{ "Event": { "published": true, "date": "2026-06-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-08", "timestamp": 1780963381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f55c261c-9f57-41dd-87ee-4626ccf373d5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3102a621-631b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910386, "uuid": "e32dcdab-b863-476b-ac08-489f88c73da9", "comment": "Malware payload", "value": "793d1adb969f89a5dcaf04594a2158b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910386, "uuid": "47950878-1a97-4d4a-8f48-301290fb2967", "comment": "Malware payload", "value": "005f20809713c1c387d8cc1f6d8a5da5abd041e0989b687f7b1e47e6cbe2b58d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910386, "uuid": "1f1e116d-1f36-4107-ba60-7714a6a33376", "comment": "Malware payload", "value": "04823ee7150743513de0f746b4a8cc46f6334dd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910386, "uuid": "78d1fa8a-2004-4d4a-89cc-8d078d51dc85", "comment": "Malware payload", "value": "5ba7d8e724c03c093186431254dd749f29859f0c3d704df42e1d3c49a2441c7eb101d6211e8af76e4e4969beb65c7c54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910386, "uuid": "1873c69b-5b8a-42bb-9fc8-c715f7ded5ce", "value": "T1FD45BF1A57832F95C36D0A7CC2BA186953F082466231D39BBED601EBDF027E6F643257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910386, "uuid": "89873c8b-4443-4cbf-bbb0-7eada31d03cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910386, "uuid": "99f47d84-398b-445a-8af4-c0c4b11c59db", "value": "24576:MhXgmaRAhDBi1N0uuT7uutGf7ATY9TL/NNGU:+cg9sqJ7If2YpTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910386, "uuid": "d4f49af2-bb24-4063-97b8-f19545f698e2", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910386, "uuid": "30e0205c-a703-42ca-ac6a-6c9b5f331800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910386, "uuid": "a8d78ab2-3401-4cc1-ab83-8c22a03cbbdc", "value": "005f20809713c1c387d8cc1f6d8a5da5abd041e0989b687f7b1e47e6cbe2b58d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fb62e3-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780913073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913073, "uuid": "4b9caf51-98a7-4099-bf43-3500d4dd6bee", "comment": "Malware payload (GuLoader)", "value": "00d1386ab7bc8a72d075813480cfb082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913073, "uuid": "6ee1211a-7ff8-4e03-94ed-9f2a5215bfb8", "comment": "Malware payload (GuLoader)", "value": "00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913073, "uuid": "768d83c6-781c-446f-ba34-8e00c151dc23", "comment": "Malware payload (GuLoader)", "value": "35eb4ad99745ab2bdbac0553f71cdaa0f584d827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913073, "uuid": "61c66e8f-a26c-4406-8f8f-c49038228b3e", "comment": "Malware payload (GuLoader)", "value": "04c0d3ec2f1e89ad0c9e506b3ef8b862ac996202362e3fe3c60f0e80cc2d9b229d9bed637826ba3f4d68d089ac3c3b97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913073, "uuid": "fe55d023-0822-41a8-aa46-f7a3b76f8096", "value": "T1A11523173F90C967CCA61AB442BED9474BF23D0591E6668F37EABB053C5A1B3910F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913073, "uuid": "4d8b81dc-55b9-4d1a-a72f-4006625b3a65", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913073, "uuid": "b4a5281d-84b0-4d59-beb2-8fc1e6349d8b", "value": "24576:LPMMMMMMMMMMMMMuKMMMMMMMMMMMhMMG8xXT6dVUkbiF1Y58m+yCaJWk9yA0g:LPMMMMMMMMMMMMMuKMMMMMMMMMMMhMMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913073, "uuid": "8683c985-e0f5-44b8-83b5-1b5a6c0424e1", "value": 910048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913073, "uuid": "8e98f88f-71cc-45a4-9e53-b8abb600e550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913073, "uuid": "06d5899a-ce5f-4173-8548-56d8ef07e174", "value": "00c3e0990cada07e01a3b842cf3d36f36c6ec7dd7d3c1aba430c08d885d66567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e586aa8e-637c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780952350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952350, "uuid": "67275d5c-7a59-4df1-8c76-2d33d57a5fb7", "comment": "Malware payload (Mirai)", "value": "6898a491f8edd512d2ab6c7c44c6a32b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952350, "uuid": "90178a14-1e11-49b9-bc51-21b3f9bd840d", "comment": "Malware payload (Mirai)", "value": "00e564d30bf595ec330879601da62438af4de670f8d54c999dc89870afdfaeed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952350, "uuid": "3775ac07-01e0-461f-9746-4b29eec7a8a8", "comment": "Malware payload (Mirai)", "value": "a800f2d05b3f9be8a36e465302bf3b1516ec2329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952350, "uuid": "b6fe1a7c-1d4e-485b-8744-b6a2092e7dbd", "comment": "Malware payload (Mirai)", "value": "91505492a4bff08e11f63d2e8c71617af7ac52a149cc9d1fe0784ad079a438772eb16ecaa2cf1434e672e4822090c8ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952350, "uuid": "04b7610c-c015-4f18-a851-7cc055247361", "value": "T1CDA34A4173690407E3E70DB12D3F6BF193AFD1A521E0A685695EEB4F8232E321586FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952350, "uuid": "0b475e57-0ff8-4aed-b2dd-9b7268240f10", "value": "1536:anSNRjh/mVl/UJedkrLYIHiv2wjbeXsdMSW2vYGUZqpfm6vRgk5OA2t6fwld7c:+S4DZRjC69TFRl5cJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780952350, "uuid": "1a1b82d4-8538-4c81-852b-ab830cc03503", "value": 107152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780952350, "uuid": "530ca76a-06bb-41f1-bdf1-c1f55510160d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952350, "uuid": "24c59a8b-0036-4db8-9c88-fb20ba6fda7a", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9cc07f-6359-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780937084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780937084, "uuid": "1d6940a9-2970-4bed-b004-8e596b2aebc9", "comment": "Malware payload (Phorpiex)", "value": "0c9e192dfbbd39f3f6a00cd5e091f7af", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780937084, "uuid": "23ad0b01-f0ff-4bb6-9f4d-4d26de49a85d", "comment": "Malware payload (Phorpiex)", "value": "0100fad18c918cae77ea6ab727a98c3028a65ac7d4bfafee314ee0e51a478fec", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780937084, "uuid": "eda58f25-e964-49ef-9587-3983868dee94", "comment": "Malware payload (Phorpiex)", "value": "5517304bb307e402c7e6f21c0d6a142cfeff003b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780937084, "uuid": "8ab3cd1f-fbde-4481-861d-70f0956ba5a1", "comment": "Malware payload (Phorpiex)", "value": "dfd1db2d3ee2ef03f262d60b9e1161fcb70578640c6967b27b03722e02ace4adaf7e0d384048554349760e7152517f94", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780937084, "uuid": "31e42fcc-dea6-4f0e-b3c0-3dcaa5a94574", "value": "T12F824A0FB8464726C1E100B49736867BDAB9A871378404DBF7E489AE1AAC6D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780937084, "uuid": "11f890ed-b98b-4c87-b85f-5051930898b7", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780937084, "uuid": "21c5dfbf-a7f0-4b90-9095-c047267f4889", "value": "192:vKaqCngTtXWAwjryNjtEyDCADjlvlgZKP2vKUSvu9zw+ghSIOgbO5qmEd/F92GJB:B0WPyNQANvSZmu9JgwGc4av8U9cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780937084, "uuid": "5c2b3f0c-6163-4bf2-be5e-e05ac59c449c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780937084, "uuid": "45bdd713-0dae-45dd-bb2a-5fc3fbd2fb13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780937084, "uuid": "437e8572-f137-4b58-b688-6c6f998220c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8514ee2f-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780910956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910956, "uuid": "83247d27-d31a-45f6-8184-eb4904520cf6", "comment": "Malware payload (MassLogger)", "value": "b5a02fe397da66043ee96f3588e5f076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910956, "uuid": "81ce28e5-894a-42fa-a6be-1f7e9e52fa5e", "comment": "Malware payload (MassLogger)", "value": "010d08582f3142d2d6a42be6d27a287068fafed0617229ecccf0da051abf3f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910956, "uuid": "e1931e32-dec6-4d78-81d4-e8fae76e5b77", "comment": "Malware payload (MassLogger)", "value": "058aeec7cf6a1b17552736dddca48ac6978ab3a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910956, "uuid": "e4a6956b-d3e6-4885-9b82-52ca0be626d7", "comment": "Malware payload (MassLogger)", "value": "65c7fa40f1d360b5eeebfb2ca7affe24b334f7836fdb719972bd7ea75254d33806161dfc72a82b41627cdbf7f0ba14f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910956, "uuid": "5e521c4f-5293-47f9-bd1b-99182634fde7", "value": "T19805125C6706E906C6855B381AB1F7FC132D9E9DE912C2139FDCAEEF7936B192C04242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910956, "uuid": "83eff6e1-e522-4e3b-b435-872d1925199f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910956, "uuid": "4609b094-7a40-4f22-99f5-492c22a181ad", "value": "12288:WYvFwTjng3R74ahNStZMlcjddOC6LiB6LIpqbSwK7kSYsbw0VGsthkYtU41Tr:Td2rEkah0cCdWSSM4SwJSVwQt6cTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910956, "uuid": "b5007123-4bff-46d6-96a3-3bcc143716e1", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910956, "uuid": "4c9482f7-b9f0-4622-86dc-831b09822580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910956, "uuid": "0f0268e0-1b59-42f9-a48f-8e7f83ac32b7", "value": "010d08582f3142d2d6a42be6d27a287068fafed0617229ecccf0da051abf3f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5706071-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780911037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911037, "uuid": "9833df96-3ec2-4dcf-a117-b2050d5d9b0d", "comment": "Malware payload (AsyncRAT)", "value": "e8514a59500ba8f41833dc99c029f5ea", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911037, "uuid": "58fc2cb4-b2fd-4400-a6c3-3dd626faffff", "comment": "Malware payload (AsyncRAT)", "value": "028738c5837494b44e9ebf63d022a75bcf49982702f239890732c4ce4b655f0a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911037, "uuid": "38c2f128-5141-4cc2-9758-4192c594b8ac", "comment": "Malware payload (AsyncRAT)", "value": "d231ace005e3741b842c65a58fedcd8593b44b1c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911037, "uuid": "19f47ec9-da1a-46f5-aeff-2b0be77a6044", "comment": "Malware payload (AsyncRAT)", "value": "c1c5ef62dea26c5e409825fcec69f19e35c4b4220c6eb4e276e2cc342951100e707779d0db548faa43c115548c990e8c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911037, "uuid": "3e68bc7a-59b1-47b9-82f3-a8a1f8be1be0", "value": "T135F402286616D526D814ABF81D70F2B8077C6DDEE401EB169FD9BEEF7A22F019D04183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911037, "uuid": "b6df7fc2-c794-4785-9320-206643563065", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911037, "uuid": "53f8dfc3-0bcc-4909-b559-ee94f955aea5", "value": "12288:XxYvFwzvM6r4OERo+UnTedEuwByEUfSYhAK0+d3i7xaCb8iI/KMCZFU9:XSdaMemo+UnSCuwByrf5AKj4ayTMCzU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911037, "uuid": "5444021e-1294-4c62-8ccc-e684ba1c4b3f", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911037, "uuid": "0b4818f2-678d-41db-8e2a-2117f17dbdb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911037, "uuid": "70f52f39-6165-4c56-9c91-65de6193237e", "value": "028738c5837494b44e9ebf63d022a75bcf49982702f239890732c4ce4b655f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a385d316-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780904994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904994, "uuid": "ba9d021a-c28b-419a-b3cf-e2e6ff58eaa3", "comment": "Malware payload (Formbook)", "value": "34b12696cb79d33a837e96611cbad09e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904994, "uuid": "e499d52a-9d59-4198-8da5-6512aefbac52", "comment": "Malware payload (Formbook)", "value": "02b896c6993d6e9973fab196c38d3462eb6e9466b3e8aaa6124010e0fb0df9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904994, "uuid": "d938854d-3555-4141-9ad8-51518f4fdadd", "comment": "Malware payload (Formbook)", "value": "de20456eccf12a9acebb6429487fe942a1ea8896", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904994, "uuid": "a1a8df53-5308-48bd-88fb-442b4086b0f9", "comment": "Malware payload (Formbook)", "value": "effcdcd10a68242169ea1ea456378351195f4d80aa122af217f3e6b24ace167b0331e728fa77144ea885fa18374b3d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904994, "uuid": "d11c4661-cc87-4a7f-b6b3-06b93983ade8", "value": "T11D15238C7965C603C4A36F750EA2F1706B286EFDB605E907BFE83CE7B56A764010A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904994, "uuid": "cb66151b-71f9-4d8f-a0a1-3231765c0ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904994, "uuid": "a2ec29b3-81ff-4207-9883-da806fb04bdb", "value": "24576:qxQPlr8z0xTi+f3pLW1Tb4YgUg5xA63NWH:PPlr8zuTi+fZLWNvgjAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904994, "uuid": "7fd6bf00-8fc3-4e97-b8ab-dd45a8507794", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904994, "uuid": "e52122eb-7565-4c16-91eb-b8b34de965d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904994, "uuid": "22a4822f-c7cc-4ae9-8412-e15d1d6df0df", "value": "TT Copy-11044TRF12008119_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5581b777-6378-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780950390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950390, "uuid": "a739471c-f315-4cc5-afc5-04bced0bb73e", "comment": "Malware payload (Mirai)", "value": "1c6115215d913f94083decef99e1e79c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950390, "uuid": "ea4af263-25ca-444a-b0d0-2a85f02b80c0", "comment": "Malware payload (Mirai)", "value": "02ca31d7b2cc5df3a0d55d40dffd979cdc2fb59005146ef30df635ea5be47555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950390, "uuid": "3211c85a-9342-46e6-a67c-a3f5a3750db8", "comment": "Malware payload (Mirai)", "value": "2ac3d95f80ecb9ea45dbb30d6c88446ac7a6c9e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950390, "uuid": "211b520c-47ff-4be5-878a-6e8e9fe2f58b", "comment": "Malware payload (Mirai)", "value": "af8ab98f3ce635261adbe96416b3d4cb08c63cb5a2775b16b586e92e14761719f90fc84ae61c277d887e12fce5bbff54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950390, "uuid": "97da03f4-0fb8-4540-b191-bd737de138b5", "value": "T160263A43F85491E9C1AED130C6669293BA707C885B3023D36B50FBB92F36BD4AE79354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950390, "uuid": "32c0e8e9-293b-4df5-8d10-92245d56ab70", "value": "49152:0xpCorb/TRvO90dL3BmAFd4A64nsfJRUEt4y0L/Prj0GB0lpURV3ecwQCxi5ER/S:+iMfyiFE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780950390, "uuid": "d3be8bf4-8cb1-4737-9a86-564b3ff6cda5", "value": 4669440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780950390, "uuid": "91fa5302-12aa-4a52-b18b-d01280df4ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950390, "uuid": "96c9ceb0-3e59-43c0-8f9a-8cfc95c77204", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdc6991-6315-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908015, "uuid": "fde4936d-d069-447b-8059-ea96065b13d2", "comment": "Malware payload", "value": "a6169923a0c8604c13bcec3bbbd8a3f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908015, "uuid": "4aa7c1f5-bd84-4229-9a0f-82c784f2b6a2", "comment": "Malware payload", "value": "030a24e85efd2c3c4ad3193f2be39cf710cb45e1490ac9de488e1bc3a4f76884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908015, "uuid": "3e4b5025-976e-478f-a8ef-dd46edaafb96", "comment": "Malware payload", "value": "6b3997141cfdb9f44dcd1f690d31bf9c43043c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908015, "uuid": "c7d57062-2850-4920-8f66-3317b0d6bd17", "comment": "Malware