED8C6E566492A0BD5680FB91C7234FF95C3CCBA0768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837091, "uuid": "59b53589-8f68-4f6b-936b-a9f89e4416ad", "value": "384:pJ26gAE6CcsFVP8Nrpl3i+00+/hwaEV8dyXx9DCymMnOWesqoqAv4CCpuh6yEFUr:pJaWs0PFBVdXtriaCkeJ5LG7n5VVkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837091, "uuid": "7cefebec-faae-4a11-a2ec-10cbe7e7ec7a", "value": 33775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837091, "uuid": "df4a8823-9805-4cf0-9d0d-3c2259bc3b55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837091, "uuid": "fff05633-a0e6-4df0-86e2-8be3cfbcc1b3", "value": "Versandbestaetigung_155002_23098.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c021117-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (FormBook)", "timestamp": 1683830024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830024, "uuid": "19d01f6b-a860-49ac-b41c-b91d8f5bb0ed", "comment": "Malware payload (FormBook)", "value": "aff1cd7e54a184afa0df5428d1e820fb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830024, "uuid": "a376feb1-2a9a-4f17-a3b3-9b549d86dd4c", "comment": "Malware payload (FormBook)", "value": "68d216b8b7a24c451623a7bba09a7f7454e6289272b1899116569259bb02b9f8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830024, "uuid": "6a803bc6-29e5-4212-8635-5e7e23b1e315", "comment": "Malware payload (FormBook)", "value": "11e9eeea9c9314dc9fbc0601e871864590d91905", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830024, "uuid": "ac941160-ee3d-49bb-9325-44cc63f62e8b", "comment": "Malware payload (FormBook)", "value": "880ded6894de77d3d9ee822af71971914de57ae83fd526937d14e15712beeaf67ec75492c559cda05812724f7b2db604", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830024, "uuid": "cad8c2b6-202a-48d8-93a3-53e79ef93f10", "value": "T1EAB423CAE3225C40DE9F680C008AD71DA3873EC3175567997FEA32BD53E71A406971E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830024, "uuid": "31705690-75cb-49b3-a8d6-128460602b06", "value": "12288:WNhT+vytL9/8ACfWZrcr7wauJI/F49KqFJvXfO:WD+vi9/m+mluJI/EFlXfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830024, "uuid": "9b735100-b26f-4312-88b3-f15a9109af5b", "value": 533158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830024, "uuid": "fc9c7328-7c3f-40e9-afc0-692b8807de74", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830024, "uuid": "2bba7572-6285-44db-b27b-0e385a5a933d", "value": "nPURCHASE_ORDER_pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39d6ac4-f034-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683834546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834546, "uuid": "5df9a96b-e936-41cd-93a1-be4a0579b551", "comment": "Malware payload (RedLineStealer)", "value": "ea7872fe63fa49bca2158c3a5bd335b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834546, "uuid": "895c6334-ebe0-4678-8867-2219a3777248", "comment": "Malware payload (RedLineStealer)", "value": "6954a2cb463951884e0448371dbff209b0406df19b1cc7c18a2051eadc717b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834546, "uuid": "6a2214eb-8bc4-4c42-b5a9-965ec4c2787c", "comment": "Malware payload (RedLineStealer)", "value": "e0ad41f0b391e6a85f5eac4b97e625e54814f7e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834546, "uuid": "f3c6043e-ed1c-44a6-833c-9b9dfc4cf7af", "comment": "Malware payload (RedLineStealer)", "value": "ff3e995776f4eefa913d36589b6138dffb3567cfdf06fc1721e4ed6a567a6905bb56329d21aee0ec9de737a7ddd9808a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834546, "uuid": "27fdc45d-c0d6-4c71-96d3-ec8da129437e", "value": "T155749F0325954524F8B7D634CCE6A839D72A31333B9F21C74B5724E5EF129DBDA3822A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834546, "uuid": "3165d0e2-b752-4f3a-8ade-b55e2c583f6d", "value": "2a1aaccb4dbcfab1e2ec8567968fc4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834546, "uuid": "620cbc63-d413-47da-80bf-dfa2cc3ba9ec", "value": "6144:OEf/D//cXNqu6v4imQfKW/dy8XGBoZcfVYH5BQ36v2f+yeKtgp7Wlct2P:3T//c9L6y0KW/dL2yBQKvmeF5cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834546, "uuid": "da8ffb82-c763-4f5b-a11b-aeccc26e86eb", "value": 356448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834546, "uuid": "d9760163-2770-4e43-8a03-574586b9caae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834546, "uuid": "030c15b8-36ef-43c1-a939-11f6a6645eab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a0239b-efb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683779995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779995, "uuid": "9c27893e-8494-4533-9068-94e9ffd6c282", "comment": "Malware payload (AgentTesla)", "value": "24429aa11d39dddc2e9daec4bcba9ed0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779995, "uuid": "70866900-78d4-405f-8338-52e597dde1cf", "comment": "Malware payload (AgentTesla)", "value": "6af32493cdcc6bcecccd6941fbe2b26f438a240dc32ad5eff26da1f9286cf0fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779995, "uuid": "09e736fe-3f17-4ce7-a252-9a57000d372a", "comment": "Malware payload (AgentTesla)", "value": "be82e66c37cbaaefddb0a2619b52d2a98cdad953", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779995, "uuid": "613525c0-bbd0-4c29-8f5f-7ebadb74239f", "comment": "Malware payload (AgentTesla)", "value": "be381cb6d13f091de17d20b302b9420fcfd49ca04313b9d81fcea32d85b0136dc5d86b7869d60de4ba1cb473aea3b4db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779995, "uuid": "ab0147ff-afca-4dc4-8256-465a6b972855", "value": "T1D1058C3C62DA5C22C71573FA8988C5E103356F00AEABD26A267E30CD8971B93FD9554F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779995, "uuid": "16d7d52c-18bf-48b7-afb4-ba007b0603ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779995, "uuid": "1f2912df-491c-4164-bb31-a20796045c0f", "value": "12288:GerKBFzEzTqZfNtXyp/z8v95TtQWHS4fLx2CCJnHXfXs3mB:Gn3zEzTI7X+r8HthHvxlknHXfXIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683779995, "uuid": "0d760538-e480-4e96-96ae-ae4850ed6aaf", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683779995, "uuid": "b50cc7aa-4633-4866-85f2-cbfa459f88d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779995, "uuid": "11ff1950-943b-4ae5-9467-16ad27c79aef", "value": "24429aa11d39dddc2e9daec4bcba9ed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad192a1f-f033-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1683834025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834025, "uuid": "c3d6f65b-9079-463a-9385-40d501fefe08", "comment": "Malware payload (MassLogger)", "value": "bece52319c082e828a438800f7e65cee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834025, "uuid": "2982121a-a19b-4705-9903-624c4bb446ad", "comment": "Malware payload (MassLogger)", "value": "6b32f25ee457934f481272ba1b12d9f828950fabe0d7df548733c57b6e8d5b2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834025, "uuid": "d3b88fd6-d201-4377-ac95-14ace91a4c59", "comment": "Malware payload (MassLogger)", "value": "2665eb15888710c8a85a65b151082928f5bfec72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834025, "uuid": "f6e24aa8-fc0b-402e-937f-660342b2f99a", "comment": "Malware payload (MassLogger)", "value": "4f743d109b870d6f60dddfb8d26e6436f0c0d6d89da28c43dfb634a8f765e699d6ec8b04534eeb29f191bf65f5849c94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834025, "uuid": "8296ee09-0b49-4179-a749-28375c3f1953", "value": "T1C834D00533FC4551FABA5E7F58B081D10B72BE579A32E68E8D8974CD28E170609A372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834025, "uuid": "89ca352e-0f74-4b25-bc4a-4de80cbb5f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834025, "uuid": "c61ea41b-cbe2-4f6b-8cf0-7093304a2dcf", "value": "6144:X1XQakQjeFxbIBMPLSmtd+tlhRK1x7Kj0jj1xmauq:FXQawbBdt2DO7im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834025, "uuid": "f54fc100-d756-4789-a6d0-773be0a36a92", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834025, "uuid": "bce5c08e-fda0-4438-b732-387cca31d9d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834025, "uuid": "f9c44447-10d0-402c-b125-6a4261a3ce85", "value": "bece52319c082e828a438800f7e65cee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11ba696-f010-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683819026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819026, "uuid": "01a352b1-bddc-4606-a959-04ae677c53b4", "comment": "Malware payload (RedLineStealer)", "value": "39e36d9dfefe8ed912cf456917558c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819026, "uuid": "a2f2602b-7fc1-410a-8913-3c3bc64c2c76", "comment": "Malware payload (RedLineStealer)", "value": "6b39b939acf1f4aa5bebe7d32fd69de1389bdbfac2e15ee8c71e45ed4faebd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819026, "uuid": "195e4e6a-0a08-42ff-850a-aa48091ca0d4", "comment": "Malware payload (RedLineStealer)", "value": "203738622571685d79c973338411a7d081d15f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819026, "uuid": "e4e66bff-6b68-4479-a5b3-2fd11666e0a9", "comment": "Malware payload (RedLineStealer)", "value": "209e09ddaf5a876d01f69daa9a171f5e802b3cccf40c8da4519a81724fa86c155db8ba425a4288e45c61d3d49dc4e9dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819026, "uuid": "7a9e1471-c6cc-4b52-a1b9-1f531468a3bd", "value": "T16415225193E48435EA762B3098F257D30B3DBC735E7486732B95A89B8C726C0A632737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819026, "uuid": "d9b9b9ec-8c4e-4c32-8fb8-3eb0c302387e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819026, "uuid": "edf13518-8dbb-45de-95c4-4050fbaf1748", "value": "12288:HMrey905R90Sym4s/eEXc16vD17n2JB3maoZjpG3oKdGadSr/ukqnkJHstUZeQB7:py8RrKs/bMiD1rAov1KUSoHEUgabvSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819026, "uuid": "217a813c-c207-4602-9073-3854c9faf959", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819026, "uuid": "c51b22c1-e6f9-4b4a-bac7-0de84dff10b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819026, "uuid": "aa4374ac-3ef9-4ee2-af1c-db3fb4bc41ac", "value": "39e36d9dfefe8ed912cf456917558c7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed6b8dd-efdb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683796232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683796232, "uuid": "d1c89ad1-5861-402b-8f4d-6980afecb148", "comment": "Malware payload (RedLineStealer)", "value": "7243ae22d3e11d3867dbc4d795fa892d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683796232, "uuid": "a3a60155-414a-4a30-ab58-d34504423ea0", "comment": "Malware payload (RedLineStealer)", "value": "6bf25bae6bbd190d1ec7c7ad378295b0d0770ade6a1242dbe684c08c288656d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683796232, "uuid": "0e5edf09-a6f5-433e-8fc1-881f30d68f2d", "comment": "Malware payload (RedLineStealer)", "value": "d37568adaba3c18cdeb82ebcad23a1e4111071bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683796232, "uuid": "eafc0abc-7acd-44e6-af3f-c8cbe1ce4717", "comment": "Malware payload (RedLineStealer)", "value": "3a732aa92a94c872d414899f4ead698cffb79dcd7f461fdabb217430fae7618a099418475169b4059375f5be006dfc25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683796232, "uuid": "d332c454-1491-4eda-b5d7-70b3f2e9bdc0", "value": "T1B8F42312D7E00037E8B1277028F653D70938FDA19EB8862727969C9B5CB3AD0B53675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683796232, "uuid": "8ec10f0c-9e1d-49ac-b186-b7c0c90da3f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683796232, "uuid": "9302e61d-b617-4360-a528-a402cda81b1c", "value": "12288:QMrky901bTEeYFDiy61izXzhkLn3SfoEOvtyzpY1p8RZjJF8TjvibQJeVoQ:kymTEfFD2QVkDmytCBRZjJ2Xvi2bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683796232, "uuid": "11fd289d-1be4-47f9-b2fc-3e6e73ddf357", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683796232, "uuid": "33decd9f-1cc8-480f-9e28-3a6c7e219770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683796232, "uuid": "d0113c7a-c56c-4155-b6f2-22af16cf3387", "value": "7243ae22d3e11d3867dbc4d795fa892d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d1b4c7-f037-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683835514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835514, "uuid": "03a61a55-98ae-4ad2-aa6a-d5a9303a44e4", "comment": "Malware payload", "value": "a14d01d96ea78f39f7e118582dad3cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835514, "uuid": "b96fc5ab-8939-4960-8b1e-5fb0c2328ec3", "comment": "Malware payload", "value": "6c6345c6f0a5beadc4616170c87ec8a577de185d53345581e1b00e72af24c13e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835514, "uuid": "a12fa228-3d47-40ea-8ad2-1d16584002b2", "comment": "Malware payload", "value": "8cf40dc12117e56aea899ddf2c381443d6537d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835514, "uuid": "43e5bf5b-2e02-4323-bd00-186f76ded92f", "comment": "Malware payload", "value": "9d1e73743f4a86c0a12b4c9c697154b8ad4e21cab7668d1e4f269046ed6ba261b6a55692c9764d0180c5652737284ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835514, "uuid": "056db3cc-df9e-4d4f-a30c-554113f5fff9", "value": "T14C742981B3DA4028E072C679CEB18363EA767C155B3096DF07609E6A6F73BE0D531B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835514, "uuid": "da874e8c-1a00-4452-8b78-a32656f2eba1", "value": "77e359c59376704055cd15c273e85720", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835514, "uuid": "b5c5582e-0148-4680-a084-bbd357fc120e", "value": "6144:xFH8RIT6Fam4StJ3rXDW49wY7SkzU0iaODgKYleQ4HzP:xWdtXDzCwGMAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683835514, "uuid": "57d11ff6-a612-423e-9b13-4cd94cdf2016", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683835514, "uuid": "04ed42c2-a788-4a7d-b934-aebe27dbe4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835514, "uuid": "857c83f8-2b51-41d4-815c-c75f705bc000", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf15b49-effd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1683810777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810777, "uuid": "a83ece9e-ce02-4b18-bfb0-deae5c2d5d10", "comment": "Malware payload (Adware.Neoreklami)", "value": "95847f9fce54f3c792bb0cc069a025c8", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810777, "uuid": "0521d92e-7fd4-4fc7-834c-f6160bb43c98", "comment": "Malware payload (Adware.Neoreklami)", "value": "6d7bfc2ddcdea1d8f1ed756c58853ae3338afc9198e6bb4882d9f9df0ef3d862", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810777, "uuid": "bb55e5b2-3242-40d2-b1eb-8942db4825e7", "comment": "Malware payload (Adware.Neoreklami)", "value": "9c5c6647ec35e1719581ae0bf3bc710f6c8b5d5c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810777, "uuid": "211e81f8-0872-4c3d-be85-7578988d5062", "comment": "Malware payload (Adware.Neoreklami)", "value": "617f09c2d966662e4da1fa209cfb5ebfcf0a85e6dc52f1c5f47de927df15737f9c0eae27b785a76962b46d8dfa502607", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810777, "uuid": "ff59b8bf-cdc9-46ca-81f4-ea8de730937e", "value": "T148763302B8C9C7F3E3A0547A4C989FE3D2AD69052A37657F1BD10A087FF561583B6B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810777, "uuid": "3bb4c59d-899d-44c0-bd93-b0d51bf33ed3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810777, "uuid": "f036fa41-fb3e-4f5f-84d8-e4aa9978806c", "value": "196608:91OKdZBePTgfIKCicyeJ9lTEraK6jDstqn0H5AhksAwv:3OyfePkTHpeJ9lTI7hZMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683810777, "uuid": "e043f3f1-67c6-4f87-aaa9-770254f63c06", "value": 7610746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683810777, "uuid": "136c3b6c-0cf7-4bf7-a47b-7200a04fc366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810777, "uuid": "a4bd90e1-6c41-4a53-8576-65e75a1a9f61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de8c5e8-f010-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683818726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818726, "uuid": "a290415e-ecef-4a5c-885d-64439f07597e", "comment": "Malware payload (Amadey)", "value": "8e54faa4631e60bff269c6d9c3d602c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818726, "uuid": "a10e6ec1-8b64-4e0d-92d8-1607fb330848", "comment": "Malware payload (Amadey)", "value": "6df63c6f49144b0e0914f380133c52cd7a7b23bbcefa931c5d2d2b2c5c8524d2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818726, "uuid": "90e7b347-965d-48bf-98f6-b337b31dc4ff", "comment": "Malware payload (Amadey)", "value": "9ad48a4948cc50b063614dfba1e26f346d373b89", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818726, "uuid": "41198d52-0930-4be7-9965-49951f1f9e32", "comment": "Malware payload (Amadey)", "value": "bcc965d2adf52ca2eedbdd7ec793981e9d221786fe7c70fed1f12b8956202e750ee54dcf9ca2943e91a461675a62d0b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818726, "uuid": "78970a75-3dc9-4b0b-adca-5a7b0c4c9322", "value": "T130152296E8E88831FD313B7059F70B870A39FC210878933B1A1579971CB36E8667172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818726, "uuid": "3355af1e-0a03-4836-ae08-8c0556f166d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818726, "uuid": "45ec6313-eab3-43da-a43a-d987fd12d305", "value": "24576:XyHkM6O7mqfVoI4IhY9KOsa+h5jzXwJl:iHkjO39oIo9KOuh5/XwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683818726, "uuid": "e6c89c89-20b3-41f2-927b-5342b805f173", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683818726, "uuid": "dd31e6ed-b434-4d4b-9ff3-469533216e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818726, "uuid": "ca116d15-8771-46fd-81de-7c0e6a4999fb", "value": "8e54faa4631e60bff269c6d9c3d602c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c4f64c-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832300, "uuid": "d37284ea-db09-43b1-8112-a3837e2c87d2", "comment": "Malware payload (AgentTesla)", "value": "b67a90c8381e471791cc4e5f7e43829f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832300, "uuid": "4588fbd8-bea3-4918-a998-4cef7006f362", "comment": "Malware payload (AgentTesla)", "value": "6e19455a9618b20fae8404a9b3c9f4f37d2b2cf032faf61d3837b59bf9497666", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832300, "uuid": "96778110-c704-4a85-8cff-e3b2e5802819", "comment": "Malware payload (AgentTesla)", "value": "7ecac5583356989ae599e6a1a096c791b350e7c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832300, "uuid": "ffd71869-546b-439a-b7d3-20444126d2ae", "comment": "Malware payload (AgentTesla)", "value": "6056deb3887db0faf8390ba00ad8d4ecaf172206de0d4828ed142932b5582c754de4a34ae5e9236757157d03128165d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832300, "uuid": "d0db9623-9440-4d97-98aa-5464741fbe02", "value": "T18555D03A1D85BFE8D26F4DB8D84201D50E97AC775E1853DABCC4BC4671BBA10A648CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832300, "uuid": "81a3f4d9-efb5-4399-b75e-99db3e739593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832300, "uuid": "541a3112-e96f-4bd9-8fb2-6f872c9c43f5", "value": "24576:zCdQy7r3oUV2nJEFQ/S26klFhX1Ar7QemnokIUSSm0U:eXgKF4S2z/XOed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832300, "uuid": "3fa06750-16e7-4b5c-a6d6-4f3e3577e577", "value": 1379840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832300, "uuid": "b6893b6c-24b0-45d2-9ac6-a59c6caa293b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832300, "uuid": "2dff353a-f440-4e71-8de6-0c0dbe6b41a9", "value": "Euro Swift Copy\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6838f7-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1683830239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830239, "uuid": "afa203a4-23ce-4319-b13f-f40a9cb3be30", "comment": "Malware payload (ArkeiStealer)", "value": "fb889bafcc6f226f1e7bfbaec1ae856a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830239, "uuid": "2b6b942b-3d1d-4c5e-9938-219aca3b1995", "comment": "Malware payload (ArkeiStealer)", "value": "6e6061cd2d846e6be7058e35b0dab7f0513038a410a367be304e2e71c0bfb427", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830239, "uuid": "90738c55-d01f-45e3-a79a-af3f272f72a0", "comment": "Malware payload (ArkeiStealer)", "value": "a04fd6e89eba5810017bf68c3a6842111ecdaf0e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830239, "uuid": "b0aba52a-69c7-4a1c-b22f-77ffc65112a8", "comment": "Malware payload (ArkeiStealer)", "value": "2dcf1524d585a87a1dcfe77cf8d7975fdb47d51e7e27a6fdf26a4c408ece3d10553ccfb95af8c025ae3527b9e7a57bc9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830239, "uuid": "8b7669b9-215c-456f-aa21-3b6e4b05566a", "value": "T1F5A47D0362D17C64E6275A728E1EC2F8765EF9518F6D77AF2218EB1F04B21A2C172F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830239, "uuid": "9d56205b-a815-4c43-a0a9-a80038e1ea2a", "value": "6847c4a23533c8db62ddf8eb8d214ba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830239, "uuid": "d03edaa9-b361-4ff3-814f-ddea1b891c9b", "value": "6144:pD7/QKxssbBpImZWE0l5u+EgOBOMxe2H32jrlhQgnC:t7/TxRbBODn5uggE2GHlhQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830239, "uuid": "f116463d-9f1b-4a1f-af92-da0fb7378a71", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830239, "uuid": "a4e1e718-f21f-470e-80dc-f3f9d0b06f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830239, "uuid": "1ea20c01-8f54-4512-a001-4178c5a1cee2", "value": "fb889bafcc6f226f1e7bfbaec1ae856a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acbd31c-efe7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683801272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801272, "uuid": "bb92f14a-6831-41dd-94c7-6efa7f0318cc", "comment": "Malware payload (GuLoader)", "value": "d2346f2d3eee479986100b2956139c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801272, "uuid": "e8e4bb7b-6bab-4b74-bb1d-b4590fd4856e", "comment": "Malware payload (GuLoader)", "value": "6e8d590e962d0889529c725f9159a878899e7f5d65b2870d528b88704d0a747f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801272, "uuid": "fcb499eb-d9a2-4fef-b740-9dbcf2c0a29e", "comment": "Malware payload (GuLoader)", "value": "93dc1351f8f3ba9326abb34288f81f97d496eca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801272, "uuid": "c4eacf42-874c-4774-a678-6e9cc6a58e93", "comment": "Malware payload (GuLoader)", "value": "3c6e128f601afcb9370fbe58955dd15efcb93790e49f37834d241bcfd8c2e4a8a1ed457efa7d855a5585bd5b9cae2c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801272, "uuid": "d73d376f-d353-4f5d-84db-e33690261bc7", "value": "T106F3029133F04863E96B8E310A6773B6E6FE7E11AC185E8B7710BF7F15321529A52342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801272, "uuid": "f994f3b4-54f1-481b-acdb-8fa5f165cc44", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801272, "uuid": "f59880ed-5808-44f0-b86b-773b1d8e2c21", "value": "3072:EwJ52Y7ZoH5XJaqKz8HIoLmMHrqY+rnKUeMyOsJ7x3JKV08xL1/BXL:EwHysqKzL8uY+LKZJ7H8xD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683801272, "uuid": "78fc71cc-0e1b-4c79-9ced-bd5bec129ebe", "value": 171370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683801272, "uuid": "3b19b181-3a19-4ed5-8786-4c9711f15b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801272, "uuid": "411f5498-ca24-4af7-bfa6-d62fee8909c8", "value": "rRGT81091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6275b0-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683829466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829466, "uuid": "50643b9c-8111-4550-bb1d-3f59eef905e6", "comment": "Malware payload (Mirai)", "value": "132792120b1dcad06a5e03810bea8bf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829466, "uuid": "ce5bc583-10ce-44cc-b6d9-a00022910907", "comment": "Malware payload (Mirai)", "value": "6ee28dfd9129e8e996e4331def0f5f1878c96a9686b6f87b4e3b0ac4f2ea2670", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829466, "uuid": "94dc8982-b857-4cc3-8cf6-735548ce3623", "comment": "Malware payload (Mirai)", "value": "1f3fac7d9bfc444cc6da3d03eed23fe26ed74cc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829466, "uuid": "f80cf19c-220d-4ae2-9f3d-ea030100b9ef", "comment": "Malware payload (Mirai)", "value": "9082209b9445439e09874d7d372c4a8da070445e9c884a869412d5cbf6314d5b93aa3e183e0fb594ffd494d4891b90e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829466, "uuid": "552f1bd2-d511-4eaf-9740-12a716d71fdd", "value": "T10F834C02F743C6B3C8830BB2029BAE665931BDAA5E2A9F45F31D3DF46B128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829466, "uuid": "0404478e-0ca7-40e8-bc2a-095219ab58de", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LFxwfhcVmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YBxwfhcVmEwVOz+ucx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829466, "uuid": "8f577397-7121-4c8e-8e9b-e89b33fae5d5", "value": 84996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829466, "uuid": "2b22a274-5a33-428e-b6d0-63f48adf6f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829466, "uuid": "482e573e-830e-4e64-89b7-4dc7096acb09", "value": "132792120b1dcad06a5e03810bea8bf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d646fad-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1683829194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829194, "uuid": "78dfa16e-0426-45d2-a1e6-4f7ba7d31709", "comment": "Malware payload (Lu0Bot)", "value": "dead934a00bace8123d20676d53c10a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829194, "uuid": "4a625d3a-9107-4311-af23-0dec5f40589b", "comment": "Malware payload (Lu0Bot)", "value": "6f7ab51e9f0d382c650743cb3c06b42708cd06d64170a458864e89ad6480a237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829194, "uuid": "67cede8e-bf37-44d6-9c9a-2f49aea86da7", "comment": "Malware payload (Lu0Bot)", "value": "32e6fe2ff280c718ebbec7dfce76eb67d9f5463c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829194, "uuid": "129ef160-d6c1-414d-aa7e-bac72282ee82", "comment": "Malware payload (Lu0Bot)", "value": "350dbfc8f1a3ae47894ea34c1859263485859b857fd6595698409ec78ae4a7b26af43267d1254ce18bf012e978f48e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829194, "uuid": "d45875d9-347e-49f1-ae2d-3e424b8fa74b", "value": "T17BB53372A5C99676FEA453705CF3D3C35730B99186BAC38263946DCA46B37A09C3334A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829194, "uuid": "c55c9788-477b-461a-a510-add731ead78d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829194, "uuid": "1a3048f1-cca3-4590-a5f4-cb197eb8b7d3", "value": "49152:giG5joOS6EeC1WpMxqWgOw41s3zEDDbPRQL5vyADGEf4:yS/HopMxqWg56fjO5TDRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829194, "uuid": "4b6f62c8-472f-4efe-98ca-d4bbeb250451", "value": 2435584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829194, "uuid": "246a0a40-d409-4462-b21c-0510bfc19b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829194, "uuid": "e278ce06-68ad-4a13-b564-fcde1e013052", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501985fc-f035-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1683834728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834728, "uuid": "610a87a7-e451-4e93-abfb-f1f13ccb3083", "comment": "Malware payload (RaccoonStealer)", "value": "2e942319c47888095b2b892637b0f2d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834728, "uuid": "aaac5955-9a08-4e84-8669-090bab01b010", "comment": "Malware payload (RaccoonStealer)", "value": "7089c3dbe04d92d42233960c8b727ef43c154bed9ca7ca89a719a86a5c731f85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834728, "uuid": "55badbed-e1f3-4f1d-b2ec-b2224ed97fea", "comment": "Malware payload (RaccoonStealer)", "value": "fc89590a8752196cb62cdd88c02f90892a860fea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834728, "uuid": "caf16ae7-dade-4427-bcb0-206819ac8946", "comment": "Malware payload (RaccoonStealer)", "value": "d2f0e974a7a14ea80547b5a3124ec30ac78f6d7e20cbecfbee6e4ae7c9a08539cf2d7b81c264d8712bdb0b933127ea40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834728, "uuid": "243b6ce2-0179-4556-8a16-c7a00ac92f0a", "value": "T10B5623F36335099DD081CD395437BEE532F6035B5B82B87898DDBEC12E165E8A622B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834728, "uuid": "4cf70931-c75b-4df7-b060-6bbe539fecc4", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834728, "uuid": "3b132bf3-a63e-4081-90b7-8083cf22e51e", "value": "98304:nSGkVUxN8yLnMAFXYglKEnF/7YbCXQylL2+wRQMUUhXicST60bNh:nYUxKeHVKAF/eCs+8UOycSm0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834728, "uuid": "c7778c3b-ca90-43ed-a996-804e5d1e997f", "value": 6324736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834728, "uuid": "55db7053-2244-4f6b-859e-e7be321eaa5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834728, "uuid": "0c86fa29-562f-444c-8d12-5c725ea57d3a", "value": "2e942319c47888095b2b892637b0f2d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c0c57e-efba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683782156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782156, "uuid": "cb049b9a-e42b-4218-8479-19c1088145b8", "comment": "Malware payload (Loki)", "value": "cffd0cff699acb02d39a2852fb6ffe60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782156, "uuid": "b25629db-6736-4762-b23b-77d9353aa891", "comment": "Malware payload (Loki)", "value": "742131a1637699e12b21aff92f2c1612f00b650eb441497128577c40c424c96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782156, "uuid": "80f48871-6973-4e5c-9238-7951c6420df9", "comment": "Malware payload (Loki)", "value": "c7abd0c4287953c696e36e6697382346abb45ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782156, "uuid": "46fcec8a-b153-499e-8a4a-d5274e0b8c92", "comment": "Malware payload (Loki)", "value": "bba0a3d75ddf2d5f50eddbab87c4de5c443382ac37a28d87927ac2652588a206839e3443465a830fe10e7a8d37581837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782156, "uuid": "6a97873d-1757-4476-9ed4-ba5f9643c3f4", "value": "T1B235B23954BC1623C1B5E2B65E84F451FAC09B927630CD9E6AC28C8A15E7D4E31CBCED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782156, "uuid": "c1c876df-0ad8-4fb5-9fb4-46467c65c459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782156, "uuid": "121b9df8-333b-4c69-a8fe-1863280f5daf", "value": "12288:Vm2XpBM9g4PAc1Y0vvgrPRDV0A84z2Ng8DrODtw66eQu2T32mgW:d6IcvXEDeAHGL36rQusGmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683782156, "uuid": "d2597acc-63c0-4f95-be5a-d107bf5bbccc", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683782156, "uuid": "c4f528f7-c113-42c6-a63e-d55d4f823d98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782156, "uuid": "a88772f9-f02f-474e-a1c3-1cf1344d0677", "value": "Official Re Purchase Order Today.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253986fd-efd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683793854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793854, "uuid": "7277eb74-76fa-48d9-8ff0-a69b8a8f867c", "comment": "Malware payload", "value": "6499c08f0845607c42ca04ec3cf24ca9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793854, "uuid": "3bbd5404-3cce-4b9e-b7b9-deded5df6591", "comment": "Malware payload", "value": "746a154e5586816d0c3c63a84a7974135135b0b6b54f452018a20ad43fe11835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793854, "uuid": "4196ce54-30e2-486f-b184-81e4fbe67f8f", "comment": "Malware payload", "value": "94f4d1ec7974bad86724267799d8ba9ced318100", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793854, "uuid": "1e49d76d-ebd7-4814-a568-505caf41ff11", "comment": "Malware payload", "value": "1f700345e4ba5dd38c7a6d6e8b588b0b65d032b6a3133d2eeec5486c83cc0bb5e73cc581f0e27df3b2c86333a3e8435b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793854, "uuid": "28d8e6b0-8251-4997-8d48-05d0af565413", "value": "T1DB13865A6A22AFECF76A473503B74E30635C23D666A0DA89E27CD5100FB014D259FFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793854, "uuid": "de6c806f-0fa6-4a31-9069-e040466e1a84", "value": "768:f0U+ADR8ZO/fhrBZWBEryiY8BZXDn5mOHk9HyCZ8h:f0UbWZM9OZ8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793854, "uuid": "5ff8597c-88fd-4479-8c43-a4fd1691968c", "value": 42124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793854, "uuid": "bac0473b-ef6f-4a1b-96eb-d9815a9600ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793854, "uuid": "6c0edb5f-f969-4afa-8b03-88536f8179ef", "value": "SecuriteInfo.com.Trojan.Generic.33590140.31541.9890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7041f6-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829838, "uuid": "1c657eb0-b94c-4324-aa9e-5f0221d24264", "comment": "Malware payload (SnakeKeylogger)", "value": "803beb75e78efa0450bd6bf0fdd5cae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829838, "uuid": "f76453ba-8b6c-4462-8e2c-f4ce0ab1ddc4", "comment": "Malware payload (SnakeKeylogger)", "value": "750d5447adae2c21802da6fb6a7374f50563ca0cf99382510d60cf9c94995a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829838, "uuid": "bf474810-4ecb-4ef9-9992-abc41617005c", "comment": "Malware payload (SnakeKeylogger)", "value": "22b7a7f89c868805ff5d838790aa7f6b40120288", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829838, "uuid": "4034dc57-066b-423b-91a9-e843f4cc93ef", "comment": "Malware payload (SnakeKeylogger)", "value": "05a84c2732218c4a91965e77186ffe08792b3b78cede5abf6f09af72d4d801eae5cf8bfc78eeb0fa9dc13f2507b41f9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829838, "uuid": "38cd126f-7e43-4aaa-a345-4de17cd31e5f", "value": "T14BD4D0886237B8DEC455867165543C628E3D7123727D60BCA42B748CCD9EDA2CFE4AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829838, "uuid": "aa08139e-5975-4aa7-b80e-88d5855dd275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829838, "uuid": "404c8ea0-396e-4f8b-a38d-fb6cb2dd7297", "value": "12288:imYCfCIoKjm1+qd+kfHlrRk/oTAqy7GhDS0R2gK5OY3pP9tKg:imNqXh1+lkfHlLTAxQSK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829838, "uuid": "cbfc48d3-6353-419c-b6ed-f30c76cab356", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829838, "uuid": "678abd85-ad96-4cc6-a89d-e35bf62fe11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829838, "uuid": "79ffe85f-659b-4975-b996-b70bde521b87", "value": "Quote - V-23-IPY-081-E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2d85ae-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683829948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829948, "uuid": "173e2393-8c45-4d9e-96ae-4ae96e6f878e", "comment": "Malware payload (Smoke Loader)", "value": "139001a1c4c7ac0a8f15b316071a71fd", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829948, "uuid": "44798bc3-fc71-49a7-a164-475e3f768327", "comment": "Malware payload (Smoke Loader)", "value": "75b564c61fdd7b8ae7e5c94b4aa3fcaec494d55a2497212c7e19cc821d7e7fba", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829948, "uuid": "a0a569b0-342e-4a94-8db2-8d35718d23fe", "comment": "Malware payload (Smoke Loader)", "value": "5325290e3c8b0ffe8f07ab7b584b2bea8fd529c6", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829948, "uuid": "a7dc312c-8830-4a90-8129-7e9a1ea63abd", "comment": "Malware payload (Smoke Loader)", "value": "d96e161d7c4678cd20d6cad1bdf5e7d393f5061337f428651fb213be65902ebb4645000222136779b83eeffb4a76dc9a", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829948, "uuid": "a68b62b5-ab3f-48b2-955f-9f5783e29e72", "value": "T1BB642C23D2A33C54E9264B729E2EC6EC361EF3504F597B6E12149E5F05B12B2C173B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829948, "uuid": "e3d39641-8ebf-48f2-9479-648001330640", "value": "4062e3723fc172742e77f31966f99ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829948, "uuid": "55a0cca7-5e0e-4a4e-a495-d240950ea3b9", "value": "3072:FwpXTpzTLjzYDnssJireNSuggFVNWAi5lM0IBf7zqiZJ75cf+4cRfeh:FI9XLjz6nsssYSugwMl/y6f+4cQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829948, "uuid": "78ff1b0f-6b45-4b19-b8ce-f6285f28ed77", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829948, "uuid": "74f1befe-0074-43e9-9062-1f9faee29daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829948, "uuid": "4112ba74-35e0-4317-a177-3d0a81b21cc5", "value": "139001a1c4c7ac0a8f15b316071a71fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9fd03e-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828978, "uuid": "805358f9-1a6a-4812-9022-d23abd6da052", "comment": "Malware payload (Mirai)", "value": "243312ca5e1772e3e211bd3346d8d4a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828978, "uuid": "9e8c8a71-afbd-4d80-8039-fa62dcb639bd", "comment": "Malware payload (Mirai)", "value": "76829ac358ad8161843c45b67946b1bb7f4defe09137dca4baf2be359cb80a35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828978, "uuid": "8c31db43-cac3-44b0-8229-d47ef5905148", "comment": "Malware payload (Mirai)", "value": "2fc933ac30a7289a001f6665e0255a4274ebf1c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828978, "uuid": "9d95be3e-3f75-4bee-ac00-d7f737f61ab2", "comment": "Malware payload (Mirai)", "value": "413bd8116976026c5cd7292b6747d450fa4847a842701eed42533c760aee707d315e7da632a653212f1a14f10326d1c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828978, "uuid": "e01e35d2-ab84-4841-81c4-c323cd6a6a08", "value": "T1DEC39517BB618EB7D81FDE3305AA4902108DE58A12D96F6FB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828978, "uuid": "67e0eed3-34ff-465b-b679-a65a92dba149", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpK+DlIrmW+IFB1Df11hR/:/UyLqAmgMJM8EI+DlIrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828978, "uuid": "f759e9f7-1dad-4463-a693-5709d0a2fe5e", "value": 126039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828978, "uuid": "68b37d33-9df2-46e6-9f09-db51d92acd6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828978, "uuid": "80cf9a88-6872-4dc1-b59a-8e467170137e", "value": "243312ca5e1772e3e211bd3346d8d4a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5701995a-f01d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683824432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683824432, "uuid": "a6c2b5b3-f938-4855-a64b-de473a23b1bc", "comment": "Malware payload (RedLineStealer)", "value": "f17f080c62943ff31a1a81fa04bc172b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683824432, "uuid": "0668af95-cc77-4a79-867e-561801d3b4aa", "comment": "Malware payload (RedLineStealer)", "value": "7917c41177e8899a1c61ad77133af340bd3d66f3a5fd2009d879aa154f5e84a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683824432, "uuid": "9f60ba41-a6e6-4a80-b8ee-7033df5db626", "comment": "Malware payload (RedLineStealer)", "value": "f53540c23382e949794525403bebeb38d10aa18a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683824432, "uuid": "0ad8a163-6aa3-42a7-ad06-c5178179f9f5", "comment": "Malware payload (RedLineStealer)", "value": "8f1c7f4784b795211bbca2c71e9dd56e42f1a52b5c2b535d1677329f3e623e661b78bc7274a4fa89ff9e9715775991c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683824432, "uuid": "3ec019da-38bd-42f5-97ba-515f3c8e65ba", "value": "T1FBF41203E6D85473E9B8477058FA02C3173ABDA05974939B2B416D1B1CB36A4F936B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683824432, "uuid": "e5485562-9f4b-4fe8-8628-089718516585", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683824432, "uuid": "8c1f8a14-b7a1-4428-9a19-8e2dfc7d35e6", "value": "12288:GMriy90adpprOgJeBPl/9ZYiPyy95cvCuC79kKDOfManl7iM73HT6M0PtlNUWSBP:cy1vJQ1TZaGaIkfMalOaOM0P3lz0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683824432, "uuid": "85fa3524-8237-439a-bcf1-cffd54b26726", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683824432, "uuid": "c9d193c6-7c78-4c20-ae8c-5583816ce5fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683824432, "uuid": "41cacd36-9071-4510-9992-8125a850cc6c", "value": "f17f080c62943ff31a1a81fa04bc172b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3312362e-f037-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683835538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835538, "uuid": "244d5bd1-03f1-48c2-bc1b-50708abf1781", "comment": "Malware payload (Amadey)", "value": "6ddba15e66e37ec9559992fa2ff21151", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835538, "uuid": "d8e5c890-9441-4ea0-a128-801211c91304", "comment": "Malware payload (Amadey)", "value": "7981dfe76ee4e72288606401eb70eace1130a1e046d56c06174e7071098e07bc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835538, "uuid": "892cb543-f6c6-46da-b39e-956f53823d99", "comment": "Malware payload (Amadey)", "value": "23f13b3fee900541a9695dfdc60f93ad9a007d96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835538, "uuid": "b5182707-79da-4623-be0b-1cf22aee64ed", "comment": "Malware payload (Amadey)", "value": "ba4d731a46790dc8c85e1af0bdb7c3a63957cd88971d806c7e69ec2c22d1d2d7eab986d6a2517224ef8bf9bd06116a5e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835538, "uuid": "7a14eb75-58fd-4c2e-b5c2-05d687e3f897", "value": "T12D2523A2BAE88473EAB493318DF6029317B9BDE04D1507633F89F8554D73A90947173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835538, "uuid": "99bd64bb-710b-48b7-bed3-745c8ff38e89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835538, "uuid": "19c24fdf-b930-4dc4-af97-cf54144d75bd", "value": "24576:Cy4x7ML8tuvNKCBgWpLed780h4Tvlb8v:p4x7ML88vECmWVed780yvlb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683835538, "uuid": "71f168dd-6a78-4542-9f04-1b4366486a2c", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683835538, "uuid": "48a08502-da6f-42d9-8af7-e45a0953e44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835538, "uuid": "ea38a97c-f77b-42c8-825e-1a47de07aaa8", "value": "6ddba15e66e37ec9559992fa2ff21151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8df026-eff9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1683808868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808868, "uuid": "4899d950-1fec-43b8-8f18-ae23105ef95c", "comment": "Malware payload (AZORult)", "value": "f73c911c5f5191bd04380be95af6c871", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808868, "uuid": "2c9a06a9-53fe-4475-a4e7-1a21fa3f4ba5", "comment": "Malware payload (AZORult)", "value": "79a7c9d15971c14d78baccbf211b3ca1e9adcb0befc6d3d1c5d92902d70678e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808868, "uuid": "be79a918-3fd8-4586-905c-191ed9138f9d", "comment": "Malware payload (AZORult)", "value": "0b7a3073fc4577f9084756e5bac8f1161d175106", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808868, "uuid": "09d50f48-a4d6-49ed-a373-478b959fd6cb", "comment": "Malware payload (AZORult)", "value": "770fbcc01f122be3d32590443a5eea8c3fadc4fed8af2cb6516cc7a4d48a50217f18719d0347098dec9812866cd3b5a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808868, "uuid": "4c38382a-60e2-4524-9e76-7bc60e37a218", "value": "T128D523305F467C2FDBBC1A38F09F2F180D611EA7810CA4AF6949998546FF794AB92C74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808868, "uuid": "18bc9dff-75a8-4b00-b194-c000c9e5322e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808868, "uuid": "22ff91e2-bafc-4877-9cab-001b71bd1d5f", "value": "49152:BkmDyTgAKWAoP3JBTMF7PYye44vXpjBP:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683808868, "uuid": "248a1805-e878-4aa6-bf04-86418920c020", "value": 2975232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683808868, "uuid": "e0bc4932-fb69-4101-b68f-b6c2953926dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808868, "uuid": "d1a418cc-f397-440e-a12a-e8fe0c3a0714", "value": "f73c911c5f5191bd04380be95af6c871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84b1782-f00e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683818126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818126, "uuid": "a50d6c07-db01-4ee3-be5c-d5e853f8801a", "comment": "Malware payload (RedLineStealer)", "value": "f50094e68114cdd59019a534fce4fb17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818126, "uuid": "fc63de48-d872-4ad4-be8a-f382c32c171d", "comment": "Malware payload (RedLineStealer)", "value": "7a1e764ffbc42d4e9ce414e4f6deb4f44dbe39f2ea4d2ba7b48aaa480e1b4536", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818126, "uuid": "9948a9ab-14f4-4b8d-87ef-5b933ded5415", "comment": "Malware payload (RedLineStealer)", "value": "ff5b9010d022c1778cc9faa610e0bb74f005cd7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683818126, "uuid": "b23a2e3d-f299-4eff-82b3-552496f1e931", "comment": "Malware payload (RedLineStealer)", "value": "dcf95f65f22e37f93c81c0dc73f4b49fa0e36ec009276917c239aef7bbd769c725b27a109dc062828d615c6a0af5ae4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818126, "uuid": "bd3a3243-0039-4760-a4ca-227437a6a793", "value": "T151F41212B7C45073E87827B159F643870B3ABCE0AE31D36B3681689D6CB2265797137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818126, "uuid": "5b71c50c-0c92-4f9b-a181-ac4e1286e695", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818126, "uuid": "f974f92d-e4f5-4aa9-bd97-20107fba1848", "value": "12288:DMrty90KFkVwL+AQiTnenJRODJVu5MEOwGps682sWIRfVFyhmJTRUCpCGx7qtt:qy3MLiTeJROjCrgEWWTJTWCgIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683818126, "uuid": "80bcfe47-6f14-43ab-95ce-ab7832db761b", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683818126, "uuid": "8fe304ec-5f12-46db-b9e4-3b9b52a6928d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683818126, "uuid": "5d71f492-cc68-442c-9542-79efe1a688da", "value": "f50094e68114cdd59019a534fce4fb17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca1b4ca-efde-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683797410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797410, "uuid": "7df20273-efee-4c8f-9595-f9099cdbbd27", "comment": "Malware payload (RedLineStealer)", "value": "c160a5c705cbe28df0ce50ab03c5fe76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797410, "uuid": "ee85abde-cd50-4ecd-a1dc-bd0f8fc80c01", "comment": "Malware payload (RedLineStealer)", "value": "7ad4f4717e68ad2d2325c6c039c2b0875890ad9d0baba986d868535680591923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797410, "uuid": "bea92cc5-0781-4946-8b27-0acda60d18c1", "comment": "Malware payload (RedLineStealer)", "value": "d99c145eadf0cd98cda887f065559224210702e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797410, "uuid": "820c0cea-2680-40bf-93dd-4326326f1592", "comment": "Malware payload (RedLineStealer)", "value": "6bf4bae15f3b9b22feb88fdb1a8ab4a6b2c862d6c6498d46921bac3efb42421edb832b1aec1839ac4263f32f86feb8e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797410, "uuid": "78d3fa66-97b5-4c57-b822-49928cc1b3a1", "value": "T1DF948D13E2D37FD0E52A4632BE1EC6F4661EF9588E4927AF12256E2F097C0B1C162735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797410, "uuid": "954540f0-9328-4102-ba80-ad95ccf3e6c1", "value": "8782517e36f7985d0bf5e74e708684c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797410, "uuid": "7844c3f5-06dd-450a-9af8-3c3840a0d3a4", "value": "6144:uijHTbQyltBCWxhUKW7R9zU2XkIZq7arWklA0BqYuJEvX:xjHTbPzBHx6RXXlWyBPuJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683797410, "uuid": "f363aafe-fe90-4a24-921c-1c1cc22f1458", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683797410, "uuid": "af079db9-add2-44b0-8138-b0ca362650af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797410, "uuid": "32f73004-b17e-4e08-a88c-2d4e934d6220", "value": "c160a5c705cbe28df0ce50ab03c5fe76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917addcf-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683830113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830113, "uuid": "0be1abd2-454f-4523-82cb-847ec6c0e2ad", "comment": "Malware payload (NanoCore)", "value": "dfa13488e17563586e4f0f5348232714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830113, "uuid": "445471c4-2433-4d30-a712-811de268ee99", "comment": "Malware payload (NanoCore)", "value": "7ade8e9cc5023375d100ff66a55971fe3b7a06e73edaec66ed0595b9f252b52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830113, "uuid": "81bfc701-bcc1-41d5-8e65-89e5d9aebe4e", "comment": "Malware payload (NanoCore)", "value": "b28e1dc461365486b8e2355dd5be9ab363c3685a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830113, "uuid": "285b3ab4-d85f-44cc-aba8-b73453223f2e", "comment": "Malware payload (NanoCore)", "value": "28e7315271ef38724cd464154545d75ef6f172253bc8b70450ab8afee58615e79c213b916826d4f1dd43e9782eeec10a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830113, "uuid": "6875f510-2663-48d3-ac79-3ea3133ddd7a", "value": "T11927C03EB7E58E62D7691B30C03272142334CC9640D6E31B999D7EEAD8913C5E149DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830113, "uuid": "f370fc55-07db-4d98-b056-e32aa340ae2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830113, "uuid": "69dd4bec-73da-493e-81f6-3b8c432be148", "value": "12288:S8SnG5jbNCUZLHVaaj7uTPUn0S6M8RLO4VsypU:SjnG5lCEGTBM8RLTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830113, "uuid": "d8b429cd-6c4a-4a3e-92f4-947f8ee290fb", "value": 20872954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830113, "uuid": "8c8d3510-1666-4b06-af3d-0211648f2c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830113, "uuid": "c5b59fa2-4307-4e0a-a982-54777eca705d", "value": "dfa13488e17563586e4f0f5348232714.