payload", "value": "3e799192c929ce7a84ef40ad27cb228c4a1cb4969e202b2864cc1075f0a22059b06abf6af7d4d8f4738ef8e568437644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908015, "uuid": "82850968-fca3-4a9e-b75b-5e680e95c7ac", "value": "T17965AE1117A85F24E1BF9770687B1512C6F3FC09CE72DB5E6A4AD8AD2532B01CB91B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908015, "uuid": "40f27aed-c8e2-444b-8a38-5553bc43350a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908015, "uuid": "2e99dcf4-27c5-4bdf-84a3-3743ed1e0f92", "value": "24576:xrZ3pC1nbbAfKbXpZllWXETG3080FhhTq8oyu2UaQ2xXs9:81bl7poUi0/hTC2UaQQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908015, "uuid": "0122eaf1-10f6-4bd2-8bed-90eec58d7ed9", "value": 1412608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908015, "uuid": "393ea910-3f1e-471c-8b2c-6449e308af8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908015, "uuid": "e21cc6f5-79c4-4d1a-a664-e3fa7a43d37c", "value": "030a24e85efd2c3c4ad3193f2be39cf710cb45e1490ac9de488e1bc3a4f76884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b198036c-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911031, "uuid": "f69bf3bb-7c3c-4f31-8f4b-6adb5557cbc0", "comment": "Malware payload (RemcosRAT)", "value": "527b885d4995f35626cce5bc24a46a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911031, "uuid": "74977bdd-1e2d-4e30-8175-5a71b98c8941", "comment": "Malware payload (RemcosRAT)", "value": "0311761bca1187e06281040ec3141356fb1008446adaeaa0b2ed311918bf003f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911031, "uuid": "49cdc117-2662-4de4-9ef9-de8a0e6640ce", "comment": "Malware payload (RemcosRAT)", "value": "5a4e5dfb9855d2449cf27f724b417233f1597f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911031, "uuid": "5b03302c-34d4-4395-8ac7-d94742703508", "comment": "Malware payload (RemcosRAT)", "value": "a5b79a78537afe8e1a8efbf0e1caa791a6b3b28dbeea3a10d261330b25fbe21c1078274f2ba76ca431085d4f681c6ac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911031, "uuid": "01c90cfb-f463-45cb-85f4-739fa7c56732", "value": "T1448412127EA1C423C1795272CD2AD6F975289DF8EB6E8F0F1F903E6DB8B16524D04349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911031, "uuid": "46c4f435-15c0-4ceb-91ae-d736973182c0", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911031, "uuid": "24ec4415-e323-42dc-93fd-2ef7821fceb0", "value": "6144:a4t6LsCB7fXyMBDmJ2wYL+jZ6Cl5MxDt36tgbWg7XgmRUaoVb4s4ggqER:akCBLXy8m2WUCEx8Xgbgme/9cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911031, "uuid": "b6a1edd6-2b99-4665-baa1-97415440e022", "value": 391097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911031, "uuid": "9b43ce82-1e04-422a-a0c6-533f107cdf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911031, "uuid": "b067a17b-c65b-446b-ae9f-02b94356195a", "value": "0311761bca1187e06281040ec3141356fb1008446adaeaa0b2ed311918bf003f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d3b5da-6339-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780923604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923604, "uuid": "d81b2e97-8716-48e2-9027-6e9457b1cbf4", "comment": "Malware payload (GuLoader)", "value": "f8abcf42dfa908dd41f59c9bc69e3e59", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923604, "uuid": "5088fe3a-93b6-40eb-a286-8810fa21960e", "comment": "Malware payload (GuLoader)", "value": "034909b8c980a4c3c677aa7f7ea86389d8c4b59629ed9ae868c9587898c94409", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923604, "uuid": "c71ce88a-aad0-4a24-9bd3-501104bcc7b5", "comment": "Malware payload (GuLoader)", "value": "f0bd74676021b2f142047665b533577190589c8e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923604, "uuid": "9d78ae16-b720-4825-b264-28d131104b98", "comment": "Malware payload (GuLoader)", "value": "e3affac3ef63e494ebb1708e6870be7bb4e44fd125fcefaee6f3cce657ab2dbb0cec4f1299c488426be307f1afd2d9ae", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923604, "uuid": "ac083a68-f52c-4b53-8e95-e2e896c21d7b", "value": "T1B691A454E0E463409C00B9C95F8394DA08A3855371F1BA7B835B4AEF0CE13E8517FAE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923604, "uuid": "64eda0f0-ed4f-4b89-9152-241365178768", "value": "96:sxk9RS1VySpxjQyYrrLXmtC9bpB/RTUSxNM8XcYbwsBZ4t7D1Rl4Srk:sxwwVozj/RTzZY7DVrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923604, "uuid": "95f9d4ff-4569-4876-b15a-a49136e5299e", "value": 4510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923604, "uuid": "833d8505-9493-478d-903a-dfb27cfdc377", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923604, "uuid": "cf1c1563-e208-4f18-bfa0-c6f9a6e9d29d", "value": "rPedidodeCota__.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ac0e1e-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911472, "uuid": "ed9a4b29-9efe-4698-8a48-05a852a3fab6", "comment": "Malware payload (Formbook)", "value": "eaefafea7c74bc37154d16652d946eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911472, "uuid": "5b3a20bd-3d2c-40c5-ab3e-7a33203a77eb", "comment": "Malware payload (Formbook)", "value": "037dd32d196811373fe258f5ea9607e67e7aca7199630211dec9b3b9e2afc796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911472, "uuid": "23195717-6105-406a-8032-6fa6070c49c0", "comment": "Malware payload (Formbook)", "value": "865c3498533ab3917364d400e26a0abca41f247a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911472, "uuid": "73920f98-521c-4256-b61a-c81f94d03c04", "comment": "Malware payload (Formbook)", "value": "e28c3ca8e8e61ed9d3437e652f56c0ecb2610b4e1ac9964fba58f7c7dc97bf9124946a178d1707618f1951d4e06d3754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911472, "uuid": "3fb0289a-ef97-473a-9c21-c6973e700471", "value": "T12F45E0E46700C151D8A78BB98836E2B766376E5DAC24C60D6ED5FF8F3C72306442798B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911472, "uuid": "6c3210b5-4ad5-4d2c-8578-e47784dfbbe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911472, "uuid": "09186f46-a90e-486a-b31d-2e4e5f5d162b", "value": "24576:DBkIg+cPGxZNPSGrpSPkb8y+58ed96bjY3ZI2TNSRdA:i4ZIDSII2TNSRdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911472, "uuid": "147b626d-27bd-4930-bbba-2a176f2e26e8", "value": 1172480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911472, "uuid": "efec008e-ff42-443d-b050-25a74fb531ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911472, "uuid": "ec65fba1-1640-4f3b-bff8-2d9b4feab3d6", "value": "037dd32d196811373fe258f5ea9607e67e7aca7199630211dec9b3b9e2afc796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f21411-62dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780883977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883977, "uuid": "04d6a6eb-7cd1-4de0-b505-29e2c8763a23", "comment": "Malware payload (Mirai)", "value": "b3867884825d51f033b0e7cb8793925f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883977, "uuid": "2e8c86c4-5020-4425-9b02-2360dde0a711", "comment": "Malware payload (Mirai)", "value": "03920e66dec7dfd159e118fdcd06264f6e53283bc15cb8ccfaed83737a7a8231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883977, "uuid": "5b6c8224-8d18-4c4c-a545-cdc2db3eeaa5", "comment": "Malware payload (Mirai)", "value": "e142f08a8203192cd0a31ba7bc383d217a765933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883977, "uuid": "5140e183-f494-4599-9d1e-35c0cc3f7f00", "comment": "Malware payload (Mirai)", "value": "23580878869c1ffcdbfac51137088763a1d9a809870f99bd02084c5be8b5f161e89c69009fcd82e573d5203c68d82751", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883977, "uuid": "2c8aaf81-2305-467f-8e2d-e0821171c467", "value": "T180A339B3D8262E68C566D4B4B0B48F792F63999082835FAE5577C2B48443DCEF8057F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883977, "uuid": "e5513c60-4959-4d82-a4f7-b76296871ea6", "value": "1536:HiAtYZWVXd9xA2NCCnRKT5MoUuNGvKbyuWe/YgVhtR7L+y:CHZc9xA2QG4T7GvbuWeggVhzL+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780883977, "uuid": "b12a210b-a459-4615-a08c-a39d43a30b98", "value": 103620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780883977, "uuid": "fc8473bf-6c7a-4e09-9a71-420495fdb5a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883977, "uuid": "4eea07fd-244e-4406-ac58-9c301d118ca7", "value": "CRY.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbecd33-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780939589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939589, "uuid": "3d9143f4-142f-4927-ad0e-d50e44247b4c", "comment": "Malware payload (ConnectWise)", "value": "78770d507d867a6878f47322ca75d5a5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939589, "uuid": "81d8f239-b2ac-438f-b6e2-08b72d0cfdc9", "comment": "Malware payload (ConnectWise)", "value": "041f0612ae9e97036a11f0fa222e4dedaf7951bedb5608bfd47f339c5e936e48", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939589, "uuid": "55141b5c-7fb3-4576-88f0-e5169a221f3b", "comment": "Malware payload (ConnectWise)", "value": "06a1b42447041b6c836b57836b5238c0adba483c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939589, "uuid": "e35052bb-9b6a-46bf-80a6-ec3825c3d7bb", "comment": "Malware payload (ConnectWise)", "value": "b3ac47d3fd82bafa2da682925cf7ea5d72941e5eda2b2ed60f3b92d8ffcdad58f4cfaf8bcf2df3f396829177ad6bdd78", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939589, "uuid": "948b445e-91c7-416d-bb7a-78a1ff646863", "value": "T104646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939589, "uuid": "17d02af1-864c-4f95-bf69-fac450ce7d66", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939589, "uuid": "fcd328ee-6815-45b0-85e0-9655d488be0c", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9h:R1iw7gryNkSV1hy1Z1u2JLu9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939589, "uuid": "1e2c7edd-5932-45a6-96f0-604c664251cf", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939589, "uuid": "9e2ba9c1-8e06-42e0-a5ff-d087ff154589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939589, "uuid": "b338fd33-32a1-4c79-a437-7111e29719e0", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad57e0d-62db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780883183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883183, "uuid": "e6bcbc6f-cfd4-4277-be08-37eb3d18cc78", "comment": "Malware payload (Mirai)", "value": "5c152227f91af4ec7999c4489acdfd86", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883183, "uuid": "1556c7ca-8c0d-472e-86c6-1c092174ef1f", "comment": "Malware payload (Mirai)", "value": "0452e5f363cfc17bf436564ac2cf30e71f7ee30d2d5d66768482c45f8a734d12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883183, "uuid": "27a1feac-8e83-4729-a4ca-ea079a94d9b8", "comment": "Malware payload (Mirai)", "value": "d720d71aeed228b3f81e75d3d04c050bda260b87", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883183, "uuid": "853b373e-6b45-42aa-815d-e35eda487360", "comment": "Malware payload (Mirai)", "value": "7ab77e615701fa7788eade2c0c6cf7c368feb018ca82148a302444ddea6ff6669684c87f43ce758747766c1346c41949", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883183, "uuid": "6bc58061-ad9f-41f9-8f10-dd84f5e2332b", "value": "T1C93175EB0F197ACD5104DD7573A53548D090A7DF248FE794FB884C7AA2C854C3259F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883183, "uuid": "05cf60c8-0a37-4ce2-b7db-857bba4a5e9f", "value": "24:9BsVz+YhcHf0I4OGOt1ydTnp9ZaBEky5dQVNn2:HsVz+YhxxPs85+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780883183, "uuid": "eb3844d8-4299-43cf-8f85-d262e5e2291e", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780883183, "uuid": "a5dbd315-fc36-4b2a-bccd-e0bc55220f69", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883183, "uuid": "2a01649e-776d-4729-b874-40b138b08ea5", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f63411-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912050, "uuid": "15de9746-a805-423d-a90a-44431cccb9fd", "comment": "Malware payload (a310Logger)", "value": "de6961e1348ea5744463b3009692a094", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912050, "uuid": "fba59b1f-19bb-4619-a731-5c88e16e3acd", "comment": "Malware payload (a310Logger)", "value": "0490e7c646bb9d6ffc924682dcc7802486ab2993248f49ec9f0cab6f27bc3e93", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912050, "uuid": "78f171c5-4268-447c-bde3-3fe897556857", "comment": "Malware payload (a310Logger)", "value": "316da5e1db2407d734ffde799d54993f7e8b865b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912050, "uuid": "2c4b3e6e-e14b-4129-b099-7c0ff167cfc1", "comment": "Malware payload (a310Logger)", "value": "2c44236a8c200cdccdb45d3dabdc401856fea180b3e63392d65b9ee61d33279f27ab47281cca47ecf0028252666d2e80", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912050, "uuid": "a860af57-de44-4492-afc0-06a07327af75", "value": "T1CB944A13EB60A11EF1A389F1B8B5925A68267D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912050, "uuid": "06413981-538a-4df9-bf44-192acb19bcdc", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912050, "uuid": "f6273f86-ce61-4436-b1f4-6756c122fa05", "value": "6144:aoT8d1/w5KA81IJ8GpF6nuTmOOUiBUrjX6CzQef+NC+tW4TPb7ydMJc0Ze:KjYKkJj6GmZUiqrliNtf7ydMGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912050, "uuid": "c33621d0-31b1-4733-8b44-e88ff9c5efd2", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912050, "uuid": "265ff44d-5842-4ba0-aa50-de5f5851799b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912050, "uuid": "a59cad08-d0e6-48e1-84d1-3fecb6c897b3", "value": "0490e7c646bb9d6ffc924682dcc7802486ab2993248f49ec9f0cab6f27bc3e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5978f052-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908306, "uuid": "434eda6e-4f27-4304-ba3f-75d63b249621", "comment": "Malware payload (Formbook)", "value": "1b10d45d79d9794ba7b73d652b14b1ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908306, "uuid": "68c2929d-0c1a-4648-9787-0872aa9211eb", "comment": "Malware payload (Formbook)", "value": "04cfb265adf28d7d0114768dc81913b801cccda13e09663bd5dca41827fb9cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908306, "uuid": "f307a4a2-3f6e-4428-b8d4-9b764488ce00", "comment": "Malware payload (Formbook)", "value": "22351ed0a0d96b362add906b4e12d72112d852c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908306, "uuid": "673efe68-f91b-4bbc-96ce-b9636f1a4e06", "comment": "Malware payload (Formbook)", "value": "8e3708fecb43a5442438c580b56e263d3c3d592ac26b908895dd5924ba8ffd90d05d76228806848c25c10e5f7aaa848d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908306, "uuid": "60288788-4143-4d70-a86c-8a7ce744626a", "value": "T1E7351258261AD817C4960FB00D70E7B965685FD8E911E603DFFBFEAFF86E6542801382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908306, "uuid": "f71aebb8-b25c-4d55-a9fc-e12df214264c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908306, "uuid": "dfc97563-cbb1-46fe-a8cf-781e1d34829f", "value": "24576:aiiAEFT0D1lbLj4/FnfzFVHjoBK1fnUvCSkSH0c7M:g3FQ5BLj8dfXjoBK1fneCSpHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908306, "uuid": "5d509f22-0e47-4c74-8f8b-70c68f2bd1d1", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908306, "uuid": "1b5d77be-eff9-4086-875c-25fe3fb379d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908306, "uuid": "41793e42-983b-47f7-8ebc-ca6004ea121c", "value": "04cfb265adf28d7d0114768dc81913b801cccda13e09663bd5dca41827fb9cf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5ec351-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780908126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908126, "uuid": "98e1e8fc-f509-463f-b297-b26c929bc1c9", "comment": "Malware payload (RemcosRAT)", "value": "7f2b3386b6c942cb3e31c53fb11197c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908126, "uuid": "edb2a276-28c8-44cc-9252-0cc930a4560f", "comment": "Malware payload (RemcosRAT)", "value": "0500163df70a709472ed90dbeb9ce871156f5125736ce763fb61fe54d06081d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908126, "uuid": "f8671906-c07c-4c88-ae73-b6d27bda0cdd", "comment": "Malware payload (RemcosRAT)", "value": "1e1b1adb7b637db21917b1dc9a78f6ccf8878bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908126, "uuid": "7f929ab8-e5df-4d56-9aa8-790c949e2e28", "comment": "Malware payload (RemcosRAT)", "value": "29ff9ec228afa5731c3ddbd45204b4bc08d33753638204863bd3ab3db165eed36429144a6bf9ff26c961d176070f61f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908126, "uuid": "6cdfd96b-356a-4869-a8b5-0657f3a092c6", "value": "T190748C61730CA8DBC4CF27750E679B68936FCE845D51C02362A0BE5BB5BD2871839DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908126, "uuid": "d955027d-6047-48ef-b3a3-924814aba5a9", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908126, "uuid": "f606f770-278d-4257-9e18-8304571a1059", "value": "6144:bpMLtOZkoM9JPQQegIi5EyGeFVOVw8yO+T9HWj9gB+K/gd:YtO2oM9J2gIXy7PV8YWZg58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908126, "uuid": "0a12a4c7-39ab-4a7c-8efa-2e6f1e8ee34f", "value": 348752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908126, "uuid": "96ab1327-e25b-45c8-9436-2062d23c2cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908126, "uuid": "ba5f5b23-b5c4-43d2-9d75-4b177e228a1b", "value": "0500163df70a709472ed90dbeb9ce871156f5125736ce763fb61fe54d06081d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5ab9fd-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904930, "uuid": "78d59dcd-268e-4252-a9ca-c49e5d3565f3", "comment": "Malware payload (Mirai)", "value": "44a872217f6e3e252c9c0dd606611127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904930, "uuid": "c575fd61-dc9b-4274-8473-3b64c38c2ea5", "comment": "Malware payload (Mirai)", "value": "05013be0bd703ad8e0a82b35c58a8d60cc80de99a624fdaf28b29b71cd7d51a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904930, "uuid": "93f25ab6-de4f-4d5a-ba93-cee5aaaa26d2", "comment": "Malware payload (Mirai)", "value": "24276dd326dfcbe1a1a43ba3d7c2af746540f90c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904930, "uuid": "fd39ff82-7031-44f8-a9f1-b70a31fbe145", "comment": "Malware payload (Mirai)", "value": "bcd82b64ce67ecb4bbd93454538d23643e407c9ee28831334520b39442271c86b17785ee82dd4123cf72b9cfe187205c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904930, "uuid": "0ed8cd1f-8097-4c71-b068-f34a4c2330c1", "value": "T179D31849ED429F11D4E634FAFA9F41493353AFB8D3FA7101D9209F6023C6A9B0B36616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904930, "uuid": "bf4086d6-28ed-4a5e-bb19-ab93c2bc71be", "value": "3072:LCxNvfQhIENQg5KD2AWa/NQz0MY4Nb/gZzCvkRMSwkLu:LCxNvfIdNQQKafa/+z0MY4NTozFMSwkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904930, "uuid": "8cfb7522-9ec7-4acc-810d-673ae07261d2", "value": 138380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904930, "uuid": "fe3dc9b4-4a88-4cc4-bc29-35798922bdb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904930, "uuid": "c79e176e-4c6c-4a36-98a3-1889f2c4949b", "value": "nova.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71d0d0f-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907658, "uuid": "221c31eb-35c5-43b0-906d-045e23b9a8cd", "comment": "Malware payload (AgentTesla)", "value": "46a3526ae9d29ff15a1244d70c0b94a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907658, "uuid": "9e5e8ba0-1670-494c-ab5d-3381fcb24484", "comment": "Malware payload (AgentTesla)", "value": "05b032bee9865b94118117a67dfb05e932ebba591af16963835aa092397a6e29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907658, "uuid": "ff8f49a6-3181-417f-a0b5-b62339f7b3ba", "comment": "Malware payload (AgentTesla)", "value": "c7f8cf5f078d9a5c3199651ae022e9d0dfdba402", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907658, "uuid": "14fda66d-ca30-452c-ba1d-4aae57f784bf", "comment": "Malware payload (AgentTesla)", "value": "dcbd7b82b682a64233740a58704d086fc7b0b86b20ad7c80bafdbe7ff065f6457371357129b8de6901a148a9f1de899d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907658, "uuid": "a346361c-7f89-445e-9707-fcc86fcd22ad", "value": "T13F451244634EDD1AD8A28FF44860E7F543B48E949920D3138FEABDEBF87A74639452C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907658, "uuid": "155573ba-624c-43dd-b934-4fdf437f28f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907658, "uuid": "72aad3f9-5d78-4bae-a1f2-1d381d6ea1c2", "value": "24576:T714TS1Ce2OMxwEzThJLkt8KucNJ8iiy+0Zt6Bt0w0iZjG:F44ZMSERBEuqJ8RyxyAw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907658, "uuid": "d87f2e26-d154-487a-af1c-a81398ebff2a", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907658, "uuid": "237c14fa-6285-4488-97dd-eeb501666baf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907658, "uuid": "65d7f7ea-7591-4851-a9f7-ca9f7da87d9f", "value": "05b032bee9865b94118117a67dfb05e932ebba591af16963835aa092397a6e29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2af54f-6313-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907296, "uuid": "eca860e1-5488-4d33-b9ca-e974d96f5f14", "comment": "Malware payload (Formbook)", "value": "60ee73b0357146b73807ab0d2db003a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907296, "uuid": "0278260e-a4fd-4acb-aa3a-8ffe43cb793f", "comment": "Malware payload (Formbook)", "value": "05c78069954d1d61b747d2ad4b019ca56b0c24c263d54fe0956832c082303331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907296, "uuid": "6995b199-e139-4a2a-8551-89512b35779a", "comment": "Malware payload (Formbook)", "value": "21ef1a4d0ed12357c6a1a501e5bd8f05f8a3b985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907296, "uuid": "9b31a823-f5fa-4224-83fd-35851dbb595f", "comment": "Malware payload (Formbook)", "value": "76c545a9c9652e0d35d470b46a9e1343f0c752f48e334457eb3d2598cad677c2badc19dcac8fbf1dd33ecb289949bc06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907296, "uuid": "2e86d548-c0a9-40af-9ee2-38c9d326a87e", "value": "T1C425125C631DE816D0A25EB00D71D1F95AA41F94E922C207DFED3FEF747A266086A382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907296, "uuid": "d7ec06ee-cb90-4e97-88f1-f6fea3f8eeed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907296, "uuid": "c439ba73-9bad-4396-ab8d-69a8e44b1d9a", "value": "24576:hIhwZthSjklfFZ0zh6rAkHQosFo3Iv4d:hYwRSjkbWMr/xskIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907296, "uuid": "8b0efaa5-7a3c-430c-b993-f619a105e7f8", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907296, "uuid": "d01bb0d5-4e5f-4d62-aca3-e1598d6efe6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907296, "uuid": "f9cd4aac-b807-4082-8ac3-4f9bd3209fbd", "value": "05c78069954d1d61b747d2ad4b019ca56b0c24c263d54fe0956832c082303331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee68042-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1780911161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911161, "uuid": "15992b47-ec47-43c3-9169-37ec921a61bc", "comment": "Malware payload (ScarfaceStealer)", "value": "5bf8bb5a01e14c89a9e31845f9353b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911161, "uuid": "ca2fbd6f-c36e-4678-9b22-cd3a4e4d60a9", "comment": "Malware payload (ScarfaceStealer)", "value": "05e997f99cb9347fb32dee57502e0dfc3a906b0bdda7501092e48d2689e72fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911161, "uuid": "7c66577b-9bcb-46da-b915-80e5d6aaf142", "comment": "Malware payload (ScarfaceStealer)", "value": "68a3c7d2f80f833db6323c2e6beb3f5b8b68f3f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911161, "uuid": "ce9fd673-fe73-4ba0-9859-73b03a636434", "comment": "Malware payload (ScarfaceStealer)", "value": "79c70195ef97453e4058151860898da3266a07c0bca93a338c1fffdd5b835441bc109b53ae6eb2d7eae5df23f32de576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911161, "uuid": "c11e853b-ab5a-43f5-8b8f-0d91186d507e", "value": "T1B2187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911161, "uuid": "84bbb064-68b0-4688-878a-7a45b0ee505f", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911161, "uuid": "fd874973-8648-480b-8561-c1e138c4e200", "value": "786432:QAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:QAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911161, "uuid": "191edc47-2647-4e70-baa3-6a244993c20a", "value": 90270720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911161, "uuid": "898c5b3c-5a7a-4dd0-b6a1-2d7be9acc0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911161, "uuid": "31ac08a7-e93d-4f17-84f5-c23be52f273f", "value": "05e997f99cb9347fb32dee57502e0dfc3a906b0bdda7501092e48d2689e72fdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce1e64b-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780910943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910943, "uuid": "26b93ddc-3ffe-4441-bce0-91a73a015eb8", "comment": "Malware payload (GuLoader)", "value": "d31531ad3901eff5eede6243a9975daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910943, "uuid": "635410ca-9d7f-4116-86c0-f0f91c192029", "comment": "Malware payload (GuLoader)", "value": "0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910943, "uuid": "3a72a2c9-2c7c-4c0f-a0d4-5bcb3125a720", "comment": "Malware payload (GuLoader)", "value": "d9acef1c5f9ed1cdbd609a3999806f55d85e3293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910943, "uuid": "eda32370-33fc-42e4-9467-10a522fc2cc9", "comment": "Malware payload (GuLoader)", "value": "8f93da7c463c6ca8c03ecdb9e0973f322fd3151b6286efe2dd41d434f847e781b2b10a3bea8b934b6de86027ff77adec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910943, "uuid": "e6598d41-2b7e-4609-9aa4-28d9dfbda261", "value": "T1FF8412163F64C55BC0B14272DA6AE6F632549DF1CBAE8F0F1E403E1DF9712418E1E26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910943, "uuid": "f95ee5dd-6c7a-420c-a710-1bdcd2787f3d", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910943, "uuid": "098d11d3-70c2-476c-9e20-05a55b5d9d28", "value": "6144:94t6LsCB7fXyMBDmJJm2DVe8JccHMQBOAmnFuy6UCEoWQ9:9kCBLXy8mJm2DvrROuyIWQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910943, "uuid": "aae2f20c-e0eb-4067-9a41-632816e02ce1", "value": 371184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910943, "uuid": "6e0b055e-e40e-456e-9160-eb88571d2eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910943, "uuid": "1c34c948-f691-4f39-95e6-04e011680eb2", "value": "0629d6563babf92a6a92aea085c9396fe755ac61d7f2175d8feb3fbc982dee05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511b65f5-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912587, "uuid": "5cde388e-589b-4f70-87b9-10480cbf2309", "comment": "Malware payload (Formbook)", "value": "29add908fa403a89387ab9636e41b012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912587, "uuid": "d2b00486-b269-4117-b93f-1b6fcac147f4", "comment": "Malware payload (Formbook)", "value": "06840a4bac62abfd410be15bd45ae47a9516682515baa9c981058428815c5fe7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912587, "uuid": "240d13be-e2b1-4e74-8ff7-ae02e8190d5e", "comment": "Malware payload (Formbook)", "value": "d8eb52d0702715bd69f5e028441bec638a55275d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912587, "uuid": "ab402757-b5e5-49a3-82c7-11082766e0fb", "comment": "Malware payload (Formbook)", "value": "1ad267f7ff3dd3e784e228dfcf6982d41a92910d1491f0cbced2aff152561a1181833cbea3c747c3fede5985c7f25a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912587, "uuid": "fc572159-50d0-418c-946b-daf5bd127d3e", "value": "T11D251228EBA7F522C59A073619A0C33003784E6EE417E3975EED7ED7384E7727959280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912587, "uuid": "25dc8919-4280-477a-a704-fe9fd455be72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912587, "uuid": "d71aeb4b-e3fe-427d-930a-1cb7b74c84dc", "value": "24576:+2snM+MNEMprk6cG2MV72MZdNf52RxB5cC4+OluM3vzQfxd6:c2L66cGL523B572l2fT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912587, "uuid": "8809f995-a1d3-43c0-b69b-0dd01a21f052", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912587, "uuid": "b4789d98-5bdf-40a2-8606-b743975250d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912587, "uuid": "765b9545-4724-408f-b8a5-02396df54cc9", "value": "06840a4bac62abfd410be15bd45ae47a9516682515baa9c981058428815c5fe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c26edb-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910078, "uuid": "64e32fe6-caa4-4fea-9a2c-5eb54d68a08b", "comment": "Malware payload (Formbook)", "value": "31a4585ab72863168ff95bc06345ea84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910078, "uuid": "219a678a-cbbc-476a-974b-e4b25162c523", "comment": "Malware payload (Formbook)", "value": "072d9c3024c9a48945bddc88911c2e94ff15958ed1cd61bf1594cc109e6cccc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910078, "uuid": "1a6a5db0-abb3-481a-9575-e0e737390732", "comment": "Malware payload (Formbook)", "value": "f4c87edb57ec080bc803ef730c0267c96d346735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910078, "uuid": "c6077a7a-e34c-49ba-9f59-78303c078119", "comment": "Malware payload (Formbook)", "value": "870203cca31cbfb35f68bd87245ef26edb73f3b3a417addfcec5da243e2e4219b204ac296e4bf2ec12f1e4b0c3f03a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910078, "uuid": "f2b51c7c-cd1b-4f79-b6b6-8ebd59e3d03f", "value": "T13A351254225AD602C4974FF10D32D2B42B786F9DA902D207DFEABEDFB5797980845383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910078, "uuid": "3809e573-1978-41f1-a170-7a362f12690b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910078, "uuid": "6a26d28e-0bd5-416b-b6a9-edef4a1464ea", "value": "24576:GmzZ5I8NHFLolH6CUByYUEUVvwmISGpAloj6:hV59ZFcH6CUE2K8oo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910078, "uuid": "94ef05d9-b35c-43cd-9520-aa5e4fa350d4", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910078, "uuid": "d41e0548-05e0-448b-9a05-ca384f267c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910078, "uuid": "153005c5-b0b7-43c8-9184-68eb00bedd81", "value": "072d9c3024c9a48945bddc88911c2e94ff15958ed1cd61bf1594cc109e6cccc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8a9607-6341-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780926937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926937, "uuid": "b6aa1359-0f90-4b34-8170-b538ede51629", "comment": "Malware payload (Mirai)", "value": "3e5c9b4f2de5541b20b8921540cddaab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926937, "uuid": "468226c4-e1be-4b2f-ad5f-43bc4cde901b", "comment": "Malware payload (Mirai)", "value": "07711bab80b600204125fad06f606c2755087d5fbfb058b028ec8f9b8dbe6d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926937, "uuid": "159fed35-e580-44ac-a8c3-445da29c4277", "comment": "Malware payload (Mirai)", "value": "5ad890ac777969b786abbc86923721ecc08530a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926937, "uuid": "31d57329-e194-4fe2-99df-4ba0e09e6119", "comment": "Malware payload (Mirai)", "value": "9762f647d9881f0a27db27b4f0ef9eeabfabd021f340ce42e43475a999f7e6a778d66b537216da88e937a954e092b0b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926937, "uuid": "38b3b6b3-7836-4d9a-aa06-fc721acf6a59", "value": "T193261A97B8958643C4E4267ABCBDC1C433631EB99B9B12675D04FE3D3ABE2990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926937, "uuid": "3dbbef9a-8ae7-44f3-a4d7-c60b7e910eb5", "value": "49152:tcyxs6hrQFpEg4f62tCNI1WYoD/JU1F1:GyxZ+pEg44Lb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780926937, "uuid": "3a33f38f-80b8-4cd4-806f-87825b5cf542", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780926937, "uuid": "8d07e602-ad36-4202-b7e2-ebb70f043952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926937, "uuid": "802c4bc3-842b-47d9-a655-2939b3b50eb0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30426a06-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780907378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907378, "uuid": "b095a16e-dccd-4144-82b7-d3a570eebe49", "comment": "Malware payload (XWorm)", "value": "1c36e6c309f110d95846952db86fc1aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907378, "uuid": "75c53cfd-1a23-4503-a293-734c9222cb6f", "comment": "Malware payload (XWorm)", "value": "07c3cc76765295534f20b4e5978fd5a158ef227f8c5815d3b59af0bafc9b821e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907378, "uuid": "c7269f01-205a-47d6-a0f4-4137eeb93c2d", "comment": "Malware payload (XWorm)", "value": "2aee57e8c76789765113b67c19b4929ce55f06b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907378, "uuid": "bb1fb230-97c9-499c-b347-47baa51614b4", "comment": "Malware