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671f1341-f034-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683834337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834337, "uuid": "92dca8b1-4632-43ec-8e4d-ae6111e1bb90", "comment": "Malware payload (RedLineStealer)", "value": "e87fee04570a98fc4dde77180f2f4ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834337, "uuid": "37a2eb1d-892d-4998-8b21-bbe81a2a0570", "comment": "Malware payload (RedLineStealer)", "value": "7b2bb81094e7101575a83998a08d5edb88f0559489b1515e7af29daf64b97117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834337, "uuid": "3b034c36-a9af-4181-a50b-473f3ff95aed", "comment": "Malware payload (RedLineStealer)", "value": "8e7e3fc5bcab9561f455ff592e49089821477dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834337, "uuid": "999bb2f1-b066-4706-80a7-77e939d14f51", "comment": "Malware payload (RedLineStealer)", "value": "6239411c267f515551e4d74db5f4d7c3f5084fa05e4a2ce999d8c698902a01cd136fe6b70468d917d0d250cc79452dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834337, "uuid": "28d80abd-ef71-493b-9bc9-b71938631143", "value": "T11B15225695D4C473E8B217F158F20797163E7CB01AB84637379AAD1B0CF3984A832B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834337, "uuid": "f07d77ad-ca38-4e74-ab07-1b3bcb919f63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834337, "uuid": "a99a1164-5a8c-41e3-bebe-56350b189d0e", "value": "12288:4Mr4y90eBK+Y74X35U7Yyx9nRpknJbm4wpP0IHAUSdNobQKPyvdrGVy8ief:Ay3YNEk9fknJS/0IHARdchPyvdZTef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834337, "uuid": "e115218f-9338-4ee7-8ee4-680deafed7e4", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834337, "uuid": "e5fe8ca4-8faa-4246-b9c5-b8789b007cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834337, "uuid": "772077f8-67b2-426b-ad6e-cca5a9ae5a21", "value": "e87fee04570a98fc4dde77180f2f4ce1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8f86ee-efec-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683803260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803260, "uuid": "53bb68c0-21d1-4a71-8c9c-511a3d214d25", "comment": "Malware payload", "value": "aa43e29cd474e0d27e1f4ccfc1843ece", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803260, "uuid": "168180e5-7a14-4d08-879e-4332d96ba07c", "comment": "Malware payload", "value": "7bc0a0cf26e9078984379a5f57ea563fb7c60fe30dce89fe306f1ee335b1a80a", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803260, "uuid": "d92ccd04-0960-48b6-bdeb-466ef0024358", "comment": "Malware payload", "value": "9dd751117e603e5894d3294c0ad80712cbd0bea8", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803260, "uuid": "f5f284bd-6e5f-4afc-9e6f-5d782a62eb74", "comment": "Malware payload", "value": "acc8214985a1fb87cdb2a4a82513fc46cac539ab1c2ef5ccec0cbf9539cfd636d4e7b90324cfbc42dd0fd01fa1627d49", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683803260, "uuid": "857d1f9f-2fcc-45c5-8735-9f6e7a34032e", "value": "T16EC3E181BDD7616EFA643277B1940C51C2BD8903D9DF195E58F90702D0D332ABB62DA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683803260, "uuid": "d4a8e9da-ac8c-4805-9cd6-7f8a44302e93", "value": "768:BnHBSe5+LCg4SxMKfdt+ygbCC70MV7ED8sSXX1sCMuh:O+zSxlHXgqMVbXs4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683803260, "uuid": "d516a525-033f-437c-801b-2b48c14794a7", "value": 129235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683803260, "uuid": "9c8e6238-28f7-422b-a749-e720ace8ded8", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683803260, "uuid": "7c835bd3-795a-4cb8-b3b7-7a1fff0d40dd", "value": "DeutscheXBank_Zahlungskopie_11052023_EU532000044555120110002.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff17e08b-efd3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683792931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792931, "uuid": "47f546a1-db30-44d5-bd93-55a9d3917818", "comment": "Malware payload (RedLineStealer)", "value": "45e4b3216f32d7c202ed0432be6da8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792931, "uuid": "9b3b80bb-5186-4336-bd26-19eb4f6eacc5", "comment": "Malware payload (RedLineStealer)", "value": "7c8364187a059506add600649e4b4b3115ac9dc4b171ec58ad542c5623fb2abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792931, "uuid": "5c4901a4-fbde-47f8-8fcc-8a8b5900bcb3", "comment": "Malware payload (RedLineStealer)", "value": "528f718bc7251eade4aa34985c3b54946f6b86c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683792931, "uuid": "4c2aa4a7-2031-4eac-8082-485966a14602", "comment": "Malware payload (RedLineStealer)", "value": "bb16bad3ac6c1c4bb355d452eebbb54d0a8c1bce70755efc83ee3e0d27a7b71cc05cb63d203807cea796e80e89de39bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792931, "uuid": "71012574-2136-420a-8a0a-8ef3ea577aa9", "value": "T1F9F41203A7EC4037D9B523B058F653D30A39FC619978939B2781692B1DB27E19431BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792931, "uuid": "b837eccc-5c9d-48cb-bbe7-a28098212416", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792931, "uuid": "8662783e-0e42-4dbe-8115-fa6fcc8acce1", "value": "12288:lMrfy90J8go1fubemA2rX1pbHDuLu46GKdOiOaHHmIPxWarwf/NOJzQCV:ayyoZuC+pbHKHiOaHGIZWaFBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683792931, "uuid": "b740f831-38af-44ed-8074-f81e36ecdaba", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683792931, "uuid": "cff36327-8f9a-4746-a629-18e63d85ae9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683792931, "uuid": "768208d7-542d-4805-a787-fa8e233191e9", "value": "45e4b3216f32d7c202ed0432be6da8eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8cda65-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683830244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830244, "uuid": "2acbf774-25c9-4947-ab85-6164657c540c", "comment": "Malware payload", "value": "ceef6967671ba1939250694d1a65beba", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830244, "uuid": "fe3c3c8a-61e8-44e9-9de6-629d76166fdf", "comment": "Malware payload", "value": "7cb0fe889fd1c910bbebd9b3a9cde06816cc755a3ee928ec22fe54acc54662b1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830244, "uuid": "8b6faaf7-451f-4d0a-8add-78254da8131a", "comment": "Malware payload", "value": "02242266f7ebd8f9e230e62c4bc459824457bb7b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830244, "uuid": "ef94f586-7731-441e-97bc-6216dbf1dfac", "comment": "Malware payload", "value": "e144bbd095d9c17e877a9473b3a57b131546f82203fad86557979bf66cd2df3d28320ad545267bf0a5c592e2d41b3e0e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830244, "uuid": "b5f8567c-5239-4bc5-988c-1d87f2ceb581", "value": "T1E43501129588CD8EE18187FA7A62B84C431DBE7772C570C73A4C774BAB31EBA559B00D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830244, "uuid": "3b0094bd-16d2-4d87-9cfc-6e9799944b6c", "value": "24576:qLKVWQmmav30xdWJWQmmav30xY/G+MXUm+MXU8M7OwPO6FR3pw:qLKUQmmQ30HQmmQ30D+MXZ+MXc7LO6Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830244, "uuid": "3bb9b937-c9b2-4839-926d-15d5f9494601", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830244, "uuid": "21dcfbf9-4631-4ac2-975a-ee2140d949da", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830244, "uuid": "dda30e74-77ff-4d56-8572-eec267c5826b", "value": "SOA_Offer.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e682a9d-f02b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683830377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830377, "uuid": "9303fc25-18d7-4467-99d7-2d350b4c150b", "comment": "Malware payload", "value": "c671d060a9c3c373eda1a6916d299716", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830377, "uuid": "1c86a673-2f09-4aee-a95d-24bd99eefbfa", "comment": "Malware payload", "value": "7f4c7936519ddff6db33783d2563b2cd98664a6d41ce1ac6fe7e59d0e920289e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830377, "uuid": "52b959cc-59c8-4207-a095-5dbe5179a433", "comment": "Malware payload", "value": "f8f65f1bb1fec8d1eff0284abc61707a3a701c01", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830377, "uuid": "553362e5-7fc4-4148-83f6-16aa7dbe9860", "comment": "Malware payload", "value": "d95db48af0df5ac6ad99bb1b3d60fc1a459e4f117c84ac9ba89b793f90078acd0e0b718c370ea9e512ea8acd1c8726c3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830377, "uuid": "5514fa7c-8ada-452c-aa3c-968d2bcdd1eb", "value": "T118868E13B285A53ED0AF4A3A5837E754643F7FA12B21CC8B6BF4294C4E34580A977727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830377, "uuid": "e1a1c66c-5100-491c-9cf5-d0d416ecd879", "value": "98304:2GPTZMdoMfEJqf+Pc79a3wwVfwiMyMvAWlijxatR9/ZPH85N:bP1wosEwwVa+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830377, "uuid": "eba379ae-5836-4b97-87c4-4ddd1c122cee", "value": 8355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830377, "uuid": "25ee4805-2e8e-441e-81c4-67dc5ca63ea1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830377, "uuid": "ff80d76f-558c-4fcf-a4f9-d9124e7255c0", "value": "Factura-vencida-121rmy.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b1fa3e-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683789718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789718, "uuid": "63dd2618-ea7d-454e-9737-fd7d6fb68ce8", "comment": "Malware payload (GuLoader)", "value": "2de260366aa32d37b4959c9c31f6280b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789718, "uuid": "f7f087ae-b98c-4da0-8acf-f302a75b57ab", "comment": "Malware payload (GuLoader)", "value": "800990d0d71ba682aee865f67ccc3088b709512ab5184b1d28eb9007a71cd5aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789718, "uuid": "9a9926df-7a82-4a3d-b860-7871609dae73", "comment": "Malware payload (GuLoader)", "value": "bc5c86429b690d058001930dbe9319970b43271a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789718, "uuid": "1f8a2f6a-f4a4-4afb-ae69-dc4f6d4deef7", "comment": "Malware payload (GuLoader)", "value": "0f77c5d1058e6d550e43e4934c5f1f65dc1f567032c439270f95245b2ca0c31a111e220a900e480f12da00c5af3f3d59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789718, "uuid": "aa4ff5a0-f2ed-40a3-8e52-66f9864cc369", "value": "T1949423806751C137E9530AB11A32E6777A7BF1385AD16B4B23A02E8D7D722430F5BA2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789718, "uuid": "3976d957-7eeb-4535-905a-a23ca6db8261", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789718, "uuid": "4c603228-f1c0-4340-a134-8f4a08772a43", "value": "6144:dQ606xoqCeQJ93nRVdHEqC/lKFfPPh/MGbTpImH0Rtyny0SBKveETDZ3KLMyWiIT:qeYddm/Yp/MSEOlSBKv7TDXbd4H6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789718, "uuid": "c10ce7f6-b7de-4212-9682-ec811e4ac886", "value": 443200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789718, "uuid": "43f8221e-3835-433c-a570-b95b18f99366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789718, "uuid": "4d181a0c-fce0-4979-9f95-a17f3b9ed69e", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d682b8b-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683789600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789600, "uuid": "e621be07-f77a-4898-956f-154cfb549e15", "comment": "Malware payload (AgentTesla)", "value": "dbbd52e30a83af21ddabdd7d20576a6e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789600, "uuid": "2ea767a8-ff8c-4547-a8ba-a870050b812a", "comment": "Malware payload (AgentTesla)", "value": "8048387e6acbcc48dac3e00ed64ed1c068e54d5c473d564432b8e980d129592f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789600, "uuid": "43a627fb-5531-4c33-90b7-e5c804678973", "comment": "Malware payload (AgentTesla)", "value": "bcb3ee8ebce8e8fdb811be108f61790d067d85dc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789600, "uuid": "e1ab5c9f-a5ad-49c7-b185-aa41aac63025", "comment": "Malware payload (AgentTesla)", "value": "06ec776c0c86c9edb87d837e340c11d7ff4013c13c10aa62ffd4495ce6178c3dd8fb757b8e8a10005c55cf032312840b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789600, "uuid": "11cdbf21-040e-4bc2-9a3c-8ad4081330d5", "value": "T11A053308E7A3E0C427D787214251F5E2A89EDD42A6CCB5C7758A942E60BF338D5DCC6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789600, "uuid": "96a39671-f585-4f11-a7a1-88bb27563288", "value": "12288:O+YV8pQhMxZr26sDjc8o2WY7dKwdkvw/2eP648olZz/Kjvra+34Y616KEJWRps+V:oV8pQRFkGdd+w/c48olB/Av2DYE6CRxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789600, "uuid": "1e6979b5-b194-417b-8dab-13e820b93e38", "value": 807971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789600, "uuid": "1e8d1473-32b8-4288-8efa-967ceb240c6c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789600, "uuid": "b93b7cf4-9995-4bef-9209-3f0f8a37998c", "value": "Purchase Order 236pdf_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f5bbf6-f020-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683825911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825911, "uuid": "3bc3ac47-b15b-4613-86e4-890cc2dfee30", "comment": "Malware payload", "value": "92188f68cfaf42d02c08fbf7c9b0ab94", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825911, "uuid": "d7d12508-b4d6-4143-9811-b7a83eac30ad", "comment": "Malware payload", "value": "812f2741f662194744b33d6e51c4fbe11823d06e90938865aa4517974a072bc1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825911, "uuid": "58c5e911-ad65-4793-9721-7cff293cd0e5", "comment": "Malware payload", "value": "d3934499d027d04e53792b69daa806a6f3248da8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825911, "uuid": "4ecfe09a-a502-4865-8ffb-5029b67f34f7", "comment": "Malware payload", "value": "27d3e2cb12ccb4ff599ec597f503abd1f9ab66e537ad3c87962882b5f25bde90539e8f7ecf7d113808c1c79cd191d5ae", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825911, "uuid": "5315f780-d734-48cd-9c4b-ddd1a6208cb1", "value": "T1A88523310A073DB9CB784A3CE0571F5C5D995D7B827890E879ED11E611BBE00BB9AC36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825911, "uuid": "ea4f371b-6b19-4ce6-ba2a-9b5822d882c7", "value": "24576:C+gJBH23Ac215BbghCf4K0CCGhpYxLsHA/bEVzljEUjOyaejvnwp5TmaE5CwWJed:kBz/b/bKgmbEVzlqOMNGSQo24sjT7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683825911, "uuid": "0a034c9c-c7d3-4891-8dd1-cd04c9625393", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683825911, "uuid": "6e01bf20-121a-491e-bd78-6ffc65e11f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825911, "uuid": "5b6099d5-ee61-4885-9a07-a87cbda37717", "value": "92188f68cfaf42d02c08fbf7c9b0ab94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fca00ab-efcb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683789147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789147, "uuid": "bc6858a7-ba8e-43f2-8206-18a2118ca25e", "comment": "Malware payload (Amadey)", "value": "5c89ffb8af9a7ffe96f3e643c27eaa8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789147, "uuid": "105c1fa7-7fea-4287-8c56-41844e5d3d24", "comment": "Malware payload (Amadey)", "value": "81d3eb8e866a2fee2f1d89c2348bcc52004ba9c292aa5c347e5b76706ac3866d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789147, "uuid": "561e7dca-311d-4a7d-afc4-2074bce7f83b", "comment": "Malware payload (Amadey)", "value": "236144a1d6b0db957afff26296a73d3d6da9c8c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789147, "uuid": "45d6cbac-dc7b-4690-ae3c-2e1373ea6799", "comment": "Malware payload (Amadey)", "value": "51c0415b02a35bd17132dfc8eff8f61422d56d5194126a01c210426259d624f32403c06f827c28c90ca374e84931f6f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789147, "uuid": "9956e7d4-8669-4926-bc7a-4166a103134f", "value": "T11BF42367E3D89432D9B937B028F347A30A3D3D914A7882777349592B0D722C476B2B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789147, "uuid": "f614aa61-d417-4c14-9365-6cdac9077b44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789147, "uuid": "6fda2f27-e643-4c34-8280-87ad92fa7619", "value": "24576:SytAUVrJ/Z3dsTHF3WBWqiSFn6yMOsFf8m:5qut/ZqTl3WBTMOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789147, "uuid": "b2fb4748-27b0-4b97-83e0-54e49c9350f6", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789147, "uuid": "a4057190-2687-4ba8-8c1f-a534997df1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789147, "uuid": "6dfce48a-92ba-4c2a-8d1a-3eced82fd594", "value": "5c89ffb8af9a7ffe96f3e643c27eaa8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a50a24d-efcd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683790078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790078, "uuid": "3fbd0511-e2b7-495f-a6e6-11098fef51da", "comment": "Malware payload (GuLoader)", "value": "5d02e9834d5a3a6465aa8fa7f6b51490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790078, "uuid": "a9f20554-496b-4ed0-928b-a719d6644220", "comment": "Malware payload (GuLoader)", "value": "82135f6f510ef27ec3e78249e0d2bf276a8890385b47e65391756b7f254c487b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790078, "uuid": "2979d89d-c33a-4c59-95e5-aa614e3237b8", "comment": "Malware payload (GuLoader)", "value": "fa94cfebae5c55a70c175e6f26641d7561d727e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790078, "uuid": "cc59e422-087c-47f5-826b-ce53c108b4a8", "comment": "Malware payload (GuLoader)", "value": "5bd87d2b672e0eb2962399533d98ab67f36bab2abf331df9fe78b1d33229a4763777668c1c8911465e189342262a8685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790078, "uuid": "9f1272e1-00e3-4491-8900-62f67eb494fb", "value": "T1A7B412113F25A4A3C6E64A32694F865E2F707CE528510B7F3778B76E2C70291CA1A37D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790078, "uuid": "53d9edf1-0253-4866-b45f-34cee135ef92", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790078, "uuid": "6515dade-be10-4dc8-92a6-2010af9cea73", "value": "12288:Wzd8UZp23enmUF0NAGvsmEhzkCDlFMddoudBYM4:WRBZpkmF7GEXJkqlFo7d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683790078, "uuid": "9216a7d4-353b-4881-b9cd-a35d3a3061cf", "value": 500832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683790078, "uuid": "495a6f49-0411-4304-9135-dbfb3af54fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790078, "uuid": "dd8def7a-0844-4866-a797-11307b0d89c9", "value": "RFQ DOC0029928938211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a08c623-efb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683780950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780950, "uuid": "df862023-bff8-4944-9988-b2f54f3035e0", "comment": "Malware payload (RedLineStealer)", "value": "38259395efec45954c2d200842e41cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780950, "uuid": "b0660549-7d23-4748-87ae-b926c91be48f", "comment": "Malware payload (RedLineStealer)", "value": "8217be8d38b6ff597ae5b01ee3b185a149d97f4cc55c700610b27d04af19b9d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780950, "uuid": "5a6eceeb-7b11-453c-86e1-45ccc96cee88", "comment": "Malware payload (RedLineStealer)", "value": "5f2bef76cc523b5d70c90f44ce28eb1980d551b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780950, "uuid": "7a8ae8a7-271a-4025-ad41-afd51c95073e", "comment": "Malware payload (RedLineStealer)", "value": "5a85d4b6857a1da33f747ea3a930937195fcf9ac0bcb6987bfe73b87cdb504518d0ee5ae3933caeed13610a60015e60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780950, "uuid": "97821c40-2e04-49e9-a722-f54f92cc1038", "value": "T107051252E7D94162D8F61BB01DF307930F35BCE25DB8436B3645688A1EB2AE0A47173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780950, "uuid": "290f44bd-c35c-436b-a39f-972c41126914", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780950, "uuid": "81583bdd-1fd8-4f19-81c9-3cf504d6b8d8", "value": "24576:kyG83nva2rrwDeqNlPE7TpOkT3ngyYYmR0cMm:zGqvJrbkP+TjgrYmJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683780950, "uuid": "ddeb2d06-f958-4b11-b97e-2284eeb165d8", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683780950, "uuid": "1f8bb7be-c106-4d69-88e2-1b4ffe1c95e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780950, "uuid": "497bf74e-d880-411f-9be4-ca82004b6fe3", "value": "38259395efec45954c2d200842e41cbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71d3d62-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828942, "uuid": "2dc0540c-0c30-475e-aae9-aca6127bfdfd", "comment": "Malware payload (Mirai)", "value": "2dd4bd2d5a07cc5f84c78d75a0592aea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828942, "uuid": "07f7b426-0e11-4d17-a5f0-4fc93de1c808", "comment": "Malware payload (Mirai)", "value": "830ed3fa3a307d073bbea8a1ff7ebf514bfc91a028685e8b48990dca237f2c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828942, "uuid": "1d35c748-89f7-48ff-904f-2d15ec33063a", "comment": "Malware payload (Mirai)", "value": "104a3ea09ced312143e7f0fc1d1db26149d5bf04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828942, "uuid": "16150053-13e6-4ccb-82f2-a9449efb243a", "comment": "Malware payload (Mirai)", "value": "01bb76f96e1107dff76f36bd42fd424af2f2162939335544756f45fcb5e393220f725fb90032ce343737d8d3fd0de22b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828942, "uuid": "b51b21a8-18c5-418e-8bf1-187746b736c9", "value": "T17BC32805D5508767C2D3237AEB9E865D37325BA493DB33215A34BFB82BC278D1E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828942, "uuid": "35f02023-7923-441e-966a-2a674096fe2d", "value": "3072:ekYPUfsgnsb0J2ag/VfrkDY9Ho+mTQOY5NX3cn:9YPUfsgEo2a0rkDoI+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828942, "uuid": "4f13860b-83aa-4de2-bc4c-83e98768f40d", "value": 121004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828942, "uuid": "ebe35b6c-be9b-4b72-8b90-d5f7e19c5eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828942, "uuid": "ad415f32-ab94-4348-8244-d4925de3de0d", "value": "2dd4bd2d5a07cc5f84c78d75a0592aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5284075-f035-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683834871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834871, "uuid": "8f8d275b-831b-4ec7-9518-f1bfb2f1b793", "comment": "Malware payload (GCleaner)", "value": "d8296869d5da253e2bc6b40bad662be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834871, "uuid": "56c7715d-0164-433c-a40d-bea6e3248270", "comment": "Malware payload (GCleaner)", "value": "83ffccb23ae448ae1199d5df4346b5532c3bab16b5006122e6d9387cb91e87eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834871, "uuid": "5241ebfa-2895-4edb-835b-622cf479dd49", "comment": "Malware payload (GCleaner)", "value": "8aca77f396fcc76202b175aa0ab97b232d40256e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834871, "uuid": "b96213fe-0892-4e85-a643-612595af42e2", "comment": "Malware payload (GCleaner)", "value": "2b669509b4eb3a01f88be1f2b44b9ed54f051dd9d713fe6a3fc4615620f714abe9dc3b215cac067c3f411c791f60c500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834871, "uuid": "723524ba-3120-4b67-86b2-823b55004a5f", "value": "T1F49533A2FF958635D82ED7308DB6420119B6FCB554FE6DAC37DC128E1EEE0A19C10786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834871, "uuid": "98776f80-cd22-4b95-9633-31626b930e11", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834871, "uuid": "de63b54c-0468-4300-89ce-d3a68a0effd5", "value": "49152:snBN5lIT14NRIySisVsRwrLu83o6RC66kAG5cL:sBNHlTI/yaT0kXcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834871, "uuid": "ad292132-85c9-46aa-a1cb-a9aa64d3e769", "value": 2020175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834871, "uuid": "cfd3f221-b450-433f-be46-5ccdbc96b3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834871, "uuid": "a0ff7aef-cfca-4d33-ac06-6d6bf3eef135", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e550dc-f011-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683819331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819331, "uuid": "40169529-6fcc-4fa0-be0c-06b93b5de780", "comment": "Malware payload (RedLineStealer)", "value": "8283cd47957e8dea379be5e04ca296d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819331, "uuid": "d76c2e6f-c485-4327-b6e0-b8b7d427e232", "comment": "Malware payload (RedLineStealer)", "value": "84d5652b3d648153816b5dd75dcb8a2c29a60e543446900135cded83cb0c0203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819331, "uuid": "67b0a395-e639-4f66-a630-1ac088eb8968", "comment": "Malware payload (RedLineStealer)", "value": "cb13f84bfc9a542697f02bfe3a4cb8ef9b61f1ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819331, "uuid": "ca0dd3cb-8f7d-4271-b634-3379b6f949e8", "comment": "Malware payload (RedLineStealer)", "value": "44a3c4c66a977d9399b3a9578569b9d9079ce5834a15f6af9090e0de9ea5e38cbb43b7d18339529d50a8ea0e566206b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819331, "uuid": "cb5cbe5d-15e8-49b6-a46f-94d3c96233e6", "value": "T133F42347FBD84022ECB597B058F60697063EBF5147B8929627845C8B1CB3394E93A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819331, "uuid": "39de4730-ba04-4d63-8598-d6a1f395ad68", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819331, "uuid": "b6652b21-8e36-404e-95d1-d467a86a406d", "value": "12288:bMrqy90ZaXZ6RyXaFhomnWQC+7TCKiOvAa1bC+7B0E3AtuH6q8wq:VyL6XFKmnF/vAa1bCUr3A/Fwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819331, "uuid": "d3615434-2a45-4c71-8125-77cada83bcb5", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819331, "uuid": "120363dd-7d64-4947-a982-5cf28c8bb9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819331, "uuid": "d9768cb3-5721-4d04-975f-be90b052fa7e", "value": "84d5652b3d648153816b5dd75dcb8a2c29a60e5434469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd138a56-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829811, "uuid": "07fe0540-59aa-4acb-9e29-65cf25ec0e3a", "comment": "Malware payload (SnakeKeylogger)", "value": "3eed726a7e4ec5b0cda4070734101244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829811, "uuid": "d5e27491-0520-4edd-9d5e-8a820bd1df9f", "comment": "Malware payload (SnakeKeylogger)", "value": "85913be7b7f0f7de4a9e3e28f16a32fc61c676d958c35296f07f8f63c20d4824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829811, "uuid": "79238299-6ff4-4e28-9b7f-fe28d9d7f7ab", "comment": "Malware payload (SnakeKeylogger)", "value": "6fc44aaaf076b1d21d39b32437f848bbf4fe61ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829811, "uuid": "d892ed1e-0b0f-4d49-a3fb-ac0e9347c61e", "comment": "Malware payload (SnakeKeylogger)", "value": "a69d9fc3457070a3dd5612caec7ce9126c9679e762e5c287f8348084178cfd9589eb6c5c39b8d4d317b195bcffce56bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829811, "uuid": "4547dc85-5ac7-4098-942a-23ee286c1b76", "value": "T11DC4CF84923BFFE1DA6517F0211434424B3DA11A75F8E0BC6D5B78C9C89AB158FD8BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829811, "uuid": "93fef1fa-48fd-4aa6-b478-3edd07c18826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829811, "uuid": "01fbcd6e-9b86-4928-9bde-d20b561adefb", "value": "12288:fqUWjmKRbQlvUziVNRfFIUV8vn8Gg3YvZYrXKssUARSWc:3+mKXzipd1vGg3YvZTsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829811, "uuid": "e7ee2ea1-4ead-4237-980e-44b3595bb3d2", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829811, "uuid": "72d0e1f1-b788-492e-9a75-c5d4c5d098c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829811, "uuid": "2991b23d-d0a7-4620-94b4-a8710bf8b51e", "value": "yzy3GN7FPnFiSeC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda44ba7-efdd-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683797143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797143, "uuid": "e03d3f8e-0f42-431b-b16c-44cb3226b25a", "comment": "Malware payload", "value": "994ed27b453cc66937b36f8f4c1df4e4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797143, "uuid": "4f789511-6e45-4b54-a090-70bc085be67f", "comment": "Malware payload", "value": "86a0326da1cd2fda3e13294b1a8b9d1de7eb21861e98255e0028dd97b57025b2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797143, "uuid": "18af431c-7a5d-4052-aa09-f7b4a71e4eed", "comment": "Malware payload", "value": "3238199e7d017f756ee6a7f0196067244fd82b24", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797143, "uuid": "2ea0769a-3f2e-400f-a00c-c08e66c6197b", "comment": "Malware payload", "value": "338b7f72f1ebcf8e3d09148c846e67e2a072c913454c55c2a3a264150824e14de69cced512d4f23d880428be8a284b87", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797143, "uuid": "b64a4879-0261-40ef-889f-95c4bb885137", "value": "T12D84E04AB395BC51F923553EAA534A202FF6FCA20728E36719D8321E6D733944CE4F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797143, "uuid": "f18f5db6-26ed-48f1-9c3d-e6ea612e3a01", "value": "6144:byMzAJsd1M676mdi9Ijv2YEHU5tRHVLFwoymbdnNEE4:vgsdPeDHU5jsSdnB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683797143, "uuid": "3bc3d8a3-269c-45f4-9908-406847c0fd2b", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683797143, "uuid": "d92bc440-8338-4729-b667-b7d81619452b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797143, "uuid": "c6c42744-43c7-461f-9d96-44e6c3ffb74c", "value": "excel_0000013D69F02000.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1667c1c-efd4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683793230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793230, "uuid": "044b495f-d6e3-4fbb-b144-71878cae579f", "comment": "Malware payload (RedLineStealer)", "value": "445bc56aaee81a3b4477ca58f519cfae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793230, "uuid": "fd14d92a-365c-486d-9d2a-7b7303c2e43d", "comment": "Malware payload (RedLineStealer)", "value": "88e1ca51c9a1c57f25368bf239d0c6d4fe629ecc6bc4842d5afde85718c24de7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793230, "uuid": "ea50e17e-f04f-4a23-82ee-0da301e8efe8", "comment": "Malware payload (RedLineStealer)", "value": "780f6404cddf79f515010fe42a4d63fb2d23d8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793230, "uuid": "38c421fe-dfcb-4c59-aea0-2e52924ceecb", "comment": "Malware payload (RedLineStealer)", "value": "fe457ac7e5a49b3ff3e241bc611e618a1ca05faef34935957e189bd20ddadfefd8b9f5450ad56d676c7aeb78035486a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793230, "uuid": "89d63405-b7c5-4ea5-97fd-dd4304f94dff", "value": "T1FC052316E6D880B3D4B6677428F702C30B3A3EA51CB4539B7362696B4CB378255B1B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793230, "uuid": "815244ef-35b2-4fd0-b4ce-4bc05a73613e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793230, "uuid": "34f7a35d-f104-4ecb-938e-c7b565401295", "value": "24576:KywgnGv3yA15Njrpv7qJWALogtpeo2VNamUscJOF:RwbfyA151pW0YrUNamRcJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793230, "uuid": "419ec2a5-1860-44cb-96a7-99a87ed77422", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793230, "uuid": "d1123c80-76b1-477e-8d20-da9d69c1f052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793230, "uuid": "b8eba54d-4c08-49c8-adba-9e105e9b6c7c", "value": "445bc56aaee81a3b4477ca58f519cfae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a859cc3-efbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783958, "uuid": "f4c2ed17-5c4e-447a-b19e-6dfd3f3528ce", "comment": "Malware payload (Mirai)", "value": "6888f7172cedf339d6009eccd3a3b9eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783958, "uuid": "713f258d-aea8-4f18-82aa-b65abb416f22", "comment": "Malware payload (Mirai)", "value": "892cf01e0a06f71e3bc04dc6ed6ea4a178276ca5fb2629900b71244d11e54567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783958, "uuid": "b342f893-d173-4550-a579-941b00ce11e1", "comment": "Malware payload (Mirai)", "value": "73695ae79f34679285b123c90afe6db713b12a2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783958, "uuid": "85bf97cb-338c-48e7-9fee-ad826774619a", "comment": "Malware payload (Mirai)", "value": "7aff1cff4129ded888fe5a55ac8ce7a6333f8f4fecbac4fc4024c6b31facb246af18a9f031fdd8c6247c993edc0e21e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783958, "uuid": "622e17da-e978-4456-9317-4c540023bc3d", "value": "T18A230271890A9EB125303C32DFD99793B6E12AB1C6672023D5290B3C6F75A131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783958, "uuid": "f74551b0-5228-443c-b6a2-2b898c628f91", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3fvB9q3UELbUXfi6nVMQHI4vcGpvw:gECFd+A6YHAxULRQZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783958, "uuid": "3ac3f0d4-9f29-4804-ba34-919c0a9f3499", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783958, "uuid": "769d1029-3c2b-432c-9ba8-38c6e4fd70b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783958, "uuid": "4ca66de7-bbff-44d4-a870-12bc9c10d206", "value": "6888f7172cedf339d6009eccd3a3b9eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a2bb01-efd5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683793531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793531, "uuid": "afad2029-d674-4863-8cf4-d3fd605af9e0", "comment": "Malware payload (RedLineStealer)", "value": "6b5ce3b08c9a8afe7ec614fa6576a3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793531, "uuid": "add56e05-1233-4b4b-bc27-3b173d513fda", "comment": "Malware payload (RedLineStealer)", "value": "89930a0c60b6bdfbd47e874f51db43c9fd07c1466f2b4011c3b6e8e4cbd31744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793531, "uuid": "f8fc8383-ff79-440f-910f-38fd46434375", "comment": "Malware payload (RedLineStealer)", "value": "ca0e1c3a88064880c7a7a3178f408eaa335514c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793531, "uuid": "7473571a-2e6a-4137-aadd-335f1bba4e26", "comment": "Malware payload (RedLineStealer)", "value": "a97f8c63cf6bbcfb84012c51b6b08e3d246f706483d8b6c690d08c038b4e758c5e3d2e5a17020b772b9d8b379bc4e0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793531, "uuid": "833ae0b1-f0fc-4b6c-ac13-a212a1d5b1a0", "value": "T120F41246E7E4D833D8B6377048F717A31B36FDA14AB8426753597D870CB3280A53A72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793531, "uuid": "adccc995-25cc-48ec-8c91-0e5b20e32d61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793531, "uuid": "7caee1f3-94b5-4613-84c2-dd53d7c0643b", "value": "24576:vyX1sQUZ0nksPdlKIYsSSm95nZb60CezKDvg:6X1VUinkuXbzSSKVZc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793531, "uuid": "9ec0008b-f97c-4799-a126-a5bb993c42d2", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793531, "uuid": "5ae0d8c7-e896-4309-a713-5eaae6f10810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793531, "uuid": "cdbb3751-f8ba-4595-bd3a-7b2cf4704299", "value": "6b5ce3b08c9a8afe7ec614fa6576a3b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46742170-eff7-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683808083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808083, "uuid": "e43fbcfa-a6b6-4e69-92bd-5afa1967ee8f", "comment": "Malware payload", "value": "34ea087535510dd7df75fdbe5b00925d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808083, "uuid": "bc97febf-5ff0-413e-9798-f0528bea0a0c", "comment": "Malware payload", "value": "89f6aa1e917cd535d8ba513f0e289772b1af0ef68a8ae27cc8d3ac93d338d6e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808083, "uuid": "b3b54da5-e186-4231-bf60-6057bd14d678", "comment": "Malware payload", "value": "a74e07cc5ff27765917cff342ec9c6cb55f9486b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808083, "uuid": "e030ac94-3cc2-4e50-a7e2-aeef7634294a", "comment": "Malware payload", "value": "62079e33ba73ae0325d93410ccced4cbb3d95aa5fe3fa5ac55ad7c516f2e5000b4018ad5b7496205ad0509ac958e515a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808083, "uuid": "240b0ba2-5577-4988-b824-712c22528e33", "value": "T17BB1633B6B470CF6CF1D0EBA1D8389186B4985A21511C13A1782069E2DDA5A7FE21BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808083, "uuid": "020bc731-9540-4f70-8dad-25d3f3958db3", "value": "ede14b73694a83dece2930898de1ac25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808083, "uuid": "9a79d60b-71f3-4ccf-a2b0-b6926857c8a5", "value": "48:imYGNS2F5vd8bts1IOCMs1IOCThcx/6+eTo/NkF7DAy52y:Up2FlB+Z+Tu/ReE/NkNN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683808083, "uuid": "22ea5f9f-26c6-495b-9510-fff9ea9ab268", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683808083, "uuid": "d0d28884-3e4e-4a68-85d1-ce1a81cbb455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808083, "uuid": "3ed44705-df51-44fb-99a7-81e3b1125c23", "value": "SecuriteInfo.com.Trojan.Win32.VecStealer.LK.MTB.24834.30300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d207bd06-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1683837094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837094, "uuid": "38d3bf21-8c9b-426c-9095-b24c77ffa43a", "comment": "Malware payload (NetSupport)", "value": "79ac5af221b8c47ce387b812bdcad3d8", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837094, "uuid": "0175f0a1-3586-4ced-8d00-0904339e0210", "comment": "Malware payload (NetSupport)", "value": "8a0a7ec6339ffe743eed09bb828c91eb1c8a89bfc645232983d502940c438ca6", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837094, "uuid": "4146a370-2712-46c2-9958-e60a13c5b74e", "comment": "Malware payload (NetSupport)", "value": "88176608bc85d343df1bee7d30f9e44225fcac60", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837094, "uuid": "f2793d4a-41db-4481-b463-45808cc36676", "comment": "Malware payload (NetSupport)", "value": "5457eb856963ae3b2cd4bac6b25bc3a955a8ebf3a1af7bc41ad6626e46039032cfed7836eb64fe365a518388c388be08", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837094, "uuid": "a737a110-4e20-47da-93f2-403f0931f726", "value": "T1CEE29E9866C3A053865FF03AB77ED8C6E66649180BD2540FB51CB234EF96C3CCE61B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837094, "uuid": "660dcabf-00ab-4e54-bec7-8f65a0391fc1", "value": "384:KM1yf9Dgfnsf09jjE81kpGNC2//bEZlAupk/wdzevWpG1Uc4GPIiklwt7emTI80f:Qg/zHE81xCyJupkczevZ5IidtI/gNril", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837094, "uuid": "876f4926-6d32-44dd-be29-fe9e0a60bba9", "value": 32819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837094, "uuid": "954cc9a6-5d63-4879-a1c0-8889da4b2962", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837094, "uuid": "f3b4c3a7-19a9-49c4-8cc0-091a87c5b751", "value": "Versandbestaetigung76663_76663.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166e22b0-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683829907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829907, "uuid": "dc835383-3dff-446e-863c-c89953d8e1e8", "comment": "Malware payload (RedLineStealer)", "value": "c9ca226a2016cda8abc17a88256b09b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829907, "uuid": "b7605a06-8f70-4cfd-a244-ae05e493e41b", "comment": "Malware payload (RedLineStealer)", "value": "8a47d16dd380f046459e2fd1ebc636a1bba301d521587cc147b4240de545b20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829907, "uuid": "41394108-8462-429d-8e8d-0c5bcdf0e9f3", "comment": "Malware payload (RedLineStealer)", "value": "8d9e5449790924430e6c0de8232e46fa97b1dae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829907, "uuid": "13c13dcf-b0ac-4554-8b79-a72d20c1d85f", "comment": "Malware payload (RedLineStealer)", "value": "c98851e5425276c1a598efe03ae4161acef8a6e497b4d3afc3645e9b8243cc766c27e377aee7759faa737f79ff654f71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829907, "uuid": "62451fcf-6e49-460f-993b-0643cc06290b", "value": "T113847D2393A13C54E9664B729E2FC6EC761EF351CF197B6A12589E1F04B02B2C173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829907, "uuid": "8de5c5eb-c6c1-461e-a090-203a0072396f", "value": "796ee4764b976b073ef697d148f4671b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829907, "uuid": "c84f30e3-b204-4b24-bbcf-b6d79fc986d0", "value": "6144:6FMJQLLzvijefEGxpUowDUefSHnmqVWRVUAAx2iJLBITOCB8MQhw:6z3zviaEgOowkmqgMLBITTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829907, "uuid": "80497eb7-8a46-4559-a51f-f91558dde1e9", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829907, "uuid": "31e99600-8b6a-427f-a581-5d31462ba31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829907, "uuid": "fb16c842-3d16-4ea9-9aed-5097175f560d", "value": "c9ca226a2016cda8abc17a88256b09b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d118b803-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1683837092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837092, "uuid": "91a186ae-8490-492c-ab5d-25b00faa0031", "comment": "Malware payload (NetSupport)", "value": "40e8a80c7841a2bf3a629489409370d1", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837092, "uuid": "c6aaf73e-93a4-42c6-950a-3d1240e54532", "comment": "Malware payload (NetSupport)", "value": "8aadc1a7d3ca05787c0f28cc093ac56b7b9cc0fac3a8c12d268a7beea49804e2", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837092, "uuid": "2c40dcab-40ab-43de-af06-929c9aa07bb3", "comment": "Malware payload (NetSupport)", "value": "e323bd858ba3f78ba4f2d8907880888ec4a13d20", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837092, "uuid": "d6b9031a-faeb-4571-b6a8-61d50aa4ddde", "comment": "Malware payload (NetSupport)", "value": "0295c89b3908be7cd584b3681f0668ae72be945edb0c0fabe9294c623d4eeb965bfbb9ad54cd64966ce39327133c2b0f", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837092, "uuid": "1692edf7-f6df-4144-8f1b-a05081228b99", "value": "T10FE2BC8866C36043565FF03A727ED8C6E566492A0BD5680FB91CB234FF95C3CCBA0768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837092, "uuid": "2c0541fe-020c-4d97-912d-627d251ea8bc", "value": "384:xJ26gAE6CcsFVP8Nrpl3i+00+/hwaEV8dyXx9DCymMnOWesqoqAv4CCpuh6yEFUt:xJaWs0PFBVdXtriaCkeJ5LG7n5VVkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837092, "uuid": "21ffb025-a329-428f-a641-30e804f81ef1", "value": 33943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837092, "uuid": "dd1b4222-802a-4978-9b9b-cc520df60a03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837092, "uuid": "c918efbf-9139-4959-8762-48af1e4e3d40", "value": "Versandbestaetigung28791.