payload (XWorm)", "value": "ccb790eeff4fdc58e3e0847e1cad1e58da207cc5d4a14ff248e40bf97cdb2e7288a44493307efe8e8c5dea3294b3193a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907378, "uuid": "0c7b0f65-7fe1-48ac-84e3-992ade80fd23", "value": "T195F401586309DE06D4654FF48D62E0B427F8AE98F912D3079FDA7EEFB4727201466283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907378, "uuid": "acd14978-1f6f-43c2-86ac-7c338c09811e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907378, "uuid": "df192282-b60a-4bb2-9e5a-12e16be668e1", "value": "12288:2hz0Ztroa/R8miwDfPOczjs69QZzCpF4HMmKjsdClbDZKXGYLCimMQRUYD6Juzs4:2hwZtEa/mpeHOY4nzQF4smK8abtKZeD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907378, "uuid": "65640b06-ee6e-42fb-8817-f90bc9a056e4", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907378, "uuid": "e57b41e0-5376-4027-82e9-d42f34bedb3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907378, "uuid": "6757dc76-4252-4f10-8138-efda6079fe6f", "value": "07c3cc76765295534f20b4e5978fd5a158ef227f8c5815d3b59af0bafc9b821e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9871183-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780908575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908575, "uuid": "5844ab2f-f3a9-4819-bc74-2a6f375f8f5e", "comment": "Malware payload (RemusStealer)", "value": "5881f3acc3a20ac03d088d99c56d12e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908575, "uuid": "baa96890-8695-4c51-92f9-ead0933c17fa", "comment": "Malware payload (RemusStealer)", "value": "07ed241e145a1057e4a409e8e0a2d3af39591e00821058de2a37c9e3b28eabdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908575, "uuid": "c0528442-8e44-4b27-89e5-0c7525592327", "comment": "Malware payload (RemusStealer)", "value": "51057cfc870765734a68742b61d4bbb1f4a6512c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908575, "uuid": "50149c93-1ac6-418b-8b37-adf43aa4398a", "comment": "Malware payload (RemusStealer)", "value": "0b0867881bc61604e0852f9b9f7af193e0c010f52b8584b4d16ef52ceff67eff29b6ad9f5d7fe9d5064d02bb98f73e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908575, "uuid": "f7c11e55-5a66-49c6-a297-360073ed3e7d", "value": "T1CF754B1B7C9009FAD4AA533288B662917B75BC460F3227D32E90B2783F7A7D0AD75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908575, "uuid": "2b54c67a-e96c-4012-a6df-342981c7b713", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908575, "uuid": "d372f417-17e9-4243-98b5-09007afe7378", "value": "24576:Cpg9+IF/gH2Md1640Q/i8BbCfsXQ/MBele5ZK2Rl04:CpJI5S2Y164h/i8BbNj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908575, "uuid": "29579f4d-7103-4fde-b837-b824ab53f7b6", "value": 1664648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908575, "uuid": "3dbbb801-6b80-4d3d-b3c1-8f50c2d1f4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908575, "uuid": "254bc838-36fc-4efd-8154-d58541b93afb", "value": "07ed241e145a1057e4a409e8e0a2d3af39591e00821058de2a37c9e3b28eabdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d9c3aa-62e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780885946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885946, "uuid": "ee43c4f8-85ca-48b7-aa71-eaeb2869d63c", "comment": "Malware payload (Mirai)", "value": "77b06bbc58032c99a0f0f3a165258d90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885946, "uuid": "3589b236-81d2-4221-9fe2-0448c86ce72d", "comment": "Malware payload (Mirai)", "value": "0833778dc8d470a32e0bd7858bbe805bb4f12cb87345314f1796463d2d7b7d22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885946, "uuid": "2efe6316-72f5-4f47-aeda-e48402e764b4", "comment": "Malware payload (Mirai)", "value": "12a3483cce8899176494365c0661e729d7024cbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885946, "uuid": "afc66c42-b583-42dc-8709-b17f3e391523", "comment": "Malware payload (Mirai)", "value": "2d649fb4a9230a26534b67a8b852a6dd11d0076abc56d8010bc7cff1d3688b723ccc7b29f69920aae9eac747fab5401c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885946, "uuid": "8fcb985a-470c-4ac7-9aea-efa3cfcd74b0", "value": "T13ED3EA46F8819B15D5C111BAFE0E124E77231BB8E3DE72039D246B707B8B97B0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885946, "uuid": "ef373b39-b827-46ed-a769-0d6c3ce3c78b", "value": "1536:Wgnp0TiihWvrf5nCaR1m8d4XyUtBFxFaZzTkc0iLiYOcY13p6SU51oyzs0m0SZU7:v0aEaR1fKXlDalOcY13p6JXoycYB+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885946, "uuid": "428b3122-9c8c-4d35-a5b9-c330021e2827", "value": 132796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885946, "uuid": "f1d76d78-2b1f-4839-b68e-68e4caf10ccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885946, "uuid": "684b1132-8a96-4485-8d24-77fb3d1c97ef", "value": "CRY.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de94ed0d-62df-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780884907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884907, "uuid": "86a57d48-7fb7-47f6-a7c3-4de07f7b3075", "comment": "Malware payload (WannaCry)", "value": "f6f9511685e9f580ae020fa1496a56e8", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884907, "uuid": "8ff43cb6-b7e8-4ded-aa68-7b7527b6ddae", "comment": "Malware payload (WannaCry)", "value": "091e5dde1f5fb3cf6575415357bbb560faa55453bdce5a092470df495187a594", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884907, "uuid": "a2432698-a16f-49d3-8aed-c11fa724d491", "comment": "Malware payload (WannaCry)", "value": "b95c336c9297fb00670687a23335d058117fe866", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884907, "uuid": "8962bbc1-5317-4bcb-97f9-7b769ea520fc", "comment": "Malware payload (WannaCry)", "value": "8bba4cd79e5ba3100cb3da4d28202532440ca6d6bc493fb12bf05f8ed4e888565c197e07d7d2e9778c1e444cf804b701", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884907, "uuid": "86be649e-640d-4e5a-b6fe-7504a358edb2", "value": "T14036F14A739C90BCD016413594A34F6AD7B3BC566678870F4B54BB6A0E33380AF79B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884907, "uuid": "37759b86-a623-4104-9536-822c94b16b89", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884907, "uuid": "467cfca3-01bf-4ac1-9bff-bab0626f72c3", "value": "12288:jbLgmvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcb:jbLgWbLgddQhfdmMSirYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780884907, "uuid": "d7b7b482-a156-4e26-aea8-6b8326deae1f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780884907, "uuid": "9b0c6150-2ee3-4e04-823d-9e19b9c85323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884907, "uuid": "01274bd4-2be8-4345-9845-ca26dd1ea6fe", "value": "091e5dde1f5fb3cf6575415357bbb560faa55453bdce5a092470df495187a594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc697710-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780911479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911479, "uuid": "2b3f44a7-5315-434e-abc0-0a6173b062db", "comment": "Malware payload (AsyncRAT)", "value": "97109256c5db33ef5c4afbbe569eb3b3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911479, "uuid": "a75d4c25-16ea-4baf-a971-4d7bb9c2cabd", "comment": "Malware payload (AsyncRAT)", "value": "09b357949e60b7cfd0a455ae4bfeb95bbc287ba8c55aaa7813e08327db251499", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911479, "uuid": "23852d53-4c56-470b-9ce5-f00c6c13b5a5", "comment": "Malware payload (AsyncRAT)", "value": "1e62b7eafde2fa20bc3ca56e29698f4fc259c9a5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911479, "uuid": "00137670-ebdb-4e16-a430-e1a7064eb847", "comment": "Malware payload (AsyncRAT)", "value": "7b4719bbdd0b33f24f53b17ad11f6423e5c3f295dcd384f26e3be6c41227efccfe3358a1faf3d2c609df6f4b973f432d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911479, "uuid": "f4e11995-e5ac-4863-9b6e-70f964342ad6", "value": "T15D0501182615D252CE6417B50AB0E2B917BD6EEEB501D31A9FD83DDF7C36F018E28293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911479, "uuid": "9cacbd27-f350-4285-a606-c2ad8f6ba51d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911479, "uuid": "706160bf-03e7-4638-bb68-dcbda12d2658", "value": "24576:Nwjt+s647CJqddxVyghfJsCgD29eGJWXWdDG:sG4CJCdbhRREGJWGdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911479, "uuid": "abc63b9a-e141-4084-9ad3-c77909be6e19", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911479, "uuid": "9d91a1b9-9584-485e-b399-6ee1f6c8947d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911479, "uuid": "e135f9ee-b26d-4017-a6e5-19be201e8a0a", "value": "09b357949e60b7cfd0a455ae4bfeb95bbc287ba8c55aaa7813e08327db251499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e286898-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780904985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904985, "uuid": "c30e0f0f-fa14-4495-9774-d693e6455dda", "comment": "Malware payload (XWorm)", "value": "d3aaf2cf3a9ead9c141332047648d4df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904985, "uuid": "de638d78-45ef-4519-82e2-a0824d15472c", "comment": "Malware payload (XWorm)", "value": "0a0d0f34402793e8eb5f4d90b8d31c26f38765e9db05e0429fe5352c0482f254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904985, "uuid": "75b11377-439d-42ce-b5de-1271418c27e0", "comment": "Malware payload (XWorm)", "value": "4dd94c1125fb4b440fb6e0fc45cd0d8a83245f86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904985, "uuid": "fa3b47d4-312e-41af-b93d-e2de499840f8", "comment": "Malware payload (XWorm)", "value": "6e5aa5537d59f2076170825a5b9f488b67ef7a59215a235498956d782ef402e7fbad4b3f009c978f61a25a3244321af5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904985, "uuid": "c3f772ca-6d47-41af-9218-10f8ff99c850", "value": "T1FC159C91EB429AF6DC9B07708229141413B09CF272DDC7565EE87CA63562E4CBA3EC33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904985, "uuid": "b3316c57-9f01-43a3-8ded-57df08699420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904985, "uuid": "4deb69d7-57a9-4e36-a232-1272c0815963", "value": "24576:IGoMnRKjN7z8Po44LTd24Ec12buDbVlT:IGojjPs4U4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904985, "uuid": "f6fe0c19-e1e1-4e41-b65a-53a8c8dcb1b6", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904985, "uuid": "4e917c68-1ee6-4168-8b99-a82355b9584e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904985, "uuid": "83fab6bc-1223-4948-bf39-11f51b81172d", "value": "OOP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5484e8ed-6378-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780950389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950389, "uuid": "6b81ea6d-23df-474c-a02b-64ce1e50efe7", "comment": "Malware payload (Mirai)", "value": "8048a73441be3e720a39ef7d7efa099a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950389, "uuid": "8cfbe5c4-2ee5-48c4-a93f-f3be0acbe9cb", "comment": "Malware payload (Mirai)", "value": "0a8313559cdf770d9ee5496a3f27e9646986dc8dd09c6ac831bd5466901cefb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950389, "uuid": "2bf66328-f77e-46cd-9310-71cb79a547b5", "comment": "Malware payload (Mirai)", "value": "6a6935532b5e69a219d533637271406243888fd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950389, "uuid": "afe8ed30-fc88-4d07-bf60-53942da95c57", "comment": "Malware payload (Mirai)", "value": "343abfd84c5ed2572412fdedc8ba310d0d6b1d896bfbe9f0c83cb8e9381135094477cfe30a555fd57254d81f2c21bf68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950389, "uuid": "54d1874e-bafe-4e2f-95b5-730aacaaf1cb", "value": "T1B7A39E12CC641D9CF02B6D7020B48AFA8727A484551B6EFB3D56C2261057EECF5DBBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950389, "uuid": "d75f76cb-b9f3-464c-b98f-64f00f2a32b9", "value": "3072:P21HiweBmA0pQls3p8hS/Pf7lLgeKbYVJ:P21C7BmAyQCe8ih+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780950389, "uuid": "bbcaa544-ab02-462c-8c14-6d8ff0cabec0", "value": 98444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780950389, "uuid": "261731ab-39a6-4481-814f-65e8acf7150d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950389, "uuid": "a2943211-f365-4352-a7ee-30e64966c165", "value": "jklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb524235-62f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780893089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893089, "uuid": "dc69d2d6-e56a-44d8-9b77-f6dae83f1f95", "comment": "Malware payload", "value": "9c6c1c2a43a46435597c5493193beb4b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893089, "uuid": "d92061f5-e704-44fe-b5bd-96dcf33cc00e", "comment": "Malware payload", "value": "0ada3a819a2cdffe006e9272a7d7921a8bc90b3ca4bdd667186510a65f75b658", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893089, "uuid": "95643d3b-e37e-4a3c-ad24-859321097dae", "comment": "Malware payload", "value": "6587b8e401f4bdd3d3a14a9e6915f0aa82eccafd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893089, "uuid": "7de9fc24-d585-4e6c-92aa-dbed7e2a9b2d", "comment": "Malware payload", "value": "64bc235c70be90ed503ac19f157ad833d4de22d8fb9b49dd5ce6457983e332fc7ff16c91f333c2fe9c3454fcf9231c40", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893089, "uuid": "bb3e445e-9d87-4159-b714-4b67cd56adab", "value": "T191B17DD5D11043EE4CC4FC4261858A14B42D66E14FC37BBC752163365AE4277C9DACAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893089, "uuid": "cee3bd23-bcf7-4fb4-9ea3-fa576ac190ba", "value": "96:eJsUa4j4k+q0O+iWznX82ty+/TkIiB7+YG5TMmpzIrfBjhnjdV6Vqc:eIHq6iWpp/SB7epjpzIrfjjfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780893089, "uuid": "988aed04-d4ad-43a2-bf23-e00cd9dce697", "value": 5294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780893089, "uuid": "c9ca22dc-f426-432d-9b37-93fe3e20074e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893089, "uuid": "22454c82-6db0-4ab9-8cae-de4bb0c65a6e", "value": "h.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fd5c08-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780912414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912414, "uuid": "4a93a3da-3fd8-45ba-b354-e8b1aa5c27af", "comment": "Malware payload (Stealc)", "value": "c19cc92ed0eebefb1201fd06a7af9bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912414, "uuid": "ba5122be-c596-4d72-9be7-a4efe39f9fc3", "comment": "Malware payload (Stealc)", "value": "0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912414, "uuid": "d6a65b24-68a9-41de-82b6-c0b84d8e0c7b", "comment": "Malware payload (Stealc)", "value": "397ee881df2f00dd9748dcb25fc7238faf71bb9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912414, "uuid": "b1e95e1a-f165-4e8b-99d6-ec39e9c6a293", "comment": "Malware payload (Stealc)", "value": "9fb5b6543f9c8c8b80170748965671eead219a8666f0311b3a52d0ab33afa78720a34f6714e050e90c1b217fa200644b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912414, "uuid": "9276fe4d-7084-41c9-a6d7-bbd36e257c12", "value": "T1BC033B6B3FD61695DC628679C775D23BEEF0B1A4B0206E4F0725CE2AEF23102D520D26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912414, "uuid": "50ed4b1b-215e-4ce9-88ff-54c05eb684b3", "value": "9d6b7a90e30c979aada0c2c88281d1b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912414, "uuid": "f676514a-1c35-4919-9ecd-cc64c8876e9e", "value": "768:+vBc4FsYxddOnewnRyD5+tRkXnCGZAO2k43nJOQVmmIn1hOV:+uesY3CnRy1mRe1ZovZ5VgrOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912414, "uuid": "0e008308-f977-4cd5-aaae-48ab7478cbb6", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912414, "uuid": "7eee40d7-c3a1-4a3b-a366-1f119234a362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912414, "uuid": "7d648bbf-8dc8-4e65-ae0b-6ac06d4bb275", "value": "0b1954a4479d66d3a49de26b07bec8b4966aa9bb47d0e23815ab4560cf7614aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e910178-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912932, "uuid": "0a677aef-eafa-42f6-8ef9-a7b57c08ade1", "comment": "Malware payload (Formbook)", "value": "571ec0000569feb46e93a5351c1b364a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912932, "uuid": "3b6a7dd7-8a4e-496a-afb4-9b3b68bdceed", "comment": "Malware payload (Formbook)", "value": "0bac76482148c816b63af8a4df15f51b32365b7bdb3253e85b61c4f2cbdcc335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912932, "uuid": "3ada1adb-4c2c-4ca6-a047-9f2dac5ed277", "comment": "Malware payload (Formbook)", "value": "7c605a1e8667c74cd4fe6aabbe1aa46178ebf6c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912932, "uuid": "68f8d017-743a-4ef9-9a32-1c3b90a1032b", "comment": "Malware payload (Formbook)", "value": "ef423044a042b3b1ca610c764724aed365a76145712dcdb7ed8bf51ead8c96755f3c8edd101e43d1b85c3e3df5394d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912932, "uuid": "911466f8-6147-48ba-86d8-992129991eb0", "value": "T10925121D6E69C403D8D217B80A61F6B166699EDCF510C223DFDAFEF738B97681886340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912932, "uuid": "0d7c7312-5321-4790-8365-93d36d5ae162", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912932, "uuid": "02cdeeee-6d07-4a9a-be35-5a38607ce5a0", "value": "24576:C5rCuxY4x/YWKun0XvCufPETd0bqqFjsGWmhR9Q0SxCD3WPIG:crRW4xglcczETyjJvJS03Wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912932, "uuid": "aaa3b065-d396-4096-b4a5-f81749dbf65b", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912932, "uuid": "94a78451-0fb9-4584-8a37-f224bae81b1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912932, "uuid": "c42bf2fd-0ba5-4d62-8ca4-b0ef08137d78", "value": "0bac76482148c816b63af8a4df15f51b32365b7bdb3253e85b61c4f2cbdcc335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bba56c5-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780907397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907397, "uuid": "b1a55e56-0e44-4058-89eb-587302623548", "comment": "Malware payload (PhantomStealer)", "value": "b51949b8ed206dda6c833ffc3cb0c950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907397, "uuid": "b5874a17-1e4d-4dd8-b00d-91b08d61088d", "comment": "Malware payload (PhantomStealer)", "value": "0c6202fa55e12253134e34558335585265b5ddf4278b3021567b49402c14fbde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907397, "uuid": "c25570f0-7cf6-4249-974c-6963a2d364e1", "comment": "Malware payload (PhantomStealer)", "value": "6c8f341ef280f3f396ea6f31b43fb224bc06894d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907397, "uuid": "d8c33ff4-3795-45c8-b62b-2c0bef4d2e3d", "comment": "Malware payload (PhantomStealer)", "value": "d736a61e92b7fa524e6afb9dc896d1f973cb5f47f06228872363ebded40399dfa1982c14a2010b64638bf744cdb856aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907397, "uuid": "e2090f76-ea55-4638-8e83-d0cff8325477", "value": "T1646512142219CA0AD4A35FF05D61D1F027F05EE9E925D207AEDB3FEF787A3601A16683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907397, "uuid": "a65d0e45-eee9-4cc3-a616-89c66a84c353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907397, "uuid": "e2888d6d-8a14-455a-9e1f-0a7013bd9608", "value": "24576:/hwZtPFlRYSpUBp4Ns74a3YcT0aXZCAddg3EgToycaxC/0EH0YgQR6QByjfAnlZQ:pwfD1yh74avUydg3BGHXgQROjfwz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907397, "uuid": "bf2e9e5a-3e04-454b-9d33-0410f92ee1fd", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907397, "uuid": "f74ee51a-82d4-4e80-89ea-887a9cd3b672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907397, "uuid": "10bdcfe9-53fb-400e-9dfd-11ce25b91daf", "value": "0c6202fa55e12253134e34558335585265b5ddf4278b3021567b49402c14fbde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649d4a88-6346-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780928941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928941, "uuid": "73a45320-6f57-4017-acc7-d90f969c2a8b", "comment": "Malware payload", "value": "ed56f6b065604b3bcfd3c51b9fa619d9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928941, "uuid": "65d631d5-5566-4a1c-a9d7-f65a37b1101d", "comment": "Malware payload", "value": "0c735b50b47537a7f8be55c3249f75b7d3520142b1d661d91d6aab5a390cc738", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928941, "uuid": "6e456717-bd2a-4866-83b4-e6c875d33b52", "comment": "Malware payload", "value": "ef080162bbd8e63928181de563de132ef0bf9ba8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928941, "uuid": "750a69b8-18ce-4e77-a08d-4ed094dde4c3", "comment": "Malware payload", "value": "817224cac394f16eab6e79d84f76fc4edb76ea4e64abdc09b381234db5ce6b416afa6a25ecd878275a787173bd903cfd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928941, "uuid": "c4a766a7-26af-4992-912c-93f40e2ba425", "value": "T161432BC8A7F9DED1AA0B2D80F181F6C724994AAD9DFC274B411274045FCCD8ACB49E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928941, "uuid": "9b95a090-d8b3-4567-948a-3e7d0c869235", "value": "768:I4a1MSFip4guIhempbqxTCLk3syDXy5uOv3O8KEs:I4Rr8xL3spYOv3OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928941, "uuid": "ae0c1a21-b68b-41e4-959a-42ca896064e6", "value": 56861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928941, "uuid": "a02e9466-6a0d-490f-aa77-313363b2308b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928941, "uuid": "9762102c-64d9-4191-9046-c37b4abf79c8", "value": "NEW_ORDER_MP.S.006025-01626.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afa72e8-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780910349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910349, "uuid": "1229aecc-fe0c-4be1-aaeb-33a49ee15087", "comment": "Malware payload (PhantomStealer)", "value": "e6cf5f821a8bb4d771421547f6bcb83d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910349, "uuid": "ec0b499f-4162-480a-96b8-65141d904c99", "comment": "Malware payload (PhantomStealer)", "value": "0d13e31b0ff25e3ff2e564ae518a72e7cca222174565bcda0d2e15154a4ec46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910349, "uuid": "2375a43e-8457-412f-bf15-1fa0e91e938f", "comment": "Malware payload (PhantomStealer)", "value": "ca00e4703ff791fb3fe70ef32e49065e62947f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910349, "uuid": "710c5efc-e3ea-4e4b-98f4-f945c92853ba", "comment": "Malware payload (PhantomStealer)", "value": "c52098254a76c10affd6053753c018095cab9803058b14621a257babb2ca203497cf1c7a9f180c268fb8861b1d044888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910349, "uuid": "41e2ff45-800b-4a87-affb-67830d01806b", "value": "T13AF42315B0E9E136C487517004A578E396D7FEBF17A96E0B32801F2F6CB1999DF0D24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910349, "uuid": "e1efe414-f757-4e3e-a3bb-57445946e48b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910349, "uuid": "a5dfb749-0f27-4f58-bcae-bcedcde31e73", "value": "12288:b+99qAKgwu+DgQm08gOmEb/ezdlPdaHNLsUXAWohV75/wwZ:b+zqAKBhgQP8gOBKfMHN4AAWoBBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910349, "uuid": "60563241-3073-4ed8-89e5-01223b845f0a", "value": 747336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910349, "uuid": "e7ecaab1-b2df-4803-a24d-d4c91617cd96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910349, "uuid": "104046dc-c282-4b93-a730-6a24b9ce57d2", "value": "0d13e31b0ff25e3ff2e564ae518a72e7cca222174565bcda0d2e15154a4ec46b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f9e5a4-638f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780960508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960508, "uuid": "805acfa9-01d3-4834-9df7-6a301a1cd96b", "comment": "Malware payload (WannaCry)", "value": "e4690b0265dc1c007a70be3fa2869e03", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960508, "uuid": "ed2e4834-df07-49a8-a59c-efcb14f805eb", "comment": "Malware payload (WannaCry)", "value": "0d8a9343779fbd652ded558c727f277b175cced909886f0cf9ed2aa04203a651", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960508, "uuid": "4e4b2d2a-30a1-49d3-bc62-6869bd5138f4", "comment": "Malware payload (WannaCry)", "value": "a1afd0f2ff7adaf9ad61fe44ddcba91347369cc9", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960508, "uuid": "1b786bd1-004d-453a-bd97-6fc96aaa560c", "comment": "Malware payload (WannaCry)", "value": "1156ee0c12d1cdf77af0c4037c359d3e35f9a35effcc97c3a11809b4f2d74e8d25090b77202f20a5661c1d35b2f2c10d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960508, "uuid": "61554b61-f66d-46ec-a5b0-9ff0113cd50f", "value": "T149363348626CD0FCE0410AB488B78E29F7B37C1967B64E0F5784877A0E53B9BBB94751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960508, "uuid": "a150be05-820a-4ac9-9bbc-15a4fe8a9ebb", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960508, "uuid": "ca6aadc7-7670-4e15-b0be-534e8422e674", "value": "98304:DI86Qhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DI86y1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780960508, "uuid": "451218ce-711e-497f-adc2-09463fcf4aa7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780960508, "uuid": "c2112342-0cf1-4ce2-915d-9cae56aefbc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960508, "uuid": "010fddfb-fff2-43e7-8321-119cd8778245", "value": "0d8a9343779fbd652ded558c727f277b175cced909886f0cf9ed2aa04203a651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c35930b-636d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780945570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945570, "uuid": "90d34e5c-2f5e-4036-af3f-f521063e5c8a", "comment": "Malware payload", "value": "1d7faffd7c08f1b1bf3fa090ceb77992", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945570, "uuid": "12ff31cd-fdad-43e7-8992-78a89b616eae", "comment": "Malware payload", "value": "0eadebbb7031958233a8fcf56a59f4efccbdbb0785c6891b699a9a552e3af933", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945570, "uuid": "daa2ff89-955e-4753-8132-4c4f820eda44", "comment": "Malware payload", "value": "911df10467076f7faa1fce390348f7fdae2971cc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945570, "uuid": "9c2604e1-cb2b-4215-9566-ffddeee17edd", "comment": "Malware payload", "value": "a679d90dfbef67ba8d1bcbfb65759a1dd91961c3f0e1f983003072348a2b6cfa2d6f0146b4b1d3b1d740c3e4e2bf2843", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945570, "uuid": "40318386-4d2b-4c6b-b9ae-205b9935f3fb", "value": "T14C1168A6E7DC9007DBDD447092E69955D71D8C6603C8135B3FE5272E1D8A6490E3C3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945570, "uuid": "67bff8c0-b516-457b-82ee-0593ffe9093a", "value": "24:9257mzpAEogQMGt5dKYdS1GR5kknrIKfewoPGi/57mk:92MlAEru0YdJR5zrILPn/Mk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780945570, "uuid": "8d136638-a9aa-4cc7-8b7c-f6da421d916d", "value": 1047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780945570, "uuid": "351b2236-da53-4d6e-9e97-f5d5edecfc83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945570, "uuid": "eb538ec8-fded-4c61-afff-31edcf8eda6c", "value": "version_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e572c3-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780910506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910506, "uuid": "c42bf96e-d928-434f-bb1a-dbb1d4fbc7ff", "comment": "Malware payload (SnakeKeylogger)", "value": "2ee751c832433ba6e345e391e554709c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910506, "uuid": "20060af8-8edc-460c-850a-9016fbcc87dc", "comment": "Malware payload (SnakeKeylogger)", "value": "0eb49c16aa8486fe6161a87b3284d95c174f6c953962525335b2cfcde17de7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910506, "uuid": "ef53d0f6-d15a-44a9-9fec-1dffa1497a22", "comment": "Malware payload (SnakeKeylogger)", "value": "c90ede646fef3e85c0e9846511030019039b14fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910506, "uuid": "adb3625f-8e64-4a84-8723-6cbcd1f2f0a7", "comment": "Malware payload (SnakeKeylogger)", "value": "71f06d70bc6e4bc5a1fa0ab341260cb618b86ee932e8c5b12f2a87b304d155abc6c5f2955dd820f7c232c0f2e4f41c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910506, "uuid": "5cd1446e-cc90-422c-a5b0-b44affb9843d", "value": "T1AD357ED1B150C89AED5B0AF16D2BE53025A77E9CA4A4810C56DE7F1B76F3342209FE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910506, "uuid": "b79d3550-6900-432b-b578-91a1582fc598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910506, "uuid": "94f783ff-3cb8-4771-9206-b4c8206b7101", "value": "24576:hVnNrc0kXWhxCVqcsD0F3Hy2cUNodkXTBc7nwJ5:hLAU3Cocseg8onwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910506, "uuid": "594c4fca-3dba-4977-b93e-598f5380e08e", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910506, "uuid": "a6383c09-26d7-48ed-970b-aee6c4d1cfac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910506, "uuid": "b46f748a-80bb-4824-a373-ac914d20fac9", "value": "0eb49c16aa8486fe6161a87b3284d95c174f6c953962525335b2cfcde17de7cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c73781-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1780911167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911167, "uuid": "b334caa8-ec1c-4417-8ddd-606e2c5db9e3", "comment": "Malware payload (SnappyClient)", "value": "b54eac252617e1b3325b7bfe3131f183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911167, "uuid": "8e03725e-b3c1-46f1-8a59-b398da4049cc", "comment": "Malware payload (SnappyClient)", "value": "0f5337696d890a61e108082e1f2038a0a4ba44bdc78d963e638d52e359020f48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911167, "uuid": "3a38378a-35db-40b2-a718-ba631f558abc", "comment": "Malware payload (SnappyClient)", "value": "fb8bacd42cb9b7eb1d184e738c8d3f578252370e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911167, "uuid": "922987ed-2553-4753-8c0d-5edd1de014c5", "comment": "Malware payload (SnappyClient)", "value": "31cc6bcaaf118f79cab454ba494738f0a4995b75263668d5cf63ae66526d87f36d1bab754765eaaae7165b88a444e6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911167, "uuid": "e0c3ff23-6176-4b97-b879-967937dddd81", "value": "T10B26337518D03E89CDFAB7B119E6468B490914B0450B353EB2BF1F53628F22EDBF46A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911167, "uuid": "e0a4fe73-6ec7-409e-8e37-705349d427b3", "value": "726e502738f0cca6934bd701a3a538de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911167, "uuid": "a2cb33d0-7196-46e5-84ab-f9ef30b8b913", "value": "98304:tPTXrdlk7INKYt1gBxMjNuOB+3HEt3fhWhnm2uhYeiT:hZlMIN/tFjHB++shnV2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911167, "uuid": "eb4192d8-2d2a-47ab-87f3-2661c7efccde", "value": 4421136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911167, "uuid": "c8433b14-a223-4aa1-be08-d7821da36d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911167, "uuid": "526dfdae-da1c-442f-a0de-ea30493ed47a", "value": "0f5337696d890a61e108082e1f2038a0a4ba44bdc78d963e638d52e359020f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df9b363-6319-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780909602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909602, "uuid": "29778812-3c81-49cc-bf40-547674060c7c", "comment": "Malware payload", "value": "b9545ad728f0fed3d7a49ea94dacc9a0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909602, "uuid": "c60b2d49-e006-4a7a-8f7f-a5fe880fd555", "comment": "Malware payload", "value": "0f7ba6fd0ff64c1115352b8fc30dc36fe8fd5d81154f2f54ac0e00f5fcf8a45f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909602, "uuid": "4299b575-a04e-455b-8f6e-b746c1dad328", "comment": "Malware payload", "value": "02c07f6016c10311b04d09d4db7ea339187c9eec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909602, "uuid": "8f889cc1-cd2b-4ffe-955a-ff3ac2e8e76a", "comment": "Malware payload", "value": "a3dbb736c85ca4baff1850e0c7d5496d63338c8f365ae02db0c897eb0c151b6b24faf6dc0a74787a710ed37b514d01bb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909602, "uuid": "5a95e499-b07e-4b7e-9aa8-d616bafc2f42", "value": "T13231C9AB5B293B9C5401DDAA73AA2048E460D5CA704FE794FF8C0C7AE5C855C3359B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909602, "uuid": "3a50365d-5e98-4909-b347-91e8fab79dd3", "value": "12:5MrrkqDhNtarEWrQrrktKtCrdxZlRorrlRx9tR4rRf3VfzrVf9+grwQQrrxxtCrq:qn1NtA9bobXvQfVkP98bqFS/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780909602, "uuid": "15a87a4f-9af0-4fd0-8171-474c14d7dd20", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780909602, "uuid": "da136c83-f536-431f-a4b0-eeb386e9b65a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909602, "uuid": "1c24f899-e29c-43f6-adc4-8def73762faf", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a0abd3-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780928936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928936, "uuid": "cde09425-b346-48b1-94e7-4196f2e52fe1", "comment": "Malware