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a1f6d7-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829847, "uuid": "b77811d7-a743-4429-9f61-00149b2b3329", "comment": "Malware payload (SnakeKeylogger)", "value": "10926a211b5e1f92f318b97509a44254", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829847, "uuid": "9111a78b-03bb-4e0b-b860-e57715d9071f", "comment": "Malware payload (SnakeKeylogger)", "value": "8b05ac7b62b49b7336f6c71833e0e5b9589df9996244789ed0bb74fe2b2d4f16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829847, "uuid": "f4264d16-c38a-4aae-8661-72c162ac7095", "comment": "Malware payload (SnakeKeylogger)", "value": "051f2bcba7b7b07414b0e419c349b37c53eed70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829847, "uuid": "db60174e-999e-4717-88da-8d549790e55f", "comment": "Malware payload (SnakeKeylogger)", "value": "b9a97a86c0c0c28e6f76d501ec4af229ea00050a7cb09a70aff5d67307d5a39c1d3204c058ba892aa79d29860e8068df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829847, "uuid": "a6212599-fc97-48fb-b263-5dc1bd56c7f1", "value": "T14E24F1020F6B182CE5551BF2FB3F5B1504E295AE3502E258CB28E50F3A14F6FE1AA5F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829847, "uuid": "64017adb-c5f1-435e-a8ef-ac51bf1c936d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829847, "uuid": "9be7b44e-d203-4376-9eaf-0f19003cba8a", "value": "3072:jJvCCFu2f+kKlrKGd0Tn68gp578/W0dbCne2ULmI+ib8pc11L2psGQQbTRzf6XCR:ssL+DrKtb6X5Hn6L/WcCsfQMf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829847, "uuid": "34fe15f5-6cd0-4dc9-b817-0eb837b054f4", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829847, "uuid": "fd3beda5-560c-4679-9b92-1ca10cc11d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829847, "uuid": "9eae8388-3ebc-482a-b54f-7e827ee18215", "value": "10926a211b5e1f92f318b97509a44254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db51db5-efd5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683793466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793466, "uuid": "bd26109e-cb82-42fa-8888-0dc9973dc44c", "comment": "Malware payload (Formbook)", "value": "5fffcf1ccc6687bd7125099278a0785b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793466, "uuid": "4b32c5c7-a36e-4844-927a-0d6c5e5aaace", "comment": "Malware payload (Formbook)", "value": "8bc4f4ce5d6c39ec058db68d3f76ea4c1b6d1cd973534dc2e4f624d17d52f904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793466, "uuid": "a13971b9-ff3f-4aab-99db-8b9a7a03f1b5", "comment": "Malware payload (Formbook)", "value": "bbf2ccbda76ac1634bc672dbb6ca9e1940dce6a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793466, "uuid": "ff4a5b61-e85b-4b8e-a448-d1e6dbbf4e6c", "comment": "Malware payload (Formbook)", "value": "3a234e76a9dfd08d4ecc8be69417fd4a82983cf4158656c9da477da5e9e9649916e0910639f70b2edbbfc785a14eabe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793466, "uuid": "fa8df471-413d-4d81-a874-a942d6a5fd76", "value": "T19E63AD02BB64C6A1E9A44B3168A347609733EC2299F0D71B379DB96F1F33392951638D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793466, "uuid": "76ed0090-cd4e-409c-a72f-98d4e80eaecc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793466, "uuid": "11578ba3-d114-49cb-82e4-cc69f6bb91d5", "value": "1536:ESYOU3ukPVxu+jQn5lOtjzoACK+yw09HXdqkSZZZ3g99ib/:fYCeVxu+jQn5otjziK+ywMHX3Utb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793466, "uuid": "e807efd5-0610-4635-a17a-e7853c6c8c1b", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793466, "uuid": "7fd78aa9-7566-4fcb-9222-4d1770565310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793466, "uuid": "51691cc3-93f1-41b4-b285-89cb7a213e5d", "value": "Request For Quotation_01324794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6220deb-ef8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683763254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683763254, "uuid": "2cbd3a20-44a4-4f15-83dc-35399a7d7ba2", "comment": "Malware payload (NanoCore)", "value": "dab2b15e2a666145f861832443fba057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683763254, "uuid": "72d2fdf1-4ffe-4d6a-a854-1d7d40b82346", "comment": "Malware payload (NanoCore)", "value": "8bf39c82088d376f612259550f253fe8c6a5a747de4c4b7b22077f47dd321ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683763254, "uuid": "9d99857c-60e5-453d-82cc-065d06625cf7", "comment": "Malware payload (NanoCore)", "value": "c075e5ed70ae9b54aabbd63520beeb2da03a6fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683763254, "uuid": "d718de83-0fe5-4646-95d4-f9d6de84f56c", "comment": "Malware payload (NanoCore)", "value": "9b299fbc0e423c167d1b34f7a00902def8b8465ccb62c1337df471d468fbfee94c3b9ac39a51e65401205de28229b789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683763254, "uuid": "55191e74-8dff-456a-9e06-675d0f30bf82", "value": "T1CE45D0B3B6A6FEE5ABF41D94E8B612090C44FFB76228D0ACF88851CF51B4554ED19CB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683763254, "uuid": "215ac5bd-7a41-4501-b02c-758b74ace7bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683763254, "uuid": "2a870bc4-76aa-4cfc-9464-8c0885748dcc", "value": "24576:GasfVIB2GcLfbk7IqwMIvtOHXHuufQMcnmHOVB6xO:bs9TNjbCvBHuuFHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683763254, "uuid": "27efe1cb-b670-4f92-bec1-38dec3d00eb7", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683763254, "uuid": "f7f88c80-dc72-4209-b78d-865fc48f8ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683763254, "uuid": "a2f2e925-f047-43d9-92db-e2832c433867", "value": "receipt confimration.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc094086-efbd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783477, "uuid": "6fc6e01e-dc34-405b-848a-b40d077baa23", "comment": "Malware payload (Mirai)", "value": "7f7713f74458420afdb386b9ca0609a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783477, "uuid": "a7f4f15e-f486-4eff-8a3b-daa2a4bc281b", "comment": "Malware payload (Mirai)", "value": "8c72ddd276890234179204485d8ed8dff3d200f25627156b99e420b36756bb69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783477, "uuid": "9964df83-1aa2-4680-9648-6e401882de35", "comment": "Malware payload (Mirai)", "value": "1d2e2ecb766a50d0281108746b73430fc2e48164", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783477, "uuid": "dc3343f2-72f9-4695-affc-dcf1ba1d7912", "comment": "Malware payload (Mirai)", "value": "f7481ab564bf0ef88e9369f18015c7e9070331b778ce22787bdfef7bc25b79749955652eb2322e8dfa3226a58114a89e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783477, "uuid": "068dfe6d-b2e3-4255-b0e1-99451417c208", "value": "T13F535C02B3684E0BF9E61AF5343F1BD483AEED8025E4B585A90FD7464235F33459AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783477, "uuid": "8e6c28c9-8c3b-425e-a6f6-c42f35f4a6ce", "value": "768:zipbi/131WUsTETbl1T9Q9n5pY5eEgGsllk5MDZH0a26lBHW2tdFsDMUQSDAYTHJ:zT93Egl1wYAzk5a+8NbK1DVbug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783477, "uuid": "fd6e0934-522f-4c5d-8f85-abef070bf6e0", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783477, "uuid": "16bbd68a-669a-4688-b633-6c77ec01add4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783477, "uuid": "8cf5271b-b7dc-4252-9c7f-eb2c61888c7f", "value": "7f7713f74458420afdb386b9ca0609a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38cbc10-f033-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683834036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834036, "uuid": "739383c8-dc15-4c29-81ab-39b2439e4c32", "comment": "Malware payload (RedLineStealer)", "value": "a8a8414cf4e68d2494d392ae057077ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834036, "uuid": "43ff77b6-0a84-4c2d-a38d-2f960cb79b08", "comment": "Malware payload (RedLineStealer)", "value": "8d0650f556a02d7e64c2569683e5c4786985c6f814e6cc24b24b8b8572d0959e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834036, "uuid": "212050ab-bd74-4bb4-a5b7-aff83b4bdd0b", "comment": "Malware payload (RedLineStealer)", "value": "eeb2f7d2d533c2771a4e16fe0f3835db9c823461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834036, "uuid": "6d29375e-e50a-4ba3-8236-9fe62764b930", "comment": "Malware payload (RedLineStealer)", "value": "7a496306728c5fed13ff9914f2b3b9a4cc647c917a5a34b7a26a0e2a52378791746827f97dc51c9181375898ce144605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834036, "uuid": "e25f7a40-e111-4e17-a235-e4e54db8386c", "value": "T1F3F42307BAE65072DDF95B3058F603870B317C62AD6DC66A3296684F0CB2388757672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834036, "uuid": "823a86d9-23ea-4c32-9d95-bb05da8b9672", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834036, "uuid": "c738fe48-e251-4da0-816b-fb7aee1dcbd3", "value": "24576:DyMYDl3YFw95w4vbDxYwvuSi1RtsFlbhx7qY4YD:WMYDlpq+8SivtM5r7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834036, "uuid": "4c5b36c9-75ac-4a29-9633-14a77e07bcac", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834036, "uuid": "bf122d0b-7606-47a0-8986-dc17046fbcef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834036, "uuid": "667bac72-9ebd-4eac-b32f-ada1bf32a9e0", "value": "8d0650f556a02d7e64c2569683e5c4786985c6f814e6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b242b1-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829877, "uuid": "d8cf5ee0-1e9e-466a-bcd0-0343fee36a79", "comment": "Malware payload (SnakeKeylogger)", "value": "02d8ada86da94c3ddb808f073ca3b776", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829877, "uuid": "f4a1798f-b859-4c20-9252-82897379aa62", "comment": "Malware payload (SnakeKeylogger)", "value": "8d2a53bd89b25935e2d8d9195f6982e3dfac315b8d77a856becc7d1aae4f66ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829877, "uuid": "128cd33d-ba52-4e42-875a-a895c19881cb", "comment": "Malware payload (SnakeKeylogger)", "value": "d8626d47187f986d43d04a67c604f6fe4af9a611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829877, "uuid": "0962b896-be73-4410-96a0-8887e4f4c87b", "comment": "Malware payload (SnakeKeylogger)", "value": "65aa7dc7fec541e7f663b2f6ac9d07ce4de1cb14579cda132366ad8b0c2bb8825543fd18c46cc3431d911951edb515cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829877, "uuid": "2213698a-82a0-4597-98f2-0fce4b5d12e4", "value": "T1A1058C3D22DA5C26C31673FA8958C5E103356F10AEABD22A26BE30CC8D71B93ED5554F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829877, "uuid": "938f45ca-8ac6-4197-b23e-7950910acccb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829877, "uuid": "002ec2b5-d4c5-424f-a4e3-38eb8b334446", "value": "12288:Ylu9BWqZfOtnygJCjK4ym97zs6eMnJzvdCyBOl1aYR6cUBKE:YI9BWIqnAeA97VNzlrBODaYOB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829877, "uuid": "c3b82a3d-f6e8-4fcf-a243-48b028eb9aa0", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829877, "uuid": "cd4192d1-7a7c-4380-982b-df72f343f735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829877, "uuid": "8c6e4bbc-c78c-4d69-8bfa-7131fadad877", "value": "PcJfA8N9ndC6qku.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a7d048-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832236, "uuid": "07a4be3c-0422-4c37-8177-0dbc13c54493", "comment": "Malware payload (AgentTesla)", "value": "91b3626da0c17a4dbcd98ca6f919d085", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832236, "uuid": "c122c669-9af6-4422-8058-91af313b1fd9", "comment": "Malware payload (AgentTesla)", "value": "8e33efcf6dbf9703b9ce4af96de2e312674607d3d3ca067f6c1e31015488a443", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832236, "uuid": "57abf25c-db02-40a9-8a29-8858277b474f", "comment": "Malware payload (AgentTesla)", "value": "d6e9a3c8faf71e17187404a6f160257c83e31406", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832236, "uuid": "cd827401-5009-4c7e-a59b-a33192a2a61a", "comment": "Malware payload (AgentTesla)", "value": "ecffa50fd834934c02dcb2ccb985118e5b0520be2e7016873c68ef6475063a343655dd02e9693869b9f800a03a8b87e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832236, "uuid": "f8efc50c-2481-47b1-9bd0-95ea76d0136c", "value": "T183617D1447E6020CF3F3AB3A99BE66554E3B7946AD31C75D0059814EA2F1A40EC76F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832236, "uuid": "41711ad8-69ed-48e7-a0c4-4238f05edd70", "value": "48:865aZU9Dmel0iglZ+1pQfYj1sAT1rTRRSJxo9AIH:8655B0+16YZsErTR0/SAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832236, "uuid": "cf292957-4e01-4135-aed5-0851d7943868", "value": 3446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832236, "uuid": "255164bd-73ce-4135-8fe5-d6396df7ee51", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832236, "uuid": "44b3cb35-80d1-424b-afc3-7d34d610c109", "value": "Payment.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f583e1d7-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829852, "uuid": "d8aeb7da-b440-4e0d-a4ce-7a60141933cd", "comment": "Malware payload (SnakeKeylogger)", "value": "e48e8bd7c034de883faae60da15ddc3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829852, "uuid": "8a204908-8d3e-41f7-8a63-1626f3aa48f5", "comment": "Malware payload (SnakeKeylogger)", "value": "8e406bd2fa24428c369151006c1d3b563675ddac328964b30a6429f64f17077d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829852, "uuid": "7031a751-71f5-4060-98e3-718fa3db198a", "comment": "Malware payload (SnakeKeylogger)", "value": "ac79da066a83feaba8a70a1f0f6456fe8e39ecc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829852, "uuid": "80e9a9e5-ba4c-4b57-a7fa-fc513c36ab5e", "comment": "Malware payload (SnakeKeylogger)", "value": "9b9040cfc008048692cd97b54ae87c0d01ce68949897ba57b53fcc4726be57e56f7d965b202f018007b7052c93d9197d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829852, "uuid": "2e34b453-50bf-47b0-a98e-51d7feebf8bd", "value": "T174E4E089533BBDE1D6581B71260438434E6DB11A75F8F0FCBD2BB888C9AA9118FD4763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829852, "uuid": "ec09df93-6e9f-4470-bdce-7d6f6c4077ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829852, "uuid": "83fafc1b-b60b-47a5-97b4-801b5aa71502", "value": "12288:AhmPsUOWatCsPAzRa5DFIsfhknQ3O3Fa0L/as+26q2:ImPxfQCZUlFIpnQkoJs+26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829852, "uuid": "190a7678-5bbf-4b21-8c2e-8ebd43f6a7e9", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829852, "uuid": "1a36a6bf-c810-4a6d-bca4-25dd80bdf8b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829852, "uuid": "3f0b7d7b-ad72-41a5-9633-a3ef2376840a", "value": "e48e8bd7c034de883faae60da15ddc3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3b4a51-efb4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683779447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779447, "uuid": "6e8737ee-ccb5-4f95-8e35-4b2798108713", "comment": "Malware payload (Formbook)", "value": "8a8c6d76e723e91a0ce4cf14bbea1670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779447, "uuid": "d7d710ba-f8ed-4f6e-b26e-1d47d0211abe", "comment": "Malware payload (Formbook)", "value": "908518191aecf6570fc10b1d299d64b2ac02f250fe17198a2407a9e12ddfcd30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779447, "uuid": "67998e9d-6dab-48c8-a246-8b08793e226d", "comment": "Malware payload (Formbook)", "value": "f543b50426a219e2f5f637ac0229a7896ceb55ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779447, "uuid": "3fd73cd2-8865-4030-9bea-88afceeade87", "comment": "Malware payload (Formbook)", "value": "07eddc59772cb9bf339fc862d7d78153c864e4a6202000dd23a4715b75c332f46d8ed23a1e72c089eb261ff32b8343e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779447, "uuid": "853b1889-519c-4abe-8d16-b07643bf3c60", "value": "T199F4E185433BBEE1D65807B1325438534F2DA11679F8B4BCBD1B7888C8AF9215BD8B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779447, "uuid": "fb76c465-29bf-4aa8-955e-241a8d5facd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779447, "uuid": "dc48e60f-3561-4866-9d7b-493e7b7c997a", "value": "12288:78mlmkAb+MWxFN8cJ5VUbI6fUxYvRj/sP9rNoAPUTeLPlPKGC8L086p:YmvfVUbMYvRWH//LPp1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683779447, "uuid": "f201a65b-7763-478c-bb36-bb67da102f2b", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683779447, "uuid": "f325d17d-515e-4ab7-b4a8-a65deebc5bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779447, "uuid": "463764ff-8f42-42ed-b155-b8fa17469d02", "value": "8a8c6d76e723e91a0ce4cf14bbea1670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2d1e4f-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683829245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829245, "uuid": "5269963c-b7d4-49a2-9626-00fc4f3ba858", "comment": "Malware payload (RedLineStealer)", "value": "6c4f205c0411b0ba55254f89153481f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829245, "uuid": "9c9aced1-05d6-4715-9eb8-2c410ede6519", "comment": "Malware payload (RedLineStealer)", "value": "917cb44066c8e38b813b821bb8e1f44c49bc1e8d34a8e59638aba0ae963f9165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829245, "uuid": "e8734dff-ad2e-45e5-93a7-968208b229a1", "comment": "Malware payload (RedLineStealer)", "value": "818800c286922e64a6b250b3f1d2cb35536e9461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829245, "uuid": "b6662f31-8223-4495-81bf-e7a1f13d9b99", "comment": "Malware payload (RedLineStealer)", "value": "c301ba3a52e005e52030a570f1b9fae8934c81e89de5ab368203cea094193b4b19ed322faba32b84fbb25f774d9148f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829245, "uuid": "62cbdd1e-981e-4223-8314-e18b94226a99", "value": "T172948E2393A13C54E9664B729E2FC6EC771EF3604F593BAA12189E1F04712B2C573B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829245, "uuid": "0a04e072-5f00-4b89-8ef0-b4daa05c16f8", "value": "4062e3723fc172742e77f31966f99ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829245, "uuid": "5416aa5d-2284-4afd-b744-ed9ad48819e0", "value": "6144:F4ySL47wXfOKMuEs5zHV5jkJAjzebthtxqN+lg7bfXGJ0mrQh:yHc7wXfFM5s5z1JkJAjzUzxa+G+Gmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829245, "uuid": "6e08cb9c-110e-476e-84d3-96990c63514a", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829245, "uuid": "f1e294bc-9745-474c-8047-39e41f53e3cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829245, "uuid": "6192b1cb-8c01-4cb0-b8aa-c6b220b1229d", "value": "6c4f205c0411b0ba55254f89153481f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc48c0c-efe7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1683801197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801197, "uuid": "23cfed39-8494-404d-9062-8b1bd36f728a", "comment": "Malware payload (AveMariaRAT)", "value": "bc15458edf598cbf8e75e9d6fd210f7a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801197, "uuid": "36b8981e-0f20-4a83-a500-2aef2a094638", "comment": "Malware payload (AveMariaRAT)", "value": "91ffc32324294f7e5104ce0847bdcfcae2a87231f449673498bf2e028dfeb70b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801197, "uuid": "81e8cf54-b781-4b62-9274-2d7282244fcc", "comment": "Malware payload (AveMariaRAT)", "value": "b32bd1b69ecf5bd24790b05f034280805d850870", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801197, "uuid": "4e8fddc8-f315-47bf-8c7e-fe52f4e6efb0", "comment": "Malware payload (AveMariaRAT)", "value": "323faa0716f39f067aa26469ecb65c049f4b1dc81e364c9ba19847786aff872ee86424b00313eaa021cee63b82e5a04a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801197, "uuid": "fabde742-3230-4169-b502-8b7cb6883ce7", "value": "T10E052357F2158938F37490DDBC5636CB4A9C962A723D1074B73A83A03B9BA71E01D68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801197, "uuid": "b84f66df-448d-4bf4-b17c-c12f780fdf97", "value": "24576:YoceOe6Jed1QA5vdQoHHc+GkBakAdlDiznmvLe:bceO3JoQANKocUBJAdYznmTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683801197, "uuid": "687b8f5f-b820-4152-ae86-ab253112ea1b", "value": 869880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683801197, "uuid": "c3db84c5-4610-44cf-8df2-f681af06a635", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801197, "uuid": "c05c9ffb-8fab-41ec-a2ae-4fe840141a47", "value": "nOrder_ MAY05 0.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c97f1f-f011-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683819329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819329, "uuid": "e83ba4cb-7723-4ed5-9708-56e5e8ae0a6c", "comment": "Malware payload (Amadey)", "value": "536e560c189e4ea19cc2ff8838050598", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819329, "uuid": "ae1fdb6e-d135-4a70-b84a-5974e21b0df5", "comment": "Malware payload (Amadey)", "value": "93b4057e7733498ff971cfe761815a8a81da63165cbc4aa1082debda9bcd55b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819329, "uuid": "9db2d73c-5d88-42dc-a944-b0ac0f37857f", "comment": "Malware payload (Amadey)", "value": "2770766fd26307c9635d7e1c4b4b0027cc3e682f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819329, "uuid": "4e695958-4208-44dd-b4f7-8a70f5d48070", "comment": "Malware payload (Amadey)", "value": "8016beb2d5e70e7894de73e1a2c75a1ce614baf0abf3a7e52400a17da533d4fabd42f305685a4d209646d25c1836de1d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819329, "uuid": "591ab42f-4242-4937-b052-45fb8cc7b4fc", "value": "T137152203EBD99A21D8FA27B104F702871F34BE964D32927E16825C890C73BD469767B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819329, "uuid": "40f4952e-81c8-4cb6-9e56-cc3d4f0f867f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819329, "uuid": "993c147e-6c64-4a1e-8ef3-e42a6e212ca8", "value": "24576:kyD8W9P2Mm33KxDq3ujUiZe3DRw5DR2Yi:zDT9Pjm32DJte3Fw5l2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819329, "uuid": "5326df39-e164-4e78-8b58-f305cb9b21d5", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819329, "uuid": "581bff71-6b7f-4b84-8c50-07ef4ead4954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819329, "uuid": "2c4727d9-5dfe-425d-91a6-e009ca5c687c", "value": "536e560c189e4ea19cc2ff8838050598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514d1d86-f039-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683836448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836448, "uuid": "356262ba-3c72-4058-bf55-a51f1ea2f5fc", "comment": "Malware payload (RedLineStealer)", "value": "70a6e922cc5a724abdff9015f29a65b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836448, "uuid": "8dbb416c-8afb-490c-839b-bd39eaaef141", "comment": "Malware payload (RedLineStealer)", "value": "93cea09cdb6ed12a8764adb71ad6927e3fdec062bf990fa4f03a0a90b7ca99a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836448, "uuid": "ffc51ad7-a4ce-4d60-b967-9d65be5c035b", "comment": "Malware payload (RedLineStealer)", "value": "fa9b3913bc7cc41b7382fbd6f44f2f39abec1810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836448, "uuid": "0949a178-960b-4126-a3da-37f7caf1d957", "comment": "Malware payload (RedLineStealer)", "value": "d635d43a1036e4c91cc1f57f2ba27fade1cca37d988d46160cd3d4bb65ed7aa695a4be6e5c3e43ea017a5b45463d6b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836448, "uuid": "f7f06dfe-ec10-46e3-a622-a4afdea115f0", "value": "T1B1945C6393B17C90E9154B729E2F86EC765EF3508F593BAA22189E1F04703B2D173B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836448, "uuid": "db7338c2-9148-4c0e-9e9b-59feaf3f0e7f", "value": "4d0a7f70eaa3e152ceda1701c7d8bbd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836448, "uuid": "1c48c33b-e1ed-4df4-bfa2-c8abfac61c58", "value": "6144:llqLXVyaxExATCnNjrt52GK99P/Ys/0M/7ggcJy04vhcQJ:lcLVyaylfI3cM/fcTGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683836448, "uuid": "24baabb5-3caf-414f-b286-35bd744e2bd5", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683836448, "uuid": "9e99432b-81d5-4290-8796-38957b74820b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836448, "uuid": "6d58e6ce-cb49-4878-b176-deecd333f523", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7159109b-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683784533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784533, "uuid": "ab053211-c314-45b6-a631-cad052887597", "comment": "Malware payload (RedLineStealer)", "value": "b578d9cb618b274db085401ab57de4a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784533, "uuid": "09146918-c8d0-4a9a-a11a-3ec7c53139bb", "comment": "Malware payload (RedLineStealer)", "value": "93d499d2273e090a6609e7630452201d6886f5e9f0d2be08ff26cdbf5ee477c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784533, "uuid": "7f187678-d3ba-49e7-88e8-3d71009f0470", "comment": "Malware payload (RedLineStealer)", "value": "7a36d9c0f9c90aec9d22e350ebc4301df2047c1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784533, "uuid": "77b70476-6c30-4a2c-9a1d-88a903367c20", "comment": "Malware payload (RedLineStealer)", "value": "d4a72ba73733d9b862de048577fde7a0ec0b892572d4826ce1d77145a43dc1d827a2ad42495b34667607a4c1b537de77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784533, "uuid": "a60cad10-02ca-4f16-bd27-4fac938de4b8", "value": "T197F42393AAEC5473E8762B7000F247A70A397D714A78467B37A89D4B1CB16C0E53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784533, "uuid": "279221ea-02ef-4b98-b4bb-ec176cebce87", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784533, "uuid": "27c8550a-16a9-4563-9ac0-aef4f3609358", "value": "12288:cMryy90Eat53drKgIhH60b8aBCAC+OKqrpnYtM//RM7TZ33KnDuSOg6:+y72B0biK4fXRgRdSOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784533, "uuid": "3f4c0bb8-f344-4b0d-b1d4-c273b9033706", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784533, "uuid": "4b7407f3-879c-4b51-9c45-120bf2fcf227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784533, "uuid": "bd0260ac-2bf8-4e3c-8f51-0f9cd99ce866", "value": "b578d9cb618b274db085401ab57de4a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8483dafa-efb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683781558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781558, "uuid": "4cb2de48-21e5-4b97-9007-2891d5f59be6", "comment": "Malware payload (RedLineStealer)", "value": "88d8d4150bf9340f54f66928b0e362b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781558, "uuid": "5132841a-504f-4339-85c6-b782d5ffac8f", "comment": "Malware payload (RedLineStealer)", "value": "940c557423afe7410f4ad93fe1c973473ce3b305db9eeff3def440d6d7b83220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781558, "uuid": "4bcf9377-428e-46f3-8b76-972dc16a6446", "comment": "Malware payload (RedLineStealer)", "value": "235e93ede977d1366b83dd4feb5f13f99766dc42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781558, "uuid": "fcfd8fbc-4d0f-4991-834c-354b557ee3da", "comment": "Malware payload (RedLineStealer)", "value": "e1b426b09da39b53a065dc8a189e70df061b1031eed70799809cdcb6990b53d991598d2d48041e4b928bc1ed0dfaff49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781558, "uuid": "08ad8e96-9d78-481c-bf8f-e610263ab710", "value": "T18E9459C1EA8565A4DD19AB71AA37CD3442237DFDA834A42C25DD3D2B3FFB7931026062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781558, "uuid": "4d9d8d9e-94b1-4d5a-89bf-ef4db09f6c0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781558, "uuid": "7b0b83f7-26e3-4fc0-b0df-3432b6130c05", "value": "12288:t+fUYGw/T5/QV868P7r9r/+ppppppppppppppppppppppppppppp0G:tcJ68j1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683781558, "uuid": "6170aa8c-c371-4863-9777-4aea2e98c1ff", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683781558, "uuid": "c53182c4-c485-482f-8c99-7c4b91612e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781558, "uuid": "8bd1bd04-79c2-4478-998a-395e9a568a60", "value": "eReceipt pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ee04f3-efda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683795634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795634, "uuid": "7dee94f9-d5c7-4339-9d8c-056e5b00f7d3", "comment": "Malware payload (Amadey)", "value": "5bc7a0e76211e954f494335be62cd28a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795634, "uuid": "e2abba5b-a41d-45d9-8535-962fcc39fb8f", "comment": "Malware payload (Amadey)", "value": "94e2aab4a036f8788be69af92be5568812541993f735732ec0f0d00dec17126b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795634, "uuid": "7a3a6be0-809a-45fb-872c-28f6e0f86c23", "comment": "Malware payload (Amadey)", "value": "41f5983a0f982cff52ec3f796c10e7ae1992f63e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795634, "uuid": "7c52028c-2c03-45aa-995c-371acbdd6997", "comment": "Malware payload (Amadey)", "value": "6d170a84728ad0cfada7b406645b19d03d2d193f3467bf6b5962301e10a819ffa780c9de122c331d03e57e7734be929d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795634, "uuid": "c1c41343-b39c-459b-9b77-5699be6efa6c", "value": "T129F42352A7C49433D9F82BB00CFA169307367DA5AC78E7A72741B51B0DB36D09872B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795634, "uuid": "e373bdcd-e6dd-41ec-9989-a1b35bbb66ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795634, "uuid": "8fd48313-f6fa-4bd9-a570-28a800a57bb3", "value": "12288:7MrGy90472ErAisHjEvH1v4BisGh0xiLVSRhRg6/bjY+y4JrNl8sWN:5yHkrDSv4gBh0xMVSRh7xr3WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683795634, "uuid": "bb0aed60-b370-4c6f-ab60-f9add423e096", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683795634, "uuid": "6b6ad6e2-4964-49ef-b0c9-1b03a8196c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795634, "uuid": "c520da90-ded4-4bab-8504-9206559b07c7", "value": "5bc7a0e76211e954f494335be62cd28a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6512904-eff6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683807868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807868, "uuid": "5ae1982e-e012-429b-997d-1bee634d7e80", "comment": "Malware payload (Formbook)", "value": "fa7c50c7ccf44be95ef9ed67d643db40", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807868, "uuid": "0fb1688f-3a76-4461-9958-db989610d332", "comment": "Malware payload (Formbook)", "value": "992dd08e8cf3195e10e9257c87499643c1202d45dea5698555414f35be652988", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807868, "uuid": "6e0deb0d-4fa7-4b46-a7ff-3af1ee1fa397", "comment": "Malware payload (Formbook)", "value": "ed45ba2c484a609b446323c68b920ae687d0009d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807868, "uuid": "67483faf-065f-4e9a-99db-909dbc26565b", "comment": "Malware payload (Formbook)", "value": "a9fa3b997363b4e0ccd1d29ad83a9b37d64ad14f5ecab12170af685547390e2ed17dd3493e126ae463a293f67f9bb588", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807868, "uuid": "4539d523-3901-494b-b992-703fddbf6bf8", "value": "T1BB327DAFC5F0443EC34E81BD8C805287EA2425D7761E46D73BB9F59849E278EAF20355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807868, "uuid": "f88cc591-6493-4d7b-9188-50ad36887930", "value": "192:tTI0FC2B1sw+DNf9WV1JYZULwDBPLM//FYywPtHHaX:RI0FS/WHJYZwSpLEYyUHHaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683807868, "uuid": "72c5fa6b-fb85-484c-9599-440d7abbb3a2", "value": 11192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683807868, "uuid": "210383f4-11db-4bb3-a8cf-f454b0f3d8b8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807868, "uuid": "14c1218a-c624-4c31-8935-23cf789fbcee", "value": "Oferty_BURNAT.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7baf0353-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832224, "uuid": "f28cb682-f673-473b-8d29-933253e37ebf", "comment": "Malware payload (AgentTesla)", "value": "8ddc283f406f03d818fdc1ed6d93773e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832224, "uuid": "d553458b-4b7f-4466-82f3-0ffae3022d4a", "comment": "Malware payload (AgentTesla)", "value": "9b71b31d74304616ebc7abb5550e3ac8e9d6456ee819eb8eed14a59c1079c28c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832224, "uuid": "7796b411-aaea-45af-b307-a3ce192926e4", "comment": "Malware payload (AgentTesla)", "value": "386f938fdd4e008217068b46d956b65b2be3a0b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832224, "uuid": "951fe1b7-97a8-400c-8f92-0995aebfebd7", "comment": "Malware payload (AgentTesla)", "value": "1cd43c603d9a78ed6f1a1123b5634fec82dd1f6d9a6bffbb8c77d64f2b38a77786ef348dcaf2f7c95c8ea70c3ec4fa60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832224, "uuid": "40447aa5-654d-4d2c-b9f9-28445bcb461e", "value": "T183D4CE84123BBFE2C9A413F1211474828B7DA51A35B8F0BC7D67B4C9C9EAB114BD4B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832224, "uuid": "65da7874-42d0-4e6f-b695-e163c86e3ca6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832224, "uuid": "4822b224-51df-4364-87cc-7f16239c6b3c", "value": "12288:sqUgm1cec5PODk1UqRqk9hsUq9EAhHMfYjCQAJvOd/Ca:ugm1cdIDkWqRqk9h1AFCQAJg/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832224, "uuid": "02c3873b-f539-4376-aa62-0bb5d1412fec", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832224, "uuid": "196673e3-8a9c-4e18-8bb9-c0f6af1b0487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832224, "uuid": "cd08ed00-e045-42b6-92d1-6c64afbab963", "value": "AWB DHL SHIPPING DOCUMENT_8860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea81f97-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1683829894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829894, "uuid": "3967a057-a57b-433f-b5d0-80a4eb7226c0", "comment": "Malware payload (ArkeiStealer)", "value": "41d09d5600b1b30b656d33553ac71d0d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829894, "uuid": "c3e4e98e-4b81-4867-9615-6fedf26c5f5f", "comment": "Malware payload (ArkeiStealer)", "value": "9b7720640ea927b47581425a91027c4f5eb4871c7b00bc86ce39079e789bcbf8", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829894, "uuid": "bb2e8203-fb17-4c36-bf79-6701469d8b00", "comment": "Malware payload (ArkeiStealer)", "value": "5736f2c7cee6ceadab60a5f7cafdb192d623ad4d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829894, "uuid": "6e1a0097-7bb8-42e1-86cc-1aa74c737fb2", "comment": "Malware payload (ArkeiStealer)", "value": "d44f62295dce82ad4a18080c48767ce2078f455f1986100e857f9f595039f41cd64f05ae0b4a37cba51cecd781ce9873", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829894, "uuid": "1e08adf1-17a4-4435-af51-4317698cef99", "value": "T101948E2393A1BD94E5254B728F2FC6EC361EF3504F197B6A12199E1F44B02B2D273B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829894, "uuid": "4207a84f-ee7c-43c1-9ad8-acac256b8464", "value": "7ce2ea0672659bde73ebe3337265c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829894, "uuid": "6afd24cb-e296-42a4-acc8-4c5cc517e481", "value": "6144:m92DDL9Na/kh7VuZX4ral0edYjH8d/JvmjCQewlVdEuQYI:m4DxNa/kJ4JuaLeT8TviewGu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829894, "uuid": "5c15d3c4-3830-4cd0-8caa-6140d5585cac", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829894, "uuid": "ec533e78-7e02-480d-854c-74e6d2ddbae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829894, "uuid": "a72f6318-23c9-4313-8e81-1e2ed14079c7", "value": "41d09d5600b1b30b656d33553ac71d0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848cd7dd-f018-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683822361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "a387d994-b7dd-4140-998a-cb73f70684ab", "comment": "Malware payload (Formbook)", "value": "b72c522d6800e344b597833b325857d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "3d968c1b-bdbd-4a54-8d52-5bde8139bc61", "comment": "Malware payload (Formbook)", "value": "9beccd0237c35c26218afd582b1c76606f1a9d0c9de1bf75cc555518ffd6d420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "6425b2de-1272-41f0-af6f-5d2ebf487ca0", "comment": "Malware payload (Formbook)", "value": "f140f199c48293ff5d7c7b12b12dcd1d4e217dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "2db7d50c-585d-4e29-9296-4c2de0af4f1b", "comment": "Malware payload (Formbook)", "value": "d7e161a14cd538886448f289301d20c8a64680e350b9e66986b7f1d8740c47e2615eb4fe72d60528e28ed10384145ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "2e2fdf4e-be16-482c-8fa8-c9792d8eeb21", "value": "T1504412184B6CE213E0AB5931173E9527AEB5C85315D4C75B0BD40F8ABDB9082DF1EB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "5b68e88e-d36e-4b6c-aba7-db1d145baaa3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "fb874c35-17e2-4a40-bcaf-c84bbb6394cd", "value": "6144:PYa69Y+h158m560vLhGpB3xusdZvNSpfaJ9p:PY//XGmjvL25Qpfah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683822361, "uuid": "8a1624fc-8c65-4de0-a758-0e5c98f746a8", "value": 255129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683822361, "uuid": "aff7a965-acbe-4fe4-b383-a5c64ae19ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "e57f0a19-a850-4df4-a47b-343fcbb08f28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623d1752-eff6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683807700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807700, "uuid": "54622a00-395e-47c1-8c31-4f6c99707e10", "comment": "Malware payload", "value": "411da57cab442a79351e2028d0d6f344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807700, "uuid": "da38cc78-9b8d-45a1-983f-f7459c605f52", "comment": "Malware payload", "value": "9c125ecf7d9d6bbd56112a6bab84799ded8a3b90d223366e09664a8ff2ab6651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807700, "uuid": "c7e42f97-7b64-4737-a892-ab37e64a45af", "comment": "Malware payload", "value": "c51217ce3d1959e99886a567d21d0b97022bd6e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807700, "uuid": "76e24435-4ec2-47be-afbd-9b8f96d3f5f8", "comment": "Malware payload", "value": "648bf66216eeb28cdec8de2b3ced4087e4baf40dd2a529fcaa0457297873728860945e79629198054fac62004eed15a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807700, "uuid": "5143cd33-00e9-4124-b4be-e6247e7c8bc7", "value": "T12681510293E80A7BF0A243302EF7830277F4F5618D67875D79D4131BAEA5B6458633B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807700, "uuid": "ea773073-0e66-4282-931e-99aa060c0fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807700, "uuid": "5f61ab54-2a0d-474b-b469-2f968dd7aac0", "value": "48:6MwPEGJlMMuT9H8C0I8yUCsTJczmF1OulBL4qXSfbNtmF:LGzpuT9H8VsUY8jLQzNta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683807700, "uuid": "460d9c6a-4ae2-42d1-93a6-f37be0680f83", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683807700, "uuid": "0aec3fd9-314b-47be-a755-c2767b503c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807700, "uuid": "edf3ff5c-c05f-414d-819b-97146459494a", "value": "AtomicService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a6d261-f028-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683829201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829201, "uuid": "4905f8f0-2a34-4f27-91cf-afd1d4fb9180", "comment": "Malware payload (RedLineStealer)", "value": "2306945139bacc986605df7115009acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829201, "uuid": "b7895c64-53eb-4e7e-82b8-75cb10f64704", "comment": "Malware payload (RedLineStealer)", "value": "9dd8c473f15d8ea5808f671bcc6474a05210f7c8e6c3f51933421a94d29ad93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829201, "uuid": "9a20868a-e14b-4d2e-82a4-8baddd5efe8d", "comment": "Malware payload (RedLineStealer)", "value": "60ded98aad4728045f3dfca87a6c5b07e77fffc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829201, "uuid": "ddd55e8d-5f45-4337-a641-d168818704f6", "comment": "Malware payload (RedLineStealer)", "value": "2940187808365060d2f9b479c6283621d2e26bfffdfedd311b6825d4f2a230ce21193d20317da08aa09d1ca06f365cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829201, "uuid": "93ff7eb0-ef4b-490e-8ea2-efd50e2f1e6e", "value": "T11FC4D05AC5B88F01DE6C0AFE5C93C2C60AF49A717C35E9710BC724CD9DA3E2B68445AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829201, "uuid": "457b963f-5778-44d5-90da-3b6085d48a99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829201, "uuid": "c947b7ad-e1b1-4842-ae1b-c4e243a17be0", "value": "12288:6NAwhh2Y4YOYN3ZPbj1hBxry1/dnl6gj4:9whh2ebj1fVy1/dlj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829201, "uuid": "3c523cd7-c439-4478-871e-30d2d938064b", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829201, "uuid": "971661df-6228-483d-b762-0a4a30f8b817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829201, "uuid": "b24f15f7-e676-4ac9-accb-3f9a7ddcc8c3", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1d2cb6-efe1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683798936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798936, "uuid": "2a4a43a5-fde7-413d-9de4-db79925287c4", "comment": "Malware payload (RedLineStealer)", "value": "d442f4c957ffee579ff8833e81b5293e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798936, "uuid": "7d41657f-d258-43b3-b2fd-cebf24602eb5", "comment": "Malware payload (RedLineStealer)", "value": "9fde5ae1eb2789887b7513a950bd2fb41f5b44d6ec0756a081ccfa7d9b4d63fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798936, "uuid": "585b3584-8a1f-4582-aac5-0965332a1463", "comment": "Malware payload (RedLineStealer)", "value": "cb3e0d1495a6adcdcf107c862e22b0d82c839a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798936, "uuid": "256ad2bb-bf76-4352-b09a-4a4c34e7daaf", "comment": "Malware payload (RedLineStealer)", "value": "6b11b43945eea809458e27f09ec0bb27aed5718ad9eeb954ecaf26c314dc978147290b81f48a7ae76e74f0514f2371a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798936, "uuid": "19383ef5-3c42-4684-8253-9969b0ce9c63", "value": "T1B9F42312FBD84072D8B92B705CF603C3033ABD669578D79B2685AD1F0D731E0A576B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798936, "uuid": "6e7e8b07-0a8d-4e3c-92a8-ffa06f7c8868", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798936, "uuid": "83088b95-aebf-4bb7-98da-f08e2879e304", "value": "12288:rMrWy90nkqHyGHR3oesK8OP7awXoiqr5N1F7xTLHfGUKkG:hyokUye3oEP7aw4i01/TLHWkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683798936, "uuid": "efcbd296-2f35-4940-a2af-535125022f19", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683798936, "uuid": "2cd18141-87c1-4049-aee1-ffba6e09e592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798936, "uuid": "b0bfdee0-1dc2-43a8-85ba-d0a1dc49a8ad", "value": "d442f4c957ffee579ff8833e81b5293e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731d6155-efc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683786254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786254, "uuid": "ca289ca4-6286-4ffc-8895-514766148075", "comment": "Malware payload", "value": "bec821cc9ca7762dd50f48d0cf4344cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786254, "uuid": "3438fe8f-8f8b-4ee5-b73d-8230b3441d17", "comment": "Malware payload", "value": "a0dbde558656175e2713fc50f6d1a49bf2c5a5150b7100c1c3f2d6ce28db967a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786254, "uuid": "f14f5b02-7a1e-4f7b-ac4e-c605e0c47a8b", "comment": "Malware payload", "value": "a034b13f039c4efc0f44728b09ca3d6a85cd1be3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786254, "uuid": "239b30aa-6285-4bab-9add-5242282c4804", "comment": "Malware payload", "value": "bdf2db6066f9327c1421a9fee739c6adcabaf917be83fa6987febf02375d9231667b02c294af15873ab7e04f1b801b2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786254, "uuid": "6996e0f3-11af-41d9-93de-a2c252762291", "value": "T1D495D03FB268A53EC5AE0B3246739310997B7B61B81A8C1E47F4490DCF764701E3BA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786254, "uuid": "555844c9-e1a3-40e6-9635-2ac9aa6b8b03", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786254, "uuid": "8b6326d0-c293-44c9-a540-1ef5518f5186", "value": "49152:7BuZrEUMykYhbgNT0klNgZ+dbW/MJGlLjRZ:NkLMybgl5laZIbWOIfRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683786254, "uuid": "8b0bc873-0c51-4ed8-b79d-1112870e7740", "value": 1975530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683786254, "uuid": "8540a38c-ee7e-46ac-b902-a311c886f07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786254, "uuid": "0510406c-324e-4ac3-98b7-5ba53bbd4266", "value": "bec821cc9ca7762dd50f48d0cf4344cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da97e0fc-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829807, "uuid": "d36af0bb-638a-4c1b-837a-cd123ffcd975", "comment": "Malware payload (SnakeKeylogger)", "value": "02adb9722a0565227fd2f5d9e2203559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829807, "uuid": "ec297839-5a98-44cb-b041-4b3cda7a8092", "comment": "Malware payload (SnakeKeylogger)", "value": "a157b66148722c2f558b4946c120ccca8681cf2c5d51f43483732e3ec7c561e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829807, "uuid": "24635b6f-6ab0-4250-b27d-00c2a3e018b2", "comment": "Malware payload (SnakeKeylogger)", "value": "cf9183c13f677f2effbd839498c292d165bec57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829807, "uuid": "52e9ab99-0223-47d5-be45-69feda5ea408", "comment": "Malware payload (SnakeKeylogger)", "value": "b40d83b0b36931420b29d0c0245c470f431a9b10b0d6a7862811196582cf83c9c4f97bdc0b97a2b35c673a64a14a9ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829807, "uuid": "8a01b891-52d0-4eaa-a7fd-5b5085e35b14", "value": "T17CD317592BF89900F1FF5A7306B16112C376BC12152ACE1D4AD1F65A2B7D690CE0BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829807, "uuid": "e37a0c17-3a8d-4b5d-8ef7-63f745ee9c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829807, "uuid": "f16e4122-fe2e-4ce4-adaa-7f32e68a8316", "value": "1536:itMpEvqHEIsanj0ly+G0/nE+vBUFrlY9DZKkAMFF7w9iM3pb6bKuwmm3LApiOWBJ:itMKH7/tDZv7w9D6bf5mbywBAFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829807, "uuid": "9fdec552-b085-43f5-9992-ccb401630715", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829807, "uuid": "670d016d-5dce-4f24-82d3-125a03ea0f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829807, "uuid": "23cc2b19-43c6-498b-90a9-0b213bddd8d0", "value": "02adb9722a0565227fd2f5d9e2203559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e6204e-efda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683795630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795630, "uuid": "d50fdba6-ebd7-4fe2-af85-017a6bef6f05", "comment": "Malware payload (Formbook)", "value": "fcf70baef57eab612fce7b21dc2a5410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795630, "uuid": "c36ae4ac-83ea-4c88-87b6-ccfbe92ba47a", "comment": "Malware payload (Formbook)", "value": "a1fc12e0b11dc727c1e4f58da908d512b2ea1fb69cc317e024390440807d62eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795630, "uuid": "0d50afe7-bc56-45bb-9533-3490876b1943", "comment": "Malware payload (Formbook)", "value": "93c16bc1445bb7fcabbe32ec19653d5b849ba2f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795630, "uuid": "4e523aa6-f18c-4300-a2c1-3fa3ad312969", "comment": "Malware payload (Formbook)", "value": "f868a1ccd8e662b5e34862e2a9663acac580bd4b4a87c6146c8b246780d73b69b6560665d333fc8a49c75e2f4bbfc0c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795630, "uuid": "a879a7bb-48b6-4411-8c82-879a99845a59", "value": "T14BD4CE85533BAFD2C9A417F0615438934B7DA11A34F8E0BC7D9778C9C8AAB214BD4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795630, "uuid": "f408dc69-b39c-4800-85dc-f0acd0517e65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795630, "uuid": "8f917390-30aa-4e8a-a274-8bba7da863d2", "value": "12288:HqUKm0e+ay2vZtiHDETS3AgRwbTKGpKO1:PKm0apvZt4DnAB6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683795630, "uuid": "205b3d68-ad22-46ec-9a28-546f70a5a801", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683795630, "uuid": "a646857e-29c5-4c16-a365-29ce20f61fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795630, "uuid": "2ea30691-7585-4bb3-bb67-6684852d1753", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4c6830-f022-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683826504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826504, "uuid": "5ef9fbbf-4443-407c-acb4-c311cca4b6f6", "comment": "Malware payload (NanoCore)", "value": "1b265ad921a486805c323330aeafdd21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826504, "uuid": "7f4510b9-02fd-4109-ac45-c0ce81bfe1bf", "comment": "Malware payload (NanoCore)", "value": "a31358e9f59219cfa5f1acbc680eab9f56aa3fd9975fc73537768d9f43fb6abc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826504, "uuid": "2b2d199e-50ac-45fa-9a03-75795a34bee0", "comment": "Malware payload (NanoCore)", "value": "0c693d648cdb8a788b5223d6b23a5ce2eff671de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683826504, "uuid": "8a702262-7536-41a0-b846-7751c7407667", "comment": "Malware payload (NanoCore)", "value": "6bc301382691a5a8eb0cf673a412dc29fb3c6818332d6beae59eb0d9b480fc1fd4c730c109e82120cf249da2ac7e5395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826504, "uuid": "40194252-6740-4137-8d66-58576cdbf645", "value": "T160E4CF84523BBFE1D96417F0225428434B7DA11A75F8F0BC6D5BB8C9C8DAB104BE4BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826504, "uuid": "4636af57-fd4d-4ba8-b35f-13ed926a10c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826504, "uuid": "c5c1df1a-d8c2-4ca2-8b9a-8ec9c5452c50", "value": "12288:OqU2m0wteOxDci6SlV3PKhAbtBqITDtYNWJmQf7:I2mFT6G0Gfy80M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683826504, "uuid": "49779f30-b4b6-41f8-a9cf-9154eb64f889", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683826504, "uuid": "aff7c1f0-cfa1-4593-808e-f186171f3f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683826504, "uuid": "43a2a301-be37-4ce7-aaf3-a98a38e61cce", "value": "1b265ad921a486805c323330aeafdd21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195aa910-f043-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683840649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840649, "uuid": "7f9dd6ad-88e8-4ee0-843c-acf8230446a5", "comment": "Malware payload", "value": "c21947b75b1bbec904d0d954d5571fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840649, "uuid": "da1a16e2-1f8c-4294-9ded-582a966b2de3", "comment": "Malware payload", "value": "a43a25d2bb5a2770100e7e2bfbfc2bcb06534354468a4a7e9b70109dead13385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840649, "uuid": "2160c555-1b21-44d0-accb-6799eba37a20", "comment": "Malware payload", "value": "dfe15b9026a9c1c40841dadcfb290b87d95753eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840649, "uuid": "fd32e14e-6f44-404f-81b5-5a8c82e86b90", "comment": "Malware payload", "value": "9f4a02df517a9af415e91897b2bfcd9432055ae5821f7228da862e575c95e4da6ad6920842308bb3a4065ac1ef5eed6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840649, "uuid": "90c6adeb-2cda-4e5d-9da5-ff444f6dccf9", "value": "T11E54C024B34CC2B6F54B587D0880D4B599AE34390B7F6593BFD5032E6F253E09AA4396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840649, "uuid": "1e69d1e0-98d5-4e78-915e-33dc0659e791", "value": "ae64f100c0f22c43c95a1d2055ef681a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840649, "uuid": "a80db32f-30cd-4ebe-a7a7-0c0ac757a370", "value": "3072:mTj8y0Z+a0MT1+fjipy74f7MXCKbTyKodImL4yjPXFGRlefGRvUw90E5HBdrTJfe:m3nI+LMTs2X7MXCsorjPVG26UwX5HB9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683840649, "uuid": "be5852ec-f931-40cd-a324-74da3a4450a9", "value": 286816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683840649, "uuid": "f5acbdfc-727f-4f28-bdef-3c36d96d80e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840649, "uuid": "e172a9ca-5da1-4fc3-8567-ceedf794cd19", "value": "SecuriteInfo.com.Trojan.GenericKDZ.99300.22090.5089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee76dec3-efda-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1683795910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795910, "uuid": "7951c9a9-5b01-4492-bcdb-d197ca06dbbb", "comment": "Malware payload (RecordBreaker)", "value": "754fd3f89dac97eb7d0c744a34ddf0ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795910, "uuid": "8b0b7be8-939b-4c52-a0d2-c202217a0bac", "comment": "Malware payload (RecordBreaker)", "value": "a57095dbebb53f0e936ca4b7fabad5434bfe533a248fc84d01b9de1af63221ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795910, "uuid": "afd4b0d6-486e-4852-bbc6-193c955f541d", "comment": "Malware payload (RecordBreaker)", "value": "f7bea522fefef6f77c2394c30f0caf729377af14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683795910, "uuid": "56ddb695-b516-4cc7-a723-a5ab95974064", "comment": "Malware payload (RecordBreaker)", "value": "29666b744453d61376c6e51c026bc1de1a8e654bb146f35bd51de1a793c170b970d978a68780969e71c4541eac6917cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795910, "uuid": "648a6cf2-5825-434a-a744-3538c3a7fb99", "value": "T1F5542A2393A13D54E9664B729E2FC6EC771EF3504F5A376A22189E1F14B02B2C173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795910, "uuid": "ab6a7faf-cac7-4efa-8fbc-38c2dbfcace8", "value": "dac3c11d45819b7994d02cd08167cb44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795910, "uuid": "ea313a86-df49-4e2a-b04a-36e3fd281385", "value": "3072:FApXBH1gLjw5DcDrOUm40fCg9BzIc8RFuLmLL1u5UuMzVxRfe/t:F4BH6LjwJcDV9gnIc8vuW1pJxQ/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683795910, "uuid": "83c4c4f2-c300-43c6-9258-7534b74ecc94", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683795910, "uuid": "ce420852-310e-4e55-a04e-1d41e4c797f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683795910, "uuid": "a98fad82-d8c1-4e3b-bda5-cd416247f459", "value": "754fd3f89dac97eb7d0c744a34ddf0ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cb1556-efcf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683790827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790827, "uuid": "95ef1edb-d7bd-4ff9-9aaa-b1a38160e795", "comment": "Malware payload (Amadey)", "value": "ae31a3bcd9cac21a1caadade9163aadc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790827, "uuid": "55bbda2e-2177-444e-a398-11efb055002b", "comment": "Malware payload (Amadey)", "value": "a574f5fe12dd99eb7c6ced297707327025363dc480d1d9b89474bb8ccebdf340", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790827, "uuid": "3e41fcdd-af3e-4c46-a7fd-df9a068123a9", "comment": "Malware payload (Amadey)", "value": "c837acb86ab35f0a4c37dbff619edf81aab098c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683790827, "uuid": "8868c69f-ece8-4b45-a8a7-c7ec9c4d0959", "comment": "Malware payload (Amadey)", "value": "7dff7a5f4ee5fbd711f89b09b8903c2697e024d7f6ead2786a62cbfbe81e34a4d0171c710462b8d601b5d02a9369dc4c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790827, "uuid": "ba51007a-f6e0-41d9-8482-08eb037def1d", "value": "T127F41216BBDC4563DDF92BB015F703530B3ABCD28834C6272281A8591DF3299A87677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790827, "uuid": "f0d56cb8-8783-4686-a73e-2eacaa2e7031", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790827, "uuid": "7f0bb734-7cbb-43e6-8171-7f6d23e3ec79", "value": "12288:yMrjy90lzQWtczb1PjVf8forCtr56NROT8EQehgvRawbvWl++qHu2P:ByCQWtczb1PjVf8A47Q9vRZ0+3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683790827, "uuid": "20bd2049-6649-4099-9903-9b53fac5fdab", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683790827, "uuid": "a0c2da08-062d-4dc6-a56e-67068d72ff65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683790827, "uuid": "7e4f03a9-d226-4633-b7df-b5e624dea220", "value": "ae31a3bcd9cac21a1caadade9163aadc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df06b76c-f010-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683819077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819077, "uuid": "ef5f4e49-127f-4dde-ad29-b7260329fed2", "comment": "Malware payload", "value": "820d54ed8bf692a35a93ad4838863cfe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819077, "uuid": "32eb6865-0807-4d05-9569-a6408796c459", "comment": "Malware payload", "value": "a646e7dd916965f2381457c7a888f1232b270f7dac6d595620c5cc26683e6a95", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819077, "uuid": "37284bda-818e-4c4d-99c5-46f732314cc3", "comment": "Malware payload", "value": "e7b3c8a466cde988a80a42e2e47f99ecf4add5aa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819077, "uuid": "dccf5e10-371e-4530-be0a-e398b111fcaf", "comment": "Malware payload", "value": "66f4607082f1fae0e48949b87d4379e0ff42f271e0be473a7b04db7c7ac359d172a215d2a316789c52763f67ea650dd9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819077, "uuid": "c9eff61d-42a7-4d74-b563-9482ed0b045c", "value": "T178C42E6013E99A0CF2FB3F552DB952846F62BDE6BD7AC15D132024AE0D74E94C9B0732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819077, "uuid": "1e22201a-738e-45dc-a4cc-504ba79d24a1", "value": "3072:obaEYnIsfnLlFSOgLc1Fr4xnSoAkpMBrrdYZ1MWf5pzutm593iKowJW7Hz3dDLak:lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819077, "uuid": "f2e2c071-c208-4565-ba0c-6a95b4626b89", "value": 557514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819077, "uuid": "666c0ff2-1ec0-432d-b6d8-cdd6efb4a1d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819077, "uuid": "fa5a6fd4-c556-4653-b522-cef9198003e0", "value": "DIJY0678_9378273.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae14bc3-f015-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1683821190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821190, "uuid": "85839188-8661-411c-8ea6-3e4abad53efa", "comment": "Malware payload (AveMariaRAT)", "value": "327a28b816e000b16c567eb7df943fe5", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821190, "uuid": "3548a0fb-4b11-49c7-b961-7f8aae2787bf", "comment": "Malware payload (AveMariaRAT)", "value": "a7400fc6a15efb3ba5d663c47258ad3b79696ca39eedf8d29e5d4686518bc740", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821190, "uuid": "6abe7b7f-96b5-4e2c-84d6-660536889291", "comment": "Malware payload (AveMariaRAT)", "value": "065745ae91b5263813b4766d5906e1a687a1a0a1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821190, "uuid": "c206e2a1-98c1-481d-a234-8ea4a946b313", "comment": "Malware payload (AveMariaRAT)", "value": "b05b5d62e6c4d551080cfea4b5a726a0d6855b5c092e575141cab36cf62dd1027ad08820db991048cc802ef8154daa82", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821190, "uuid": "141964aa-a093-44b5-8cae-b233753bd45a", "value": "T152C2F199D1AF401AA07D19BB138D0F80D23F7152E5C17C0A9F6BED45A05C2BA21DAEE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821190, "uuid": "f4067d1e-8b0c-4d3b-817a-b1cc06636093", "value": "768:nuBLR9ys/OqZVbklWiXS4v8Rljh6Xz9nkRTcza:uBL3Z7ZRklWiC44LKlkhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683821190, "uuid": "688c090e-7a9e-4bb9-b1a9-3277905c2b1f", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683821190, "uuid": "bf4d9e46-1af4-46ef-8ae9-182e32a56dca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821190, "uuid": "d4a15c24-3b5d-4331-9e00-53341df31932", "value": "NEW ORDER.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90ecebf-efff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683811738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811738, "uuid": "d84a1f2d-f05b-43db-8297-e9d3b8e226ba", "comment": "Malware payload (AgentTesla)", "value": "d8c0f67b19685c0c250f354caced3592", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811738, "uuid": "4370ffab-521c-436e-b98c-309de162864b", "comment": "Malware payload (AgentTesla)", "value": "a7abe48c11defe7c62c3b5b54eccbf4b7a4cd7ae844c7206312dfbec8ab3b9ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811738, "uuid": "769f60cf-0adf-4672-b016-bd22722d8bbb", "comment": "Malware payload (AgentTesla)", "value": "f698a20ebfb571138e64d317de01581c55183ee3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683811738, "uuid": "3b7783b0-381c-4f97-8135-aa42e7db2e9e", "comment": "Malware payload (AgentTesla)", "value": "ebb362429f8ec698c477bdd8d0e4a0aa53171fe30f92ad3e7953e3eb70241c47bcdd0ec1cc6b46fcec7fa212721e3f56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811738, "uuid": "4bbb3e9b-052c-4811-9e1f-0a3cd1fe1073", "value": "T171944945D2C544DED52377B07C2FB9DC19639E7A5668AE859F263C262633EA32033C0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811738, "uuid": "1875a6c0-8574-484b-9599-ba200e97b431", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811738, "uuid": "cdad8999-340e-4459-9fe3-46e7d23bab0c", "value": "6144:AYa6xQidnmtM5vN0/cMlGgpnIRgCDijtzDNAbpjVAk5PU86D2Ly7L2Vps38/:AYgiFmtMtACDijRDNO75+/fIl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683811738, "uuid": "2c006f17-fb44-4358-8882-02cef3dd802a", "value": 424596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683811738, "uuid": "6f8a6cc4-682d-484c-9857-fe6beb6138ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683811738, "uuid": "b1816638-011a-4ca6-9066-fa4229c5ea4e", "value": "a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815aa2b7-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683832234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832234, "uuid": "661924da-6a4b-4208-a95b-5e8fe0629812", "comment": "Malware payload", "value": "d6dd6127cb4b563fc65f63d82c40bd2f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832234, "uuid": "afd2b738-449d-4645-ab52-542921f68ee2", "comment": "Malware payload", "value": "a7c8b1413107f9a3d35196702d64ba038ec3cb3026d77849bba7fb0a50cbba55", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832234, "uuid": "64dedc74-a45c-4b8a-a7e3-c1cd557e1451", "comment": "Malware payload", "value": "bec10c4b674823d48d101b68d0a51bf4d982759b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832234, "uuid": "7f54ef17-98ce-46af-b1c9-3d1f03e5f9fc", "comment": "Malware payload", "value": "643d63702191a6e509103053d9260e4ff61d942ab4eeddd46a882389dfe2b46aa2e06b285f7e377d2efca72914dedbb4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832234, "uuid": "884a7921-8512-4d53-98d3-e3feac51e96a", "value": "T1E6618D144BE6020CF3F3AB3A99BE66554E3B7946AD31C74E0054814EA2F1A40ED76F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832234, "uuid": "775e0c26-033c-4f33-9bd9-41e3e2923899", "value": "48:8v5aGU9Dmel0iglZ+JpQfYj1sAT1rTRRSJxo9AIH:8v5IB0+J6YZsErTR0/SAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832234, "uuid": "d6137cd1-00db-47ba-bfde-1f779118269c", "value": 3444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832234, "uuid": "2d35b9b9-335e-4fa8-bd71-93dd288159ef", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832234, "uuid": "089ba991-e160-4cda-9934-bf65d11717a4", "value": "Invoice.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe3f9c0-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829809, "uuid": "3da6fc4d-3dc4-4a24-8a35-ac1ce4fe8dee", "comment": "Malware payload (SnakeKeylogger)", "value": "bc86ea79435238d3f10f31708b8a9d9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829809, "uuid": "ae49b92c-c68f-4dba-a6a0-bbafc4f85407", "comment": "Malware payload (SnakeKeylogger)", "value": "a7ddbe5d449df517e310e1982be8b8ac30691950a8d424f8eddfea80561cd332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829809, "uuid": "7d94a88b-3901-4a82-9486-3548233e7f22", "comment": "Malware payload (SnakeKeylogger)", "value": "b68011b59545017c94ab526521bcb51350e4cf8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829809, "uuid": "df2812c2-f99d-4aa8-ae29-fd10a3d8f5b8", "comment": "Malware payload (SnakeKeylogger)", "value": "06f0d8403030838f72140f58430b6efc23b63904a08d4ec47a34680c8474021983495d88061b34ee1cc163521991acc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829809, "uuid": "d4ffd83a-21ce-4dc0-b66f-4825433df64a", "value": "T1E734F1857AB37B1EE7874BF07E463A4017B6284BB812E14E4D9630DE1F1BF009956D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829809, "uuid": "095e53cf-1826-4c23-aca3-b815dc6a5317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829809, "uuid": "ac10e017-7eaf-4c76-92cf-4584ffca381c", "value": "6144:JQsL+o+ftEXuEU733bhfOSeHzhgQBY5t:xiE+n7nbhfSFgQBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829809, "uuid": "eccbb2b1-5fd1-4282-93d7-ccc0eb6f8ac1", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829809, "uuid": "0237bbdd-ba5a-4076-a15a-ef6cec282d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829809, "uuid": "e18c421b-763a-46d6-b7ef-bcdccbad5f40", "value": "SHLD098765000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a2c03c-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683832291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832291, "uuid": "f19ed2e7-a3cf-46a6-b05f-17fdf83e5cfb", "comment": "Malware payload", "value": "2d900620e07331a60339d11b25b9292e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832291, "uuid": "704acb77-2943-42d5-a165-76337628ddd3", "comment": "Malware payload", "value": "a83f0415df70e06c63f57541df0e9b8ff8a8519d5a2ede0abe20e0373adff06f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832291, "uuid": "b0a8a353-5b56-4c52-90ba-d0472b00aa0a", "comment": "Malware payload", "value": "c24b6d36bd77f55b802454c5bf72d20f821e5666", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832291, "uuid": "3cceb44b-0a78-4205-997f-10059c83ad4e", "comment": "Malware payload", "value": "f0ab250a517e372724967863e61482a8aad27aa48197394738bc3d9862c08b026e4847fbac715058e7d63fa3bfcba46b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832291, "uuid": "c9a20b7b-f6d5-4e17-ae3b-ebedcf2f2583", "value": "T17224F11FBDAAD4E8D4078932680CD211E24DC55CD568F2AF19FC89484D79C7A0E27EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832291, "uuid": "a9cc9399-d427-4267-9b3b-99d9333cb8a3", "value": "6144:+GwX7REYxBgfoGGwniwZRGdj15u1znD9xqRX65Z4+dugVaHer/c9:+7lEsgppiGA7KjGZ2u0B/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832291, "uuid": "2e96cf7f-ce2c-46d8-9d6b-b75f5b899792", "value": 224643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832291, "uuid": "282a4556-dea4-4a68-94a2-f72a5e2e0cd4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832291, "uuid": "6be76587-a81c-4a42-83b0-2b6062d3a25b", "value": "iftbel-list of items.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11a8da2-efdf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683798035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798035, "uuid": "1b8d1270-b086-4c49-8197-0a1dbd02d5ad", "comment": "Malware payload (RedLineStealer)", "value": "cb38c8d084aa9ca8174530af192a3a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798035, "uuid": "c6282042-32fd-4245-956b-4dfd378da84a", "comment": "Malware payload (RedLineStealer)", "value": "a86ff5ae9603c86e84e8765285802f5c3aeeb4f50c0632741f42994907db2ed6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798035, "uuid": "1c72d7d9-2cef-49bd-9b1b-62c56108cf94", "comment": "Malware payload (RedLineStealer)", "value": "4565eb1e4b38cd56aa907c81a1e27417fc1fe56d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683798035, "uuid": "5bb3d523-7fd0-4227-b796-f10cb3c50ee3", "comment": "Malware payload (RedLineStealer)", "value": "3278550bf995f7c9cb7b4d27bac225a1298fe0fdfe4050ffef97c421303b326383d605c1e9f421a648a1d38e0478922d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798035, "uuid": "3a4f5561-4c8b-44a9-9bc3-a6f09ec3f38d", "value": "T1EFF42346E2D48432D9326BB088FB07931B3E7D92ADB483772244799F4D726D8A47533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798035, "uuid": "4e2dfd60-f78d-48ab-b40d-31b4f7eecff2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798035, "uuid": "656c999a-d662-43c0-8775-e433cace7a1d", "value": "12288:+Mrcy90/DyTD1lmI0cMuhzYrdp8OmnSHpN7f9EinTwpTIjdEkX44D8r6:WyzldMuhzSe7n0ZfYpToD8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683798035, "uuid": "89fc7771-772d-4129-ade1-9c8bc1c2125a", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683798035, "uuid": "26e3fa22-4fed-426b-8030-1aa94973d646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683798035, "uuid": "7414db08-8dc6-4e0c-847e-bc5413d95d93", "value": "cb38c8d084aa9ca8174530af192a3a71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2e6275-efc8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683787828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787828, "uuid": "8efc20e8-133c-4a55-b854-cd9e03e6ac61", "comment": "Malware payload (RedLineStealer)", "value": "7585b89582340e8c960023e230e49769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787828, "uuid": "d7829928-cf7a-4743-9801-46d2bb7d737f", "comment": "Malware payload (RedLineStealer)", "value": "a97ad7281baa6b0de4b68c6da01948cc641b16cf23caeda4834bf81e5b519ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787828, "uuid": "a122755f-aac2-451e-8441-cc70095a9043", "comment": "Malware payload (RedLineStealer)", "value": "b3a9b24df0ef1e4d370b1eb05a7525cd99d14a97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787828, "uuid": "d3e35ead-787f-474e-82e1-9ad181d5c55b", "comment": "Malware payload (RedLineStealer)", "value": "1f247ed7ebe72ebc79738ba05b72c72fa8e1992719a09eb4083f8dd9747eb4f2c9f2259ce81840d4315b2c6b7c9767d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787828, "uuid": "12f63384-69c4-41d5-a4aa-87d04d2d404c", "value": "T144051257AAC8A073D4B12B706CF607C71E38BD665C34466B3756789F09B2B84B53232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787828, "uuid": "eb9e9db6-f019-4411-8f32-361383ce23b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787828, "uuid": "250b087f-3708-450d-aa8b-25d41862b1e8", "value": "24576:hykCz994sEbvOxBtJyfToclyQosQdHZ7v:Ut94bvQgT33iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683787828, "uuid": "b669d45e-ba46-44c0-95f2-9466cc50223c", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683787828, "uuid": "b82ec186-78bb-407a-87f3-1e1fd8f85290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787828, "uuid": "e5925199-b983-4f37-baa5-5b866d2420ec", "value": "7585b89582340e8c960023e230e49769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc0f686-efb7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683780848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780848, "uuid": "73d73c8d-5344-49bb-97c5-6c07ed4113d0", "comment": "Malware payload (AgentTesla)", "value": "6155b423ab8071a895c5f8dac1dbebd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780848, "uuid": "b06387a9-b5f0-4b45-87ac-264e6e6f4cd5", "comment": "Malware payload (AgentTesla)", "value": "ab2fa246d4f83af7f69c3d9ac4ad3c5a4aab69046dc5b0fe1e8f5e26b905999f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780848, "uuid": "72001267-90cd-4dea-a238-8194fa636da2", "comment": "Malware payload (AgentTesla)", "value": "7b912b23b0f84d9dc1dd8f9846b802f84c889948", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683780848, "uuid": "3e8f08a2-b983-4037-944e-a7c8d27b5bf9", "comment": "Malware payload (AgentTesla)", "value": "effc967ae4c1f052e824d7434853524d35b6ef52f29b11b0975125b53758f841c0c13bac6b4e5778ae4de489dc086988", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780848, "uuid": "76b55815-1296-4ea9-8a7d-931830b4c6d9", "value": "T184F4E061322A9B2BD76843FF0A18484503B97756FD2BD27D6EDF21CCDC22B504A21E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780848, "uuid": "4f0f8ab6-34fd-41a7-bec5-936828e9db9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780848, "uuid": "e42c7d50-5275-4458-ae1f-d5667ff506be", "value": "12288:I+ZfTSmQ/Xp4LiKsfj5wSb0qp42Po7vXi2N8h1Q7/VOtaX2e1X/KSboYFDPjV:I8LgBldwSb2Xi2NIqDVA3e9Sqo6rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683780848, "uuid": "9ba93461-0744-484c-86ba-58aff5d6e658", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683780848, "uuid": "f6c05116-e0bc-4c34-86b1-452982341b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683780848, "uuid": "3b903126-2059-4eb1-a89c-0354ec2a0259", "value": "lNuvqoBjegB7DrK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4f1460-f038-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683836118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836118, "uuid": "e4cd8697-6abb-42d6-9012-a86370935142", "comment": "Malware payload", "value": "2c4fbf6b09ff7b2c67deebbfc9f1c47c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836118, "uuid": "a35939d1-8771-4c3a-9b34-f83724be36c9", "comment": "Malware payload", "value": "ac0607aeb020d69ba982c4f30a26f09f5a15a6ad2c4868fff404b646f4b1163f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836118, "uuid": "577279c6-c307-4b03-a75e-6e1ef80bfc38", "comment": "Malware payload", "value": "6d87a3193eaba4f98cf6c498b7eedc38125fbd5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836118, "uuid": "276e3767-ee08-492e-84db-898f2544aa26", "comment": "Malware payload", "value": "11cc40c986cebfabe4b4e08145af162a06ada59656e2da09ad9ba7cbc9ee2fc72aa16b089126b82d5f3be5d7461a862d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836118, "uuid": "66167a60-9e45-4efe-bd0d-6198895f9344", "value": "T15E430A52E785CA62E6AC833578D793427732F614AF67EB431540C9BAFD823D0AE807C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836118, "uuid": "bce4f1cb-9443-488d-ac78-09824b20fc9e", "value": "768:nDwv/qZgdJkxhYpyfbb9RzWIjrkM1C+I6+s7B6IL2MJhglTPaFYnEVt4o0:nQd2UpyfbJd1Cn6GMPIaZPf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683836118, "uuid": "ab90648f-848f-4138-bb83-f3330dfa6a65", "value": 56840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683836118, "uuid": "cb519fed-7d0f-4f06-b6c0-087679549a62", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836118, "uuid": "a6c1f3b8-ec47-4318-bb56-1ffbc37bafbc", "value": "classes.dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84aa7c10-f018-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683822361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "8f2edaf4-d66b-4eca-993a-4e794bcb09ac", "comment": "Malware payload (Smoke Loader)", "value": "8b75d4e0ecaaf72018e4ad13783a275d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "21c2f5be-0af7-41e1-9e5e-69166e022de1", "comment": "Malware payload (Smoke Loader)", "value": "ae74817df2569f0619a180f569caf62d7ac5d5418f7a64cb4e21724f20d96dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "456b0228-e0da-46dc-a963-e4467db197c1", "comment": "Malware payload (Smoke Loader)", "value": "c323645cfbbc1be1d3e523155394c8f32dcf5951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822361, "uuid": "13cdb6ef-4f7c-4047-8886-3ab47bf74ef7", "comment": "Malware payload (Smoke Loader)", "value": "3ee99687ed947e5ada2a57a0673be2f36548cdc187829611b920ca7d0a8df152cdb003e68dcbe739b633d2c7566aaeaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "280903fb-c01d-487b-9c7c-0f88274a0e24", "value": "T115643C0362D1BD64E6374A328F1EC6F4365EF9618F5977AF2218AB1F04B52B1C162F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "92f784d8-2c67-4a55-9095-fa6008715822", "value": "6847c4a23533c8db62ddf8eb8d214ba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "9cb8df57-01ca-4480-89a7-e0abe3ab2e37", "value": "3072:TJIg1eqhAMYbMFiaW6FhGv/6QKskf4a6DBXz1RLqBe63nVDZXwKkEIZo:Rey9PWu7HsPvDBXnqbnVDHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683822361, "uuid": "5ba2bda5-2f3a-4125-af72-126a47e45ac9", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683822361, "uuid": "24fe01f7-5fed-4ef5-b4c5-2ecd4365ede8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822361, "uuid": "86c796cf-1cb5-4bb1-aad9-8e77b735cde6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a856bd1d-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683785914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785914, "uuid": "67d89931-204b-47e2-8eb0-f600dc753540", "comment": "Malware payload (AgentTesla)", "value": "b553e760f52ba5211986efea731f3b68", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785914, "uuid": "2e774ccf-b582-4ab6-94ea-3ed894b369ed", "comment": "Malware payload (AgentTesla)", "value": "ae76d97a8a5173d82378838fc1334902095304a92643b316b6a26dbb1c8ddff8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785914, "uuid": "8ba68e44-789b-40dd-b8a2-c57aa49bbba8", "comment": "Malware payload (AgentTesla)", "value": "362ab90b779dc9a15976300aca2c5645f440a3d5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785914, "uuid": "b6035651-3e5b-485a-ad40-475cd3001677", "comment": "Malware payload (AgentTesla)", "value": "15a6ffe1a58b745df4d0ecb3ed119ad447ed30b944dc4cecf6ff84c88ca12924a5674a7e3873e2e9ce6a3090265c5eee", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785914, "uuid": "86a000cf-3d80-4850-9d91-4f3be92419c1", "value": "T10EF433A6E1290B23737F16EE06FC7C5CC33959B4D1237529662601A077DC6C2B9EDE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785914, "uuid": "112ef68f-6589-45ee-b677-46524b2c1f6a", "value": "12288:LKtxCEI19ChA9iQ4z6I0AtVzT2b2tu2e019sMsFC0XaPKqmf18vM5VZ3Cew:Sc18hAsWI7VzT2b2M2dXrsFC0OLmdWMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785914, "uuid": "62b4f8d7-4359-4784-8dbd-7885d7cda783", "value": 732110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785914, "uuid": "68077c8c-7530-4287-9297-a3510bd0035e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785914, "uuid": "60918d6c-5001-418f-89b5-4a044bdef7d1", "value": "-logistics details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91ac1be-f027-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683828972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828972, "uuid": "536fdeaf-8c95-449c-b9fb-ed09dfe7bd8d", "comment": "Malware payload (Mirai)", "value": "d410ad6a413dcee31559c85123a188ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828972, "uuid": "974159a8-813c-4586-b125-5e34e05cc6bd", "comment": "Malware payload (Mirai)", "value": "af5fae56d33c971af29fc61dedf96b101ec09d6c781997c8032d4179e30ed5c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828972, "uuid": "66e2a68c-ccd3-4955-970d-c8f60c0f183a", "comment": "Malware payload (Mirai)", "value": "011acdd1b814a8085b5509a17de0a178df896ca4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828972, "uuid": "536bd164-3ae5-4b7e-b4a9-2765653f766f", "comment": "Malware payload (Mirai)", "value": "03c12e8766e28f18d186b956763d3fe9c90e8efa567db40aa4403809a43217aa3512c6c182e212bcaf9f2d0978ac68cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828972, "uuid": "80fc6e84-1ceb-482a-a05b-2d2a76646159", "value": "T13BA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828972, "uuid": "47992386-a0db-4af5-9fb8-ed2cc216dae3", "value": "3072:VSx+i6mqaObhNSnPTO/X6HmZuqQ4DPwXXtse:y6mRObnSnPm6HmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828972, "uuid": "4049b41b-73f3-4231-b572-2ef664e0406c", "value": 100868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828972, "uuid": "964e5277-31f2-4dc8-8ea9-a0b1a7a7b36d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828972, "uuid": "725406f9-a47f-4f68-b902-82a8fec3d189", "value": "d410ad6a413dcee31559c85123a188ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82502c8c-f02e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683831806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831806, "uuid": "9cd0feb6-5777-424a-b8bd-14dd8dd66763", "comment": "Malware payload (CoinMiner)", "value": "7bb8ca07a6fc374d3125f9937ad51053", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831806, "uuid": "96d92038-0b81-4583-9148-dd24e7271b46", "comment": "Malware payload (CoinMiner)", "value": "af78e7767e5de75f481ba8e49497ad1c6e43c182cc662eb6b19629e8a363ab61", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831806, "uuid": "277a5037-9484-4368-91ab-be83ac6e5aa3", "comment": "Malware payload (CoinMiner)", "value": "46370414b9938ff62fa4b7769ec7a96d7600dd92", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683831806, "uuid": "1edec565-7020-443b-870d-5525b78952d1", "comment": "Malware payload (CoinMiner)", "value": "4bae2de502a091c33f5646b717622b9644a59910c89fbadb2adbe7ae3651b915bc924dafa7e5bdbafe0aa5ca26ea0255", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831806, "uuid": "acf002e8-a4da-4d03-b277-1a9c81d285a3", "value": "T12656D0E7CDFE5444CBE1CD76CE9D61898AAB343160A8483FC356CDA516A207E4827CDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831806, "uuid": "2e9f7ff3-52f5-4fa1-bb03-968296343ff7", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831806, "uuid": "19111a90-043d-4f28-b379-561728a779b4", "value": "98304:r9fwth43thCYLqxkhlqF8oIa1+UjvGRPEXM199N2IMmXgeDVhopBhc:rlmhYzVDEIG+IvweMOcTopc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683831806, "uuid": "24bf7951-bd7c-4094-ac38-716319bc9a70", "value": 5985280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683831806, "uuid": "e0ede16d-24ca-476a-9a98-4eda85c5ba9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683831806, "uuid": "887aa60b-62e5-4823-9957-57c9b0d06cf3", "value": "7bb8ca07a6fc374d3125f9937ad51053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df014bc-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832201, "uuid": "54a18094-51a6-40ad-92b9-87e65be9a684", "comment": "Malware payload (AgentTesla)", "value": "cc735540fdab9d6e4e7ec4ac34b5cb9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832201, "uuid": "41316410-673a-458f-8eaa-47c694d0a7f6", "comment": "Malware payload (AgentTesla)", "value": "b3231521058b66364d048bb682f599c247ec822d984cc479e6eb1ea4bf802f2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832201, "uuid": "cde81118-71f9-4902-a835-9429bef4c03c", "comment": "Malware payload (AgentTesla)", "value": "537287bacfd3c9a99f305088c2ba79bfe19e89ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832201, "uuid": "6b77ac7d-4cb3-4dd9-ab2a-97dd0623c57b", "comment": "Malware payload (AgentTesla)", "value": "e77b901a31658d4c8130608a7e907cc146e95645f7f33271a37fe73fc2d3f503419c2d8b04966a4b8f2baa4f1cda592b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832201, "uuid": "0d84aa31-7569-42dc-bd3c-2e66149097b7", "value": "T19634E10677929922C7485978D0E3562413F6D3C77373C3867A98428F0F663EA6E8A7CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832201, "uuid": "f194fdb1-e27e-456e-8bae-07d92e21a4f0", "value": "6144:gvO8YCXiKuXewtF/N+cMLjzmk/o6nSoCo7Ej192ZnXn4:QO8NXiKueGF//MLjiYSyojr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832201, "uuid": "89cdd0a8-af2e-4dad-8f23-273ae1ba28e3", "value": 245832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832201, "uuid": "c9090852-97fb-4dfe-8cf8-efe99cd32d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832201, "uuid": "1ab26dcb-a08c-4ecb-90bc-87928c31b9f5", "value": "ZiraatBankasiSwiftMesaji11052023-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c49f1f8-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683832198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832198, "uuid": "43d56d74-ebcd-4ae1-89fb-339f0585713f", "comment": "Malware payload (AgentTesla)", "value": "05cb87f20bf45c0fe50d44b760bda8c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832198, "uuid": "43c1cca1-0fb7-4c5f-8705-0461c1c7d0a0", "comment": "Malware payload (AgentTesla)", "value": "b34061090a7feced2f241fc001825ad1e47314b30a09bc6debabc962d7e32375", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832198, "uuid": "23ded777-993c-4891-a708-2f33ee2cfcf3", "comment": "Malware payload (AgentTesla)", "value": "0b929157912bd110d4371d7ad23f033e7ad4dcd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832198, "uuid": "cb841fd5-fe46-4c41-bcba-ad924352775d", "comment": "Malware payload (AgentTesla)", "value": "a3de844c9c99cf272d8161384dd91164d895de87b28f267330d71069943a01f5109151603a9c08b9015ab0dfc6eff416", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832198, "uuid": "54113472-f40d-4747-8f3f-3486ce403dfe", "value": "T1922402166F532025D903AF32A8D151186BB2E3C125A3CB8F71D8935F5F833DF075AAA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832198, "uuid": "ae58cba7-1ea5-45c3-ae47-be73edeb130b", "value": "3072:2GoKPc8b4QK/OuODduhJ8AYZT/RyIexLCWUIsfk4Lavi+JKxFwoB7fxvXX4:2GoKE3OXDdkmZFWxHUxk4mlK9n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832198, "uuid": "e42327a0-9e5b-4519-8e56-7f1f95c286e7", "value": 209480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832198, "uuid": "cfe37cc9-dc16-46d6-b750-ddd59d7eb736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832198, "uuid": "6b706e1b-8faa-4bf6-8012-e18b3dac83d6", "value": "ZiraatBankasiSwiftMesaji11052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f052c6-efc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785564, "uuid": "a728b34b-5913-4f71-89d2-7e294be0a58c", "comment": "Malware payload (Mirai)", "value": "5863ddb7cb3d72867011bb087a678902", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785564, "uuid": "d8372fd1-83a8-4042-80be-d29b9516aded", "comment": "Malware payload (Mirai)", "value": "b3925bf3137744ad4a7e1dbc219e57b848e1580dfd82540046920e77c379f4c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785564, "uuid": "d3e1d80f-a764-4e99-b65f-85497009db2f", "comment": "Malware payload (Mirai)", "value": "589e38d10ac00fac4690200118e3bc94df909ed5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785564, "uuid": "9e4a48eb-645b-433a-b054-57d96c4204d6", "comment": "Malware payload (Mirai)", "value": "ed9cf3603421f228035968bba0e5c163d6c38404872173e6955802f05cf4609bbe681321ed2e2cdbecff9b5531d9b5a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785564, "uuid": "9c617698-8cac-449c-a304-319a08977c1a", "value": "T1D8731981BC809E15C6C517BBFA6F118E330297A8E2DEB353CD145B6477CA81B0E37A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785564, "uuid": "e42fdcc8-0be4-40d2-9f63-99c9c8fe5675", "value": "1536:n1nblFlufknASOgUb+AAYg+y2HNclsuxIw9mrsplDKZUCQBKXAVan9X+F8Jyv+Bf:HFlvO5bzA1+JHNcsS79mrsplDKZUCQBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785564, "uuid": "d75be801-29b3-4884-9a8b-0a2e25d1d4ef", "value": 80108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785564, "uuid": "c78b22ba-a6bc-48f3-912f-303f37fbfb33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785564, "uuid": "ca717f54-95ac-4a0b-a40b-a49602e099c8", "value": "5863ddb7cb3d72867011bb087a678902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f86cc68-f033-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683833788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833788, "uuid": "4522b771-2cce-42e4-ad27-bf5102287721", "comment": "Malware payload (Amadey)", "value": "cedd2a204e4f2b1d19882d8800bad11b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833788, "uuid": "14064fa7-b1ae-4317-a632-56187b003b2e", "comment": "Malware payload (Amadey)", "value": "b3fd93cdbb22498647bba224764a189c19d0d3226b63347e2fc10f7f8994facc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833788, "uuid": "40289fdb-e263-480a-8fd5-b30255b4ac37", "comment": "Malware payload (Amadey)", "value": "215e0d5275d567f4c1599364f6e5f5ab0e726cc8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833788, "uuid": "d7008715-a964-4010-8c10-b1b6b1d37fa0", "comment": "Malware payload (Amadey)", "value": "dad79191bfa85b9dd557d2880f0732b0226efb65125419185530ab091e0f918a55f2d9a3db4af6af3c2cc143d327164e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833788, "uuid": "e952aca4-0aaf-4a08-952f-f9cc7cd38506", "value": "T174252353A7E84972C5F41FB0A4FA02430B7ABCE19C789617A751B88B9C73581E87036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833788, "uuid": "257227e3-58c9-40c9-a55f-74e8b4763b2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833788, "uuid": "92d4d070-8629-4857-be51-39bb85effdb3", "value": "24576:9yUtvrjcPD0GbgWSAg+Feg7Q+Yu2KsxUnWht0l:YUtTjcPDyWSAgKegbvLPWha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833788, "uuid": "711f9ccc-f28b-45e2-9380-5a6875b4379b", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833788, "uuid": "2ae71e7c-2c33-406f-b238-f28bcc8eef55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833788, "uuid": "2202f00a-0298-4272-a39d-b7350fa434e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0247e69b-efbd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683783058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783058, "uuid": "7e2939cb-7f05-44c9-8650-2de8c4ecad1d", "comment": "Malware payload (AsyncRAT)", "value": "c059c7a8562ba10afe69e3b5d76b26fd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783058, "uuid": "01bdce25-4042-4d93-bacc-b2a2356a85aa", "comment": "Malware payload (AsyncRAT)", "value": "b6170116eeddf03988722915c4aeb57c1517d32fd5d74f4f7d5c1d3dca4aff54", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783058, "uuid": "0de0e99c-0ea7-4bd8-94f3-2dd322e87884", "comment": "Malware payload (AsyncRAT)", "value": "fd54908c209c8104518566e9dc12d7a7ecf42ba8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783058, "uuid": "555522ac-30f2-4ee6-a399-61e82ee1dace", "comment": "Malware payload (AsyncRAT)", "value": "d7a9ae5d86de59af04168c0160d4fbde03ddd809753fc830e1998e10ceb3b7e20486b4355b769bb76891468a2f66242f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783058, "uuid": "3ad371a7-f78a-4082-bb83-fa67d61886ca", "value": "T152F3F108AB54D473F9630B725A3A6B967EFAFE2221B85A4703506F0D7D37B81D50E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783058, "uuid": "a0950244-1438-4bd1-a4b3-da457d34d882", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783058, "uuid": "665bb2a2-df64-4d5d-baca-816a3ee917a6", "value": "3072:3fY/TU9fE9PEtuabJFQK6qtElHf1D/LQ0KGYXiZD2fzN5O/4KHQ409TrlT2sb:vYa6abcHxU0TOqD2f64F409vlT2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783058, "uuid": "a9ce52ea-09d4-4c72-b499-eeca42eac103", "value": 168768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783058, "uuid": "4fde99ca-d128-440b-be12-a014a1edf373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783058, "uuid": "ddeecddc-5cb8-4bd5-825a-0144a8d2889c", "value": "ID Fakturpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3897d113-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683829535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829535, "uuid": "82acdb6e-5ee9-4237-929f-5a56e692c4f3", "comment": "Malware payload (RedLineStealer)", "value": "57d753a2f49451125e04a1885eaa213c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829535, "uuid": "94f4cdac-ef6e-4ed6-b96c-548db4adce62", "comment": "Malware payload (RedLineStealer)", "value": "b94f59e01806fd3d43d17935c5d1d0a5838ace2826e982e59bf4379f76f9a647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829535, "uuid": "f88bd839-2101-4727-80b0-3ab48ee6181b", "comment": "Malware