payload (RemcosRAT)", "value": "814ec305851e652d252ce03facfdc99c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928936, "uuid": "bac37439-991f-4cf9-91b0-ed9d6fd90f7e", "comment": "Malware payload (RemcosRAT)", "value": "0f9fbbbc8bbb5231b3dbce495da2ddfbcc536e35369ae93417dd24cbe9c666d6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928936, "uuid": "c6e4dac8-33cc-4b00-8b48-e47b0c4105c3", "comment": "Malware payload (RemcosRAT)", "value": "2fca304634db64b429fe243912c87ec5f34b3f5b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928936, "uuid": "81310991-d52c-45e9-8cef-a320c1986c51", "comment": "Malware payload (RemcosRAT)", "value": "97c1eb89f5c53370f6263f5bb8966d42207f66f3abe4a4037d1c5515d3ade433458b096da7ab85c2cb7c075fc9183641", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928936, "uuid": "770b1c1f-db34-446d-8d6f-ae8c06556998", "value": "T16AE42249B8808F43D1E3D2740D948A8A456CFCA57B41DBCB375873CB327CEA749A925E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928936, "uuid": "9f8c34b8-b7ee-469d-8e8e-45797fa867b7", "value": "12288:XlrF0mlzVXgxpdLHT9uvsXpejIoRRorgsWUxjgobQvapy/FuEv8:tZlztKLHT9uvsZ4I2Rihtb5Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928936, "uuid": "37c52028-cb12-4928-91c7-1dcf3ee7b719", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928936, "uuid": "dd0a56d6-a8f5-404e-9d39-e332e6d03758", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928936, "uuid": "90695178-5b02-48ed-b14b-93acce25aafa", "value": "June_Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d40dcd-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780910963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910963, "uuid": "43457fd8-20d2-4f1e-a11c-b5057992d159", "comment": "Malware payload (PhantomStealer)", "value": "66fb2e050a95d591d75fdb6e26537085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910963, "uuid": "13b13d2b-8122-4f98-99a3-3f8de28b2251", "comment": "Malware payload (PhantomStealer)", "value": "0f9fcd8bfc73b744ce1ec0185645156969f864ec4142204fea4b2608226248c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910963, "uuid": "d3fb5257-95ce-4709-909d-514be858c211", "comment": "Malware payload (PhantomStealer)", "value": "d5f1e6be6b636c5c2af53a08785c04e70f904ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910963, "uuid": "d6d5d8cc-eaf1-403d-8dba-bf75ad624d55", "comment": "Malware payload (PhantomStealer)", "value": "ac6f6dc064a954990ebba407afc221c1606beede10814aa85f7b7b7b8bf8b50e4d52706341714392b5fb0ae02bbce862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910963, "uuid": "6675425f-48b1-4eae-b267-81160dceeb4e", "value": "T13D65232C6626EA06D5544BB84E70F2B913784DEEB512E3472FEDBDDF7525B2A4D00083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910963, "uuid": "f8502ca2-6f71-4e7d-856c-e26b97fdd51d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910963, "uuid": "7f9ce634-6548-417d-8b43-03228759f3fd", "value": "24576:36dSnX17YT60eMGtJqnyyJKQGjpy/IXctGBzwiUHPNdvCK616H5z/E0J:Kdq7qaKnyv3KIstyU3DvCK61M/E0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910963, "uuid": "3390e57f-7bd6-4091-b47e-57da93762fda", "value": 1543168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910963, "uuid": "0e515527-0cea-42a3-a0d8-6297adc3ba1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910963, "uuid": "dfc2d452-dda4-4120-a433-8c7ef3d4f9f0", "value": "0f9fcd8bfc73b744ce1ec0185645156969f864ec4142204fea4b2608226248c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b94ef09-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "83e5a72a-b569-4735-8f90-6a0933d8cd46", "comment": "Malware payload (Mirai)", "value": "7bac39418d52e47c897f3b597d6abe82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "957009eb-4628-4b00-9bb1-0355f3cceed9", "comment": "Malware payload (Mirai)", "value": "0fb46404e71786b024991909210d5317b39ab2eadd885e1b25b73e06f7daac97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "4afc2087-ecfc-4d86-8e16-6b30b75ba8f8", "comment": "Malware payload (Mirai)", "value": "28ef10c2a1639559d785cbce8c01f53664597450", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "117306e4-dbd2-4eca-94c1-2ee83f4d0c87", "comment": "Malware payload (Mirai)", "value": "f18126088c0b1dcdeefc770d4b72b57f8acc2083506e61e675d1a49601e07c62058ef7fcecdcd6c78baa541ef5899484", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939582, "uuid": "6a8d842a-424c-43e1-9ae0-1ccfcd2feb9b", "value": "T1B9A34B36B874192FC4D4A47E22F74721F5F247D925A8861E7EB20D8EBF206403653BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939582, "uuid": "50502995-b998-4294-8c24-f189d00e90d4", "value": "1536:a7ZpFghRWSbbmLOnzavBUgOl2OpT30kbekbRlM5RAPwTTnt0oQj:bbbmPTO930bkbRl886Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939582, "uuid": "4ee518c4-301d-4fed-b40a-df9e508429e0", "value": 100192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939582, "uuid": "64e8357d-3106-449a-b386-91ca2c171347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939582, "uuid": "a3ee176d-b015-4221-984a-2f99e2582dcc", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a30850-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908088, "uuid": "009c6a2a-cf8d-4d8c-bcdc-a3c13925bd5c", "comment": "Malware payload (Formbook)", "value": "8f88380cf87ac0070cfe4bea8defcf44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908088, "uuid": "4e654365-29d6-4d0a-b99a-cf6161a7948f", "comment": "Malware payload (Formbook)", "value": "0ff8a207bf56f8ad568fe2ccf540cab84a202c04aa1dbe691b6202c98b39f806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908088, "uuid": "73bd3800-b299-43bb-a8f6-587695aaa24b", "comment": "Malware payload (Formbook)", "value": "dc16e766d663af7774f9bef31d361d1b32aff0b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908088, "uuid": "0488749f-191f-40e1-8026-c94a150637f0", "comment": "Malware payload (Formbook)", "value": "6c2718267ca6fe31939ed736bc1a80e6bd589879cfc3be85ce75c9af054c84d8c6f7a6c685c61168b39e0f22eb270abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908088, "uuid": "a3817b9c-6935-47c8-a4af-8e6bc6d0dc67", "value": "T10D3502542216CD09E5928BB98C70E7B417341F84F571D723AFEA7EAF787B60258243E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908088, "uuid": "c33b6eb7-95fe-4869-8911-3b2b7f40732b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908088, "uuid": "9eee1d8f-9fac-47cc-a77a-0a589f3f0a07", "value": "24576:7ulRwL24vpVMCMgwoLnSz8ssA/uAicAfwrbu6/0SSSk:e6Xvdej8sHmASN6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908088, "uuid": "2d3ca061-37a9-4041-a477-b17784a14820", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908088, "uuid": "3af5109e-bc4c-4435-88a1-fe00acea9b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908088, "uuid": "5e8a0220-dd91-4a7a-b91a-9eee5e80d872", "value": "0ff8a207bf56f8ad568fe2ccf540cab84a202c04aa1dbe691b6202c98b39f806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9bf407-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780912526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912526, "uuid": "4095f51e-e736-4e16-a780-7df5983b0e9c", "comment": "Malware payload (Expiro)", "value": "e4b6fccef84249307a990401638e3c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912526, "uuid": "4525874a-6d5f-436c-a315-fcb7f582ea8c", "comment": "Malware payload (Expiro)", "value": "10e93c665ede7e2d755523515db8269369edb07068e060416117ffe252e75c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912526, "uuid": "2959da1d-f488-4b4b-971f-67196ab104bd", "comment": "Malware payload (Expiro)", "value": "f781b8b80660c7b555dfa52467c7cba2814eef21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912526, "uuid": "3469354b-4b2e-4acd-bc92-70d702e1c241", "comment": "Malware payload (Expiro)", "value": "f54df24091430a2373d137149a6268d1479b5dce363f4e6ffffeb6c154f786b7aac5e0b9b877ea6ea65a2faca81f2298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912526, "uuid": "1d11107e-72ca-47d3-b5e2-6137923fa881", "value": "T161451912E911A02BE4A789B079788556FC192E3136D1BC6FB7802B9930749AFF5F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912526, "uuid": "d21a4c13-5cfd-4572-960c-0a4a085f4f44", "value": "2190d96a3b1dfc387e493d7b9ed15eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912526, "uuid": "0df4c69d-5bc3-4860-aff9-f3503a52bad7", "value": "24576:CD9XlMwD+Meerd6I9vIVg9N9JMlDlfjRiVuVsWt5MJMs:CD9TDZeerd79AgFIDRRAubt5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912526, "uuid": "ee5af335-40fd-41b8-ad36-633f72873f52", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912526, "uuid": "59d6ebef-8c1a-4894-8158-36b8fa6965b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912526, "uuid": "bdd02f0c-be98-47ac-8619-ebae6b7a03ed", "value": "10e93c665ede7e2d755523515db8269369edb07068e060416117ffe252e75c42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf11b36-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780907371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907371, "uuid": "90dcae79-6dab-4214-952e-bd7e8f0f7d97", "comment": "Malware payload (PhantomStealer)", "value": "56fe5645c6b6a03a71b817e0ba7f9e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907371, "uuid": "dd553fba-242b-4c45-a174-b0aeadc8ea7a", "comment": "Malware payload (PhantomStealer)", "value": "1111810b615080da021051e957d6eb1df3e88e44b2e1b8e53186ea3f2ecc14d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907371, "uuid": "595ce3f7-08d0-4d3d-b9db-44a2477e21f7", "comment": "Malware payload (PhantomStealer)", "value": "3eab89184a99326ec44ec897fce111abd18b1499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907371, "uuid": "243f1056-055b-4e5f-99f6-3a8e66e4e49a", "comment": "Malware payload (PhantomStealer)", "value": "8a392a29154a81fe9646997b61ff96a73f181602f531d822a8985336b2eebc92725431cd76993f128495bdecc0c437ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907371, "uuid": "7721db3d-ab0b-48d8-99ca-c0eef32dccfc", "value": "T1B675024A6449C80BD0D1AFB06CB1D1B62A357C9C5424C28FEEEABF2FBD723545AC5394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907371, "uuid": "52b1efaf-402b-4e05-bb0d-323298b7ff63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907371, "uuid": "ecba98ae-33f2-4626-822d-8db90bf345be", "value": "49152:VOKPDfIlIa/2N+io5wIH2KLNXSX+XLswYG:EKPgdu859KeLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907371, "uuid": "7eb25890-ce78-4854-9739-30d268dc58cc", "value": 1696256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907371, "uuid": "d55680c2-441e-4f04-b64b-949efcc0121b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907371, "uuid": "0f74e80b-48f6-4c55-99fa-34da5033734c", "value": "1111810b615080da021051e957d6eb1df3e88e44b2e1b8e53186ea3f2ecc14d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8b3f42-6356-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780935693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935693, "uuid": "11231e6f-20c5-4984-9000-1594bb564100", "comment": "Malware payload (Phorpiex)", "value": "e0210434542c9943397ca84aeebe01a1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935693, "uuid": "2d090cb4-1916-44df-8651-ceb04ab2ff91", "comment": "Malware payload (Phorpiex)", "value": "11b5e5f7bdb06e801ed174f64b22436040731284730649c776181c6c76c23f88", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935693, "uuid": "537906be-e5b6-4977-8510-4c0ccf05eb69", "comment": "Malware payload (Phorpiex)", "value": "d01c1ed03729d66f5dc74034009f645f9bad2367", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935693, "uuid": "927a426d-654c-4a2e-a224-7bfd2bc2f3fb", "comment": "Malware payload (Phorpiex)", "value": "9fdbfcbb2e6643cfe85a90974e974b5d58eaf6ff75e497bae9a7ac7a7f0846a3fb1fbfd4eb79cf4cff4428e34d60a93f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935693, "uuid": "b4f073d6-9415-40cf-914d-213e88626226", "value": "T147825B0FB8424726C1E100B09636967BDA79A87137C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935693, "uuid": "9b918178-4c8d-4429-94db-9a01e4bf9159", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935693, "uuid": "983e7ffc-c564-4052-bfc3-1bd8b251824c", "value": "192:vKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSvu9zw+ghSSCgbO5qmEd/FN2GJxo:B0W/ytwEN/0Gu9JgwOcoav8U9cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935693, "uuid": "737cce4d-bb3e-443d-9108-f1ba4671621f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935693, "uuid": "f2436f0b-9508-4bd5-9510-ccc843724f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935693, "uuid": "a7ffa61e-6384-43ee-a3be-38afe94ef3f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c3ef3a-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780907468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907468, "uuid": "58166bcb-71ae-46c2-923a-6c661e566fba", "comment": "Malware payload (PhantomStealer)", "value": "730410a21ba80c56f99f1bf070b79ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907468, "uuid": "a748010b-1df2-49a9-8d06-8bf5f1b498cc", "comment": "Malware payload (PhantomStealer)", "value": "11f28cec965ac3063378fab89f46d3a93f0a7803d4b4494e3d32b985ddf38f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907468, "uuid": "2bc94ffe-1e8d-4c63-be2b-9c260442a701", "comment": "Malware payload (PhantomStealer)", "value": "f638d9e6e0f73e8dcd76e9740e93b5d7f519d2f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907468, "uuid": "92f5f369-9a95-4159-b409-6c5848fc27fb", "comment": "Malware payload (PhantomStealer)", "value": "2285644187d72147b8e8bb62002c573825da0e2c0bf22b69488833d3405b8ab9ca8ef2938439808eab7a8ab7ac6e508e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907468, "uuid": "7336fd12-9cfd-4d65-b95c-bf3c7844759a", "value": "T1AC651228623ECE07D5920FF45832D1F42BB09D98A926D3075FD63EDFB4367A1152A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907468, "uuid": "307de046-35b0-47ff-81e5-24854c293a6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907468, "uuid": "6090dac0-964f-422d-b9fe-4fcd66350db4", "value": "24576:YhwZtr45i4BthJwd0h/dDDWaYIaM8X8BygTm6HHence447U+3ODkmNzGB47GuIcy:IwKtXhJ9h/dma5aMXBdZJeHU+eDkm5Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907468, "uuid": "df7eed8f-9898-4cde-81a9-7b7199fa3d04", "value": 1534976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907468, "uuid": "df3d2e1b-705c-4518-ad1a-f3c61707678a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907468, "uuid": "4a5adb1a-a8f8-4f4f-92f2-27ad13d4735f", "value": "11f28cec965ac3063378fab89f46d3a93f0a7803d4b4494e3d32b985ddf38f9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf910f6-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "a875a953-a631-4f8d-a05c-5b935198a051", "comment": "Malware payload (Mirai)", "value": "4ac9934a5cde7d9afcefec5cb61178ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "e03e219f-7392-4818-8a8a-93f82b555932", "comment": "Malware payload (Mirai)", "value": "11f938ed53aadbbe0e03cc519df08144d5dc2486e19fa17279b7b8b846517862", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "2dbc4b88-cf2e-4631-a235-832d041aff00", "comment": "Malware payload (Mirai)", "value": "ea15a5c18412a1c317ada6416e9756e056d126dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "dfd7882f-6a4d-428e-b1a5-8900b2725721", "comment": "Malware payload (Mirai)", "value": "7ea8d0cb1983b48076ca354d21b56b9879ee08b650ceed9c4e5d0e64ceab5428c0be7ffdb326df508eddbc956801f616", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939583, "uuid": "b1489922-09a3-4e4e-9264-75d2a5acbf55", "value": "T14F635AC5F643D4F5E96705344137EB7BAA32F2B90229EB87E77482327C92642D90678C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939583, "uuid": "ab6a6d16-9523-4ba9-9c77-eb524fe057b9", "value": "1536:RaZsGDExpTGAtV+/C8eQBW2OnEGc8z3WyL35IUfA5PGFjfnPv:zGYxpTGASC4XT8yyLpIoYPsPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939583, "uuid": "accbe57f-e7a9-483c-8f85-0a81b6ebbf01", "value": 71520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939583, "uuid": "6d144315-a8be-4712-8bea-6707d9fef995", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939583, "uuid": "0db325a7-aaef-44e8-96c2-dea89bb70684", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765abeac-633d-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780925105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925105, "uuid": "29d8d5ff-d491-4bd9-bd11-c26e74321f13", "comment": "Malware payload (NanoCore)", "value": "82e99b4128a7274f89644a8e3a92a0cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925105, "uuid": "30b38917-4ae2-4041-916c-aa7e16669bb0", "comment": "Malware payload (NanoCore)", "value": "129426e16332e5dd7f5fde56cb1c5e73666fcd4f629219effc16102cc7c083ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925105, "uuid": "7e82924b-9c85-4948-87c0-8b6ab1d2d554", "comment": "Malware payload (NanoCore)", "value": "758a5b7347fa59972386bab1bdd972dd5aac8127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925105, "uuid": "8699a15c-b8c1-4ebf-8abc-d50f1a2f726a", "comment": "Malware payload (NanoCore)", "value": "225decff6f6240beee12684cfed41c83d440614bb12d3b580a12c35194a98821d0473bf77fd7e57f905b32d2556d5bc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925105, "uuid": "40493fe5-4584-4b04-89e0-19dd7705041a", "value": "T10414CF5677A84A2FE2DE867D611212169379C2E39CC3F3EE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925105, "uuid": "aa053b1d-c5bb-487a-9d37-bdba91a3b2cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925105, "uuid": "fb296f0b-185f-4f4d-894e-934a36bc6f62", "value": "6144:sLV6Bta6dtJmakIM5u6V2qhLyNPYTbEjW:sLV6BtpmkVM2uL4YTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780925105, "uuid": "98f5f1e1-16f4-4dd2-9a98-b1ea806032bc", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780925105, "uuid": "5ea24f7e-fe9a-419e-bcfc-acd7ff57c466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925105, "uuid": "70df3e99-1f69-4380-8962-87dc3ca3235a", "value": "hexbear.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4510fc80-630b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780903547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903547, "uuid": "1a896f1d-1929-418a-b5c6-d6912d4487f9", "comment": "Malware payload", "value": "6cce79b38e7c46f7f0f85080b72b5182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903547, "uuid": "98b5d1c6-1ca4-4107-bcbb-3457d17432e2", "comment": "Malware payload", "value": "12982e0f27c2935828ab591743fc1e0d8af732b781748404df05c3a02142f65e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903547, "uuid": "dbf46f71-e5fc-47b2-9de2-e3e0b34894d9", "comment": "Malware payload", "value": "a4b240ff85af00dd03071eb2c0287f643b3acaf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903547, "uuid": "161858da-98d2-4796-a4f0-827845b89a8f", "comment": "Malware payload", "value": "b43eaa73cac5c9e6a047828e3873363928fd083cea0cdfdb30e671754837186fa65e85776dd02a5bf941e4007ce22a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903547, "uuid": "0930c831-ddf9-4b77-a66a-db051c86a70e", "value": "T194059F41FDD380F6C625153049E6677AAA7AA9470F14CFCB9394FE292D339409E3633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903547, "uuid": "4ccecaf4-2bc3-451c-a886-593d36295e42", "value": "fb070027dd43778367248839af922885", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903547, "uuid": "3fa0416a-ef94-4821-8466-2d52c4c8cce8", "value": "12288:lroB5YYSpAaijzPLzDTaK3zxm6iiDI/HjiG:lr8YrpBiPzzPamxfPDIfeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780903547, "uuid": "3cb0b6f0-7cf3-4827-a3cb-fe9fa7d1bfae", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780903547, "uuid": "67f399a2-bd5f-4b62-b966-77a49293a681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903547, "uuid": "51a231ac-2278-49cc-b4d6-6bc38818c388", "value": "SecuriteInfo.com.W32.Trojan.GRW.gen.Eldorado.20817.5979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e0e18e-632a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780917123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917123, "uuid": "b551effb-cf1b-4460-ad92-192f513836fb", "comment": "Malware payload (Vidar)", "value": "c2ae13e8c19bb35d67942e566089097f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917123, "uuid": "72ea4e06-5b72-4bb4-803a-cf37b7aa7321", "comment": "Malware payload (Vidar)", "value": "137b3109ede19d332f3feca533e4f440b78a1b3597329e468f299801d811cd8f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917123, "uuid": "c170d794-a7f1-4e85-98d3-bf502ae31560", "comment": "Malware payload (Vidar)", "value": "f3e2bb2d24f130d50e02f2d796edea675f8e59ca", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917123, "uuid": "673109f0-6a62-4a6f-8633-6f221afe7861", "comment": "Malware payload (Vidar)", "value": "90fa4dad7527ad6fc6dc593f02073912ad66b9b25f501f661c81082cccc13657aa50303b094cf2092be0aadb0ba02f5d", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917123, "uuid": "1ebc5b09-890f-4c6a-9f4e-0c728519d602", "value": "T1E3E57C1ABCE10AF4C4E5A3B298B62692BB36BC440B3523C72F9067393E727E45C35755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917123, "uuid": "97f1ed3c-fa19-4dcf-96a9-564e0a460e34", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917123, "uuid": "a83dd745-2354-4216-871e-f1b2840b55b7", "value": "49152:hWxkJZpP7htIQTM4Utl9kgLVGZAckccHVPF:hhVXwl9XVGZAf51PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780917123, "uuid": "91f33f5d-507c-46ab-8dce-723854abf469", "value": 3109040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780917123, "uuid": "ce18a71c-7fd0-4133-b916-c74ed709ebc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917123, "uuid": "0c335e22-5fb7-447f-a28a-ef98128bf605", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cce219d-62de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780884179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884179, "uuid": "ca42be94-5bbd-4613-a01b-5e7ecb2de07e", "comment": "Malware payload (Mirai)", "value": "8a92c189e7036228261690ecaf0da9b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884179, "uuid": "f213743d-1de9-493e-886b-bdc82fbe5030", "comment": "Malware payload (Mirai)", "value": "13a1bf912f3d69e4b173cc0ddefd9005a95dc4816b3bd805d899c71ecc77e39e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884179, "uuid": "aa4608c1-c122-4fea-91ac-caac679e3fa6", "comment": "Malware payload (Mirai)", "value": "c234f76ae47e312d8e701185eddf4671e0310eb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884179, "uuid": "7330979d-1119-4a48-bebb-2b479ce554e0", "comment": "Malware payload (Mirai)", "value": "943d69cc2a4401fac1076580884b2ab16eaf6758ed7d300b90757931a681170c38a8a8c85bf0aa1fb2a7c85111316170", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884179, "uuid": "af903ffe-3821-4506-a22f-6484dc5d8061", "value": "T120A34A4273690447E3A70DB1293F6BF193DFD1A131E0A685691ADB4F8232E322586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884179, "uuid": "c95fe025-a2c1-4fa2-9320-55550d8bd1bb", "value": "1536:nn4ai5KOtu7o5wtkrLYIHiv2A6Dguo9d062AzQm8ZqpPW+RgE5+QW9afARdrs:n4aiTQHR6bv4L1RF5M9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780884179, "uuid": "0130a094-ff6f-4540-a52c-a29589b74d24", "value": 107168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780884179, "uuid": "928776d5-f78f-4f38-bbbc-6a936f74dd1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884179, "uuid": "7a95a86b-eb79-41a6-bed3-cb1228b4f6b5", "value": "jklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61c911e-6307-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780902019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780902019, "uuid": "463c66ec-d88f-42ee-8e1b-134a71c734f3", "comment": "Malware payload (RustyStealer)", "value": "e23b9047a83448a6f9895855b9393402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780902019, "uuid": "5a43501c-2016-4360-8846-cc31f057cd48", "comment": "Malware payload (RustyStealer)", "value": "13d0653dec7c4f464e1b1484f914ea4a1960b0a66d3729cc197ee8f2c526151f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780902019, "uuid": "c7f97c60-9bfd-4d87-bb50-1ffed00eb601", "comment": "Malware payload (RustyStealer)", "value": "3edc5b24a1e2092fee974a1606b8980fb0b096c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780902019, "uuid": "0838af54-9153-4ed4-93d2-c647009cd78e", "comment": "Malware payload (RustyStealer)", "value": "7475da3ac636dc4452b89fcf172fb9c946874583dc8ddf450a07a9015f168a7212219a0de78308a9bbf0f5c7c862ec60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780902019, "uuid": "e2a6d41d-2e58-4ebc-8560-87b700b4eae1", "value": "T128055C03B64684DEF93AC07D86364131E622B48D47306AEB399C6E393F56ED21E7E714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780902019, "uuid": "4934a9a5-08da-4228-8529-c2bbb1b826cb", "value": "f8458a68231ff5850171c4c2f9793fee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780902019, "uuid": "a7817cd2-7fc0-403c-8ab6-a46f85d9d253", "value": "12288:dlJOcNRTrWhuYnj9KFksDkMwkc7fFOLGQviaF/UkJzOW:ducNRT6huPVIM27tOVvYk9OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780902019, "uuid": "b1869443-33ca-4b04-b069-4e65e8920ef3", "value": 830792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780902019, "uuid": "05bdd769-7f3d-49c6-af62-8c92eb37f098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780902019, "uuid": "bc1eef63-0ed9-4718-8551-19f8a4038f90", "value": "#\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cad241f-6328-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780915908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915908, "uuid": "6f1de03c-27ff-4094-8153-a62634a98de2", "comment": "Malware payload", "value": "9e975fe2fa86d955528ade8c1fa867f4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915908, "uuid": "c53708b0-3a80-420e-9025-4e7014f8870c", "comment": "Malware payload", "value": "148c52d3568ec6a4bf1e7b58c96abb2984497c2a56883eed95dddd527b1503d6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915908, "uuid": "52fe5a44-ee83-4467-9a84-055061a382ea", "comment": "Malware payload", "value": "11a59cfc60df56802eef17bbc4c82800ec70b658", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915908, "uuid": "d77fb40d-0b75-4af0-9c14-e65be0ef2c8d", "comment": "Malware payload", "value": "ce4416b53cd1da1ac61cf8e37abb2ed5fe924eca2dcf9477f80656d3ef0ae0aa9155d25dee508c0373ce0ce5688bf6c7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915908, "uuid": "f0111063-f997-43a3-9512-6dd8bafac55c", "value": "T12064230C12EB8F13F43487076D6EBF7521768934806F58E4279A506CAE126E6FDE1BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915908, "uuid": "6352c956-22ba-4cfe-a770-7eb8a6406248", "value": "6144:6WIxWng/oTO7/VXN1ieml9TCObCtAVgeICytS3zuPH1QzUbS4cet:6xWBTMdXN9mjnR3yPHSQbXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780915908, "uuid": "0531028a-a9aa-430f-9553-a151d07055c8", "value": 324238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780915908, "uuid": "e1e64492-6746-4f28-ba9c-c5022b6e55d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915908, "uuid": "1632330f-642e-4cf5-b404-7fbb57482e51", "value": "148c52d3568ec6a4bf1e7b58c96abb2984497c2a56883eed95dddd527b1503d6.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b6dba6-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908543, "uuid": "c518758e-51f8-4dcf-a7c4-d76b15e36132", "comment": "Malware payload (AgentTesla)", "value": "7ce60a927dde28359eaa1d6719b19477", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908543, "uuid": "8d4daa0d-b0d0-430b-9aea-3e6469604a58", "comment": "Malware payload (AgentTesla)", "value": "14b10d22c7cd0abc9e5e63e8fe5ff7392f79eae79bba1381fc536d3081ec2fde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908543, "uuid": "736d9b8e-6c2c-49e3-b26d-95fa09127531", "comment": "Malware payload (AgentTesla)", "value": "dd284c72c32236294faaf75c4e99fc5395368c71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908543, "uuid": "58ce3cc4-84be-4f5c-8121-0a5820107459", "comment": "Malware payload (AgentTesla)", "value": "f0d259b07b2550a9274db612f9c62e61851dd602ec15c5618f2fa8942082a5f534c0c084819fd058e27d28e354982270", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908543, "uuid": "1aed6e9f-840b-4abe-a173-e4f6d4670122", "value": "T112250254274ADD0AC0E64FB51A71E2B453785E98ED21D303DFDBBEFFB8BA2521810285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908543, "uuid": "a4355218-1926-42da-b8ae-658b76a581e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908543, "uuid": "89ee1cd3-dbb4-4faf-a81f-d2999aca030f", "value": "24576:y0AEFT0D8c23Q/CHDywksKKUY+juaXQ30NKT3BbB7:N3FQO3yCjy6Kv9qz3SKTFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908543, "uuid": "9a037fca-c60d-4d73-9a18-343b1d10fd34", "value": 1031168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908543, "uuid": "d0f2a210-16ec-4b87-878d-be3d91702adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908543, "uuid": "7c985b84-bd7a-47eb-8817-763c2b66da63", "value": "14b10d22c7cd0abc9e5e63e8fe5ff7392f79eae79bba1381fc536d3081ec2fde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f692f5c4-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910717, "uuid": "9da90462-6808-41e6-beaa-36d0c1ff1fc1", "comment": "Malware payload (a310Logger)", "value": "3475e285b6055a01fa5c74f1440fce7a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910717, "uuid": "62e5ed32-e7e5-4eed-baae-410b84474891", "comment": "Malware payload (a310Logger)", "value": "1556ef60b8023750fcfd9ffdae75df500efca8d84bf7b81f0aa54fe91277f568", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910717, "uuid": "fe8e8f8b-be6a-406a-b057-c1ff03908710", "comment": "Malware payload (a310Logger)", "value": "0792380e67ae653a7b6c7790f01b2aeccb5c2b3a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910717, "uuid": "315c71d9-fb87-46a7-8e90-b3a74b86726d", "comment": "Malware payload (a310Logger)", "value": "3d8015b08254dbef5ce40d703ac8383bb317f945d3a1c6cfa6d278e2a7c0b6829f49bc6028d32fd8b5edad17bed92667", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910717, "uuid": "3ec8da03-8cf3-4707-b148-6e2593ca1df2", "value": "T195452382259EE427E1DE0BB059A1E17867709E9CDA20CB07FFD87FEFB476B640105242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910717, "uuid": "9da0320c-49e5-4044-b1aa-1655a8d1949a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910717, "uuid": "50930447-4ef4-4733-b48c-aa47cc23764a", "value": "24576:D9bhzjMEvX/sR/PTeq1B4RnNr+lrQ1Q4RAKnC5G3knmOmrbmMlQ8Nu1c:RbhzjMEvX/sR/PTeq1B436lrOQ4RFC5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910717, "uuid": "58d035eb-04ae-4ff0-834b-578474f690e5", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910717, "uuid": "0caa13dc-615e-4b72-8a75-64f93a3d2fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910717, "uuid": "e7aecbd0-3804-4331-a321-a9d59ec136a0", "value": "1556ef60b8023750fcfd9ffdae75df500efca8d84bf7b81f0aa54fe91277f568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6255d8b-631a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910233, "uuid": "f9520891-9640-4390-8a10-1cc9f297cff3", "comment": "Malware payload", "value": "e5c81fbec7a8451a6bfa14c58bab0cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910233, "uuid": "c7ce8f68-5b51-4102-89d7-fc91029c77b9", "comment": "Malware payload", "value": "15c56d18ec8d58b823be719feda38e5861850681425b907892f73cc0d5dc68c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910233, "uuid": "a074d691-f6d6-497c-aafb-a0b8a517e42e", "comment": "Malware payload", "value": "09e7d7e5c654b00e281bca9758ecbb2b331c6e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910233, "uuid": "2a49d228-99d3-468a-a994-218ab7a25e79", "comment": "Malware