payload (RedLineStealer)", "value": "b352147a14692033956ee15a46cac9d26fb797e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829535, "uuid": "c4a6adce-6b7a-4ca6-b5c4-b48116fcbdab", "comment": "Malware payload (RedLineStealer)", "value": "10d6586845a80e0759d3ac11901f7895c58f6ebf53fc87f4fbf3fa60cbc27a472f1dfe2ee64afadfb148bd371c78c0a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829535, "uuid": "489d5427-0e91-424b-992f-91ae2522cb24", "value": "T136152202B9F48476E4F90BB048F686C30A32BD635D79872B2748ADAE5C72554E87173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829535, "uuid": "572dd9a6-2b77-497e-999d-d735f0ab51fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829535, "uuid": "5c91099b-c2bc-477a-86fc-fbd09696fa48", "value": "24576:3yVMLP73k+fNoCt+zimi2RjLtKaC2nQGS6cS:CWqbimi2R3lCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829535, "uuid": "d19a312f-77b7-4155-b68b-dd6abfc6b5ed", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829535, "uuid": "e46666ad-5ea8-464c-a4eb-8bba2b49fd10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829535, "uuid": "307f2bd1-85de-4ac9-9c8e-d6c57efaef29", "value": "57d753a2f49451125e04a1885eaa213c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c357234-efea-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683802456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683802456, "uuid": "4e1fc0b3-c919-47ac-b9ed-8e6d0b3cc25a", "comment": "Malware payload", "value": "039838ad7d88b9ac20d5f8886d035a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683802456, "uuid": "94dcf654-7d4b-4d78-9418-149333ddac28", "comment": "Malware payload", "value": "b968eae40d201ded2ae5a5a52042aee5fe252a60cb15d79a6e5f1ec3dc93d0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683802456, "uuid": "4f4186f1-b9d6-4442-bf19-479699823844", "comment": "Malware payload", "value": "adde6c32e63c8dc04c2877662442f2d74bc893b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683802456, "uuid": "7c00f709-51cb-4d85-98d4-1d0c322033d5", "comment": "Malware payload", "value": "a048c0bce398c841e471d51af96ac1f82f323300999178e1c5e54e086bef904196941e6424f50c28d71b3859f5cafb5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683802456, "uuid": "363cac5a-ac30-47c1-a8fd-e54f2a4fd878", "value": "T1DBE423B74F1C6E4EDA49B539FB3607CAF15AAE065C8DC075EBC0B19F017600672A5238", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683802456, "uuid": "4d255e75-b8c0-49d8-b0be-c11dbbd02a7d", "value": "d436c55cc61e4d62b21359ff12be3c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683802456, "uuid": "59d68244-4be7-4ff2-a921-ca320452038e", "value": "12288:sJUl1Y7ODwIZ//qJyxR0kVtktVpr8PrfOkYWKWv/IBeADltCnTUcaPLoEDqKKY3h:SUla7q4Jy/fVtktVGPrfO/Wxva3UTcLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683802456, "uuid": "5ffc441a-ef39-4d0d-9388-054da3c8ee99", "value": 716298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683802456, "uuid": "94ed0625-9bae-47f9-b2e2-494ebf04edd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683802456, "uuid": "f8290f3a-2023-489f-bdc7-0b20160aa522", "value": "asd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12daa78-f032-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683833683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833683, "uuid": "de931dbb-c887-48d6-8a8e-dc81545f00b7", "comment": "Malware payload", "value": "6fd0926a8817fede28372c309be1ec41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833683, "uuid": "9e6ea183-9b98-4587-90fd-b91cc13b3820", "comment": "Malware payload", "value": "b9d131247fa8488311afe5da12d699c984cbbf71ba7edf8b560d11c18ea9872c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833683, "uuid": "5513f64c-7c12-4c78-b80c-b8d18a875474", "comment": "Malware payload", "value": "ff97bf8e665fda7a9da94a92f91689a436f0c9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833683, "uuid": "dd8d18c6-a09d-47da-93a9-b2f861ebd0c9", "comment": "Malware payload", "value": "eb53b868c34e36db07b8e74a71d88d5782e98eb9add2963a9ad9e24969558a332285f86954ad093ca48d01beb7bc894f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833683, "uuid": "34be4dc0-0c48-46c9-ba80-8d0f2514c75e", "value": "T18A9633DFEB421B80EE62D0B309A6FAB029734FD6963F742019DB7281357644ADB71391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833683, "uuid": "ecd4d5f4-0af4-43c2-bb39-d63810c74aad", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833683, "uuid": "ff8e768e-86e4-418a-82f9-70e9abf66f94", "value": "196608:HxKMARSuV2XJXf6hzsy07g1vse0yEn2iswaT+5t7xrxN:oFRSJXlf6Z8gWnyi5aT+5RxrxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833683, "uuid": "6a80e1ee-556d-40ac-8a5d-baecf7b188a7", "value": 9095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833683, "uuid": "a9e6e5fa-ec70-473c-9985-21f1ac9b95b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833683, "uuid": "f52220b6-7246-4976-bfe5-9ff6017a7ae3", "value": "SecuriteInfo.com.PUA.CoinMiner.7446.29299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27746d6e-ef93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683765081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765081, "uuid": "ebeb7b77-3ae4-4c2b-baa6-39d5e84cfbf1", "comment": "Malware payload (AsyncRAT)", "value": "f28f5f2088dddb4d5fd512e870afec1e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765081, "uuid": "0272027c-1f5b-4e91-99ca-57016e3f3f3d", "comment": "Malware payload (AsyncRAT)", "value": "bafb79c0260edbcb4a9d78aa5d0a2e0198c4d86b097c1118c732add640d237c0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765081, "uuid": "55ecb672-32a2-4cbc-8163-b90afa871bef", "comment": "Malware payload (AsyncRAT)", "value": "ac3e9b13e7162fffe2abe7bf3cc09525ceeb28ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765081, "uuid": "95120530-e7d8-4b54-ab94-e782adfccbdb", "comment": "Malware payload (AsyncRAT)", "value": "0331ac234bf634b516a698a383730525ce8727329b96b4c9660737a9b1e7dc5879c9e305ee78e45303f6ee613c538125", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765081, "uuid": "9c5afe30-ef1e-48e4-8844-8d46c3bbaa12", "value": "T1EA734A053BA8C966F2AE4BB8ADF251070EF4D1577112CE5E3CC450CE5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765081, "uuid": "d4256599-bf67-4360-af1f-e1fd6c83b841", "value": "1536:dUZGcx5NVCMoPMVls4cd4nYYYHYYYYYYYYYZKYFYY6MYY99bzYYtgI/I1b9/oQz3:dU8cx5zHoPMVlrcwI1b9wQSlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683765081, "uuid": "442f8780-acc8-4330-bb11-27dee0746f0c", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683765081, "uuid": "ccf21401-e99d-4243-9f44-fd71a932adcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765081, "uuid": "32237ea3-6e88-434a-90c5-42e15a1d7646", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f159e1-efbe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783487, "uuid": "f65a0802-fa9a-4c6a-9376-65319b224008", "comment": "Malware payload (Mirai)", "value": "0ed3434a01f0e2efc22391765b9979d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783487, "uuid": "ad280842-71f5-40e1-a5de-b9b4e0ed2b28", "comment": "Malware payload (Mirai)", "value": "bb9e2792bccd38df5a835aa036464aa916cba4a1384512bf94f9fe7d9b128dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783487, "uuid": "5c8327c2-2c23-4f18-af73-e2b2af404d31", "comment": "Malware payload (Mirai)", "value": "de7f4fa9371c4bcb8c8cdd683370d0e5eb69bc9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783487, "uuid": "b15727e6-ccec-4045-aed3-495ddad48b2e", "comment": "Malware payload (Mirai)", "value": "c7de876df20a2747652ed23043ee527a0d23d98bc57098c865cd4e921359f773d7f4e5eb8090c3f7e68d27c4169bb6c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783487, "uuid": "ba3d47a7-8d56-4b8d-9b7a-1fcdb46b84c8", "value": "T1B783954D2E219F7DFFAC823987B79A21960533AA27E1C5C5D05CEA022E7034E741FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783487, "uuid": "4670f9de-703b-4c93-8c26-4c06f19a7edb", "value": "1536:y2MI3DAoc6Qncqa0vLEKN3TgPnEDg4iPK2PQ+DtB:qkDp0T7NanEDg4iPK2PFJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783487, "uuid": "e2646da1-c944-4564-a835-d923d404a8aa", "value": 88000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783487, "uuid": "7a14f332-f326-443b-901f-71018aa14428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783487, "uuid": "4b38a00b-d439-401f-9512-17c9470e4ae0", "value": "0ed3434a01f0e2efc22391765b9979d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a783d5-f009-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683816026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683816026, "uuid": "78a36727-f7f4-408a-abcb-bc0ec696e4fe", "comment": "Malware payload (RedLineStealer)", "value": "e298789b77e434426647d95b9f1b5929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683816026, "uuid": "0155e657-145a-4ad6-a475-2bb39f790a9f", "comment": "Malware payload (RedLineStealer)", "value": "bc16fbf93d80cbd51ecff034dce428809c082100d774eee10eceb04fb106a5ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683816026, "uuid": "10d366e4-e14b-4300-8c72-f4f940cafd69", "comment": "Malware payload (RedLineStealer)", "value": "5c1debf32f757a04d4f502ee9bc132565a0f3ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683816026, "uuid": "8ca136a7-4083-43f0-8714-74edbd9daaf6", "comment": "Malware payload (RedLineStealer)", "value": "88fcda4f1a1f58ac453a8ceb7bbb05db23f841edae1ff8d96a63f012eb2f5f9d59d57e82b83de590fa2bd16318291fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683816026, "uuid": "9aafabe3-f259-4979-baeb-03669cc021b0", "value": "T1FBF42393A2CC8463CAB117B04CF707C70B3A7D969E79D3660751A96E1CB2AE4613173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683816026, "uuid": "1bc5488a-8547-44c6-abde-a4fbc77ce9b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683816026, "uuid": "87fdc5fb-ec15-4f0a-812b-b8e6aa798021", "value": "24576:Vy0zVc2ZRFMsibYtSAaO5PjvbJ+0gv3BlIZLuE:w4xlYbWSAz5PjGkZLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683816026, "uuid": "f4fd1af5-3ed1-4ca5-8d59-99f3aa814652", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683816026, "uuid": "3d011270-bfe9-4d70-84cb-5a1522cf88b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683816026, "uuid": "94438683-177c-4939-93ae-4cf55f252111", "value": "bc16fbf93d80cbd51ecff034dce428809c082100d774e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6afed7-efc5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683786753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786753, "uuid": "eafd69f1-01b6-4e49-a8df-0371cf9962a0", "comment": "Malware payload", "value": "2746fd51855e750aa6b52dd72bca0cb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786753, "uuid": "44ff6d94-8ae9-443b-8dde-2bd76e675043", "comment": "Malware payload", "value": "bdba18aab116f4344a0827f1c712aeaef5224fb42dbfbd9453121b223fa1b1fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786753, "uuid": "d7a2032b-852f-46f3-bd8c-c8e03740c165", "comment": "Malware payload", "value": "1aff320d415b34a0db07b935f5fa12db2fe8dd52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786753, "uuid": "66ad385f-d548-47ec-b82c-62868d68cf44", "comment": "Malware payload", "value": "eac15e3fc15a489631fca3073788764b66cc07ed8689e9829a899cc591339e387e847ffe358129757e9a58aa6372a451", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786753, "uuid": "80d44edf-8f4b-41b8-9cd2-2d71a2e69d3f", "value": "T14272B611A7DE0236F5B787709873434012B8F65165778B5FA6D4106EBE53B4447137F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786753, "uuid": "96f8bf8f-e18c-4afc-9272-dc0149c40c7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786753, "uuid": "d811ea34-c022-4cec-aea4-e36cd72ee7f8", "value": "96:5yeT3aGlGVq0dU+x5mTc6dki5FXVzzq+5rOzNtP:weOG4imL62i/lXq+5E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683786753, "uuid": "cde5e08c-6ccd-4111-b471-d78ee0f6557d", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683786753, "uuid": "d6c9ae7f-a194-487f-bb7e-63997d39cdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786753, "uuid": "13dfb8ac-4157-497a-9d24-4eba51abf5f8", "value": "2746fd51855e750aa6b52dd72bca0cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3b84cb-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683785923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "8ff3ec60-5dd2-45d7-b945-6d06831d6718", "comment": "Malware payload (AgentTesla)", "value": "09836aaa6441dbad3e0fa4aae4173972", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "00da4fa1-412c-4b35-b7b2-f37676fdea40", "comment": "Malware payload (AgentTesla)", "value": "bec11b766972a7bb42603a2e6f1452cc5a769779586b17120eaf4299db06fb00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "801d3a0c-dd39-44d2-be8c-06861e00a40a", "comment": "Malware payload (AgentTesla)", "value": "9dfd53d3e4b493244e3d9575cdb66eef578c98d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785923, "uuid": "3ca21259-7fdf-43a1-b638-7f5ce3f95ed4", "comment": "Malware payload (AgentTesla)", "value": "41731410a84e34f4576ea5a00176fa458793f88ff5d2cbdaf8e392748dcab46162cf6c351eef2fff776b9594f809330a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "6cb5adb5-3a0c-4beb-87e9-0e699c3f3870", "value": "T19C45E43954BC1623C1B5E2B69F84F451F6D08B9276308D9E6AC28C8A15E7D4E31CBCED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "a1d66007-5398-4d52-a404-b455dfba22be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "e92baa2b-0964-4edb-b2ca-076a3f9aeb06", "value": "24576:KkcRX1Eox9zx2D2Q23H12FC0qLiHAMdVr3YsA:e91nx9V2r2XgE0qWgMdVrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785923, "uuid": "b8f640f1-3c51-4455-81cf-f700662103e6", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785923, "uuid": "1eaf25d9-a8af-4813-9eed-8dc0636c1eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785923, "uuid": "a9a4b054-a041-4523-8eb3-21b487e1977f", "value": "-logistics details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a9ff15-efe7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683801123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801123, "uuid": "54469a7a-f19f-45c2-b4f8-aea844cc1478", "comment": "Malware payload (Formbook)", "value": "5e3e9036788808920a3ca6c8943ed407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801123, "uuid": "6fe0a57e-d90f-4679-9e46-1e74828c2c4f", "comment": "Malware payload (Formbook)", "value": "bf7d050627a7bf67ad74bed6cf159d30c88423a1c0ef53f9fdc80b6977e79d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801123, "uuid": "8c822d60-f4a6-40e0-9a8d-f4afa931f305", "comment": "Malware payload (Formbook)", "value": "6704b7e7022b31053dc6389f946db8505b5681e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683801123, "uuid": "55808bd4-eddc-4fed-a316-3c1209278514", "comment": "Malware payload (Formbook)", "value": "3dda16fbf7073e89f8dbbcd8cfde84161efc7cdc0b312b9cd6acd2c386d4f503a14719a76e70db23dcf2cee9d099bceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801123, "uuid": "31fe3c50-8640-4818-8a02-221e8355e866", "value": "T10FD4DF48523BBFE1CAA817F0261434434B7DA11A74B8E0BCBD5B74C9C8AEB115BD4B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801123, "uuid": "0edca2d6-3ef1-4400-8f99-9ef21038459c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801123, "uuid": "0938391a-087f-4831-93ab-9b7550ab9b3d", "value": "6144:TYvasUQMHx8s+rck5kOGNMx4Dv1xMc1sH+p0GpyGsa8Tp4VolYYWWjp12wl5Obps:TqUQmJ+S9NMxyvta9GsaLiYr0vz4pud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683801123, "uuid": "24524afb-dd0f-4eba-9fe1-6c330f0bb4dc", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683801123, "uuid": "faea95f9-0d64-41e1-8351-7aaddcb67a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683801123, "uuid": "4a8f5a56-aa61-47cb-876e-ee41d6077250", "value": "r5\u6708\u5e10\u76ee\u548c\u53d1\u7968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0f6834-f025-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683828037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828037, "uuid": "558ad8bc-2d86-4aa0-bed3-6ff6b4255f37", "comment": "Malware payload (Amadey)", "value": "163446c2bb4107521f053f1a4fd69a32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828037, "uuid": "12b1baab-d733-4364-b3b9-8f587d844b89", "comment": "Malware payload (Amadey)", "value": "c0c1030bbba4126b51da03be33c6bc09da536259c029001f969b28d736f3e011", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828037, "uuid": "1ff30963-ab3c-4343-9d25-ca0018713433", "comment": "Malware payload (Amadey)", "value": "c4ce959d2ff93feb4d14162377053925c549d3e8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828037, "uuid": "d06fed31-0f28-47d7-8863-186100dc2498", "comment": "Malware payload (Amadey)", "value": "1efd356380f055f2913e7a416377c626891c63f723a2aef03b2714538ca2ec51c0c374e147fd42ee3fce027f52017dca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828037, "uuid": "973393fe-7ac6-4773-8f92-acc9cccb0920", "value": "T183F42202A7E89133DAFA2B7058F917931730FCE5CA39539723D56A1F1EB6584A43132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828037, "uuid": "7eefa0ea-d862-4695-96ad-2c2f2985d236", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828037, "uuid": "c1aadee4-5c50-49ea-85cc-27020270f229", "value": "12288:IMrjy90crFdnm1I3zajtT3Y/vuXvEzjnLQfoD0zzERLHsK5Gx:ryfqy3EtTAvuX8D0zYRLFGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828037, "uuid": "b84c90f9-ab6a-437c-979c-797c4f7a0614", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828037, "uuid": "2fd13047-148f-47ed-9293-32e6b10e89f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828037, "uuid": "bae38096-161f-41eb-9fd0-0831a9a5adfe", "value": "c0c1030bbba4126b51da03be33c6bc09da536259c0290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9895f451-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683785887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785887, "uuid": "a827a4e0-7239-4e13-a03b-140286cda8fa", "comment": "Malware payload (CoinMiner)", "value": "092d064fa7c8b7c292462d00eb149265", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785887, "uuid": "41507ead-1e69-4b4b-b18a-6ff1e2acad41", "comment": "Malware payload (CoinMiner)", "value": "c295fd06c87d51ea44008eada1aebdf83b796d84110d0c887b30dd1f3f042136", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785887, "uuid": "131ee81c-0d87-4ead-9102-bc6a4c19e40f", "comment": "Malware payload (CoinMiner)", "value": "0d49c50765b8bf2b4204e879a7be4cc26687f067", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785887, "uuid": "0a7a3c4b-f043-4f98-ba46-e295b4751a17", "comment": "Malware payload (CoinMiner)", "value": "5159c919b346664dd65ba306e452632697a3526079179d99b431ee9790f90d45615c5bd79bb4bc25096f455bd70e5cd3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785887, "uuid": "c32c608c-8c9d-40d3-8984-28dd2c84ec08", "value": "T173A52326F6C2CAFCD326507D46EE86B65E226080E3F48B6E79EC5C658E109315D2C5F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785887, "uuid": "5aaf5f35-e4b1-429f-b6af-3f84a96d7323", "value": "df9a7bc1c6c6cd97d04c3762fdde6719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785887, "uuid": "7c687d50-349d-4870-b962-1009c0c10328", "value": "49152:x4PS8H+0oebhaupXOZcifTeCv31EMFvxbcS32paotG:xl8e0oebgE0xEYAHpa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785887, "uuid": "18f7c4c6-0838-4102-9774-4aae61c1008d", "value": 2137088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785887, "uuid": "6ee01f7d-d93f-4abc-9c8e-684a8223fe67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785887, "uuid": "58ad5fa2-043c-4528-80d7-a9da00067874", "value": "092d064fa7c8b7c292462d00eb149265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca27b457-efca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683788977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788977, "uuid": "2f4d38d5-fdcd-4efe-84a9-8010d0e86a26", "comment": "Malware payload (AgentTesla)", "value": "85736bb4da9fdc0660a3c6fe2ed2e284", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788977, "uuid": "941ee885-7d30-42ed-9eb5-e95b1c8f838b", "comment": "Malware payload (AgentTesla)", "value": "c31db24097d178763ff2da3d555e3dba2ad6e2d055c9f22e1a3a0a9f28784162", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788977, "uuid": "0aea59bd-e1ad-40cc-9083-47be29a785fb", "comment": "Malware payload (AgentTesla)", "value": "b820188b7c9417fdb55e336aef4c5ac31c3fa94e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788977, "uuid": "fd263897-72b1-40eb-a23f-4b9596f03d5f", "comment": "Malware payload (AgentTesla)", "value": "5069644b3eafb5fa623ab7f6847fba6cbd89831bf413d5d8b77ae0f831520750d25ecc00906e3bd0a856ba262cd8e523", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788977, "uuid": "c37272d9-d96f-47ed-874d-b1d8b97cb068", "value": "T1FDB4BE85123FBFE2D96407F1221834534B7DA11A71F8F0B86D5BB8C9C8DAB215BD4A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788977, "uuid": "64c0ffaa-a9d2-47e3-a566-413e240ee74a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788977, "uuid": "95706676-245c-4b25-a227-78ebe7b4e21a", "value": "12288:KqUumxIP290VbLtSIi5ysoZSzZHedtmZIyIbnzSbz:0umxIU0VgIi5XoZqHeWAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683788977, "uuid": "79096b1b-307c-43b5-915a-07ff2a4dd844", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683788977, "uuid": "0ef073c3-6bff-47a9-b342-22f03fb7c3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788977, "uuid": "63e37ad1-535f-48b5-8270-f2147e0d1eb5", "value": "pQBto3pAQGDaLCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ba95f2-f024-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683827508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683827508, "uuid": "ad56a991-6b0d-497c-8e11-c96b2af15f5a", "comment": "Malware payload (AgentTesla)", "value": "29e8ed45da59b583268b41793ed35d4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683827508, "uuid": "257b36fc-b793-469d-917f-e2647c20e1dd", "comment": "Malware payload (AgentTesla)", "value": "c33d4a210d1270bc9a6135df8b6fc957b18511ff91d27e657ddf685cb2fa3408", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683827508, "uuid": "74cffbef-c20f-4767-bc00-c4da807306e8", "comment": "Malware payload (AgentTesla)", "value": "1df7212d7bd649777f10e46fcd5658aea4b39647", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683827508, "uuid": "5b621fca-f347-4449-a854-a6961f805339", "comment": "Malware payload (AgentTesla)", "value": "2d53ce5512c87678dd102207170c87058749915e92fff757b89f67a864a3ef8ec1cdbcced75880680655366dbb15a50d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683827508, "uuid": "a968c145-f9b9-47c3-9b4d-2f7b78a59d5d", "value": "T1F2D4E19A85784F00CA6C5BFE5D93C6C106F98AA5BD25D9310FC724CD9DB3A2F28442ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683827508, "uuid": "f5e11d08-28fa-448a-b021-c92bf18d9d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683827508, "uuid": "5eabc935-6d4d-4ebc-9fc3-bce81ecba70a", "value": "12288:G3Awhh2Y4YpGnfaRl6j1iv+kJ2lJwoJuMV8IvkI69MsR:nwhh2G6j+J2lJDuMVL16a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683827508, "uuid": "75ae33a9-e860-4901-affd-0d306187a355", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683827508, "uuid": "9c6059de-16f8-46d3-ad1c-0baa6307bfe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683827508, "uuid": "0f1a9c1c-2e54-412e-9995-ed6333f8802c", "value": "Purchase Order #2602360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def2e575-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829814, "uuid": "bb022b51-dbf2-4909-8032-e026f8a1fc38", "comment": "Malware payload (SnakeKeylogger)", "value": "25838e0a702668d762e1a77e7e397b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829814, "uuid": "96461f28-bc7f-4506-abbb-f02e1b10bddc", "comment": "Malware payload (SnakeKeylogger)", "value": "c4084d96879350ddc8232b32943523162f1f922254d2677452b0a944ed428e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829814, "uuid": "958ee2bf-6d61-4668-a02b-cc0eb0d44877", "comment": "Malware payload (SnakeKeylogger)", "value": "c2a2cef75f5e1c100af61a797d362fe80539d395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829814, "uuid": "ed044fcc-dd33-43c2-8229-cffb9eadfbae", "comment": "Malware payload (SnakeKeylogger)", "value": "621d8d004e58a69f06371df5d2d1a919e111380a739129b0ef7b98745c8e17a9568d84ede19a11013ae144a2439d8ac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829814, "uuid": "d46a1076-a4aa-4b3b-b66f-7ff0a5d9d962", "value": "T1DE34F1546776EB3AE5DE43F568216B8003F128751983F2A5AECDF0CA5FA3B1025C1D23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829814, "uuid": "d979581d-8dde-4751-9236-0cdc3d0464b7", "value": "3072:gsqW+D2TQTSaAdZPRTCTDxjwx5UHD+n8c/Z3cMP08m6Q9ykVRhpzi7A4vdfBr6FS:gsqW+7TPAdqRSewt/ZXMn9ykji7Acr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829814, "uuid": "fe367076-2c07-4b80-88fa-57d7fa6c4be7", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829814, "uuid": "d0b0b80a-d28a-4bea-8cd1-fc34a266ac5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829814, "uuid": "7b292f88-f1b5-4214-a94e-839290c9d9f6", "value": "ST0434568909-986.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b29904-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784564, "uuid": "f4921c72-24ea-479f-aad7-29fcfb622561", "comment": "Malware payload (Mirai)", "value": "3fbfe340c88f29fb9aa4bf10abe7f9ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784564, "uuid": "30a026b1-5b03-465b-a2eb-68483ca437e5", "comment": "Malware payload (Mirai)", "value": "c528d789313ff3ad613dfab18bb154719cc78ab8e47dcdcbe516408ee94611d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784564, "uuid": "b0c45c75-5d77-4c8c-a44c-85483022b7b2", "comment": "Malware payload (Mirai)", "value": "a77c7e2fbd5df64c1725abf21b8403408011e3fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784564, "uuid": "aa7ca5ab-9ebc-40b3-a34b-bf30f62278b8", "comment": "Malware payload (Mirai)", "value": "4b8849cc313c8481f9baa528875959094e2ee3cf42c5faf7fa1a6b173f1140b340a72cd987972ff9fe8cf80ccf8e96f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784564, "uuid": "036beb81-7926-4a9a-8fa2-508e1955458d", "value": "T1CB03029A63211030FB2157F20BEBD21A75AB99B50261C1F72CC1D8A42519ADF917FFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784564, "uuid": "65e0c7b8-32ba-451a-bc53-37ce533012af", "value": "768:i6wiUpaHKKSHL20nthLouO4HsQwlJlGKA1dQ0MFmhI91qY/dRV:iUUYqK2L20r0LQIjcWJfbRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784564, "uuid": "b33173a1-fb0a-44a4-b649-989fa34fffe1", "value": 38524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784564, "uuid": "d69a0f7c-54d6-4e15-aedf-f6a412226316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784564, "uuid": "e94e8c1f-b0fd-475d-97ed-5c805dea8021", "value": "3fbfe340c88f29fb9aa4bf10abe7f9ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc5ac0d-ef94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683765654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765654, "uuid": "bbda0152-1cd5-43fb-bdf5-22c2e338a8d8", "comment": "Malware payload (njrat)", "value": "1b70e009670dabf7bda0b5f89fb5c1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765654, "uuid": "dc09fe63-fa6f-471e-bfa9-5c60b173d56b", "comment": "Malware payload (njrat)", "value": "c572ba047f514bd2513fc227173034daf4a6ce38e1f3ae28e7eaa3b6de4a5d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765654, "uuid": "b5247232-7910-4002-a4f4-648c16f59a77", "comment": "Malware payload (njrat)", "value": "8e85964711b0653f72e7c4c929d13d7d6f0a78b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765654, "uuid": "b29be96b-739c-41d0-b6da-e3389ab831e9", "comment": "Malware payload (njrat)", "value": "fbb4e577e5cef8eb50b56a639bd45d7792dae0d1bce898fe7061c64d9e679d2f61249a00314226280f84ddc686a0c7ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765654, "uuid": "295372f2-8893-456a-b31f-e8b9c68ac414", "value": "T109032A4D7FE181A8C4FD067B05B2D41207BBE04B6A23DD0E8EE564EA37636C58B54AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765654, "uuid": "0841a827-4c00-459a-b5f7-0adf847def29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765654, "uuid": "1210a747-eeb2-4df6-bb22-a42201520ec0", "value": "384:5mOs0IiejvCVLO309QmykrtG+dA+VfwvOSiWrAF+rMRTyN/0L+EcoinblneHQM33:rFdGdkrgYRwWShrM+rMRa8NukKmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683765654, "uuid": "fdc4e036-327a-4d72-8d33-9a6344ae540c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683765654, "uuid": "04d8cfc0-5610-4244-9134-54b992e811eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765654, "uuid": "0d6bc5aa-e624-4b16-820e-7333b4bfcd13", "value": "1b70e009670dabf7bda0b5f89fb5c1bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c667e87a-efbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackGuard)", "timestamp": 1683784246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784246, "uuid": "fc3b83fe-4025-42aa-8637-24af94af838b", "comment": "Malware payload (BlackGuard)", "value": "bfaa027a645e567824a10a26fb8dbefd", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784246, "uuid": "1aac731e-5d71-4937-8dc8-815258b8a431", "comment": "Malware payload (BlackGuard)", "value": "c67b6f45d0beb461838f87ca2ad4774b52d7ccf9b0fa36652e8642dc72f43302", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784246, "uuid": "fa307309-4a37-494e-876a-ba8ceb8d37ff", "comment": "Malware payload (BlackGuard)", "value": "4ab52a0b1cc105a5462c2255ef84be9af431b82e", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784246, "uuid": "a8ed991e-7a82-4841-963e-4b0e6c7a379f", "comment": "Malware payload (BlackGuard)", "value": "51c90328252eae56a0141e24233bfa365ca1c62892ab8616a4a0f6c5742795fd559275ca369857e7602e5428b96fabd4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784246, "uuid": "6f96f3d9-436c-4e75-a1ab-bd4f1647e8a8", "value": "T16BC3914A6A4F81A1D5749571037B87F21B2D1F22A9C3C68DABC13F1AE87D181F909B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784246, "uuid": "a80ed97d-b198-40a1-84c4-428a08bf7496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784246, "uuid": "550dfce4-af27-4103-9b98-b4381d087b2c", "value": "1536:ztCbuEYE+9z2wpuFavGmhMnDIhzZtz20tnh/:5CbuAsEFNmhMnDIhNI0tnh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784246, "uuid": "f5d90931-bac4-448a-9dea-8c9b9d90e7c9", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784246, "uuid": "53cbc9c4-9e35-4cff-a11a-dcb07510e194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784246, "uuid": "b8737ca0-c7c1-4992-b64a-71f06befab7e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa43e72b-f032-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683833725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833725, "uuid": "4dbd54a8-e16b-42a7-9dc3-e0ddca0fcc89", "comment": "Malware payload (AgentTesla)", "value": "a6d927ba4a4b0cad4e2f459aef0c4c3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833725, "uuid": "b1a68327-ae42-4470-82c3-918cb76eaecd", "comment": "Malware payload (AgentTesla)", "value": "c6d17684d5779f287df9ff7e53f95f5dc8ef24a7725d5ba1b60ce17ff1157e61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833725, "uuid": "142c7374-3bde-455e-bead-20d4e936a541", "comment": "Malware payload (AgentTesla)", "value": "74b46e9615014e0e39d809cc469c7a061093210b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833725, "uuid": "da7c0a23-c17d-48dc-81f7-6775c3f3cd9f", "comment": "Malware payload (AgentTesla)", "value": "4b072214870591fe9fc5d6469728d37f3ee15a49c119f26dd7dc202f15457da9e50380d834ddd0d5bff25d27c5fbbaac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833725, "uuid": "3e621989-575b-499a-93fe-7e10ce23e9f8", "value": "T125F4010413FC4440F2FABF76697441574B767E1BB871EA5D8ACA798D2A30B816C12B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833725, "uuid": "dfe70eaf-082f-4133-8673-bcc4fd81870f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833725, "uuid": "131fa1cd-77dc-4b9b-a23a-45a6bfac0c79", "value": "12288:ufeeXfZdfrXg+JwuKt/S/60YbNyq3NzXCvCdMCJmo:ufw+Jwz/S/6BbYYZ5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833725, "uuid": "d309bce2-5827-4ba9-b662-776edf359799", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833725, "uuid": "50a6c25b-98ba-4611-bbf8-aad8a1d99612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833725, "uuid": "a822086f-b89c-4b8d-91b5-ec196eb3dbe0", "value": "a6d927ba4a4b0cad4e2f459aef0c4c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfd614c-efc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683786295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786295, "uuid": "ac7cf1e3-11cd-462e-955c-579320337c44", "comment": "Malware payload (RemcosRAT)", "value": "882eae9db1263720e6642e99db0c3fe9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786295, "uuid": "05ef7fbb-1e76-4ed7-901e-934c6931651f", "comment": "Malware payload (RemcosRAT)", "value": "c73e3c81e8b239aa9180b85ef86db00e3c8a9ad9c14469de56c273457ef3744e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786295, "uuid": "4d0feae1-64b5-4ed1-bf7a-58623aa4978c", "comment": "Malware payload (RemcosRAT)", "value": "dfcf77cc72f463a208ef037659b3b5819373e8da", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786295, "uuid": "405ed3ee-37e0-47a5-b34f-618a64f3310e", "comment": "Malware payload (RemcosRAT)", "value": "acc751d61d2ce12319b02d9722bc350277a4c77be81043f5d1f6125aaad83ed50529214f87ad026e8003682a0eaf78d1", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786295, "uuid": "e1792310-f606-4d9f-9ce3-9909ab8148e4", "value": "T153A423CD802E67DDBF547C8AD85ED1BCBE46BFD9318BD1B967CB780A41A8624F540280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786295, "uuid": "764f4d1c-6876-4573-b1cd-c2c79878f8f0", "value": "12288:EC2du0kLYiu3h3IKkHbQGT1sqNSHh10hAGy/UA3wV0eF4jPGL:pFLNmbysxHzmcUAgOC4juL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683786295, "uuid": "9fa65fe9-fb15-4137-ac7d-f1b66f27526b", "value": 468885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683786295, "uuid": "5872a84c-98a9-4163-ad16-92aa743f0e74", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786295, "uuid": "f9c74d4f-5b4e-44c7-b7b7-09013200e8d9", "value": "FedEx 00237794891929_MI_20239002382_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da312a8a-f020-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683825940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825940, "uuid": "0c5105a7-a882-423a-acb7-94a1a301855f", "comment": "Malware payload (AsyncRAT)", "value": "85eadd379714196df5b223c64110c799", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825940, "uuid": "d4e646f3-b976-4c78-87bf-220d9f5e9395", "comment": "Malware payload (AsyncRAT)", "value": "c7a7cf228d04cae217e689217f6a810f560a3033773e38fef04d9e483c6ce902", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825940, "uuid": "4d5020e8-658c-4389-a5b7-1c00501a5e0e", "comment": "Malware payload (AsyncRAT)", "value": "cb4c7535da5bcfc2a59c9a173602421b8b38957c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683825940, "uuid": "35ffdfba-cb76-4ded-b49a-77680a866d49", "comment": "Malware payload (AsyncRAT)", "value": "a6fc39ac23b70ccc6af26ca62a8206be2892ecf434f2e6fc1fd181bdd14a88dbea9899c9e13e020971094b69768083f6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825940, "uuid": "534d9fbd-8216-4fb7-a8bb-5187b8f71989", "value": "T1BEB4C09682B88F01CA6D4BFE4C93C28606F499717C25EA311FC728CD9DB392E64585FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825940, "uuid": "6f3f66bb-45af-47d0-bcb9-edb20e3edffb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825940, "uuid": "8f227ee8-56a4-4d14-92ba-c12d7b6da245", "value": "12288:GJAwhh2Y4YB8+i1izKoy6j+sBrz4LvBxvQOuRJ:Bwhh2K8HanE9lQjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683825940, "uuid": "339cd19d-9e34-41b0-ba53-22b787291090", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683825940, "uuid": "c49695c8-76ce-4013-bcf7-a9b4cf9f8ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683825940, "uuid": "6ee69dc7-f214-4cdf-999c-f92c12ecd877", "value": "Faturas pagaspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071e96cf-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829881, "uuid": "c4e4ecaa-6f54-4a62-a0d6-ea9b4f75d2ce", "comment": "Malware payload (SnakeKeylogger)", "value": "f813afb8d6415f83d7e26a01cc6dfa98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829881, "uuid": "b1e98da2-c7cf-4963-a638-8b06e4084321", "comment": "Malware payload (SnakeKeylogger)", "value": "c7d2461a20a6687bef74bfc784219676af232262762a102ae4f11765d2324210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829881, "uuid": "8f3aeee2-0a51-4a54-afd3-dc7dbe84cde5", "comment": "Malware payload (SnakeKeylogger)", "value": "d67ea743adbefdd142391a645782787dc03df3a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829881, "uuid": "e58e5f2e-d900-4a30-b752-8b04e946a43c", "comment": "Malware payload (SnakeKeylogger)", "value": "d9f8b742cfebefe70d56f621e8576386c6b8a64b4fb5783b8e4dff7eb90a7ead213854801cddd4a6f6940eea0dde4d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829881, "uuid": "4029debd-84f8-456a-a265-1b2dde3a374e", "value": "T1AA058C3C22DA5C26C71573FA8599C9E103356F00AFABD26A267E30CC8971B93ED9154F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829881, "uuid": "df5977cb-3a63-4e6d-abf9-4f087d0c11bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829881, "uuid": "61145e8b-0a34-4cd2-9d57-6baee29e2223", "value": "12288:O3NzfVZfOtXybYi2AbczegDtp2R3RvCxOqDTpYy6zX0cW:O9zfHqXaJ2uHgKRPqDNYFEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829881, "uuid": "dd931cd5-6688-4c10-bb8c-a10920756c50", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829881, "uuid": "c9222c08-6fdc-49d3-8a92-0cd35921187d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829881, "uuid": "28ce7a1e-8982-4188-8a8e-15271fdbd863", "value": "ryNnzhKjaA8TO4N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9e562c-eff7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683808310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808310, "uuid": "074370c1-ff2e-4b70-9e60-050b56a8c72c", "comment": "Malware payload (GuLoader)", "value": "7ad378979a95ed85e5bc3c31fd947727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808310, "uuid": "31c6f824-bf0d-41af-bc6a-5472c015a8a8", "comment": "Malware payload (GuLoader)", "value": "c8edfb818e8a68ef4c127122bf9ae430d6d43ece8c9e70627cccb44e486f2827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808310, "uuid": "c3202647-28dc-4795-86af-1adf77815e08", "comment": "Malware payload (GuLoader)", "value": "bc5ad33e6d8eeb3565b3be5c604d0b92d457bf5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808310, "uuid": "9fdc38fb-0cf3-457f-b766-00858c5840c6", "comment": "Malware payload (GuLoader)", "value": "a42eceea1ec59c97a60698e2e30f19a76b195278484e5580516329c25c35b3cd802dbcc41f2050f2fc3dda98c72baf0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808310, "uuid": "761bc1b2-79d6-499e-80a9-ea9cff833a39", "value": "T1175412537B958DB3F6844A78493A6B2287F28D02F0537B8B5B543B95AD722434B0F6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808310, "uuid": "f52665d5-6e01-4e00-981c-18701f036888", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808310, "uuid": "93d88b9b-9f6a-45ae-a259-eb4020b0b04a", "value": "6144:ex4veGehjmwGl36FROJyjD3yfUUyD8+yN/R8a/koagY3:o4GGRlqFmyjDSR3ggQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683808310, "uuid": "35e990e1-9c06-4aaa-b282-ab550a291319", "value": 298836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683808310, "uuid": "b0885c90-c8a3-42a2-b754-26f8fffbb9ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808310, "uuid": "e9caaf1d-cacc-401c-8d15-90b3ef08a947", "value": "Solostemmes249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38af5b19-efd1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1683791739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791739, "uuid": "61aedc89-fe48-4d47-b3f1-44957230d239", "comment": "Malware payload (STRRAT)", "value": "19e37556bf2d775d91c9254c4cefa6b8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791739, "uuid": "6498c749-58fb-4e32-8170-563fe6d83951", "comment": "Malware payload (STRRAT)", "value": "cbb2e38ae780609232d6f989d46b128123f821fd29b80bc39b5790ba4a4d5838", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791739, "uuid": "3b92bebb-4040-4140-9523-9df9ebc3056a", "comment": "Malware payload (STRRAT)", "value": "50475af6bdb8e50c2fb9a2fe454b89394980c195", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683791739, "uuid": "229ff5f7-2d52-481a-8b77-1f5a8d0e2225", "comment": "Malware payload (STRRAT)", "value": "206a2324d38b5e8dd9fe9f345a294911fb5a4b61f2e99bb0e27c46a2f6c8d044dedace6b56333c09ffe83e88c528d217", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791739, "uuid": "11f19a2b-b3c9-4d2b-9788-f2e899bdee77", "value": "T1A424F16E3EEAC5BDF00B65392000D522AA1D4458E88DC17F32FC95861DB9D698B16FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791739, "uuid": "bafbe193-c628-41b3-8e4f-3f6df12fe5f4", "value": "3072:l4BaLxse1LGozzkv6kjVQdJvYIGWahboDD4TD1uDZPelidRYlY:eBalseUkz06k5EvYIGWa1gkUPqQRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683791739, "uuid": "797afde4-b50e-4b49-8a9d-862496bcd4a3", "value": 209997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683791739, "uuid": "5e28065f-5b58-4ca9-9eb6-f5f75876e9b7", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683791739, "uuid": "136cc221-0ef2-4136-ba33-77e28c098c08", "value": "sample PO.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42824b4-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683837070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837070, "uuid": "51a5bacf-c1fe-4017-9922-2521ad589032", "comment": "Malware payload", "value": "bbae1cd42541786ef902955d36e5b29c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837070, "uuid": "aae9af00-2c26-4ef9-9f49-3fbc32eb16c7", "comment": "Malware payload", "value": "cc78a14cb3bff140e2b55b0acfbb6e90abb3b14c6cdeb7042ed2bb89858bb25f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837070, "uuid": "59db9e27-ceac-4311-8b07-cb43acbdeb52", "comment": "Malware payload", "value": "4c2854d8f29788751aa685fb5f942635a98c9675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837070, "uuid": "23ff8552-ee5f-4312-a441-e79ee3c56eff", "comment": "Malware payload", "value": "f24ea8ca67ec210369234cd21fc73ebaff07232406bd5f6a5710a03c642a4002df1496c4eedac616b66e2a3df0d6b52a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837070, "uuid": "e27d569a-55a9-463d-b73e-db595246f31b", "value": "T100750140023BAFE1C9A557F0721474434B3DA61A75B4E1BCBEA778C8C99AB109FD4A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837070, "uuid": "af233f2b-b9bb-4314-b54c-7e2e025fb515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837070, "uuid": "54752bb7-a228-4c7d-b571-ff9cb4f1dd50", "value": "24576:N0mHd3orKY1ZIErYsOtO7QhQ82KkU9CWaQMf0Roo6GbnbZgUe0nN0C4hz/:PePZxraOshQzKkU9aQ+woo6Gb+URNC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837070, "uuid": "e9903bf1-c979-4f01-823b-173dc11463f6", "value": 1579008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837070, "uuid": "492b82c3-d0cf-4af0-97fc-b48d9a30997a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837070, "uuid": "6b58f1d7-9ab5-43cb-bef3-4c428c844f0b", "value": "Download Tracking Reference.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2127b6-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683830135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830135, "uuid": "651d3996-68a4-4241-8fff-a6a65479d3cd", "comment": "Malware payload (RedLineStealer)", "value": "fcdfb383e22168fb547a5381b24e3c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830135, "uuid": "80412086-23b9-4faa-8bab-50a7505addc7", "comment": "Malware payload (RedLineStealer)", "value": "cef8ed0baea5977ec92a708285e67dc86c84b18a6eac72e53674d5b9d85f97e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830135, "uuid": "ae632ad2-b85f-47ef-8913-b315a404169e", "comment": "Malware payload (RedLineStealer)", "value": "fb49221ec3b9f65cdc8b2319b2ac1d27be9b5ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830135, "uuid": "5614785b-437b-4ca3-8e0f-5de643292ba7", "comment": "Malware payload (RedLineStealer)", "value": "0101fb26ee2a7234e14125caf8ee23c333219f1b3225590a358ec0b0f9bf8f41f1b06e4f80c19b3b58722fbbbe240ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830135, "uuid": "41553c21-3858-4900-9cd4-bfe9535a0e20", "value": "T1361523467AE84473ECF41BB044F613D72734BD716E38AB6B3393898A4C729989439367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830135, "uuid": "dc1b8195-25c3-49b0-bd65-f138c243b463", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830135, "uuid": "0054ebe5-2611-42cb-ba88-94955b6dcd30", "value": "24576:Qy7h0N/W88XJuyLrVXb0Aa0CVFmKn4ZXXKtFoAt:XWW9JTft0F0eFmKOHKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830135, "uuid": "bafdd995-8152-4e4d-83fe-7d608d05f89f", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830135, "uuid": "bb7c5aa3-f5e4-4aa0-bf2e-b4aed19df5cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830135, "uuid": "ab3b9375-29ee-45e0-95b7-3f3ef6ddf49c", "value": "fcdfb383e22168fb547a5381b24e3c0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dad766a-f013-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683820229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820229, "uuid": "c6473149-60ae-4542-aca8-f0f5eb53a18d", "comment": "Malware payload (RedLineStealer)", "value": "e72d04ac7f3eb386823ef8026f016241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820229, "uuid": "d8a4f92c-02ae-43fe-b46a-d2ec6f90de6f", "comment": "Malware payload (RedLineStealer)", "value": "cf4fa9c480473d3419eb68f584d29de06dab99400ecfd2557100617ab7490c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820229, "uuid": "eec2f9f6-647d-4eb6-b340-426a080e661d", "comment": "Malware payload (RedLineStealer)", "value": "87649a54f19d6c07c0a2080e210ae6660bfd0c1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683820229, "uuid": "6a5b208e-94e7-43eb-a9fd-471d14578b43", "comment": "Malware payload (RedLineStealer)", "value": "dc85fd9e8d5cbb286fdd2a4dfb2420d44ca3eee37d0cb2d88c41fddf115f5a4f1a75545c4b8ea3d06382322e90cc9e6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820229, "uuid": "e4b917af-a93f-4ebd-b3e4-11c3ee0871e7", "value": "T183F42341F7C48433E9B52F7018F70683133EFCA0AD38926B1345A99A1CB2A95B976777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820229, "uuid": "7371562f-e8a7-4b38-8f9c-e9e8e48948b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820229, "uuid": "a8ed2bd3-88a7-4e46-ab60-1c52fba64570", "value": "12288:qMr0y901JMzTwi6XM8UEXcC0XGQwcWg4yGpVS14KVuRffceEPtnoKqRJLCFccK:ayUMzMi68znrt4VaVOfcftoKBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683820229, "uuid": "cecb843c-87fa-4dfb-9149-7257235c2f68", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683820229, "uuid": "451e2b9e-744c-4d72-8e82-8981f299ab4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683820229, "uuid": "9679ddf9-7274-4bcd-b981-501592b92944", "value": "e72d04ac7f3eb386823ef8026f016241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9175f396-efc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683786305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786305, "uuid": "5bd5bbe2-d112-4ca4-93ad-21ce9907b24e", "comment": "Malware payload (RemcosRAT)", "value": "f1ebe62c0ab6fc311d1e02faf85b0c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786305, "uuid": "6b5f7e8b-f59c-47c8-b07d-14b65cb9cdc3", "comment": "Malware payload (RemcosRAT)", "value": "cf8056e691bd5d73dbffedb8228a1cb2bee27791633c7cf2114041112f66b93d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786305, "uuid": "9bc2934f-3bdb-48e8-b40d-27aa61d56c0a", "comment": "Malware payload (RemcosRAT)", "value": "b8f3ddf5408e1fa07f27f525e6cc547c59efdcf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683786305, "uuid": "bfc63997-85e8-4113-91d2-733294d00918", "comment": "Malware payload (RemcosRAT)", "value": "0e00b03374430741c40d6054b1592ab88c50fde64b74e7514bd05740959ec96e6bad23b419a5dfcea41b1636b42bed5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786305, "uuid": "4396e547-721c-460a-8198-9ccd9149555a", "value": "T184A423141BE864E7ED1212763E7EE36D4FD0F9224BD12A479FC05E9D64A5A80CD0E3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786305, "uuid": "7592340e-cedd-4eac-a61e-19e3355ca6cf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786305, "uuid": "a39b9561-5e15-4ce1-b8d7-c4655df51bcf", "value": "12288:vYM0aRhA+gi3DlBtme5whQ8qxvSRBpkY4nfjJqKcZJPq0gaB:vYM0t+giJBtX5aQNxqp2jcSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683786305, "uuid": "76621bcd-419c-4ff3-a5c8-afc5ebee81bd", "value": 484278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683786305, "uuid": "67af846b-bddc-479d-881c-aa8ea9150a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683786305, "uuid": "d70ceaf6-7e0b-4852-b22b-f0dc1c17d873", "value": "FedEx 00237794891929_MI_20239002382_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf89142-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829834, "uuid": "df62f74a-6cb1-4067-b594-fb9e5456ec80", "comment": "Malware payload (SnakeKeylogger)", "value": "37908b2729e25ddb746ee9c48ca7e036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829834, "uuid": "78265c45-ff2d-4465-bb80-443eb12973ab", "comment": "Malware payload (SnakeKeylogger)", "value": "d06f8c0ba7041cb8739cbf7458c60c6c637f3159189ea668fa3df7200a4a82a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829834, "uuid": "c9bf919f-453e-4af6-81c8-6d32f007e760", "comment": "Malware payload (SnakeKeylogger)", "value": "6bab99e6e1c877a438ef39df8d4473fec85b6e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829834, "uuid": "31c10066-6543-47c0-9d82-3a18d2bb878a", "comment": "Malware payload (SnakeKeylogger)", "value": "13b320494f43063a22082bccc9a2af1bcb1155329f6666eb73db742926cb6f3e715ecb3aa15fbfc2e305224e08b74a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829834, "uuid": "8ba974d4-70f1-4687-8fcf-b2705650975d", "value": "T1B524F116AFAF613DE63A1B71EAB7AD840994C904600369F88B14F00DAF13F5993E31F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829834, "uuid": "6ea5d719-abfa-4c3f-a5a5-47f561cb57d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829834, "uuid": "eafb4d6e-b5c1-46d1-86f9-1c959c1c78ad", "value": "3072:KKuBCFu2f+kKMPuXn9CbFQvv82N1dK6St8Cgp9eUWeNrfg6EgOssQQbTuzf6XC+C:kBsL+2Qvv82N1dceCgp8YQe04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829834, "uuid": "7487479e-02ec-4987-9f9b-79d598eeb48d", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829834, "uuid": "43c392b9-96c6-4083-b307-ba027a14a923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829834, "uuid": "5525af74-5722-4404-80d8-b249b2698f19", "value": "SSTTE30008000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e808cb-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829832, "uuid": "4b758490-371d-4144-a9a9-f34ec882af9e", "comment": "Malware payload (SnakeKeylogger)", "value": "a80295ae0157914a80e85dfa3f0042fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829832, "uuid": "c86fcc93-49b1-41b5-9eb0-8c10c42ba9bb", "comment": "Malware payload (SnakeKeylogger)", "value": "d0bbf51d9dc7100fb76b837b5e5ffe89b767351518e76a64fa2748463a1c89e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829832, "uuid": "8271ff37-bdec-4f8d-8aca-6ceed963b568", "comment": "Malware payload (SnakeKeylogger)", "value": "48ebffab2c9f9bc931bf513a1745b945f8637dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829832, "uuid": "434e9951-8b4e-4a1f-9c85-356f0620c0f3", "comment": "Malware payload (SnakeKeylogger)", "value": "86a49cef0c5da5aba9abaa40ed1e2e5b07b383ab0e86cafee8ec7b688efdf4551066c1054873b5d2091cb4e949e12bcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829832, "uuid": "3449d1e1-0d29-4353-a4ea-aca633f6bad4", "value": "T1B0C4CF84523BBFE1D9A417F0221038524B7DA11A75F8F0BC6D5BB8CAC89AB114BD4B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829832, "uuid": "e7caf072-220b-4ec3-bd8b-59e49650b164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829832, "uuid": "da9714f1-cc51-47d3-b712-bf6d9d0ded5b", "value": "6144:lYvasUHMHHpGbmK71TZQmLht4vaUIcW2JiIZxgUkfixGT+r2f2N1oYMG3whHIMsM:lqUHmmJZQYvxcWZIfgLKGT+qSoZTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829832, "uuid": "c3fda3ad-1d42-4ee4-af41-2afcd15421f0", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829832, "uuid": "a508b708-cf25-44f2-8502-fa25295606cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829832, "uuid": "90e35927-4355-417c-84d3-e8bf7f757b44", "value": "IV0MjHzypK9fepo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517fc483-efbe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683783620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783620, "uuid": "07a3669f-e9f4-45ec-b3d8-8b1ead42d874", "comment": "Malware payload (RedLineStealer)", "value": "1c9b0685b0288deb72e2e39865b12d11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783620, "uuid": "c73566f5-595e-4cba-a39c-5a0b49edaee2", "comment": "Malware payload (RedLineStealer)", "value": "d11e02cc2ce31a34d48437992e2e96956b97e249960f2fd28479e8dbd329bbc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783620, "uuid": "f2d80077-48d1-413a-b9d2-ac5ee515aec7", "comment": "Malware payload (RedLineStealer)", "value": "5bf833e52d16d0097412c22c8d247c9d46a818a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783620, "uuid": "43629248-b306-4ee6-8e41-fb8b66b6e01d", "comment": "Malware payload (RedLineStealer)", "value": "d3c43c9eddfb33126929ae4cb385aa7c03a1606d50bacf61f28ff028f94c9ad140cbc8a68e416634b431a3cfae3bacce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783620, "uuid": "07cd16c4-59ae-41b1-baae-3ab13eba81c8", "value": "T127F41286ABD845A3C8B503B0B4FA03C316397C719E74AB6B7751A44B5C73681BA3533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783620, "uuid": "e594ee56-6151-4467-82e1-6ac480749f49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783620, "uuid": "238eade3-332e-479a-8a14-1517d30b03be", "value": "12288:PMrPy901MyzKzv87ITJ8uON+HonGTD366TazQE1frXHZgBi5/XM5f:wyEMyMk8TONcvTD3xTmFXH2BilMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783620, "uuid": "0b7a39a7-aae3-4f9b-93a4-7e3b0a94748d", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783620, "uuid": "c135acd2-5cd3-4a0a-9960-d334d9697095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783620, "uuid": "e95ebb4e-b5f2-4edc-9f60-6b081b172a24", "value": "1c9b0685b0288deb72e2e39865b12d11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b9d65c-f038-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683836140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836140, "uuid": "ae74c0b9-062b-4a4f-b8d2-4041a42cef6a", "comment": "Malware payload (Amadey)", "value": "7633f5146de3650ca29ae3407e0c23b2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836140, "uuid": "63db542f-3274-45cf-8b7d-4b04e75963f0", "comment": "Malware payload (Amadey)", "value": "d1426559d706d47dae91c04e99aa05082b107d1ee5eb8ddd99e9556496b60aef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836140, "uuid": "c4a6cc79-7df4-4a20-a174-5b0db5565442", "comment": "Malware payload (Amadey)", "value": "8079aefefe419fac7523181c1bc8b83dd299c304", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836140, "uuid": "1bee6690-a1aa-4d38-aad3-eef2f4166efe", "comment": "Malware payload (Amadey)", "value": "8c7bcc997fb42d39db524de1fef1f826100b3a9f3dd97ebaa8b6749017b50abf43cc48b7eacbd17647cea239bef91415", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836140, "uuid": "da706436-1908-4d62-906b-ac9eea5ea011", "value": "T17D642B2393A13DD4E5264B72AE2FC6EC761EF3544F5937AA12189E1F04B42B2C173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836140, "uuid": "9b4f5336-4ede-4cdf-b6ba-43f6bdb4b515", "value": "4d0a7f70eaa3e152ceda1701c7d8bbd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836140, "uuid": "a430f607-1a01-402a-bdae-bae5b5dadb3e", "value": "3072:XpXtquyALNpbnNKjS/n1/fhHpeEdjy2Uwicw3GK1I9cib5EXmRfeJ:d8bALNpTNKj81RJLdO3wdw3GKPXmQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683836140, "uuid": "1308a13d-0950-434d-9e91-78ca0137409a", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683836140, "uuid": "5b4d8cae-2f84-4abc-936e-4fc1379e57ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836140, "uuid": "c0004f99-d6dd-4d17-886e-5d5adc8deede", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b78ccd-efb3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1683778856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778856, "uuid": "2212403f-3e72-4c4c-ad0f-73898c7b1144", "comment": "Malware payload (DCRat)", "value": "3053cb488a47f0cfa652722c79486ff8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778856, "uuid": "edf3d063-b602-4321-b447-756c9925283e", "comment": "Malware payload (DCRat)", "value": "d4e0dbb934691a16f4c9fb7534e2c0f2940389e65e1799f6f231909edaf171a7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778856, "uuid": "fde3e23e-c3b8-46d7-a789-9efea7ad6921", "comment": "Malware payload (DCRat)", "value": "59eeca2266169cab55c917755e5f0996b4866cf8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778856, "uuid": "36084eeb-fc5a-4ec5-a6df-a0a08949298a", "comment": "Malware payload (DCRat)", "value": "55eec146c79fea6d273cfff7b8766246031a4b29c206a25a3e7f2caa7ca0877bde718ff0d70d28ea85e89d66170a59c2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778856, "uuid": "4984a37d-fde8-4522-a4e1-67ddec879d81", "value": "T1BBB53378DE229FE6F6F609734E4342CC4A72779A6F825FDBAFB433A488CD4615456002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778856, "uuid": "507cd45a-2b42-4193-9a3a-06946797c4b5", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778856, "uuid": "32b3c3fa-e718-4673-a1c0-012825c4ffc6", "value": "49152:AWZrpdaJJVoYNRFmujPP2TyqYOENC3tAaJWX/L2qU6A77DA7so8j8K:AWp8oYNquTkyPXw3yaJ0JUL7ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683778856, "uuid": "ac50fe85-40ce-457a-ac4b-4b47a4fc3e3c", "value": 2412544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683778856, "uuid": "9c298dc1-1800-4a72-b3b0-eddc9e48d9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778856, "uuid": "11c38694-8211-4ae3-b0b8-e7971db431f9", "value": "3053cb488a47f0cfa652722c79486ff8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc720f6d-f032-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683833729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833729, "uuid": "767ababa-7494-42a9-927e-cb5a987782e3", "comment": "Malware payload (SnakeKeylogger)", "value": "f01c49f8331cdb6ce3bf50ae389cf4b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833729, "uuid": "ea23f287-1853-4758-b669-6719e08d2cac", "comment": "Malware payload (SnakeKeylogger)", "value": "d4fc19e27156a382f5f769484b3d1487cfa28f1e443cd05f4c85a10604071346", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833729, "uuid": "d26b7168-85f3-4c10-9497-5f03d442b01c", "comment": "Malware payload (SnakeKeylogger)", "value": "d9e9d3fc1f01383217307d3dc4a0659e03dea805", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833729, "uuid": "2734cf5e-90fa-44ad-a16b-e040ae1d0250", "comment": "Malware payload (SnakeKeylogger)", "value": "e535e9fb56f9b883f4a654a0b14960b8057ff60e260b715b2334733f335d4131eb89d078119f06e8369f1adf10cfd8fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833729, "uuid": "ef5be902-2477-4d14-a96a-72049db5259c", "value": "T1C0D4010413FC0440F2BABFB669B051574B767E0B7871DE5D8A8B798D2E31B816816B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833729, "uuid": "cb5c2f15-89e4-4792-ac11-b23496b612df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833729, "uuid": "dd9fb0e1-5117-4b36-ab9b-40f022d83bcb", "value": "12288:dfeeXfZdfrXg+JwuKt/S/60nbO8d33dcMAAVmo:Lfw+Jwz/S/6Kbp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833729, "uuid": "c6e4816d-e4ff-4a18-b392-38a451a89331", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833729, "uuid": "7e496a51-ac96-4b4d-b193-e66a6a756170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833729, "uuid": "c4cb5617-8d85-4dcd-90f3-2a56f5818fd3", "value": "f01c49f8331cdb6ce3bf50ae389cf4b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc47835-efc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683784825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784825, "uuid": "a1023879-2d63-4150-9ae7-828ae3e49041", "comment": "Malware payload (RedLineStealer)", "value": "36604f2f7eaa4d277081f858425b2955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784825, "uuid": "d441006a-ea09-4c71-8c40-527d42dd2b13", "comment": "Malware payload (RedLineStealer)", "value": "d5017341d9ec265ae3d3ac0c23e522191b5026260f653628d2e6b280d85cd315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784825, "uuid": "b93e6dd0-6733-4286-8389-7ffd81aba51c", "comment": "Malware payload (RedLineStealer)", "value": "350cb3ecdc84f2aa643cae2fdf5eae4465f88171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784825, "uuid": "71a7f899-a4b0-4c68-be5e-e2649ac6e506", "comment": "Malware payload (RedLineStealer)", "value": "a134bbbd0098b020d81f47743d8d11016e217cb6a8b4220fa10905433d0fe0e6d1d684edd18dbee43171d165fd086c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784825, "uuid": "3f0e2906-4d12-46ad-8235-3486e501da0c", "value": "T1D0051242FBCA8537D4B4A7703DF616D32F357D62997883A32699A40B1C722C9D13632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784825, "uuid": "d31afaaf-58fc-4b5f-981f-d8b50931a858", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784825, "uuid": "ad31223b-278c-4a20-b666-c0864f29dce7", "value": "24576:0yUMQjm+laxefPUq0ZQsICHJSM35laUJ:DUVjm+lakX0oGJSW5la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784825, "uuid": "a749135e-dfd2-448c-b723-9d07d57afdd6", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784825, "uuid": "92831f08-a538-4949-857f-96433c9bed3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784825, "uuid": "98d40e65-03c4-4bb8-86e1-c5edbcb1d9bb", "value": "36604f2f7eaa4d277081f858425b2955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62d3570-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683830148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830148, "uuid": "15ccc0e0-c8f8-4576-bbe0-13704d26dc22", "comment": "Malware payload (NanoCore)", "value": "9a66f9e8035f0b47c28ebdda6f0d6ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830148, "uuid": "02f059e7-80cc-4ccd-aa03-affc51936e77", "comment": "Malware payload (NanoCore)", "value": "d6143602fe61f03084aecf1a53398adb08e4135a69b99b3e9be547e9f306080d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830148, "uuid": "85e40cf4-4038-436c-9a8c-37028b2d216d", "comment": "Malware payload (NanoCore)", "value": "d3fc4cebf7fde1158a1e86297c6729b1314ecb69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830148, "uuid": "6b6f973d-1244-41c2-81bb-7d81990a0fb5", "comment": "Malware payload (NanoCore)", "value": "afcd9733270829357ff16ff8fa8584866bb12c306ca948037adb083a412710857beeb7e3c719ad89052710ee0e45e55f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830148, "uuid": "b45070d6-2538-4cee-be7e-3b0dcf7a1ed2", "value": "T1B227C03EB7E58E62D7691B30C03272142334CC9640D6E31B999D7EEAD8913C5E149DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830148, "uuid": "e5df04ff-11fe-4bea-88cf-9da72757b3be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830148, "uuid": "feac8a70-d112-4d6f-82e3-300a37b9d465", "value": "12288:S8SnG5jbNCUZLHVaaj7uTPUn0S6M8RLO4VsypU:SjnG5lCEGTBM8RLTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830148, "uuid": "07cd03e8-4ac7-4ddf-8b86-90d6e846f25c", "value": 20970442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830148, "uuid": "8cdc5c7d-8c9d-432c-b3cd-286543619a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830148, "uuid": "d45ba2f2-38df-48a8-b6a0-57a430c89e25", "value": "9a66f9e8035f0b47c28ebdda6f0d6ffb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bad5ed2-efbc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683782752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782752, "uuid": "86eb1beb-3097-4de7-ad29-c5c188644082", "comment": "Malware payload (RedLineStealer)", "value": "0bc00bbaeeea9d04aac010ca2f44088f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782752, "uuid": "8e80c572-7b79-4df8-83d8-1c2da11e596a", "comment": "Malware payload (RedLineStealer)", "value": "d639ec3a51acd0e1ccdb0b07f29bb3df7b930266a5ae7396c73fd2a1fe4859a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782752, "uuid": "92d7795c-4fc3-4f1d-8be6-61627f831373", "comment": "Malware payload (RedLineStealer)", "value": "572690f28c8ea0a5f3089f0b5ec73c012f39e23d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683782752, "uuid": "f49157f1-3938-4a38-aa55-2b7972ab5790", "comment": "Malware payload (RedLineStealer)", "value": "6b691b291466e34550aac022701ac171c0bd66ddb2f6be11dde82feb148378a3aad1144b36164dd7fb59ad72c787fdab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782752, "uuid": "afefb894-0ecc-42b8-bdbe-72e2e6a03df1", "value": "T1F4F42202ABD89463D9F467704CF707C7163A7CB559A883522346A9AE5CB32D0B83637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782752, "uuid": "192cc27c-0dc5-4269-a628-802a3b388ea9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782752, "uuid": "8d1cdf8d-7e0b-4560-a5ea-bd5ddb9c3720", "value": "24576:vy0JM2BRr3xXXUUxzsaaM39O8TylZZ5WK:6mRlXkUxAbg9O8Twb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683782752, "uuid": "e4d61331-4e39-4c7a-bcc9-4e105b047836", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683782752, "uuid": "8cdceea8-6aa6-44fe-bb40-7fc2b1259792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683782752, "uuid": "20c7df20-5304-41dd-ac76-2665195a04fd", "value": "0bc00bbaeeea9d04aac010ca2f44088f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b1a99c-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683789585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789585, "uuid": "d0bdb723-feed-42f5-af07-36ecb1c9712c", "comment": "Malware payload", "value": "8e7715c3089fd8b08bdc363d32f636e0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789585, "uuid": "6978e644-89b7-4bd3-9082-272ac5340cb3", "comment": "Malware payload", "value": "d6dd0ff60c54c31784566d189ae60ab6bb790d028e618b6b83b0a058b14ce6ec", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789585, "uuid": "fe600a15-f8b8-48cc-847c-43fdf9f0cded", "comment": "Malware payload", "value": "70767c258349b9dfb7022996a7285d80a3a62b99", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789585, "uuid": "a65cc2b0-1833-4d37-893a-b6b96a3d8fdc", "comment": "Malware payload", "value": "8ab4c472abce5c3816433992ec008cbe97069c4a5c5bc79e97411fa3ef722cccf55bf8fd5d40948090916a69f33bc705", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789585, "uuid": "b34e19a5-61a3-491c-8722-269a94819bc9", "value": "T19505230DB79105EA36D85EE0997E7EC8F5E091B5E590BBA2105C5DA2C201FB7DED02C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789585, "uuid": "552d66cc-3f9f-4b0a-9d16-acd9f511c610", "value": "24576:sBzzfSKwb0zv/qOGJ+8dvyEPa6N2bjPO4XtQx:s9zWb0zdo5PP/CPOTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789585, "uuid": "0b60cd61-0bb5-4859-95e0-9ed8699c867f", "value": 803746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789585, "uuid": "dc8cb8d3-5393-4f97-ba43-9860cd4b83e0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789585, "uuid": "cae423fc-34e4-4d44-915d-2f5482b1d202", "value": "Odeme_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ea0d75-f033-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683833743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833743, "uuid": "82d2d0d3-413f-4826-bddc-bd7fcb06c9b6", "comment": "Malware payload (Smoke Loader)", "value": "eaa1cba4d0151c17b1839c8d741210c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833743, "uuid": "92b10ccb-9582-488f-979a-9874766171c4", "comment": "Malware payload (Smoke Loader)", "value": "d9e69f472ab0c87fc220c50ce9bcdf5880999f521d2409f4dc29041ed9e858e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833743, "uuid": "47542a1c-8d76-4554-b9dd-b29e4e3b0c20", "comment": "Malware payload (Smoke Loader)", "value": "044abc51961fb00ce03afdb0d7863ac90db22bd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833743, "uuid": "07dd218d-93b2-476a-a3b7-76ee1ba80c40", "comment": "Malware payload (Smoke Loader)", "value": "866a3183602a91df79ade5e861938ea6fd559634af764c05db1294cadb31d74c945936605ca000da939af77a2aa62b0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833743, "uuid": "dd6d0288-fcda-45c6-a341-3d0215bfdcbf", "value": "T151643C6393E13C95E6264B729E2FC6EC361EF3504F59776A12189E1F04B02B2C177B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833743, "uuid": "d8e2c850-5603-4f0b-aea5-485abf573ab3", "value": "7ce2ea0672659bde73ebe3337265c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833743, "uuid": "c1a6f87b-206f-4485-962c-084dd385b3a4", "value": "3072:ppXtaT316LgVH3ztjJAwmO1XhgXRthezOIKOzCHjpmlBjmA5kDp3RfeYy8:LgT3ALgVXzdJ6OcRtUaIWjp81ADp3QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833743, "uuid": "b2cc8041-cce5-4e41-a3ff-f34a372c13f5", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833743, "uuid": "0149fe68-23c7-4626-b694-b4c5921e59d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833743, "uuid": "e90779cb-ad1d-4b1b-adbf-f007c1615cfe", "value": "eaa1cba4d0151c17b1839c8d741210c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4138b62a-efb5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683779728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779728, "uuid": "89d1c235-ea46-46be-9f66-985eff501323", "comment": "Malware payload (GuLoader)", "value": "f908218ac1828a12fb1972d54fddf1ec", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779728, "uuid": "d5b3e9dc-2df4-481d-9e9d-fe034fa1aa84", "comment": "Malware payload (GuLoader)", "value": "d9f45cf5b8a54b55765870fca2f047b822f44eb90f1b47190133f7b96ad4b51b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779728, "uuid": "6e3355e0-2d92-4816-8504-25bc96109636", "comment": "Malware payload (GuLoader)", "value": "b21bbb11e7f447ab2574bfee6201523a67a49de7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683779728, "uuid": "40ef9ead-244d-4e3c-af15-011a2954f0d4", "comment": "Malware payload (GuLoader)", "value": "67272198955c6b72bf4780c596990e4c9b6173b596a84549c861785041e8ecba404313b395b31719a80a4c136a567db7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779728, "uuid": "79f01672-27c0-4e6d-a3c2-34de51240e92", "value": "T194B238565B8C4C61E25AE8BB475DA00E59BCF23634C215C5BD9DE3743B3E10E0B6B2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779728, "uuid": "fb18e860-282e-4b45-bbbc-86cdbbfa1660", "value": "768:ai/rYLtVC7sgwr5IWqX5f2OkhaAktdn1olnI:avKsgg5INX5Qhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683779728, "uuid": "a02fc3d5-028f-49cc-b043-83f7c82a838f", "value": 24666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683779728, "uuid": "a3348e3a-d586-4bae-afd5-c0fcb525ddda", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683779728, "uuid": "6eca4bff-45d2-4ebb-9e66-a8fe42ff98b2", "value": "f908218ac1828a12fb1972d54fddf1ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56c5c6d-f01b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683823839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683823839, "uuid": "0bcdf692-92cc-4043-9201-e453d723252c", "comment": "Malware payload (RedLineStealer)", "value": "21a291440c4ff52c1f184aa46c961a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683823839, "uuid": "da0c7151-c42f-4c9e-b75f-17589d0a37ca", "comment": "Malware payload (RedLineStealer)", "value": "daf53b8f2857fd240f0d6f624ac479ae9da7c48908e764a6b627c9bbdba7381b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683823839, "uuid": "06c57a0f-9169-46fd-abde-e18112a0467a", "comment": "Malware payload (RedLineStealer)", "value": "d48d66b91cb3880102595b0e36b4d3da64b87268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683823839, "uuid": "1b978785-4b49-48f3-9f18-58bf7b6a8d6a", "comment": "Malware payload (RedLineStealer)", "value": "bdb689f90c6cc0b4865fbffcb576c1bc269900c200e6981d89d234aac2b30df0b99d0ea4c2354c80bcbbfabf0a3d8596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683823839, "uuid": "37dfc186-a2e1-487a-8be8-e7c1319f8403", "value": "T14764F91383E1FDC5EA264B729E1FC6E8769EF2508F59776A12289E1F44B00B2C277711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683823839, "uuid": "9067866a-6c12-4aa0-8d4a-be16bd5092e4", "value": "513663070e5d163878e1cb9d4a5e6408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683823839, "uuid": "c1b685f1-0f4a-4785-9768-c274a9bfee83", "value": "3072:NAXPzcAZSNIGxywCL2nqIrV/xy1wawgazyU7wRaKVc5X+gI5gPW3P+lQ+TAh0:2IWSNjSL6qIrV/x0bS7wRtVg1Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683823839, "uuid": "81102621-5119-4e77-a518-99ff691be135", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683823839, "uuid": "949a263a-033b-48ea-8b42-93a315d69352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683823839, "uuid": "02907e0c-197b-41e3-ab32-8dcc8f57865e", "value": "21a291440c4ff52c1f184aa46c961a2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a674ea0e-f015-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683821129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821129, "uuid": "c47b58ad-59ec-421d-ab75-e020c5aef54a", "comment": "Malware payload (RedLineStealer)", "value": "6ee0526896ccc15f8337fa9d4228ff1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821129, "uuid": "f48b228a-a12c-456f-994a-cb65db5532a7", "comment": "Malware payload (RedLineStealer)", "value": "db1c8fc3822511f7e804660ea93dfe82713dc79a1d9d80cc6bbf236e415d644f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821129, "uuid": "412e0a90-06b6-47d4-a66f-e5f8d9f0d2ec", "comment": "Malware payload (RedLineStealer)", "value": "34b41ed30c0b1580c42441310487be99de44c91f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683821129, "uuid": "74992a26-aa0e-4016-9c3c-9c2e064a43c2", "comment": "Malware payload (RedLineStealer)", "value": "aa7055163511fc7790615f1275928194690044454b16b1c1d47a002803f47f1e252c320450a75062b109664fd5fa68bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821129, "uuid": "3be716f4-3f65-43b4-a357-6ad45d6d77a6", "value": "T1CDF42203B3CD9572D4B167B468F703D31F3A7DA5AD7813AB2745A88D08B26A0643277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821129, "uuid": "eaa6c5af-3146-4e95-b824-a3062829dbae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821129, "uuid": "f5949200-39be-4db9-b4b4-e6b24cea3db7", "value": "12288:iMrby90/9Dz2nZ17j9UZ8qHu12psEDF881u6y9Bf6tk5Xuaq:hyeYpSsmFDF881mBS2pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683821129, "uuid": "e7f7f404-df5f-48dc-b29f-4b69f1e7330c", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683821129, "uuid": "d9242013-b2c3-49aa-8b5e-2d1801754111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683821129, "uuid": "ed3ef512-1596-45b6-a162-3c9b9ae64b98", "value": "db1c8fc3822511f7e804660ea93dfe82713dc79a1d9d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487ec0bf-ef92-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683764707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683764707, "uuid": "c3456c6f-5dbf-49af-bc32-960460d649e8", "comment": "Malware payload", "value": "ba9f849e3c6e57316548367f0f6a444b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683764707, "uuid": "8acf3552-8b69-4c34-819d-2da109c3741e", "comment": "Malware payload", "value": "dc2c8c8369c3dee48feb6b43b5467f22e6a0c939257207828104ed8d94b154d2", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683764707, "uuid": "b357208c-f875-4080-b0a5-e29007ac58b4", "comment": "Malware payload", "value": "34b80863cddfd512be800f366f282eb58fdfc640", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683764707, "uuid": "3e2fa985-49fd-4fbc-b89b-5142c08da71e", "comment": "Malware payload", "value": "f2ee1b89093304e57dfbcad61a9664b604115c405a9ce84eba31501e96def230c4db8326a04f8eaff7e1e1f175b312dd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683764707, "uuid": "5615d099-f1f4-49e7-8b58-35ad7535a69d", "value": "T12066330271CB9632C0BB073566BE5B3A173EBD305ED5844F5318726C2EB22E0A7B5B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683764707, "uuid": "76b7c00b-4b37-4c2d-9157-636f39f090c6", "value": "98304:ZiWF9TZpfEK0lk5xmY7aRGm7XCiiQO95anWA25u2tEYjTMy5rp5WpiSvv:r91pSlkqFGICii15HrgYjTMIrfWESvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683764707, "uuid": "d17b7f21-7fc3-47f3-9c51-20bcfe4e0809", "value": 6830592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683764707, "uuid": "faaa2b5a-1a5f-44cc-9faf-77adfca6604f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683764707, "uuid": "4b921cd0-75b1-4434-87d5-10904b486512", "value": "Lorex.AdluminInstaller.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01497959-f033-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1683833737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833737, "uuid": "a6165d81-9985-422e-9ae7-8e5ecbc50e65", "comment": "Malware payload (RaccoonStealer)", "value": "fab02f4052aadb65ebe180e58da323b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833737, "uuid": "434eeb5e-b12b-42eb-b7c2-4981a98fb3dc", "comment": "Malware payload (RaccoonStealer)", "value": "dd87e832d0e814f6a5f50c00cc7a8eb7a67ebbc7100973a4a7039b1a905446cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833737, "uuid": "d6ef5bcd-0ee6-4359-bcb3-f76a84fc26f9", "comment": "Malware payload (RaccoonStealer)", "value": "36ffff98b13e5edcfe560cd42c429f2183789aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833737, "uuid": "e813a4f2-f78e-41f3-8bae-19977cfb7460", "comment": "Malware payload (RaccoonStealer)", "value": "b1f0b2680bb12aea8e2f27cbf86614bfd71d59c0450ee5e6c67c719eb754a21099aab57b640c2a108e633f8a4829af90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833737, "uuid": "3517c842-532e-412b-b122-33f6e84bc3de", "value": "T1F35623A322A1045DF0D2CC37852F7EE9B1FA436B4A82BC34B6D659C526325A1F316DD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833737, "uuid": "b0c32333-4a67-4372-9334-e9f3b5384ee6", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833737, "uuid": "e77571e4-be46-43e0-a9aa-22bea94f62f7", "value": "196608:FmExMeoCVrfaN9xVpWrysh+QlulEak022uWjO5:FmExd1lsYryG1v022l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833737, "uuid": "c22dc81e-8661-4485-a9de-8a1d365c2244", "value": 6298624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833737, "uuid": "20c0e78d-4323-4e7f-9f45-8da01acec651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833737, "uuid": "94dc3d5e-72df-49bf-8eb7-d65f522c5507", "value": "fab02f4052aadb65ebe180e58da323b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ba8027-f032-11ed-b3cf-42010a9c0076", "comment": "Malware payload (MassLogger)", "timestamp": 1683833721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833721, "uuid": "255b6916-1a03-4a88-b8ce-b829cba87aa4", "comment": "Malware payload (MassLogger)", "value": "29531f95f2ffc356c67975a60effa857", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833721, "uuid": "6ab798d4-8bc8-4bb5-af6a-0fac4c0d3a27", "comment": "Malware payload (MassLogger)", "value": "dddaf7dfb95c12acaae7de2673becf94fb9cfa7c2d83413db1ab52a5d9108b79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833721, "uuid": "f8916c24-0df2-4139-a1d3-7cc5fc70080b", "comment": "Malware payload (MassLogger)", "value": "058763934fb991ace223861f1b4b83880bc0a63b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683833721, "uuid": "c5b1e99e-eab4-491b-bdf7-47c80996b048", "comment": "Malware payload (MassLogger)", "value": "2a5876882c2f5d9253fcfd057bcbf0d808a118ad7c85fd42924b2c4fbd33627fdd6768e63df8387fca5faf8308fd2a1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833721, "uuid": "8782e39a-df12-4b34-98d6-823d22051ae2", "value": "T14DD4010813FC0440F2BABF7669B051574BB67A177831DE5D8A8E78CD2A71B816C12B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833721, "uuid": "0f530fe1-c3bf-4e53-9a59-be03debbaf8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833721, "uuid": "562d3389-aa6c-46e7-8b90-b6852bfa9c3f", "value": "12288:5feeXfZdfrXg+JwuKt/S/60bbBJZXMAMDmo:vfw+Jwz/S/6ebhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683833721, "uuid": "c7d87d85-56ac-44c3-bc9a-2be568036799", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683833721, "uuid": "6b803061-e8ca-4ecf-937d-c50b8a476a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683833721, "uuid": "f4298ed0-2a4a-4026-9922-ceb0e896a8ec", "value": "29531f95f2ffc356c67975a60effa857", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832fe5cc-efb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683781556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781556, "uuid": "f0db543b-ee0f-4b40-a577-4c0cc0e352a4", "comment": "Malware payload (Loki)", "value": "a3fc806f41f240b44de20cef1755ccdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781556, "uuid": "920eed20-a3f8-4da7-8250-18fd09bbdf09", "comment": "Malware payload (Loki)", "value": "de0615cb1daf9aab7912c990038221c971a3f82985344bac6d1d81bebf05c499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781556, "uuid": "19582571-6ad7-4041-9348-744bc6e95d8b", "comment": "Malware payload (Loki)", "value": "62375347e1c4a70110e35f83fd4fe75915d87843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683781556, "uuid": "bb4f2367-c025-4d42-8346-38ba1f4be943", "comment": "Malware payload (Loki)", "value": "aa3bf373291a540c66842cfada2f3416d9f1f0f6c3d1ecccb98d08a043b8731ededf7f7c0154a86470606bcde36af47e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781556, "uuid": "1f37f650-2b51-48ba-a8fe-626abf5c60ed", "value": "T175E30260A7A0C477E97256B10F379BE367B9E6221474911B23209B9E7D372C1CD0E376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781556, "uuid": "f462b2e0-431f-4415-a303-f247a7c8ba15", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781556, "uuid": "af06c78b-cd5b-43fa-8924-5be68a6f605d", "value": "3072:3fY/TU9fE9PEtuYb6v/1WwajkZ1AzJ3z1QH7LrlUjdMQ:vYa606v9WwkzJD8lU5MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683781556, "uuid": "bf745caa-9ed6-4707-9f2b-51b8ad7dd6a8", "value": 149735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683781556, "uuid": "2a1576b2-8d2f-43ad-a3e7-b1295b433e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683781556, "uuid": "d7f7cf6b-9d96-4719-a684-8958a072b165", "value": "SHIPPMENT-DOC&ELE-ECOM001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3bc4f1-f035-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683834806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834806, "uuid": "93a6d1f5-b923-4653-9254-b1b1d9a8d18e", "comment": "Malware payload", "value": "e9b9deae7fc5e4cf596242d51205bead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834806, "uuid": "5b8a2a3f-6cb2-4bff-ab0a-d01ab181776e", "comment": "Malware payload", "value": "de6c5ccad4ed4a6e743b627fcd2f24f4fc888950099c75abbab649f07051a390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834806, "uuid": "30b1a29e-fffc-47bc-a997-bf44db93d3d0", "comment": "Malware payload", "value": "eed79b3236a1433130abf6ec49e3f56db204c479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834806, "uuid": "4bac73ce-d740-4542-87f2-d8ff8c69574c", "comment": "Malware payload", "value": "38d2a0c54b3ab9e7cda4ffc4059aab4b446be38ae80fa3756f0091bd805c24d56c0ccd736ca556588336c8455af76818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834806, "uuid": "a2152c4c-b328-453b-8da4-00125c7118c9", "value": "T16EC402D57B98C53FCBD35976A6A1B22B4ABC2C7035101B136B987F0D3E3E8C0994A725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834806, "uuid": "f8c0782a-73c3-4cbf-afad-3fb4ab31a562", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834806, "uuid": "1877b905-389e-4532-922d-2534e2423fc2", "value": "12288:K7YaMPI+XCGCKMYZsE5tnxgQzd+wF9icVibSxHv:1myCtYuETxgi8wF9Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834806, "uuid": "e1c2984a-c863-45a3-a21d-5f8018616bd2", "value": 552111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834806, "uuid": "54021d82-405e-4076-9c96-c8333e446f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834806, "uuid": "3be9daa8-63a4-4b79-b9ad-754a32927506", "value": "de6c5ccad4ed4a6e743b627fcd2f24f4fc888950099c75abbab649f07051a390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19d1bfe-f03f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683839214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683839214, "uuid": "5f07f54f-ee7d-4b65-b383-eb00bdc14fe7", "comment": "Malware payload (RedLineStealer)", "value": "2742063570ede152a3ba426deb3acf44", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683839214, "uuid": "9fec3c3d-2d62-42c4-917f-0beafff81dc9", "comment": "Malware payload (RedLineStealer)", "value": "ded0c0f527a2edb91c438b6b4644bad58a28a8a17c112cfb6567e91c3197b6bf", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683839214, "uuid": "8e526d6f-c3de-4088-894f-a1c0a3f1a97e", "comment": "Malware payload (RedLineStealer)", "value": "56e3378da24efc470f8d5f229ac7e1a7ad3d31ba", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683839214, "uuid": "43c71f25-a4f3-49f6-9bc7-fd7375cf28b8", "comment": "Malware payload (RedLineStealer)", "value": "6849b440dc9fe3549372a9fb13fca6ed6002ed51d995f54f09ef872c5f08ae3700ab0f9e28f1b2202ce141f3967c41b5", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683839214, "uuid": "d6e6a56a-a619-4deb-9b49-7d66f078d96b", "value": "T15F1523A157D8D932E8B52B7068F717831932BD626E35931F2354B44A1C72BC462B3B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683839214, "uuid": "8d7d9a44-1bf3-4a56-b24c-72ba8e8aafa0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683839214, "uuid": "c57c5492-b86f-4f7d-8a03-c2a1bba95b5f", "value": "12288:MMrCy9057F6Xd5WM6oE/iX+8+eUtBiAPpY0b+xUb8fYYt4Gqxz5o6ve2s5sqi/dF:GyH692+53iq9+qb8fY9GqlmGqQo6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683839214, "uuid": "1ea8940b-f720-4490-bece-3c043f31ac41", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683839214, "uuid": "b1aafa79-dff4-4f0d-98b6-458ab09a5daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683839214, "uuid": "29c5f9f7-5953-4925-9fb6-affeef112c4c", "value": "ded0c0f527a2edb91c438b6b4644bad58a28a8a17c112cfb6567e91c3197b6bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea4bcfa-efc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683784824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784824, "uuid": "99502976-5707-43d5-aeb2-c21b9ff0989f", "comment": "Malware payload (RedLineStealer)", "value": "351456a61bee4afd3aed5fba494ea62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784824, "uuid": "f85421e2-b0a0-436c-982a-1422c342c986", "comment": "Malware payload (RedLineStealer)", "value": "dee3a2072fcabbe87d1d6d7612886eec44d08e3e1087dbf838f4921daca07bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784824, "uuid": "b6a50891-3584-4064-819a-7fcd20b3e1f5", "comment": "Malware payload (RedLineStealer)", "value": "acfd1008afbceb1c343c13295336fc330f044863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784824, "uuid": "65159ac5-1509-419b-a0ff-1770ff5308d2", "comment": "Malware payload (RedLineStealer)", "value": "98c3ea353d546c8312a2ea4889bf76d42313f47ab155d205e90c37e1db77770b0e913e8b62d1837b05c6bd96f80bc873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784824, "uuid": "591bf0a5-d25f-4bc7-a321-2055edc7a263", "value": "T1F4F41257A3E8D4B3E9B62BB028B70793073ABCE1497443A72291AD4B1CB22447536777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784824, "uuid": "36419a3b-05b3-40d8-b76f-30dc98394621", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784824, "uuid": "aeda34f5-d58f-4ec9-aa44-c0f4b4250682", "value": "12288:SMrYy90DY0UsQVfeO687dIXGUNC4GtoS1pJ2VOp7eUiNjL7X8eRzNexW:Oy81K7mzlEoOoOdeU0X7xpNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784824, "uuid": "75e0dd29-1bcd-41b9-860e-840ac37b17b1", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784824, "uuid": "a245fe23-d7c3-4211-b3a9-3aa3c0830e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784824, "uuid": "e18fbe76-be78-4acb-8c48-d66db233984f", "value": "351456a61bee4afd3aed5fba494ea62c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4a10fd-f042-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683840199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840199, "uuid": "73ef679c-5f61-4c4b-b13a-5d41d9cb0b28", "comment": "Malware payload (Smoke Loader)", "value": "e7ae33d64bfc16ada5c9e1c0ffd67423", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840199, "uuid": "0433f5ef-db59-48dd-81bc-de62bf2db32b", "comment": "Malware payload (Smoke Loader)", "value": "e041ffe88f51cb80473d15d87095bccd986e42697e6e0085b103b25bec5f471a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840199, "uuid": "d6bd8ade-d97c-434d-937d-5f48f4ee972f", "comment": "Malware payload (Smoke Loader)", "value": "61e49548bfddf1e5f8a12c977c724e672357d106", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840199, "uuid": "03c66d7c-7927-4b9b-9541-1ab0934c0036", "comment": "Malware payload (Smoke Loader)", "value": "b3c85dcd83daa4007db4b1ab74b7989c4ef2cf521a42a79de9e5003ca7e01e41a2710ab364c35a3d508b7149fa571e08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840199, "uuid": "bc9dbce6-b64e-4b01-8102-2c3f51bb48e0", "value": "T109642B2393A17D94DA264F729E2FC6EC761EF3504F5977AA12189E1F04B02B2C173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840199, "uuid": "d902da8f-6e60-4b54-8897-c8d1ba27be75", "value": "4d0a7f70eaa3e152ceda1701c7d8bbd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840199, "uuid": "08add22b-32d2-403b-9470-755e762bd2d7", "value": "3072:PpXtfcTLUqtnDA+8qN0ulTTUUcLrCax/0ALpPTb5EYERfeJ:lleLUq5DHf0VrCk/ViYEQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683840199, "uuid": "55c469f8-c675-4e51-98e0-3bc2be7193fe", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683840199, "uuid": "ddca53a7-8e17-4413-9922-3bf0411fa93a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840199, "uuid": "095c9f60-deb2-4fc6-b203-3cce1189c6cf", "value": "e7ae33d64bfc16ada5c9e1c0ffd67423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bf20f0-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785881, "uuid": "f45294fc-e24d-42b9-8eb0-49907b7f8bd8", "comment": "Malware