payload", "value": "0da74efb8f06a5f28846bf1e3b3f84b9c15ea23c0719ff228909876afe9231be6903169ad255e9c48310cc5af59a627d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910233, "uuid": "a4044653-6c19-4499-938f-191ecd0a8be3", "value": "T13994D1652741E52BE36214B144D8E7BE94A0AFA03A91D813B5F23F6FF638793EC19113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910233, "uuid": "0fd2257b-b4ce-4e34-909c-b2de9fdc8eb3", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910233, "uuid": "cd9dcbaa-e64d-4a13-90bc-13cbd0525ec5", "value": "6144:I+MvoJZeSCiO/gX/EEmKs0SAbvOsNZd/NBAYoxGi4RIr6AZ:I+LeHiJvEifb9Z5NqfttZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910233, "uuid": "d8e22c5b-a994-4723-a872-a1c3cfffa890", "value": 443076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910233, "uuid": "af13aac3-c260-4abd-bb19-98bc0dd4a924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910233, "uuid": "5135c731-f48e-42b7-84ae-d414025c6f4b", "value": "15c56d18ec8d58b823be719feda38e5861850681425b907892f73cc0d5dc68c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a183b49-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907556, "uuid": "073e63fd-dd63-41ea-8956-9a0a13050fa0", "comment": "Malware payload (RemcosRAT)", "value": "73c2288a2042088c94906cba3b3fe4b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907556, "uuid": "a1b31247-8c3b-4c32-8f85-f8ce01230067", "comment": "Malware payload (RemcosRAT)", "value": "15fc998c7fb7476a4d63ef8811b17e62edb3918bf7a6f317acd2ac22f8aa6556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907556, "uuid": "fb36d624-8290-4da1-8c83-9ba5bdf20b2a", "comment": "Malware payload (RemcosRAT)", "value": "83e3b6c1ede03957c129ffc69986c8a877ca0f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907556, "uuid": "8b7cdc60-92c5-47e1-bb8f-f8daaaab0b4f", "comment": "Malware payload (RemcosRAT)", "value": "20969368533c9d284e52ad4dd04acca153480ae913392316a538f691b8f59642b93a8c93d458b5299604f81003f40ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907556, "uuid": "6ed6e729-4a6b-4bb7-8e45-81022e08abfb", "value": "T128B4AF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907556, "uuid": "a1525b84-8bba-419c-bc9d-fdc2f1d32eb2", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907556, "uuid": "7df1373d-920d-4749-97ae-4168441b8dca", "value": "12288:llQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSvj/:ll0GcNUJV8i4mHM9/DZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907556, "uuid": "694ee7a6-f6a7-4c29-84bd-655bd5890144", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907556, "uuid": "b8c12606-e1c0-470c-a636-f51258dec5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907556, "uuid": "7c5d5711-2496-49f3-8b12-e019c13be8c5", "value": "15fc998c7fb7476a4d63ef8811b17e62edb3918bf7a6f317acd2ac22f8aa6556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34dbd7e-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780910148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910148, "uuid": "21b799fc-08ab-48b6-b5f3-91f18120d495", "comment": "Malware payload (QuasarRAT)", "value": "a9a7abdc319844c03560fd63a8264648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910148, "uuid": "ce48bbd8-8796-4d3b-b48c-463b33bdbb1b", "comment": "Malware payload (QuasarRAT)", "value": "160c8b49da5574d0dca62e5e9393238b3bf1991662347aa29cea1325f5e7fc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910148, "uuid": "9f8c6b35-0974-42c1-881b-eaf3ae6dc768", "comment": "Malware payload (QuasarRAT)", "value": "42f50953cf5ceeef1336c992a4894b4609728827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910148, "uuid": "c22a02fc-906e-420a-a355-f70de148c0c0", "comment": "Malware payload (QuasarRAT)", "value": "2690118c4ecf136a6469ceb79c356a31cbe970b14f46f4c194c316f485e304e17dd902a68713e771ab08578f206731e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910148, "uuid": "20339cf0-dabc-4b59-a42e-209ae1c8b66d", "value": "T12905018AABC04D34CA5A9E34C4302EB802379F497E55F205ED68BC7337B76D628E1597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910148, "uuid": "537ac90c-b940-4fe7-99c3-f3923404fbc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910148, "uuid": "a95fad3b-d497-41e5-ae3f-39a6daf2b2fe", "value": "24576:1NmiIPRGfNWB3YEeKyc1IIVwziVJpPeiR5ak5aUCjU8Q:1NmvPUfUB3yc1IIVwqJpGM5akTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910148, "uuid": "db5e5bd6-0cad-488c-a5d0-37aefb7742c1", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910148, "uuid": "1e17c23c-530e-48b5-885b-dfcd0f8246da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910148, "uuid": "0febe4bd-c9e1-4a2e-8988-b31f562dd4e3", "value": "160c8b49da5574d0dca62e5e9393238b3bf1991662347aa29cea1325f5e7fc07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad4d576-6357-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780936279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936279, "uuid": "78379100-33a1-40c8-bc21-af57e2748658", "comment": "Malware payload (Phorpiex)", "value": "898833edf6e0cc2a58c58b486ef42329", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936279, "uuid": "18a38948-c12d-4f0a-9f67-a1e58875f9e6", "comment": "Malware payload (Phorpiex)", "value": "16769da177e6579365e2fcce85c55803790acb24cdb1beb3afaf7bf308be4ebc", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936279, "uuid": "53bc3f5c-bb02-4d0c-a14a-8ac80dd820f0", "comment": "Malware payload (Phorpiex)", "value": "24edd68edd0b624f08cc6393b1490a22afc34f0d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936279, "uuid": "b6d27430-0dca-4e1d-87e3-8d8fb04fad66", "comment": "Malware payload (Phorpiex)", "value": "4d216abe69808dba34a25b59e0d6083376f57cb9cf366f58941666ede2950183583307c5ca5368f525140d4b2de86378", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936279, "uuid": "e2a3c86e-1880-4c58-a487-4930567d796f", "value": "T151825B0FB8424726C1E100B09636967BDA79A87537C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936279, "uuid": "68111376-9282-4685-94ad-785a99ab54cb", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936279, "uuid": "008735d2-c7e8-4f0b-8290-f33e4e258894", "value": "192:rKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSvu9zw+ghSSCgbO5qmEd/FN2GJxI:l0W/ytwEN/0Gu9JgwOcoav8U9c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780936279, "uuid": "de2320d6-61d9-4688-920d-038cf4d421eb", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780936279, "uuid": "20e5f9cc-1673-445a-81f4-7ccd0be0482f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936279, "uuid": "16449513-4e38-4bf1-af7d-cc6fbbf3150e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e74c5b-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "a69ac809-3ca9-4e2e-86c2-1a657f68f6d3", "comment": "Malware payload (Mirai)", "value": "fc8422686b23eca1e06fb18a76319350", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "c121da32-7c26-4ddd-a8a1-26e0ccb98246", "comment": "Malware payload (Mirai)", "value": "16d78160e10f383e673485b722c46961f5df3da2a081091baa933de0a63f878a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "d14beb5f-bb77-442d-acc1-2ee02dbb0a5d", "comment": "Malware payload (Mirai)", "value": "2a9f664771bbf8fcccc4b5f068a873e0d502df9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "24766a6f-df17-42a2-8650-aeea20339195", "comment": "Malware payload (Mirai)", "value": "1c986bb7511c9044bfeebd9180888776b711d1f9106bc20fb620033c127f1bacd310de6fcb0cc0c710debc6a9c54964e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "1aa40c55-b797-422a-bc76-27494f017cd1", "value": "T135733B81F54B80F1D847487090BBF33FCE31D6954175D66EEF699F36EA63202A60629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "136b2aa8-f167-4d78-b37a-25bae6f87d7b", "value": "1536:uVHQ0rPyMQn+JgVV/SGQ+Zsb3SfFWLIk1Q9j+Lxty4AHe:uVFrPNQn+WVQ3EyVUk29jgxOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939580, "uuid": "69e40fad-820e-409a-a1bb-73f8cd928d69", "value": 79232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939580, "uuid": "ffd01032-538f-4eed-9995-9635fd2590fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "a4594377-f9c2-4a4e-8ecd-81d8df21b3c1", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca9c445-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780910566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910566, "uuid": "2828ba06-440c-4011-a883-b06b352747ce", "comment": "Malware payload (GuLoader)", "value": "c2873a7fe2c49d6b51931b893409be04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910566, "uuid": "9e4917de-c08c-4e0d-af5f-513d822b44c1", "comment": "Malware payload (GuLoader)", "value": "16e10519af870b3333a6d37a823a9846a4c7a0b7caa5d35acf683ae31ae4e5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910566, "uuid": "19b7b409-0844-418b-8b2c-ea06f6fdd069", "comment": "Malware payload (GuLoader)", "value": "683d7425cd81620e036ac7491e2a7712209b8e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910566, "uuid": "3fdd5026-2a99-49a2-982e-3cc1942cba3e", "comment": "Malware payload (GuLoader)", "value": "b1a2603c9a57b37bd82eb1c359776215a89db29677abb7cc5ae1b8701de469200b943f0ce032513d95c7337241b4976b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910566, "uuid": "98fb2ff2-7466-438f-89ee-acd63c46cb03", "value": "T1AFF41282BE74A655D6A0CE3164BD593C4B3AEFBBE648150B3180BF0A78F715F550BE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910566, "uuid": "0e13fe86-f8a8-427a-a41f-fb30152102e5", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910566, "uuid": "6800afbd-cc3a-4a2a-b712-9e345d5e7717", "value": "24576:obudKXDY/adczFCmC5uENNSMtubw7uNQ5yprVD:6udKM2GFxkTJmw7QprR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910566, "uuid": "00c22a81-204f-4b81-8b3c-9df20d3d3096", "value": 786856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910566, "uuid": "f6db8300-4c6c-41dd-bf99-65e34fc555f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910566, "uuid": "6f9a9ab5-47bb-4ccf-a6b0-b987d2f63b36", "value": "16e10519af870b3333a6d37a823a9846a4c7a0b7caa5d35acf683ae31ae4e5b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79147bc7-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912654, "uuid": "e13ac043-682b-4eee-bb00-9f9dc599aad5", "comment": "Malware payload (Formbook)", "value": "597300073e8431472660559383fe65d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912654, "uuid": "29740f95-60a9-4306-a778-30b7baa1c236", "comment": "Malware payload (Formbook)", "value": "16ef07a309e47d0579af30471dd149c77a2fe6264536454f7c512813fea0829d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912654, "uuid": "c46a0b2d-24ec-403d-8256-56dc91f92de1", "comment": "Malware payload (Formbook)", "value": "6ac200fde86f5c41dc2fb2370c2afc6583dfa219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912654, "uuid": "bf0ac9d1-2489-4a3c-acd6-47624b73942b", "comment": "Malware payload (Formbook)", "value": "28dd27aefe27d152eded316cf9a06a7663e8cef394431e15a2340ba67601ec85de8c3984847fd0a79579dd6bbe55c84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912654, "uuid": "dd63f153-4627-4bfd-88c6-cd886fc062c5", "value": "T1983501089A90C902D19527F85923F2BC237D5D8EEE90C72AAED9ADDF3477B430445673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912654, "uuid": "a73b7373-8ef1-476e-a890-c9196c63a4e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912654, "uuid": "77aca87f-8a52-4ce4-9a92-4bdab64b236d", "value": "24576:/+pBIsEbBYGWdJwl6Ahyi6fJyyxbeZUn:/jp9oYBQ4yx+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912654, "uuid": "1b191ef5-15f1-4090-9661-76dad09997f9", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912654, "uuid": "69fdd1a9-5c58-4bea-be0e-fc0ecef0017c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912654, "uuid": "a09aa74a-4fc8-4151-bc44-77d826e6629e", "value": "16ef07a309e47d0579af30471dd149c77a2fe6264536454f7c512813fea0829d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0193d8-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780911206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911206, "uuid": "4963813c-7638-45af-90a3-0ef397a60b46", "comment": "Malware payload (Stealc)", "value": "d56a70333cdbdc9e69ce10821dc13dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911206, "uuid": "da6f4ab4-3443-488e-88bc-e7b3d5013e86", "comment": "Malware payload (Stealc)", "value": "16f32ca2bbcfdba72952f806ce895a6e857cc69d61f4dc13d2c801eb2ac94d53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911206, "uuid": "b538ea0a-7139-4784-861f-8ee791b7bfaa", "comment": "Malware payload (Stealc)", "value": "2e247ee01101187b285cc8638ceed48af1ce7a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911206, "uuid": "2ee29f86-3f16-4a35-aeda-f52caa95eaba", "comment": "Malware payload (Stealc)", "value": "b889711d65210e1ca1a231bbb1a2cdc9abfe8915e99940c1ea046d2ae25dbdc3064d343d340b684e951d33cf087d79ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911206, "uuid": "a49cd22f-f21c-42d7-a49e-b31c5bda8a7d", "value": "T10E546B1AB7640CF9EE6BC23DC9524905DB72BC5657A1E7CF03A04A961F236E08E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911206, "uuid": "8908d310-ae2d-4086-a994-2e3432c69c9a", "value": "15a1d73feee1088bf3b4d4acfa589482", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911206, "uuid": "d5bb215f-6411-417f-bee5-cd47a6ac9ef7", "value": "6144:2QEaoT5RIRJ0y4vAaXmn/hfLYPyISLzdc:2QDoTIRW9zXKhfU1SL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911206, "uuid": "a0f9a239-c789-41f5-a3dc-20f7f18b17a9", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911206, "uuid": "424144f9-9db4-43ab-adaa-79865863dad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911206, "uuid": "f1ceb809-2bb4-41dd-aeb7-2afd1eed4965", "value": "16f32ca2bbcfdba72952f806ce895a6e857cc69d61f4dc13d2c801eb2ac94d53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26788e4b-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780911657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911657, "uuid": "913f1d1b-847b-48be-99e0-9b8927e752b1", "comment": "Malware payload (DarkCloud)", "value": "b4ef3d905f8a0cc969f3e46b4ffac839", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911657, "uuid": "c12bd7a2-1439-4514-9804-477410119601", "comment": "Malware payload (DarkCloud)", "value": "16f469e717eb1239369889464fdc3d421e83bc1480b6445a7972b3c4ea6ed397", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911657, "uuid": "2debcdec-41de-4246-ad3f-9127e69ac561", "comment": "Malware payload (DarkCloud)", "value": "e1899dc4167a756a6ce384aad85fe176b89bc529", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911657, "uuid": "c9e9db48-9f14-4428-a601-8bf87ef9f16a", "comment": "Malware payload (DarkCloud)", "value": "b0ff024257df4697a5bee8d968dfa0453d40fde62912ed7456ca938cba96e166ba649124672bef9213d43fc3b66349e6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911657, "uuid": "e22bae99-2f74-442b-9dc2-ad9a2b766d3a", "value": "T1F645236CB646E507CA9057349D72F3B9267C1EECB101E3958FDDBDEBB676A410C08282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911657, "uuid": "6c424f8a-1e8e-42cf-81dd-62cb2fedc09e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911657, "uuid": "627631cf-f08b-4e4e-902a-1ed8490dea48", "value": "24576:7LSK1i6l4448eQ19KsdxWb1L6g9gsfF62ed2FAVK:7LSKRlelsdxW56YHcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911657, "uuid": "dd8a8032-fa2b-496c-8036-6c0b38edb92f", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911657, "uuid": "4e5f4a74-4416-4dd5-a775-dfb0e611293d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911657, "uuid": "29942ece-6123-425e-b6d5-194459aca71c", "value": "16f469e717eb1239369889464fdc3d421e83bc1480b6445a7972b3c4ea6ed397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79de8a6-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911578, "uuid": "27356b49-29b2-47a9-9f17-f34f3626d949", "comment": "Malware payload (Formbook)", "value": "aee116d83377d7b080f9feb12f95275d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911578, "uuid": "c29d923a-6f68-4237-a5dc-c59857bc8848", "comment": "Malware