payload (Mirai)", "value": "e50bec26dda2a60ce0765419cd25bdd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785881, "uuid": "44577fb9-9bf5-4925-89f2-530d44abe55e", "comment": "Malware payload (Mirai)", "value": "e095e6876feee7ffdcf5b8ef8415033da8a82891a564e36f10b6dd1db0fe661b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785881, "uuid": "11e0a8b4-2b50-4e37-8e5d-872bd33058b4", "comment": "Malware payload (Mirai)", "value": "0eff8a11a32cf7da782af35be373e203840e60b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785881, "uuid": "c6cdd3f4-0a02-4207-8dcf-dfee9bc83b25", "comment": "Malware payload (Mirai)", "value": "e68c87803ba4606232207fa0b891be46f6574299b96f2f8da64841c7feeb32461cc9e711ef736336ef5d46787d33aca5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785881, "uuid": "dc313d6e-e94c-49ea-8518-e2930f3780b5", "value": "T18A735C34A97A2E26C1D0B13F22FB8761B2E5260E25B4865D7CB60F4FFF2065454172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785881, "uuid": "cc20dbd7-243e-47e9-abb6-d1e90e2c384d", "value": "1536:Azvh+FNkgj5cXlkqFfjzYWcSrGhQxV6vVgFpqxfcFFm:LtIYWc+8vVfxfcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785881, "uuid": "1d39f0b1-2def-4553-9e02-8912b9118c34", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785881, "uuid": "9dc2a8f4-5897-4cb2-8ffa-f40c9a2415e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785881, "uuid": "5c38fd10-20c7-42a6-9cf9-b94f498726dd", "value": "e50bec26dda2a60ce0765419cd25bdd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09ecd8f-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829817, "uuid": "6fbffd53-fb9a-4511-bcc9-84e55fea5174", "comment": "Malware payload (SnakeKeylogger)", "value": "e7c8d66e5e4f6c4180751dc318c81c9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829817, "uuid": "b15d092e-4477-42ce-8822-be5651ed28fe", "comment": "Malware payload (SnakeKeylogger)", "value": "e09602a4f8e956bcadcefd160458c0e669d176a1915edb9715e7d7aee549efed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829817, "uuid": "3f1655e3-03aa-40c6-8f88-0b9ce8944b90", "comment": "Malware payload (SnakeKeylogger)", "value": "16c7f45b6bbf268fe217e94799d1978aa0d0d785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829817, "uuid": "a7351032-5dc8-493f-978d-ffe14e58f631", "comment": "Malware payload (SnakeKeylogger)", "value": "14e9fcace852e70ae75243f657a199cd07538d9b32c4761ab923e8ce071ece11bd6c1b3d70eb95b47ede3ef6fe37669a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829817, "uuid": "d602a0ba-f5e2-4abe-8b5a-679c622bdc60", "value": "T14AC4CF84523BBFE2D96427F1225434524B7DA11A74F8F0BC6D6BB4C9C8EAB104BD4B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829817, "uuid": "c0d00457-e8fe-4b7b-93d6-b65253fd09f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829817, "uuid": "30760787-4f8f-4a32-817a-76e0de2ee6f8", "value": "12288:++qUim4rC7Yv66yxzmC1SBg8i2M4+A013jjFSrZii:dimQCoyxzmNnMXljJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829817, "uuid": "b59e151a-1aab-46c5-8220-a18aa400aa67", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829817, "uuid": "2fe9d5f8-f4d9-47ab-952a-6cdf2348a8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829817, "uuid": "3683217a-c334-4bff-913a-53e13536ae33", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ce56ab-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683830174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830174, "uuid": "592551cc-fdf1-4fd6-b8e1-dd20f56c5727", "comment": "Malware payload (AsyncRAT)", "value": "e51beeef2a2539ff8ef9e4bf7ffdf002", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830174, "uuid": "3554a7c2-916d-4b54-ad96-dff872bdd7e3", "comment": "Malware payload (AsyncRAT)", "value": "e09a35ac6c37f4807daf1dcfeb8e2f1fa78003cf1b48b942152ad54152ed2ae6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830174, "uuid": "cc376391-5a0b-483a-a7f8-5e0ea6c1cee1", "comment": "Malware payload (AsyncRAT)", "value": "fb7435fcbe78d1e50364db3bc527a7e394a3cc71", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830174, "uuid": "b7e34277-90e6-42a0-be92-5f18c844f84a", "comment": "Malware payload (AsyncRAT)", "value": "b659f2c284e5535e25cad42b17fdf8c20be2247454b444c5227193466770fc359dfc182c8dda1a1057bd7d500fcfa153", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830174, "uuid": "682bdcac-929f-462f-b124-0685beac394b", "value": "T1472794F9E7E347E7F8321A35C652523461323EC5A4E5AEF545C8B62C49302DEE21AD2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830174, "uuid": "7054f6a3-e174-4b96-b421-1a09ec51f58d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830174, "uuid": "621578e8-cb7c-4bf1-a15f-e5294aa9d31a", "value": "6144:7fQTkfGlJz/us5e2jKFFRavrXQ1SHbboDr21dP:7fQTkfsJL9aS7sfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830174, "uuid": "5e873472-3c64-49cf-adbd-69ec091f527a", "value": 20767342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830174, "uuid": "bf2621ad-380b-487f-84a9-423cc71e33aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830174, "uuid": "3e929ad0-b9c7-42a4-9f4c-331f6947636e", "value": "e51beeef2a2539ff8ef9e4bf7ffdf002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256c2b7b-efbf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683783976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783976, "uuid": "4100c0bd-09f0-43d9-a5f5-8c72f782a8ae", "comment": "Malware payload (Mirai)", "value": "c100569e03ab29a96ba42f5567716cbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783976, "uuid": "396ccf2b-e09c-46ef-b99a-33497b432a07", "comment": "Malware payload (Mirai)", "value": "e16584774638c230ee54f829105a01eee783f8d544dffc68791bae456c3bc377", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783976, "uuid": "77c89ff5-df7f-404b-a51f-13870c8c85a5", "comment": "Malware payload (Mirai)", "value": "dbd2a4bb026eed7831acc537596ebaa242c993e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783976, "uuid": "ee96bcaa-b392-40aa-ba96-74f73d3e13ba", "comment": "Malware payload (Mirai)", "value": "d1a14a0f5ef29fb3d8494648876bd36e1ac01a297454b4af8ab82c19187362012523ba6b9c5c8d01946edef40aee347e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783976, "uuid": "e0e6a33f-311b-4374-af9e-571f43419a94", "value": "T1BEB2C0CC61543184C98D7C7C278D4A664F6CA1D0BAED9B16E350CDD8B3BEA4B7859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783976, "uuid": "48efa830-b105-41d2-b2f8-90fda8bd9878", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpVwZqSWv1:4QlS07FUXqIYSXQKquWqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783976, "uuid": "f1480dae-9db6-4c4f-bed2-7fc6e1c61e4e", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783976, "uuid": "2187f6e9-be32-4460-bc21-d1bd04dbfa84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783976, "uuid": "76ecd186-d829-414e-8b1c-e2cd25b93807", "value": "c100569e03ab29a96ba42f5567716cbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d60ccf-f036-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683835189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835189, "uuid": "70e39a06-bd4e-43e6-95e5-cdc0cb9139c9", "comment": "Malware payload (RedLineStealer)", "value": "04ddc69a550d5cd0831c3123d79b4c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835189, "uuid": "d04ff1ef-9ad9-4603-b369-59aed2d2c658", "comment": "Malware payload (RedLineStealer)", "value": "e29264d11a7be505c2d3a54b49287a98445d6084492d51a343646aa2004b02a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835189, "uuid": "ffbfc5a0-e36a-4018-b9ab-5047f0d0eefc", "comment": "Malware payload (RedLineStealer)", "value": "7b4c195dc72472575c955bc00e407a25446cd823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835189, "uuid": "fef89096-9196-4f3e-8122-e12e387b72b9", "comment": "Malware payload (RedLineStealer)", "value": "01f5fb42c80bf69ab659b95cac38d43dc49cfa6600b599474c88ac55798ed6b72e7b4a2b5fb0de5b43e0664865359a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835189, "uuid": "c4f0cdbb-25b5-43b3-9cda-5005f7f17af4", "value": "T179846C2393E17C54E9264B729E2FC6EC761EF3504F5977AA22189E1F04B02B2D173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835189, "uuid": "70a2fb01-7a1e-4cda-a98a-0ac1c91658eb", "value": "4d0a7f70eaa3e152ceda1701c7d8bbd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835189, "uuid": "90e69241-4275-4024-9150-ed527ae4c419", "value": "6144:A90lAL7Awz8BpvIAelis67d4jTZHmltPq2cKVXXnQJ:AbnAwz8BGAnd4j9GLq2/nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683835189, "uuid": "b7e1cdaf-e54d-4b4e-8279-be16c732a544", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683835189, "uuid": "f92a2e91-2eac-420f-ab6f-6a7d89a0fa19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835189, "uuid": "52e5609d-962d-406c-a220-2519b23f391a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f031c3-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683829846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829846, "uuid": "068550fe-d078-42f5-a87e-1dc684a332ac", "comment": "Malware payload (njrat)", "value": "66ed6930fca16b90ed9d8035c9cb7eb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829846, "uuid": "22a77cc7-d40b-4717-b855-68b53f9d9f89", "comment": "Malware payload (njrat)", "value": "e6042bb173a230cc8b25f3d2d34d037d7a5afc687e3bdcefaefa7be756139f98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829846, "uuid": "b1efcb11-1c5e-4f51-91d0-4bd947c23554", "comment": "Malware payload (njrat)", "value": "004edc5857699c18951aa5a842c49c07174858d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829846, "uuid": "7964f398-ebce-45c1-a04c-da008b6e5238", "comment": "Malware payload (njrat)", "value": "803e3543b6141f5b2ecd33725c79f3b160e935288f6d37b617870794cfad3ace8b30ee60e40b0862be4975629bdbe77f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829846, "uuid": "e8a78f05-c8b3-4f17-9803-cd72e15e2930", "value": "T1C5032B4D7FE181A8C4FD057B05B2D41207BAE04B6E23DD0E8EF564AA37636C58B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829846, "uuid": "6c8b7654-e9c8-4cc6-8ea9-40bb83c5d0bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829846, "uuid": "6183c85a-f398-407c-a568-9d1804462b59", "value": "384:oy+6WIiejtCVLO309Qmykrt4QdqMjf+vWEWYrAF+rMRTyN/0L+EcoinblneHQM3x:yHdGdkrOGb+eE7rM+rMRa8Nus62t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829846, "uuid": "9ae131c9-b177-47b9-8a1b-2d1e1bb84efc", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829846, "uuid": "518a516f-18bf-4c7b-a7b7-f59dec50bd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829846, "uuid": "75c6d3dc-0e45-410b-948a-13cfc9bac9e5", "value": "E6042BB173A230CC8B25F3D2D34D037D7A5AFC687E3BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dc9563-efd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683793855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793855, "uuid": "e57b5736-f9fa-471a-9716-e153989dedb2", "comment": "Malware payload (Mirai)", "value": "5e049ed7c60e7e05104d1d654161d868", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793855, "uuid": "12ce5a6c-fa6e-44f8-a9b6-e7f5d0233e0a", "comment": "Malware payload (Mirai)", "value": "e61207e0bc6e69fd28d17073fb08256bc288be9ce949760dc0758d81447ed2d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793855, "uuid": "715ca8d2-370f-4f51-999b-45508fd9f36e", "comment": "Malware payload (Mirai)", "value": "b92ecbbdd86b5197aef0752bed2bf959803298f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793855, "uuid": "d398058e-aeb4-4aee-88ed-e574afded55f", "comment": "Malware payload (Mirai)", "value": "45d1c7ae2075018137f5027b7a179e69cd4079afb0f3a392a5b3e7cac47d03e7d9bcc20f497be30742c917d6e784ba53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793855, "uuid": "bd248337-c580-4a8e-bd2c-a1d8747e4a93", "value": "T1D2C2CE2D2211859EC262E3FC92E20FE11CB11F27604BEC593C88D6850F5A9B1F8A3FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793855, "uuid": "0238bfe2-be9a-4fc2-bb9c-3d4dc7e9c2f5", "value": "768:WUnnuN5h5MO30lW1YhtXhWMbOiJgGlzDpbuR1JP:WUnurjMOLYLhWanVJuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793855, "uuid": "932d9fc7-1920-4e13-b0bf-e00a3da643c6", "value": 27080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793855, "uuid": "53fe411f-480e-4666-a42d-3eb9c4d8b15b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793855, "uuid": "3dc17993-7444-43bf-bf31-e652d615813d", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298766.32725.20286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679c4ae9-f03c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683837774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837774, "uuid": "e124f21e-4c08-41e4-8b88-9f16b51146b5", "comment": "Malware payload (RedLineStealer)", "value": "75ed3f6753ebb051d271bb513f50539f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837774, "uuid": "e649373b-9138-4ecf-9353-5868da4764c9", "comment": "Malware payload (RedLineStealer)", "value": "e7fca093b926acba3bc60a2d4079925f30e4e220fc2244847cb4e9ab480da59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837774, "uuid": "e3d7aa74-34b0-4b85-a716-8ace787436dc", "comment": "Malware payload (RedLineStealer)", "value": "13f708dcd72e22162ed2cbdccaa9ceb430685284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837774, "uuid": "b2c3bef2-9e51-4a70-bf28-b90a07edc4af", "comment": "Malware payload (RedLineStealer)", "value": "b87cc8f8bd31c361782b0f5f89f82e69f899dfbdf701ec286da94b7de719574a3ea3f94d0f192cd6e0d4b08677102e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837774, "uuid": "d97f8d8e-1e6b-4956-8be8-fd59dafbe30e", "value": "T10B73F79D325072DEC497C431CE996D74EAA07877930F5213A1A31AAE9E5D887DF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837774, "uuid": "b0d0b12a-b1d4-4b24-9e70-adaa08d4004f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837774, "uuid": "ff3103f8-93ff-49b6-b22f-bb739f232121", "value": "1536:3YlRJYrt63BqeuERYH5qW6FpDsYabKWd+zimd90+E:36Let63BgHhM+bKWd+zimI+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837774, "uuid": "784c488c-bc77-4725-85e9-82122e5633da", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837774, "uuid": "ca8ee37e-0993-4217-97e4-f2ff017451c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837774, "uuid": "4d09d525-31a6-4a6c-8193-6563a5a9f0f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c871f64-efe6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683800819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683800819, "uuid": "5df9f77a-bdca-4bb9-82bd-b9b9753e1b8a", "comment": "Malware payload", "value": "af613de3027041ff1d357d45fe02681b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683800819, "uuid": "f51b3ee9-ba1f-4333-a763-3c4c5370c9c0", "comment": "Malware payload", "value": "e818cdd24707acc4f083327b32d2d7f1f90c1924b9640f4099b8159368c93a6b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683800819, "uuid": "0d9240c6-9f7a-4872-a047-27b70f2f921b", "comment": "Malware payload", "value": "413ec230bca921e88f841f975fe35b140fa96eb8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683800819, "uuid": "d656f391-cb9e-4218-922b-63ccfb8e5c45", "comment": "Malware payload", "value": "dc2a3fe83018cd06e16d18ca579a5a9679dc7f9a26aa3cde173bbfc7d12b76910edc1a55f511f9fd86802d01efa56912", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683800819, "uuid": "d35d5309-f05a-480d-8008-1f2860a2e73a", "value": "T187E5724562C0B8849747AEBF7B1BB1E9E46A3CD862840547F259F8D8F5B4307F9E1A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683800819, "uuid": "4ddc2003-8a5b-4fc3-adeb-8f0b7a020d1c", "value": "24576:Mhke5EY5AlM821+0lQtDdYz+c/CC6g6wtrMzDtIeXhTmMN:O/EY5Aq8xvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683800819, "uuid": "f860a32f-7401-4a8f-837e-7710a415d3a6", "value": 3227648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683800819, "uuid": "8662dd91-ba99-499e-92df-ceb2381cf4c4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683800819, "uuid": "e179d23d-dbe5-409d-b4de-cd72b9e942f0", "value": "RTC-MAIO.649-LS.46.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1488e25a-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683829474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829474, "uuid": "312037bc-786b-4101-af31-915d554f7480", "comment": "Malware payload (Mirai)", "value": "73941efa85a5c6b4b8b0d582a18f51c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829474, "uuid": "50eab6a0-6fba-4bfd-9890-f5dd7691a7c6", "comment": "Malware payload (Mirai)", "value": "e82c9a3ce602e85c75e397bb3723cfeb204ba62ad07bf7c344b9476fd2372b43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829474, "uuid": "2895ce63-38b6-43c8-8cf7-5a258837d771", "comment": "Malware payload (Mirai)", "value": "b3f9f8779acec3778733e91eb901b4a8f55050f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829474, "uuid": "62aacb29-b623-40c3-9750-73ce17308a21", "comment": "Malware payload (Mirai)", "value": "c9f7fde4e12b99b3c13ea507c6184849a65b510c35994c9448d7027035233456059dc952a019f2e6430ddbb268cf87bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829474, "uuid": "a451623a-2e5b-49fd-a2b8-ea79937dae22", "value": "T192A3F89AF800DF77F40AE67604D34B24B670BBE14F532622731739A6AE762D52823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829474, "uuid": "156a4f24-a686-4580-a853-5cfea369eb4f", "value": "3072:Vgdr2vIBAxMyAOLRcftlhmuxVqDr78fz1e:Vgdr2vIRyAYcnhmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829474, "uuid": "c164cc9c-47fe-4d1b-8c6d-7db63d2e420c", "value": 98916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829474, "uuid": "34a9c58e-159b-478a-b4c4-80fcdee8380d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829474, "uuid": "aabc3fd7-909d-4b67-87ae-a6d8780a52d9", "value": "73941efa85a5c6b4b8b0d582a18f51c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee3961e-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1683830082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830082, "uuid": "747cb8b6-0c1e-4b19-910b-ef00ad498db5", "comment": "Malware payload (ArkeiStealer)", "value": "6d236e9e66badd330cbf2982fe0bf9fb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830082, "uuid": "a9de0620-8035-4696-aa1c-44ae84da0c2f", "comment": "Malware payload (ArkeiStealer)", "value": "e8324602f5fe73ef4f3d40d6dccea2e532e5f72a65d5dfd6a8916c628dfde5ed", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830082, "uuid": "425080fc-ee12-4976-b58b-21999e689fb9", "comment": "Malware payload (ArkeiStealer)", "value": "2f275a5f83d8807ec0321e1e9b667271db34903f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830082, "uuid": "2fd2a5d3-7dba-4548-80c5-fde636e1b68a", "comment": "Malware payload (ArkeiStealer)", "value": "9eac5a5fae070575d726c8062866e23f08ca4e7c8bea8bb401b4c162c71039fa3c20fd2a0081bb7b98d6730d5c9f6ba6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830082, "uuid": "8dddfff2-45c7-4c68-91c5-55c83c489234", "value": "T142747C24B700F036E9A200FA9E6DD776043C6930171599C7F3D46ABA6DB01F2A7B578B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830082, "uuid": "358e00e0-5458-4c80-b683-0acda40a57a4", "value": "4897e1eeaae4c1751d91ca9b21915d51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830082, "uuid": "9bda5d67-a8ad-425e-8665-96384b39b0d4", "value": "6144:Lua5z4XeLqMVc2Uc1ax/QfTyuAlHKdlJP0K8ah6wu2Ai0qvF:LV5z4XPMPA/QryvodlJP0K8TOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830082, "uuid": "f9078e83-40ef-446d-a01e-d56558bb182b", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830082, "uuid": "b511bfba-44fe-47bd-a96a-a363ccac63be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830082, "uuid": "5f0fe658-5660-4b9a-961c-150dd5c8a6b7", "value": "6d236e9e66badd330cbf2982fe0bf9fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0e7d12-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683837080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837080, "uuid": "cac22875-1226-4af0-9cf1-92e444d95c75", "comment": "Malware payload (Amadey)", "value": "11574ccafb7bed5ff2420a0f8a1cd44d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837080, "uuid": "4a237762-ea46-41a3-bf11-2d269a30e951", "comment": "Malware payload (Amadey)", "value": "ea2435b5c737a2a761ac03b9be4c1d0a2410c23abedda82bdef691c72cacdb24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837080, "uuid": "82374458-3bdb-4a15-a0f4-14ef3a779e25", "comment": "Malware payload (Amadey)", "value": "f9bdde02ca6c0775b5fcc13bb717def8d4860b22", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837080, "uuid": "f914b5bb-a5a1-4785-9e4a-1c9d6571a152", "comment": "Malware payload (Amadey)", "value": "fa9a8e7fec453b3891a6f830565e4deead8875a8e597e503da076ed55e7502310a767f5368e4b942d112f921579ae099", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837080, "uuid": "830c8975-241b-4584-9430-38e7640eb352", "value": "T11A252352ABD41422EA744BB15CF603430B35BDA29D7A437B6F92E95B0C337819970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837080, "uuid": "74bc2491-5ecd-4008-9b37-f0111de5b67c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837080, "uuid": "7d52bbf6-6210-4bec-8317-514a04a2832d", "value": "24576:dy2KQNbKXq3+BgWRxv+TeE3FIQuibiKMW3nHx:4IbAqOmWRxvgeOIQuiuKM0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837080, "uuid": "91b3bbb6-bd7f-4384-bac1-1c0874acc733", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837080, "uuid": "460233e1-9d8d-440f-901d-f9ac8ee45907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837080, "uuid": "5e908e6b-3cd9-4d5a-93eb-2ef7a513b805", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76daca2-eff5-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683807467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807467, "uuid": "ec53b8b7-2d18-4d12-9ea5-feb0b1810f92", "comment": "Malware payload", "value": "40440ade44d16b4c1f2de198e2bb8682", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807467, "uuid": "e9b1475f-b637-4f98-9582-7554c68f0087", "comment": "Malware payload", "value": "ea5a5dd9b89a9238faa52829c10f8cd38ccf01150928a6f24b06c79fa926d83f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807467, "uuid": "e2764c72-f21a-4f14-a460-967b86785fa1", "comment": "Malware payload", "value": "a2e92a74905f2d8406a1e9aebc47d7c52e37eab7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683807467, "uuid": "98a4484b-ef72-45af-9dd1-6be8ac08f958", "comment": "Malware payload", "value": "ad0dbe340da7c2ca29def0935c516d95a006ff8811bcc60b7ec2e0a0c524a0f80c91a29a7769267a1f6480d6a467e33f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807467, "uuid": "7fd10535-e192-46b4-8ed9-6b652c083058", "value": "T1D295322C2DA40437D2AFDEB2BDC065CAA67951E3F50AAB161C8E43145B43583FEC71AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807467, "uuid": "36fb4943-1635-4c42-9950-ede866c9337f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807467, "uuid": "bc071c92-410a-4ad1-a761-dfcf42772194", "value": "24576:28w2G6Cj60yD3o/4T3k+gaW44ZkNZHvmyCn4nweia:Jwx6CGm4TNZHvmH4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683807467, "uuid": "bdd2f250-637c-4838-805f-7c2ef78fe8e4", "value": 2048032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683807467, "uuid": "76135710-9d01-482d-adb4-a7aa77e15e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683807467, "uuid": "c0e50ef8-edf0-4ca8-a9b6-87dcc2eb5342", "value": "shampoo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e342d0ee-efcc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683789878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789878, "uuid": "af5f4c70-a229-42a1-bdbf-10ca110776fe", "comment": "Malware payload (AgentTesla)", "value": "eedab4f7b05e7bbeaa7544f375429b34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789878, "uuid": "7d8b958e-86da-4470-8ad0-05d35f5bfca6", "comment": "Malware payload (AgentTesla)", "value": "ea5d05e0b638ccc55cf1c7d641e6ca67ceb79ac5e4be6ed178402cad263efc7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789878, "uuid": "984d870a-9623-4f0a-82ba-dcdb454cde08", "comment": "Malware payload (AgentTesla)", "value": "a9260d332418ab1f387367a62298386df85971c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683789878, "uuid": "27660932-2d1c-4411-92f2-21a8feaea9d4", "comment": "Malware payload (AgentTesla)", "value": "382a1d5e945322300fa5ae4e8c971456d7a2bd139970cac56f1f37636977acde4542dff5527ce7babaefde45974fef97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789878, "uuid": "fb745236-d449-44de-928d-d20599ac8cc0", "value": "T1FFE4E085433BBDE1DA541B70365438534F2DE11678F8B0FCBD5BB888CC9A9119BE8B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789878, "uuid": "d529859f-509c-441b-9c59-4567d4a4324d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789878, "uuid": "943f3808-2812-4806-a275-d4561df26cce", "value": "12288:QpmZ6VrKIhQBi50HAJo8JA0o5ZMZ1hVI6wVubK6qrDHKAQfvBUCHnCF:gmZ6VnBcArA0o5mZ1L/KJfHAX22Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683789878, "uuid": "b8aa71db-4720-4e91-a14d-d1ac1acc5862", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683789878, "uuid": "2c86858a-5a35-4c86-9fb7-3875d58c05c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683789878, "uuid": "2e5ba6c4-a912-4946-84f1-8607a0147ce0", "value": "advance payment invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16fdd77-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683830247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830247, "uuid": "db988b65-e035-47ce-9d02-a690df445123", "comment": "Malware payload (Loki)", "value": "12c7083311f5879b61983dd862c39226", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830247, "uuid": "748a620e-5db3-4f7a-ae75-371e21594602", "comment": "Malware payload (Loki)", "value": "eaa8a73c4ee0873e44b10a7b98cf56fbdcee2708db095a3cf7c692cba31a0176", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830247, "uuid": "5e30c1af-ce77-4464-9f8e-0c08fd212229", "comment": "Malware payload (Loki)", "value": "a910abe80a61692f97c957676ced8131f231a42d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830247, "uuid": "39b6f1df-d118-42dc-bc47-f0f7e796bac0", "comment": "Malware payload (Loki)", "value": "ae6b16abef568546f3318187be2aaac5b3d4e205214bc029704e06ad70540e2b9a79f6b1c08172164973ad61e0eef9ee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830247, "uuid": "80c0229f-c529-4f76-ae50-349f46da90bb", "value": "T1D5F24C5EE79B02658F511376131B0E89A6BDB63EF35054B178AC833433EDC3906666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830247, "uuid": "130153ba-bf14-48d2-80f9-c94bffa6e10c", "value": "768:cFx0XaIsnPRIa4fwJMu7I/xF2JlX8bjCktPjEBjn1M2DmRzfV:cf0Xvx3EMuZlsbjh8nS86B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830247, "uuid": "0412d5fe-d2e6-49de-b5f5-0d9da8c30897", "value": 37037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830247, "uuid": "633316b8-c809-4e8e-824e-d1ac070791d1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830247, "uuid": "bbfa439c-7e0f-42af-82a1-97a74b782ace", "value": "Re Invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96593ba-f039-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683836676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836676, "uuid": "8e0a5f46-64fb-46c7-adfa-c8be439a4c62", "comment": "Malware payload", "value": "499c5aa1b21e9029f76bc57de37907ad", "object_relation": "md5", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836676, "uuid": "75974199-b205-485c-816d-79f1b2ea53da", "comment": "Malware payload", "value": "eacce5121ddb3922e6234a3210e9e291028d0520e1ceb7e325d3a093917eb228", "object_relation": "sha256", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836676, "uuid": "eb8bfc8c-c022-48af-ad0d-31618cbd36d3", "comment": "Malware payload", "value": "a2552f2bc1f7d10eb409e864d15065ff1cab94b9", "object_relation": "sha1", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836676, "uuid": "9c3f4d08-d108-45b7-a5cf-2ee52925f429", "comment": "Malware payload", "value": "c6e9bb35ce8e4b4adc18da2f41f05fa50c868e38da9b446f84f11a424b83d1d06b7f0d3e95cc776656bc5fc602acdbcd", "object_relation": "sha3-384", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836676, "uuid": "97dbebcc-6e8f-4aa1-8f76-153f1ec3cb5a", "value": "T119C27F2B390AE0198944B6A4CB3FB59EF748D08792D46D5CB4FF40E66741DC3B06DB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836676, "uuid": "5e1df081-c735-433f-b708-5ee9ba09fba1", "value": "384:0omL5IjEZiZryAOENuPuOJsYTQpLuLpDq7QYfLGMV+jasHHLgLxLJsYTgV+L0py/:0nmNu2OJsYTBJcJsYTtz9aF4GC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683836676, "uuid": "13d37000-063e-4c24-9c2a-358708887184", "value": 27722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683836676, "uuid": "550f989e-5268-4ba7-b2ab-224e5d49104b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836676, "uuid": "a98288bd-2e29-4024-888e-b63ce6948c29", "value": "Loveware.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2675e0-efc8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683787826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787826, "uuid": "17bc7fc6-9c21-4b7c-a11e-834a3593607e", "comment": "Malware payload (RedLineStealer)", "value": "7377adb808a5fe8e16319c8eda6ae66d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787826, "uuid": "6f862f78-9e07-4777-8b14-ae37d4444b0b", "comment": "Malware payload (RedLineStealer)", "value": "ebea38805402b3b2c00fceda76faaf4ecb36dac826fc08d489e0299830a13ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787826, "uuid": "85fde457-8d06-43c3-ba01-dbfe220f573c", "comment": "Malware payload (RedLineStealer)", "value": "e006132abf8794dcb4e14d2e4dc07e3114fbd8e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683787826, "uuid": "3b059142-22a1-499b-a2d7-90e6cd94330c", "comment": "Malware payload (RedLineStealer)", "value": "494ccb9cb9eb6100f81c1a8611611937f2b4a3445a6cd30809f2fb950f389b7b946eb4700ea192cd03a1f794df4bbc68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787826, "uuid": "caecc1a3-8052-4dd0-a8b9-af3d21527e6e", "value": "T17EF41253DAE8A033F5AA277144F607E30A39BDA15D74476F1784986B0CA33C4B93276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787826, "uuid": "c823c83e-0d61-4157-b1f1-5ceedf3d5b7f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787826, "uuid": "e93e803e-9378-4170-bf41-e31670cb93d6", "value": "12288:fMrMy90VLo5Vuth7h41UxqKLphT5Kg9azwmrRpimhEWImmb9kG/CvfZMZQ:nyZjuPXzBg0m78WqbiG/AZYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683787826, "uuid": "5ea7d8d5-6d5b-4de4-9f21-f778378f6f78", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683787826, "uuid": "c003df2b-eca9-4f6f-95f4-e63aecd1860f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683787826, "uuid": "51d7dfbe-a198-4b99-ac14-3437a50a8a6f", "value": "7377adb808a5fe8e16319c8eda6ae66d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fcdb04-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683837072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837072, "uuid": "abe24fb2-3c86-47a3-b61a-b91c203a88db", "comment": "Malware payload", "value": "648ac6c91dd5dd9ab924026518d112bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837072, "uuid": "c7c311cf-8fb6-420e-b7e5-c1f2092d2351", "comment": "Malware payload", "value": "ec790bc671a501b9b0503c15a6fd1c24a94374fd666dc1d74cc132d1388ff472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837072, "uuid": "f88a1669-9a8a-4c01-805b-ba440a6ce6cb", "comment": "Malware payload", "value": "554ce14e642d25919d2f2337bacc9825b513ecca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837072, "uuid": "2e0b6b21-c8ce-4dca-adf9-abd9cc246da9", "comment": "Malware payload", "value": "98cf61fa8504cb9e17c7b04236c4a90c88e070ae1a06dd239ce5ea457d36c96a39eb2686e9909dc3b7b21c5c16dc5677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837072, "uuid": "b3a93894-47d4-418b-b4bd-3c0539fdd9d7", "value": "T1C6E4DF88523BBFE2D96517F0221434420B7DA11A75F8F0BC6D6BB4C9C89AF118BD4B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837072, "uuid": "3feb853c-d768-4990-84cd-783d48b69410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837072, "uuid": "b4ec879d-03ef-46ef-88ee-fcfcee63e45a", "value": "12288:bqUWmrN9IzfmpkjUaHUEa8ZkwCYOcJPMsjIfNEcuFTglPpiSq4Kz:zWmLOm+jUaHbTZbQcJrjyNEzCbq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837072, "uuid": "f2978049-2b5c-400f-a702-3e1bc44b33f3", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837072, "uuid": "d3d58b06-bd9e-4d21-85d5-7a62ce802a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837072, "uuid": "c3bee0e0-0be0-4ce0-bf78-437c1312dfb0", "value": "Download Tracking. Reference.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1b3542-efd6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683793808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793808, "uuid": "34c9ea5e-10e4-492f-ab91-8dcfda69779e", "comment": "Malware payload (RedLineStealer)", "value": "7970de1dcf66dff399befd012521bcd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793808, "uuid": "bc15c479-dcc1-464c-8240-e0c986bb82dd", "comment": "Malware payload (RedLineStealer)", "value": "ed79b6198efd98d91026646c56cb7c9eaac381e310a05e63d4c8926393815ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793808, "uuid": "45df8b34-1a84-4f9d-a815-d9e9b9f54006", "comment": "Malware payload (RedLineStealer)", "value": "608a1957ba97441b9596732b2d00036e385b38ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683793808, "uuid": "e26717ff-9ef1-4c72-8516-82c53fab8a76", "comment": "Malware payload (RedLineStealer)", "value": "406c7ab3fdc4690de12e934b24f23b08827a9230a21c98222357d1d5d7c0d91e90ea0495095636a5259477e04be95490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793808, "uuid": "dd5bbab6-9161-4c10-9674-6798ec17cd0d", "value": "T1D8846D2393A17C54E9274B72AE2EC6EC371EF3504F59776626189E2F05B02B2C173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793808, "uuid": "e92736f0-dbfd-4443-bac1-e87f1660e15b", "value": "dac3c11d45819b7994d02cd08167cb44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793808, "uuid": "ff03e007-9a6e-405d-a6f9-662126166fc2", "value": "6144:FbpzO3LduTTDKtq7BqkyRC+lWAeis9hbM6zxoaQQ/7:RAJuTTtnyI+Ez/bM6zbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683793808, "uuid": "2d3ccd71-9af6-48be-aaa3-1dced1ed9aab", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683793808, "uuid": "a3f92b48-0cf1-46e5-96df-fff763b84781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683793808, "uuid": "67c73f8f-218e-49f1-b8ab-25576b9c49bc", "value": "7970de1dcf66dff399befd012521bcd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37539294-efb3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683778852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778852, "uuid": "90483d0f-7d74-4a3e-b254-600901a82d80", "comment": "Malware payload (njrat)", "value": "2fe286b05e80df1ac84f099920f102dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778852, "uuid": "b3360a6e-a804-4719-9454-0cf002745e4b", "comment": "Malware payload (njrat)", "value": "eda5780bb6af8ba7c65ddaf53892dbc594436ac573d5e366239a200dbb3f04f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778852, "uuid": "44762325-2fd5-49d4-a99e-8ab0116f5575", "comment": "Malware payload (njrat)", "value": "cd5c4c49b42b7a5ae4f6e9d60bd34403e43eead7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683778852, "uuid": "ea57a928-08ac-483f-a9b3-6f6d3eb9c898", "comment": "Malware payload (njrat)", "value": "f2ae868b40a4779f2d73b95d47a60f45e0c33357fd1b3c3a9490b6eb25545adac1600cf34d015e0c6ed309efbc1772b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778852, "uuid": "173a68b6-266c-4c8c-a0c6-a2fc9f0d0ac3", "value": "T1DC032B4D7FE181A8C5FD157B05B2D41207BAE04F6E23D90E8EE564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778852, "uuid": "072030fb-91d3-4379-bbdf-dc0c98d1008e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778852, "uuid": "6b66e4da-e66b-4f98-a0b4-a174f1eb31f5", "value": "384:ZZhxgswi+/x3+j/NSyszemoHfm3Wwr3rAF+rMRTyN/0L+EcoinblneHQM3epzXRW:jh2RCNhszemoOGwzrM+rMRa8NuT0jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683778852, "uuid": "e4cbe996-1bc5-4604-9af4-34556fa7e18c", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683778852, "uuid": "aeb42713-f1bf-4a13-9002-8742d1a77edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683778852, "uuid": "87a3fbcf-dae2-41ca-994d-ced5fc813c1c", "value": "2fe286b05e80df1ac84f099920f102dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cd9762-f00c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683817227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817227, "uuid": "39edec9f-42df-44dd-825d-132da1aca810", "comment": "Malware payload (RedLineStealer)", "value": "ead5f1781bc32c8665c8c3b46e8e6b7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817227, "uuid": "9a353d4b-8d80-40db-9678-3d8f295e3aa5", "comment": "Malware payload (RedLineStealer)", "value": "edc300934c276b96ad1e2b338b57de9c352a8da6cee4910974bc9a535630b9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817227, "uuid": "dbd03f22-de73-4458-b739-b1647f1cbea0", "comment": "Malware payload (RedLineStealer)", "value": "9da84caaafa3d2e6cd676b6f19189855937eb369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817227, "uuid": "1290f03f-aa53-4f50-b929-4026b97a031b", "comment": "Malware payload (RedLineStealer)", "value": "8199833f2e30b01c25a4ac20218e4045acc44b4db18b4c4f4f987de130314dd600c006cb3fb4333e665b114743dec0b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817227, "uuid": "42f47493-896a-45a0-b64a-cf79c1d42730", "value": "T174F42392D3E48463D9B52B7418FB07C31A3ABCE11C7582273795BC4B8CB26887936767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817227, "uuid": "15ce113e-a0bf-42f4-96f9-272a8cc2a079", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817227, "uuid": "e0b12b0d-837c-46c5-9d1d-9ed720f6c133", "value": "12288:sMr8y9049Gr8dkdSxCGvdI4CMAxpK/haHSK7P9CwO3pr9PRLp:4yf9GzuvSNMGK/haHpP9Cn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683817227, "uuid": "eb860746-8b59-4ed2-a494-a527e666b031", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683817227, "uuid": "2f44ec9f-e8fd-48dd-aadc-1d894910bc2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817227, "uuid": "2f0a5722-0a23-4a7f-b919-08ee776ea28f", "value": "ead5f1781bc32c8665c8c3b46e8e6b7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af46b80-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784522, "uuid": "3d8e3462-7a98-4226-9121-4c91b784297e", "comment": "Malware payload (Mirai)", "value": "511f7a6f5deaab17592731c6910c487f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784522, "uuid": "4f12bdde-cb15-4b3a-afd8-7a982c9aa9eb", "comment": "Malware payload (Mirai)", "value": "efc0b999a10ae030d660640eb8a0cb3ee13e96a7a75631204108f13a20224a46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784522, "uuid": "82c60718-d068-45b2-8522-44171c255ed3", "comment": "Malware payload (Mirai)", "value": "d3ea7a5c020294eb33aa04c4d8ffedb2557de28d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784522, "uuid": "eaa9e0eb-848a-4c98-a2af-95aa70c01670", "comment": "Malware payload (Mirai)", "value": "e9ea145a7094d4a2faea234289652365cfce597e3c74f60326dfdeb54be3e70a9a8550f053f309a52c3e9314f019b8b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784522, "uuid": "e9a91126-2a74-4ef5-ba7a-f822e0fb3243", "value": "T13282DF3061AB75F4DBE14430EAAECEC2971A0BF9D1FC36D217586B788A4210650F96CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784522, "uuid": "678654ba-469d-4522-a723-ec88fe2dbb06", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMauhymdGUop5h5lq:6/V0P6+kom0tVAoNvm+to1us3Uoznlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784522, "uuid": "5d1292f2-9abb-4f6e-8ac2-1cd1a31a5def", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784522, "uuid": "6483583e-3779-4591-89f7-b1117134cb89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784522, "uuid": "f1ade287-4902-4af9-82f2-e4a2b0ce773d", "value": "511f7a6f5deaab17592731c6910c487f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aedf764-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829888, "uuid": "fd2ab3ed-1eef-451f-93cd-bf200c8f8525", "comment": "Malware payload (SnakeKeylogger)", "value": "0464f146bde0f62ae86eb55c342cec44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829888, "uuid": "addad1ec-550c-461f-8c4c-1ab5e160459e", "comment": "Malware payload (SnakeKeylogger)", "value": "efe80cf748bd25110797151a16a29b956213cc00a85716dae6e6008d648725dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829888, "uuid": "93fc28c8-996c-44e0-96d5-e9c89d460d35", "comment": "Malware payload (SnakeKeylogger)", "value": "3a61bcf15526985dc73a11ce3eab27cdd7f813e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829888, "uuid": "4fbc23a3-93bf-45ba-9ba5-50c5dab78e33", "comment": "Malware payload (SnakeKeylogger)", "value": "b573df88eb1a2ed900aefc93b31ab610e6c20d916c891151890c511c7f7af397965676091723fbdd3ca63268666f96f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829888, "uuid": "e7a1099e-a885-4b1b-a604-d2519c7a2cf2", "value": "T1C8058B3C61DA5C22C71677FA8999C5E103356F10AFABD26A25BE30CC89B1B93ED4150F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829888, "uuid": "74511ef0-32e3-4fc4-8014-6253ec65668e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829888, "uuid": "27c5e771-37d4-463a-aed3-345fe98f4460", "value": "12288:3/HtT7lpZfOtXy/tSKY/4ifpVAYV7rqD:3PtThrqXGY/4kpeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829888, "uuid": "ea8b5a3b-13e3-4ec3-8ff0-9dc6bce8c1b8", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829888, "uuid": "17507f97-8d4d-4cda-8a0e-b4e50f6ac80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829888, "uuid": "ccf3df41-0ab0-44c7-ab2e-f9eb0da017af", "value": "Tx2hWcH89AE9nWx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cf7ee2-f037-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1683835833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835833, "uuid": "4aa6f2f0-15b9-4f27-86c5-dbee6c6061e1", "comment": "Malware payload (ArkeiStealer)", "value": "26a8ddd47b7f67df77bd282256fd8293", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835833, "uuid": "3a7ecffb-7b89-4b2a-b93a-1ef0628e8cb7", "comment": "Malware payload (ArkeiStealer)", "value": "f01608538a93b5fe39be148c9935775d8a12122fe04612bc609e0ebd9e7ee4a8", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835833, "uuid": "630c5a7d-c810-4f6a-83df-4bf766bdcee9", "comment": "Malware payload (ArkeiStealer)", "value": "67718b275a7b80ed03cc340932746791e30f0fcd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683835833, "uuid": "cee04349-3a03-4eff-9cea-460b33af38da", "comment": "Malware payload (ArkeiStealer)", "value": "0a5427efcf7cbed16dfc34452373b4d81c2f2a71f517b5440403de61b13f4b352c3cf64d1db78c0d0178144865ee95a2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835833, "uuid": "21c882a6-e581-4bd2-b9d9-9184655117a8", "value": "T1AF2623A7919401C8D4F5893D8927BDA472F70E67CB81983965EFB8C12933EE2D723643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835833, "uuid": "3b344139-338d-4741-8134-ddc68818a9a5", "value": "f8b7bbf9d430a2bfb9c440a3cf35d684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835833, "uuid": "ea458b94-06ff-4db4-898c-cd7a2f7d2e2f", "value": "98304:rkQtvLyqjmYKwmkdB0FshzRQ8wFFeiEObGkc6lmMWjcSlWL:rkEyM30F6pvObGW+cLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683835833, "uuid": "1e3d10ba-ec56-45a6-91f6-cef9d6a71434", "value": 4677680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683835833, "uuid": "de8c3265-6d56-4c17-ba1e-71532e31561f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683835833, "uuid": "5b3a56ec-ee2d-4b95-b4d2-d5f5079bf884", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf18d11-eff7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683808391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808391, "uuid": "0b05c1d0-f146-4800-93fe-4da959081b12", "comment": "Malware payload (GuLoader)", "value": "8601c8a8fbfe8401986c5ec6052ee4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808391, "uuid": "36ddde99-0fb4-48f2-b700-9ccf9ffaf53c", "comment": "Malware payload (GuLoader)", "value": "f02d9e1fdf4826972b2f04a91f3a62ac9257a5195494c1bf7460b94eec1aeb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808391, "uuid": "b4ed957e-dbc9-4652-9e6f-145c8434feb5", "comment": "Malware payload (GuLoader)", "value": "95b0f33d1a931b6ad672aff2b3fbb96c930e2e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683808391, "uuid": "a00de485-fbc4-4b00-9ab3-059940209790", "comment": "Malware payload (GuLoader)", "value": "4f45f18f410114aa5dee440bb51b498789e352c311bad231e3e26adcf5dcd72bf00141ed7e9c47f010e9105f59724d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808391, "uuid": "ee1b7e82-a32e-4b17-be85-fed8905b0f4c", "value": "T120F302D167E1587BD68BCA3009A7BA71F77DAC15991429CB7724FF6F2730082C52A283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808391, "uuid": "d8a8f5f4-612a-4a6e-ae6f-22ea2e88ed25", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808391, "uuid": "c92c30a3-dac4-4182-b9d0-83114272a5a2", "value": "3072:EwJ52Y7ZoH5XJaqKz8HIoLmMudi3a/6HP/uePXyEi38+H22zJCLIz7Q9wA/:EwHysqKzL8oi3a/6HOeKZsk22zo0z7Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683808391, "uuid": "5c27aeb4-fb1f-43dd-873e-43181330d8fc", "value": 172171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683808391, "uuid": "c7d2d15d-d149-4047-984d-bc2343419694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683808391, "uuid": "c8ba9793-902f-4056-a156-aff2379750b6", "value": "DOC-INV00789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf01838-f025-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683828035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828035, "uuid": "f7482cdc-72a9-4ce3-9893-4c24387db5a5", "comment": "Malware payload (RedLineStealer)", "value": "b9d9cff04d47f14708336d98b495a995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828035, "uuid": "988d6672-e846-4836-9bab-44f17bfc99b7", "comment": "Malware payload (RedLineStealer)", "value": "f080262d4ed0e5116ac26d9edef8787e8bd6c7ef73e023b69e386c25e1185c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828035, "uuid": "3946c0dc-a681-474c-94e0-9094e65cff47", "comment": "Malware payload (RedLineStealer)", "value": "1add50d1593ea6b88abd85ad975e70ccbc7f6069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683828035, "uuid": "2d0678ab-dadc-433e-a123-88a9f4e99bf9", "comment": "Malware payload (RedLineStealer)", "value": "9e34ba533db03be0df7d45c4560a48d6138000ed787b9fa780f9099f6b4142f7465a087b76e0a7c64c3968798e67fe51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828035, "uuid": "331bbbce-66b0-40df-a471-1cf9a43b2be3", "value": "T15BF412066BDC9473ECBD57B084F30383073A7DA2997447AB27599D5A18B3250A932B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828035, "uuid": "27e8d601-4ddb-4b4a-a99f-e1f417b45cd5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828035, "uuid": "e132428b-8872-45f5-97a5-9df9afb53aa1", "value": "12288:mMrWy90BK3ZpksoEMIL0e0cpekaqKoOSnaYhwE+z6qlNiKaGKC1Y9cnA:AyDCEMIYe020SnaYu3lNixG8mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683828035, "uuid": "55b76c9b-937b-4201-995f-dc3f9ed074e1", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683828035, "uuid": "5b6e7870-4315-4bb4-9378-0dda12c621b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683828035, "uuid": "92baab98-4166-4aea-bb17-5c90ffa87c72", "value": "b9d9cff04d47f14708336d98b495a995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ba051d-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683830067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830067, "uuid": "7806cac2-5a2e-4345-ae87-22f8299096a2", "comment": "Malware payload (AsyncRAT)", "value": "731288ec76b58bae03242bb1b908f1bc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830067, "uuid": "b6586ed8-8732-48ae-a9f5-47de72ad8f84", "comment": "Malware payload (AsyncRAT)", "value": "f3412ddcb057b04761d36b9b110db887a12d0af91cea82f7004295a92c004b16", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830067, "uuid": "8bde627d-1f34-4e4b-bd8e-dbc31249b5e6", "comment": "Malware payload (AsyncRAT)", "value": "ddbc9d7c5bb40ad254d5e267ac0a5e1ea494c843", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830067, "uuid": "d1f4034a-05ea-4915-b732-dafb8714523c", "comment": "Malware payload (AsyncRAT)", "value": "7f326231e664f809153c55d722d80f3b17a4f1524d4a487d65e16be8e23327ac3aafb81b426a7f6a43fe48ec53905516", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830067, "uuid": "2ab52c57-5469-478a-9c33-cb821082768c", "value": "T1662794F9E7E347E7F8321A35C652523461323EC5A4E5AEF545C8B62C49302DEE21AD2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830067, "uuid": "68016ce9-d89b-4310-88e9-b61a394329c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830067, "uuid": "03d5d8a6-1f7a-4ec6-94ac-d88cd14c7242", "value": "6144:7fQTkfGlJz/us5e2jKFFRavrXQ1SHbboDr21dP:7fQTkfsJL9aS7sfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830067, "uuid": "dd2da858-cf08-4f2d-a079-4d8aff05c924", "value": 20947424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830067, "uuid": "6bdd8181-a7f3-4411-b984-489114c3ec8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830067, "uuid": "f19c6565-6057-44c7-be2e-c82fc57fedf2", "value": "731288ec76b58bae03242bb1b908f1bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881ba5e1-efc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683788436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788436, "uuid": "3a697d4f-b111-4542-b965-9a8233ddc955", "comment": "Malware payload (njrat)", "value": "96bd95789e305a696a7d1a5e776b9804", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788436, "uuid": "cf45908e-4f56-4490-bce2-35b35dcf4b07", "comment": "Malware payload (njrat)", "value": "f3adace9b9f1d61d8752f65c0418a49595e347c417a17b14655d838993b74229", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788436, "uuid": "62f773cc-92d4-47b3-adf6-9a55d8b530a7", "comment": "Malware payload (njrat)", "value": "092434938da0b2a19ea7478d873cc6497c8445ed", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788436, "uuid": "5d284e53-3f95-4f78-921d-71c4aeb4bc32", "comment": "Malware payload (njrat)", "value": "225df95d64f6b557f2741ca738e9b31089573a722f37360721af77d808a28b9045cf6d1cfeda80ffef2c9b886eb58432", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788436, "uuid": "07f8cfb5-875e-4cd3-ba67-ece43b16bcc2", "value": "T121839F62A3ED5114F2F33F50BCF955214A3BFEEA9C75C94D42841AAD42A2940DCB2B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788436, "uuid": "1961089d-4c7e-49c4-9eaa-b90c8ee1b0f7", "value": "768:mnHGdUBDCKtfYjE3Luo4+eaWkzBYFPk9Wai2Y:OHGd+CKtfSo4+5zBYFNai2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683788436, "uuid": "340588f5-574c-4f26-8c55-4294efd2ca38", "value": 83704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683788436, "uuid": "716803b1-93bc-431a-b3ef-26f4912d696b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788436, "uuid": "7dd4b838-817d-4c12-9123-a8de2a1d9a5c", "value": "INFORMACION PROCESO DE EMBARGO DIAN ESTADO Y DETALLES RADICADO #2022-000236-996589-9662659-PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75212cc2-efde-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683797424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797424, "uuid": "dfbada4e-63e9-477a-b5d9-2af4b363a5a9", "comment": "Malware payload", "value": "746106eaa684bec69cd7e6a7e706ec85", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797424, "uuid": "8f3d359f-7586-4b65-8518-e4fdd81b7077", "comment": "Malware payload", "value": "f4ad1130a000eef80b3786a74fa4245304dc0e32be32029a58d1f96f4d51a358", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797424, "uuid": "451c8641-f00e-46e8-acac-5bd54ab53864", "comment": "Malware payload", "value": "749adbfaf4830cf658e5e7e0aeeddef2723b0c36", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683797424, "uuid": "e77b2a15-6fdb-43a0-ad68-642959092f4e", "comment": "Malware payload", "value": "87b52ce65ff886e99ec3350a84fc6c388864363f7b7192a643c2235da728596f35aa1a15bda4c4e69a35b43dae9a617c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797424, "uuid": "ddbcf921-65ed-43e1-bbb7-9a6cf866c41f", "value": "T14AB1933B97070CE6CF8C0FF90C57841D672C425641A085318BEA429D0FE6E93F868BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797424, "uuid": "956ecd15-98d3-4ec4-ac91-9c7777873f69", "value": "344afbbe7c4c790e27fd2250fb876b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797424, "uuid": "f2bc5c44-5f1e-4ea0-8fc8-5aa2efbd9d9a", "value": "48:ibHDpPUrytMKTQuXKVTXKgOUXRaR59nIP8g9wb22aEBmn5y:0yrpOoT1BR89nSd226Bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683797424, "uuid": "1adce848-fd3c-4a2c-9877-97cf13192bc7", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683797424, "uuid": "05cd3bd4-8ab6-4a88-bd85-c275753c39bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683797424, "uuid": "3504d0a6-bcea-4f1f-8289-c7c66b5698d3", "value": "SecuriteInfo.com.Win32.RATX-gen.12603.26916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d710ad-f019-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683822631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822631, "uuid": "39a9024a-681a-4800-8254-3c3781ff1724", "comment": "Malware payload (RedLineStealer)", "value": "a94fbefb7c242e6515054ff676916ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822631, "uuid": "df42dab4-69db-4d45-820c-57e10b7aa34c", "comment": "Malware payload (RedLineStealer)", "value": "f6156e781add70f932d821aa8ccb59363f9ac868148e0eeeb79c1d19540435de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822631, "uuid": "b866c4c1-8e89-4c74-9aac-bf7874444be4", "comment": "Malware payload (RedLineStealer)", "value": "c75a7eb10e89aa3a1ca93d64fa3141aa36f48b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683822631, "uuid": "7d7aa2b1-4f02-4817-b802-40018fb673fb", "comment": "Malware payload (RedLineStealer)", "value": "26e44916bfa6d8ed5d07afbe00876d88441aff1496e3be872d34127a537a1733ca31d7694d50790b8e61794d9f171046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822631, "uuid": "0c9290c5-544e-4945-9bb8-644b5ac5e8c1", "value": "T1D5152366E2EC4836E8B4777158F61663033FBDA17E3583261799AD860C73780A632367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822631, "uuid": "db771e29-a700-47e2-a800-dcc81c0d64fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822631, "uuid": "cb36b909-31cc-46c2-b20f-e5225c5afe28", "value": "12288:1Mrny90Sq7Qf+BdJ1GwWdf6tilSisFipB8JN/TbmEWbwKTqNTmDrIjreYTK53:+yMuUdiF8kvsGBONhGHum4yYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683822631, "uuid": "27736c2a-a393-4d47-89c9-95c98a8c6f27", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683822631, "uuid": "706ffa13-e9dc-4787-8a24-e246ad6c77cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683822631, "uuid": "ebbcd938-96d6-4bea-9546-b418bfad8dee", "value": "a94fbefb7c242e6515054ff676916ed3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4290447a-f00d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683817526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817526, "uuid": "1a7ca0a6-ee7c-4cdf-9971-6d6064c531ce", "comment": "Malware payload (RedLineStealer)", "value": "524645baf06b8b879211b33aaafdae0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817526, "uuid": "ead63500-c345-444d-94ca-8d21942232f7", "comment": "Malware payload (RedLineStealer)", "value": "f7f243c095defbebffaac067bd9c1f965e506dd54bc515721c854b37b52b72b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817526, "uuid": "5682f76d-4a01-422e-b584-2234d4aa11f8", "comment": "Malware payload (RedLineStealer)", "value": "e8b2a74913c809b12f6890a58edc4f0b06ee7441", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683817526, "uuid": "f0f4385b-e315-42c0-aeaa-c83d75854525", "comment": "Malware payload (RedLineStealer)", "value": "b33614a6aca4c4f261850480cf9245abacccabcee7c7f51829aa5e62fae01b0d13f2a0ae5850287a94f4e2dacc0ff69e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817526, "uuid": "19e785b1-a612-4666-90e6-1e2894056fa2", "value": "T194152213A6D864B2D9781B706CF203D3073ABD615578A36B2B852A5F0C732E4D5327AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817526, "uuid": "e6eae1e6-6c12-42fc-8ac1-c8e031a69870", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817526, "uuid": "17274633-2817-4646-9c30-b3dc14964b7c", "value": "24576:oyrWNEQ6jdUkj638abqZYmJ6E5IPMZ0EZTRY:vaNCpZj6McEMPM2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683817526, "uuid": "489ca1d3-5de9-4ec5-a510-6301d40ec536", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683817526, "uuid": "8516c65d-1ad5-464e-9dfc-020e283b1105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683817526, "uuid": "e292a24a-9d95-4271-b7f4-68fe7fabe1eb", "value": "524645baf06b8b879211b33aaafdae0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8542321-eff9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683809241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683809241, "uuid": "bbc2f555-1b13-45c6-8392-421d7b993381", "comment": "Malware payload (GuLoader)", "value": "4ab4a3d1894572436b1af077779f4051", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683809241, "uuid": "fd6fa2b9-68dc-49b7-a823-84383be0ec09", "comment": "Malware payload (GuLoader)", "value": "f8082dc1210616c55008edc73e1ca4966cd8575e2425ed72f71f28b97f71172a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683809241, "uuid": "2668c082-e67f-4ea1-976c-1009ca2da806", "comment": "Malware payload (GuLoader)", "value": "271cd8521dab65d5a9d127c5296acea983d29512", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683809241, "uuid": "bc75d569-eca8-4a3b-b1eb-85d063d15977", "comment": "Malware payload (GuLoader)", "value": "d5048dbfc8fae6abcc190c9d18612e76dc645d6e5b311c8f9077780a73731c3404b86c0495b6aec9ce6856e86ba44b96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683809241, "uuid": "afeb5c58-9655-4296-a0b5-740c372e7bde", "value": "T1DB64127255B0CCF3DB3362704973996AC9FB585C50A1FB2A0F917E2AA932141EA0F1D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683809241, "uuid": "99e4b59a-2b73-40f8-85c0-74dd3077e14a", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683809241, "uuid": "2ea5e308-2cc9-4c41-b721-09bc3f8e9797", "value": "6144:ex4veXIVOy5YUVFAEhpjyecwKz0CawKMeedSvR:o4GXfg1X1cw40sFPd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683809241, "uuid": "3f4b88b1-6909-42d3-9135-e2a5a89ce8cf", "value": 329795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683809241, "uuid": "e8a35fae-f58c-49d7-aa51-6712335edae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683809241, "uuid": "677d58e1-d60f-4106-9cb9-937be3de57e4", "value": "Understregninger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b03312-f029-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683829830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829830, "uuid": "9939910d-8dc8-485d-880f-f404c7627757", "comment": "Malware payload (SnakeKeylogger)", "value": "55a37ed125fce5ff25d36d777e68d711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829830, "uuid": "61e155be-4225-4257-8903-d7bce5d80007", "comment": "Malware payload (SnakeKeylogger)", "value": "f8361cfd071c7c258b148d194ab3abdea0f5f68c2d0d98f0275c3b335b83d469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829830, "uuid": "fca8ba90-41bf-4273-9677-2615ebad3eb6", "comment": "Malware payload (SnakeKeylogger)", "value": "1dcb2bc63cd0614b17b67e816f4654240eeb7cf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683829830, "uuid": "c86e3f29-dacd-4d0d-a4ef-0a3dab2df5db", "comment": "Malware payload (SnakeKeylogger)", "value": "41c7a7dbb1f08077866dbc3581f915e9de323c13c28d60eb8e3cbd3d9c891a9264d8681846a7f3c1dbe3318f70dabca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829830, "uuid": "657f97cd-61a5-4576-89a5-26642dbc96dd", "value": "T154C4BF44123BAFA2DA6517F0221038524B7DAD1A71B8F0BC6D5778C9C8BBF214BD4B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829830, "uuid": "5bc0b760-db13-4e92-86f5-7e24e51feea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829830, "uuid": "6f0df6d5-53a4-4f99-89ff-63da6631a370", "value": "12288:bqU+m1YqpQhsBAD/s8f9Tbhrn98x92ZuWhr:z+mfpQh/s8lhUuuWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683829830, "uuid": "43bdb549-85c0-4fea-8fcb-5ae1dbd5416f", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683829830, "uuid": "0e2fe58a-8684-4a24-b28f-ba84d1d88760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683829830, "uuid": "c8982cc5-271d-4db4-9c02-e192ec615b67", "value": "2EjiOTNFUbfhunv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52971345-efbe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683783622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783622, "uuid": "1d428353-ada9-437f-84e5-2e504f6cfa47", "comment": "Malware payload (Amadey)", "value": "1bc164aeea101785c49ac77311347ca0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783622, "uuid": "3b23f29c-f64c-45ff-9d0b-9c39ddb017bf", "comment": "Malware payload (Amadey)", "value": "f83eb5d54bdd202e1982d76462c2fa721ddd4acdb6b8e7a4b01a0af6cc12b723", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783622, "uuid": "63b1f808-0dee-4487-a15c-7a5c95c4bc34", "comment": "Malware payload (Amadey)", "value": "967433287e234b1209a638dd0b2e75b75773f8a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683783622, "uuid": "04a4b402-f92c-4054-a934-c9e16ad4c8e1", "comment": "Malware payload (Amadey)", "value": "48f7e6e9577a9fbd9524dc0776b542491a70adf3322147195035744423c307d42c99f50b8f1a00aa532f299837c4331e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783622, "uuid": "c70131b0-470c-4abb-8591-aa1e14b68d49", "value": "T14FF413536AE89023F8B04BB059FA038305367DB1DAB983277756954A0DB3FC4A53673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783622, "uuid": "20261f5d-0653-4758-a7b1-de6547ae4b76", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783622, "uuid": "4c172cc6-61b0-49f2-838d-e80ceade2500", "value": "24576:ayhwJzL5pTBj39qYwCV5vIy07LKemEr+:hhoffTB3LmLVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683783622, "uuid": "cf57f64f-8d2b-4798-8e65-5b82cf93df03", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683783622, "uuid": "e0a25458-d368-4f53-95d9-542239668ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683783622, "uuid": "85fff008-cb29-41e3-b5f3-a52898d41052", "value": "1bc164aeea101785c49ac77311347ca0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8cc1fa-effd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683810694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810694, "uuid": "d138a75d-46f7-4ee6-b168-9b9b1e55435e", "comment": "Malware payload (AgentTesla)", "value": "406002f829b1e84b402aadc2d2391a06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810694, "uuid": "89ccf13d-c8ce-4fb1-ad04-2683db458ab6", "comment": "Malware payload (AgentTesla)", "value": "f854947414eb240ac6807004331d3026156e195084486eed7060ae0c1bc05e98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810694, "uuid": "dfa79d83-367a-4883-b9fe-cc6c12c3829f", "comment": "Malware payload (AgentTesla)", "value": "9fb9ba707d553ae2f68755e51e1268300148c26b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683810694, "uuid": "dd77b38e-3d50-4acc-bbdb-ec6741273ace", "comment": "Malware payload (AgentTesla)", "value": "e851b0a2e3db292fb08bff60ab7e200a8496fe17bdd374596bfb26fe418c95fdff2e663eec45b2cfc23a9e69e534559d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810694, "uuid": "fd6d10cc-0a04-4126-8ea5-692a19fd40fa", "value": "T1CD25913954BC1627C1B5E2B65E84F451FAC08B927630CD9E6AC28C8A15E7D4E31CBCED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810694, "uuid": "36e127af-5453-44e9-9464-6b36f35842f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810694, "uuid": "1d5128c9-996a-4935-85fc-f3927b902f4c", "value": "12288:b6T9k9Ac1M0vvJrFrLcnNviJnF0GnEXg6PK5NYElV:ecHXlFr1nSG4g6PKLYcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683810694, "uuid": "fd922c2b-98cf-47d5-8fbd-e70f3f81975f", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683810694, "uuid": "3d50fe70-4876-47fc-9102-43c248b2b9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683810694, "uuid": "a5c49fc4-4500-43fc-93d3-2e3800efc08f", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d3f253-efc9-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683788459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788459, "uuid": "69e504f8-a69e-4167-9902-3c8c6fb98f15", "comment": "Malware payload", "value": "319c2135f99c822e2e7a172f9896ed56", "object_relation": "md5", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788459, "uuid": "eb1cc25f-b85a-4b19-b41d-c7036c589661", "comment": "Malware payload", "value": "f86962682a031e037476ea11e8f19b584e0cb19ef80da2af997e0aa64e13b586", "object_relation": "sha256", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788459, "uuid": "95938a57-5c93-4814-a606-f8487a0f743d", "comment": "Malware payload", "value": "c116bbf0fa2a7c1768804ca0cc537fb03aeb5bfa", "object_relation": "sha1", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683788459, "uuid": "4dd5ebf0-6d3f-4eaf-be15-f92c1b55a525", "comment": "Malware payload", "value": "60c23e59bea81db6eb3d907896faffb94edcc4ac245bc3dd5af07b8b658e88b36df16a7a60bbfebb4276d647d4eab540", "object_relation": "sha3-384", "Tag": [ { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "DIANColombia", "colour": "#8ACE16", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788459, "uuid": "7fa5f9bf-80f8-465a-b05b-a5cd8ea14dc3", "value": "T193A56B85A692DE2BD3826B3AA023C6685631D2023723F75FDFBE52743C93B7409417E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788459, "uuid": "94c43393-a614-453f-90d0-6a2688536408", "value": "49152:Lv9j5xUtBOve9Z0gFxvKx7w5sskl5ON93oqMeQHN:Lv9j5xUGeYovKxhskl5ONtoqQHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683788459, "uuid": "e7bf48ed-9ddf-41a3-8c47-d6abcc36b9bd", "value": 2129075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683788459, "uuid": "c4d7e624-b3fe-4722-8579-958747790381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683788459, "uuid": "991a7b46-fd68-4ead-838c-d532f96baff7", "value": "Loader.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a3be8b-f011-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683819328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819328, "uuid": "69479df9-81ab-4877-b402-99bb62dfea29", "comment": "Malware payload (RedLineStealer)", "value": "428bf07263fc6b23da1b17620cc85c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819328, "uuid": "dc29b5a6-77f2-4d29-87ff-5a0ddcc189fd", "comment": "Malware payload (RedLineStealer)", "value": "f8cb70ff35016137f6ffac142ac61a36f47ee76fc792a865dd0f3c6625958ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819328, "uuid": "c9c33b16-4992-49c4-a8b3-ae47efa02a4a", "comment": "Malware payload (RedLineStealer)", "value": "d24c82e6702442e8e6b426f44fa20833f881521a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683819328, "uuid": "d85f83bb-8cff-4a6f-8374-2694601e6e52", "comment": "Malware payload (RedLineStealer)", "value": "26eb63f9a0af0dd6914120fea0f1d6e0d25ce5e8ffe7f887a7b1ca30263980108f8b4716545b99a10d7f60c3e23a46ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819328, "uuid": "581a4200-2b5b-493e-85df-2df878656143", "value": "T1D4F412437BE885B3E8BA07B058F606830B3A7C659E74856B67469C4F4C72B81E532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819328, "uuid": "605401e8-daa1-4434-834e-e327d519a79d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819328, "uuid": "abb8450d-a27b-4129-a56d-ff9a406a8a91", "value": "24576:Py/IJdSdiL+oQFkAwRA0IZnhEV8WYQf5ZT7qHBME20h9:a/IJd4TogkQD5Q3T79U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683819328, "uuid": "9d5c14c2-203b-4e92-9ffc-b1709db1b7e3", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683819328, "uuid": "7a9702e3-f1b4-42e0-9d68-6bba84b32f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683819328, "uuid": "80fdc666-acf7-491d-b714-4e5a3b358fa3", "value": "428bf07263fc6b23da1b17620cc85c7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3f7bef-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785917, "uuid": "8a68d6f0-412c-44a4-b88a-f7c0974539ee", "comment": "Malware payload (Mirai)", "value": "826b6d0887097a7fd40de1d04dd81bf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785917, "uuid": "1d7659bf-6f49-431c-b909-63fd34b363ca", "comment": "Malware payload (Mirai)", "value": "f9145c6a96a9d1d8825b9d25d359465876ba053759a43864af6b4a702fda9026", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785917, "uuid": "529d03d4-d2ff-448c-9d37-e357a67f3562", "comment": "Malware payload (Mirai)", "value": "0a16526f8c4b399d1f8c63c107c5f8bca823d37d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785917, "uuid": "9bd02130-6b31-426b-9ffa-b3af89d90605", "comment": "Malware payload (Mirai)", "value": "9e77df3faaed164972b569878e32897c5768ba7201dfc362dbab87ee6d8115c127034833d69b306f4f130236326d95f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785917, "uuid": "02e18d05-aa43-41d7-961c-6238c71ae28a", "value": "T1B1B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785917, "uuid": "88c2e01b-61cf-44a0-b121-6bb7a3012602", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg16/LWy:c9sSyzz36YaWWgg16q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785917, "uuid": "2afd1e97-b415-4871-9d60-44370c81323b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785917, "uuid": "7d5cb17d-1884-4894-a9c0-4ec71d7c5d85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785917, "uuid": "42787608-3d02-4ac4-8d57-18d12ab1ec8d", "value": "826b6d0887097a7fd40de1d04dd81bf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9809801f-f02f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RevengeRAT)", "timestamp": 1683832272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832272, "uuid": "4807dea0-57b8-4b6b-aa1b-58ea8b7bf09f", "comment": "Malware payload (RevengeRAT)", "value": "515ff2344f241cfdb65a08b0c6fa90f9", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832272, "uuid": "a7320959-3757-4e8c-8839-cf44b56406cd", "comment": "Malware payload (RevengeRAT)", "value": "f918fb220166f75e3bd9f8cd162b411bfd9ba210f4abe0f9509c5a7bf722a981", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832272, "uuid": "c74519c8-60d6-4ddf-8fd0-f81b6e04eec3", "comment": "Malware payload (RevengeRAT)", "value": "36b640ba2e0c9b6da14364e4b24a960b964b8377", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683832272, "uuid": "a61ed4c9-c9f4-4451-aedf-fd9cd3463bfb", "comment": "Malware payload (RevengeRAT)", "value": "2150d1b30457bea1d455da3412f9f4818953335aa28b21bba423b8d2a07bccd6214b9b8bebcb89e6ab3ac976fb204191", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832272, "uuid": "ab51b235-d6a8-4100-915a-a33c03fe2ab4", "value": "T12C82D04B5CCFE426C63A1BB9CC244D93A793704DBD6A5236A0C0BFC4792C21E5B9752D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832272, "uuid": "4c0ea36a-e16d-4ca5-aa49-fe2c6f36d87e", "value": "384:dXPgOGHYbeUPGocggolFNXy82T4XIERqzmhb:VPpGHYfGTggol7O44nzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683832272, "uuid": "2c9a94a9-d727-44ba-819a-3aded8b5d5c2", "value": 17604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683832272, "uuid": "d29f8268-f11d-4f43-aa74-bc2182592ff8", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683832272, "uuid": "60d9b58f-86f3-4744-bd52-e3f5b550c825", "value": "bee2pay Authy.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d9d411-ef93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683765322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765322, "uuid": "6b431476-064e-4bc0-937d-2e3158481e15", "comment": "Malware payload (RedLineStealer)", "value": "04c9a1baeed565db068b8c1432ef0b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765322, "uuid": "f9837918-3245-43a1-9fed-90900abe8e72", "comment": "Malware payload (RedLineStealer)", "value": "f91a73af3965046c61f70df2c8fece00e7213972c26def42bd0bf706ecd66324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765322, "uuid": "e2a6f347-ba2b-4ba4-b0fc-abc5631e51d2", "comment": "Malware payload (RedLineStealer)", "value": "0c91b2cad571d75fa6ead00643752f9803998658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683765322, "uuid": "794a93ba-d42f-4e50-9cab-b2a40a645163", "comment": "Malware payload (RedLineStealer)", "value": "6dbd74cbd9e4db51d03725f5b7f650028f149701e6b9fabea6bd19fd1de04d6d74e4d00fa9be23c7644ab2e8fffcc192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765322, "uuid": "6340a3d8-62ed-411f-a61c-547246452f71", "value": "T19705120396DD8032D8B8633439F103D30E397DA64CB586EB2256E85F59722D9B67237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765322, "uuid": "524bcd5d-231a-4811-91ef-f1f05787b7eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765322, "uuid": "52a1ec73-d913-4dd3-b5c9-095e1b648e28", "value": "12288:NMrHy90dpUL+rXJ2AW5Zf8o2JM37dsmsWff9m+Wrx+8GZWOh6D8TCSdbUYSD:yySUarkJ5ZD5WmsWf1Gr4wO3fSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683765322, "uuid": "e70ed687-cd00-4343-a28f-4c9c078d1d02", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683765322, "uuid": "c48366e9-c8cc-488b-aa20-7e7483471b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683765322, "uuid": "c9c9eab9-632c-4595-ac15-d1c35974d8ab", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fa65a5-efeb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683803116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803116, "uuid": "699007ba-65c2-47d7-bc42-93c1b613be2d", "comment": "Malware payload (Loki)", "value": "e2a1993d059745a36a72582c89ad741b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803116, "uuid": "b96cd060-2a0b-46bd-92fa-5216e1bc18b8", "comment": "Malware payload (Loki)", "value": "f9abc71a65beed84b344ec4ca11b2d242a9fba725fa5c12db5ad8152bd551826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803116, "uuid": "9fa41257-95f6-4eff-a2c1-12a7f820bb5c", "comment": "Malware payload (Loki)", "value": "2783bc79cf0d6c5dba2bd1507602ba50dd2453c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683803116, "uuid": "a77765f3-a831-4cae-802d-6a7df38e8de1", "comment": "Malware payload (Loki)", "value": "c58c52d97901b70872ba0fce36a62d374f5cd3103a32cabc1a19b382a5ba9226bd8b7bbb54ff12559d1a31f270f98a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683803116, "uuid": "1e1f418a-1c1b-46a1-aa00-b738bf41e4ae", "value": "T151C4BE85123BAFE2DAA413F0221434434B7DA11A75B8F0BC6E5BB4C9C8DEB115BD4B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683803116, "uuid": "33a4286d-e5c6-4da2-a4eb-14f9b7fbf3de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683803116, "uuid": "a7cefaff-359c-413e-b4cb-65cc6cc372d9", "value": "12288:cqUwmLTiCHvY7oCwGL7L34pJ7Re9fSlVXetRpDirO:ewmLTS7oNGfLIY9qlVXezpeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683803116, "uuid": "86813b37-3aae-4b4d-a681-5d47d31b8b3e", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683803116, "uuid": "bd8dede4-ef8d-41f1-8b7c-0981e874550b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683803116, "uuid": "a5bdbcab-fd93-4df1-8309-6e9f533085b5", "value": "Maerskline Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64a3b5f-f02a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683830202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830202, "uuid": "6aacf0cb-0bf6-46a9-a1ae-423bd41ac702", "comment": "Malware payload", "value": "64e254990898ad621bbdce947956c031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830202, "uuid": "2624e0b7-174b-40ff-9241-0128fa8125dd", "comment": "Malware payload", "value": "f9c45a6d84be48f33f8cf4dd4ec0dae40d9939d6f3bdb26dfbcf632aba0a6418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830202, "uuid": "a380443c-e382-477d-a1df-6fed975f3de4", "comment": "Malware payload", "value": "eb8769a72aad62632842367a18a75e2bac4fedb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683830202, "uuid": "f81c1922-be6a-46aa-89b1-082e457aaa76", "comment": "Malware payload", "value": "18897c4d94be301e040adcabba685eb367c18eef7ae67d136fb41bcdd5e7cf06cbbdaa953f4ba667c8828f0bbfb77ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830202, "uuid": "f88bb14c-44fd-4d75-8a48-5ce0bb9a5349", "value": "T19095D510D701521ADDBB35E94BAD313DB10CEAE0131464C781C8AAFEDBAA6F13E355DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830202, "uuid": "b2408777-709d-42f0-ab60-186e25713336", "value": "24576:HBcO19SWdwWRhpHqPPWuPnhMlY+i31w+LGr7G13xSUHq8B:HLz6va++B6xNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683830202, "uuid": "b3f3a4f2-8126-4d60-b5ec-dc7411c8498f", "value": 1927477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683830202, "uuid": "ae783ab1-3e78-4b8f-94c9-0529d5a8140d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683830202, "uuid": "290e5548-3d08-4ef2-99b9-532b656b7512", "value": "64e254990898ad621bbdce947956c031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c049c928-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683837064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837064, "uuid": "69761ef3-99cc-45e5-8f0a-8d273251713f", "comment": "Malware payload (SnakeKeylogger)", "value": "008a6a7f7e2610edadf3e2f26c73b646", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837064, "uuid": "dc7d555c-807d-4f75-a624-c42ed3592325", "comment": "Malware payload (SnakeKeylogger)", "value": "fa0227b4110583fc6adc132fea1356d064945b67e4299dfb27f38adc6f0d2330", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837064, "uuid": "cabe4750-24c8-4f44-9dc4-bad54930dbef", "comment": "Malware payload (SnakeKeylogger)", "value": "f62c8bdc4a2a4dba4b817e61ef00ea6e60d7bbcd", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683837064, "uuid": "781d2c1e-396d-42ef-ac5f-bb7261fb1daa", "comment": "Malware payload (SnakeKeylogger)", "value": "41e2ea5a3d2184dec0f6c2c6d8d8d6fac9a8b6ea59e04c47bf1079499e885655440d35e5c52e3e4c4f6a2ecaa14fd2ab", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837064, "uuid": "217e18c0-334c-480d-911e-8341fad736f3", "value": "T1FEA423CE98A7503C13D0A8CEDB04196477F89DF5D640F1AC9AD2F580EB74E829BADD48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837064, "uuid": "1214160b-79fb-467a-b665-ff2cc792faa2", "value": "12288:KgU+naUR10SfI6E1jqrRQF3arBJHVS6tfkj:Vxnwl6EWQ8rBJHM0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683837064, "uuid": "8110129b-23a9-4afb-ab4c-393c0dd2686b", "value": 473441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683837064, "uuid": "853b643e-d532-46e9-8c37-e8ed62763714", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683837064, "uuid": "869f168f-ce4f-45aa-a5bc-e01948796b9e", "value": "Doc 45 AAB 979 - 45 AAB 850.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755fedc1-efc0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683784540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784540, "uuid": "6f928afe-0b8c-48fb-9a5a-7217d2821ffd", "comment": "Malware payload (Mirai)", "value": "f3d79d2a0ce9dd8a05508803748d7850", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784540, "uuid": "99be628d-dbb2-4188-a880-c9467e6e0c33", "comment": "Malware payload (Mirai)", "value": "fb95105530a9c097df924915f67c2281dd8e913d3833fbcf1ce4594874a42f1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784540, "uuid": "0d23b8e9-ef39-469c-8290-bc0f88065f62", "comment": "Malware payload (Mirai)", "value": "2930a59993f48e787aa91a922e872fe64411684f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683784540, "uuid": "57b40217-5d99-48ca-aba0-0e0e85da922e", "comment": "Malware payload (Mirai)", "value": "39773e3286e695d9e3f24c2691b28d6ab7e6e5abe52e6f3ee31e88e2dc8a179980e0afaa2c175150ca16c5f1c3a411ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784540, "uuid": "6751499a-27a1-4659-95e1-55cbdd106b96", "value": "T1AF432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784540, "uuid": "37015527-b25b-41af-bbe4-ae5c644385f6", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwb:RqtmZPuutfbltZFBSJsBcfDSTFI+BEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683784540, "uuid": "16f3b065-9450-44e2-92e9-446253464338", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683784540, "uuid": "101c2628-c2c8-4003-be30-6a6ade8f72d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683784540, "uuid": "81362f5b-5f3f-4b83-8f05-4b7b64f636fe", "value": "f3d79d2a0ce9dd8a05508803748d7850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67170af4-f03a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683836914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836914, "uuid": "6df4573f-174d-4d11-a073-9026a71fd758", "comment": "Malware payload", "value": "02b942ad766d717f2d90f6d1c6b69646", "object_relation": "md5", "Tag": [ { "name": ".exe", "colour": "#9CB8E9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836914, "uuid": "c09d9211-002c-45f7-b3a6-1983030d70ae", "comment": "Malware payload", "value": "fbd5ed2986f6dcdfe32fb0a659cb3363c5bb914ab523da589cad645418dc42f3", "object_relation": "sha256", "Tag": [ { "name": ".exe", "colour": "#9CB8E9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836914, "uuid": "f59d305e-5950-4902-8898-46f6f9707a0c", "comment": "Malware payload", "value": "bddbb63208fc2b777a97b4707321fbfbc096c2cc", "object_relation": "sha1", "Tag": [ { "name": ".exe", "colour": "#9CB8E9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683836914, "uuid": "6fbc90f8-3266-495a-9b4b-60651cb0a844", "comment": "Malware payload", "value": "e6cbded890e3055613ab3bd0189d4b0b3f21eca5c2da253ff4700c236b7d170ab29b62ae778aacfc82cae737fbb1cbae", "object_relation": "sha3-384", "Tag": [ { "name": ".exe", "colour": "#9CB8E9", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "email worm", "colour": "#C01DE6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "loveware", "colour": "#575EBA", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836914, "uuid": "d3ec6cd5-c962-454f-8f32-eb029da3ab95", "value": "T1E654E68272A1CD75D1E376BCCB49B320532F3E501B60F15A26B4FD1BBA2558B4E187CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836914, "uuid": "4058f09a-3a22-4d60-a84a-3196414f48ba", "value": "26ea1b45766fe26f9c40750d36f4cf7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836914, "uuid": "4c49fae4-aa45-417f-a674-5087f5c09dd5", "value": "3072:ZJVD1zx0HrJvtuKm8wVKQ3+nBgBDlQID3RjfpKYHiTWNLkk24Pmqsuxa5YUJCU8W:nWFvSH5lQ+hjf8YHuWJjkCU855og9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683836914, "uuid": "88f4b75a-e199-40cf-b79b-c3c6bd89052a", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683836914, "uuid": "4e046783-f727-4b40-af3c-1a7941c895e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683836914, "uuid": "2d58a6dc-8278-485e-96ce-bf160d1b684b", "value": "FinalPayload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85fb1b4d-efc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683785426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785426, "uuid": "c2c19e69-55f0-45c5-8e9b-42f3a0ba953b", "comment": "Malware payload (RedLineStealer)", "value": "43e95707bddc18601d06c9728cbd3ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785426, "uuid": "e962da1e-b11b-4923-8177-ba38d530f9b7", "comment": "Malware payload (RedLineStealer)", "value": "fc398e0cde6a420898f914da59fe9f8efbf33a43a6721324d57e0cdac03d43e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785426, "uuid": "81ae7523-4d96-452b-beac-3565f7af5880", "comment": "Malware payload (RedLineStealer)", "value": "2fff86a8f027a8e21c54cfff210fe0bc222a8756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785426, "uuid": "a784a134-1ce9-43ff-948b-5d4c927f6f45", "comment": "Malware payload (RedLineStealer)", "value": "ff155f9e880c318ca6666f9dcb931f0a17c83834b2f185ce84bc130cbd6ed1e619680cc657aed3ffab1879bb0ad87b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785426, "uuid": "8b67df9e-9cf1-49e3-a580-3920d9a39aa2", "value": "T1BEF41212EBE440B3D9F513714DF643971739BCB0A9788B57239AA94F09B3485B83272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785426, "uuid": "ec706880-047b-46a4-a023-cd8dbe76146e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785426, "uuid": "80f45795-6f35-48ab-aac5-9d6cf882210b", "value": "12288:hMrpy90L87YhqN5tHNZEaR+CFAQvZmfoAK6O6NaFq89Kx1tvcjO3qBfKs5xdTK:syzshg5tHwa0ChBh6NaFqjvcj4qBfbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785426, "uuid": "228c5b71-1d06-4ef8-81e1-1af6ff67aa41", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785426, "uuid": "aac44e44-eba5-458e-a4d2-a9f62567e444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785426, "uuid": "bccfea4b-9426-4f9c-b57a-41b3bf4fabe5", "value": "43e95707bddc18601d06c9728cbd3ed1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ff1b7f-efc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683785906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785906, "uuid": "00ed6375-8b15-4105-8fa2-28274953a464", "comment": "Malware payload (Mirai)", "value": "358ca857c69c06507dcde6847f6c8abb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785906, "uuid": "d3e3b62a-a33a-46d9-9879-2e468970591d", "comment": "Malware payload (Mirai)", "value": "fcb03b7b31c7351e817eadf3294f2b4e377ca45095fdc0f23bc4c001032f262f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785906, "uuid": "70f6162e-65c2-4bfe-8d99-c5646a991d74", "comment": "Malware payload (Mirai)", "value": "42dfc159a06d2d4d8447a8c25ded57015567c0c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683785906, "uuid": "8c53417c-acf0-4712-93d8-b257c5ad640a", "comment": "Malware payload (Mirai)", "value": "4a7f4b132cc0e7520d6ff0a02b1ab99730ad3bd79c450cfa4923d9e0afb6b43bdbc5d0db33ee09507008b7a13a63fe30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785906, "uuid": "cc575cc4-986a-4b8b-88b2-39d0539ae5e4", "value": "T178A2E01172632D65E3ED1C3CC9AE8367F9A71BFC80F5327639415A20C94924A3E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785906, "uuid": "16c3eac5-9386-451a-8812-13cca23594ff", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjzhymdGUop5hc:vvQn4j+ZO5fKAlxvs3Uozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683785906, "uuid": "0c7b0a23-33f3-4d50-8be9-93664bef9a8b", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683785906, "uuid": "6fd29a9d-d912-447f-aed6-6a1e6abd7aa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683785906, "uuid": "b8557688-dc49-45ad-bc38-c16eb763d70b", "value": "358ca857c69c06507dcde6847f6c8abb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bc92a2-f035-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683834712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834712, "uuid": "87825fd9-ecc6-4de3-ab89-58a26b4a4662", "comment": "Malware payload (Smoke Loader)", "value": "1952b1243bfb58cafe4a274c0ed9869d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834712, "uuid": "6dc62cc1-34b7-437f-ac17-9bccccc55e8f", "comment": "Malware payload (Smoke Loader)", "value": "fd5957eee1c9955a0e640d3447fd62b464feed850ed5ea539a78bd87020490bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834712, "uuid": "14b543ce-034a-485f-a71a-d1bd1dc26bfa", "comment": "Malware payload (Smoke Loader)", "value": "ec6eaf75d67bb38df0604c464b653cb5c80b4c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683834712, "uuid": "aa4c848c-8832-464b-bf8a-4dc7c23a9449", "comment": "Malware payload (Smoke Loader)", "value": "a5033bc4d29213becf3ddc7975888757d4a87cf3ff3be12ea9f06b7b9b6ef620bd1f2a9c469c91c84c0008cf752417f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834712, "uuid": "7e5c699e-48df-4124-b4da-7958715f57df", "value": "T19A642B2393A13D54E5264B729E2FC6EC761EF7618F693FA612189E1F04702B2C173B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834712, "uuid": "a3d736b7-cd5e-44b3-bf6e-616ef72d58ea", "value": "7ce2ea0672659bde73ebe3337265c0a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834712, "uuid": "549ef1af-81a1-41f8-90c6-0fe07e06742f", "value": "3072:x2pXtHT/cL0Dx3EAICsf0dg4+zP89bnXao85HzSmhpLA5kOUZZRfeJI:g5TEL0DVEAmfdTCbqouOm1OaQJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683834712, "uuid": "c7e188a8-14dc-47fb-a7cb-c3e646bf146c", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683834712, "uuid": "14aadb90-5374-4484-994c-6b9d7b674b6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683834712, "uuid": "2bb680d9-0be8-4f73-9a8d-de072d8768ca", "value": "1952b1243bfb58cafe4a274c0ed9869d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6eb954-f042-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683840203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840203, "uuid": "21c9f508-9fb2-4a7f-806c-e990d3fdf8c3", "comment": "Malware payload (RedLineStealer)", "value": "e7bfe15a570c39270e626af013275132", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840203, "uuid": "f980487b-0f87-4716-9c52-d3c882c7a8da", "comment": "Malware payload (RedLineStealer)", "value": "fec7bae13e41a9368eaa8ab467ec84f62121375def9c2ec5d792204d02b9b9cb", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840203, "uuid": "87dfc55a-8941-42cb-a316-59059afafa3b", "comment": "Malware payload (RedLineStealer)", "value": "f2279b1fce7c2e91c3b9748009f6f742b5efe70e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683840203, "uuid": "9419d38a-79f9-4a41-8f11-059e91468398", "comment": "Malware payload (RedLineStealer)", "value": "7b158b0007c392b73cb682b7ab2bb02db39ccde273a41ed7167ec45bab48f87bde005cb157e43f7c9cf7354d299a015a", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840203, "uuid": "297d2ac3-7cb1-4647-a8a0-81178396f400", "value": "T102F41243F6E80277D9B0177058F30787173ABC619978C67E6BC4285B1973588A836BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840203, "uuid": "c60ed4ce-342c-4b76-98fe-4036329837b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840203, "uuid": "a57110ed-4ed5-40fe-9b03-9e84450cd3bc", "value": "12288:EMr3y90klreejAVdlc39+Oay9qVRExaKHOjaabBoVrGqJ2Btx4TQ0AEtSEmW62TL:jyrlCnV7g7LJ6jaabBwdJa4kNW6Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683840203, "uuid": "0ecf250f-d05f-4eca-aefa-32307ef7c6f7", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683840203, "uuid": "817ced69-dab9-4d73-9562-0d81c2cebf25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683840203, "uuid": "9c712f01-37c1-470a-83e7-a4b546326f2b", "value": "fec7bae13e41a9368eaa8ab467ec84f62121375def9c2ec5d792204d02b9b9cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }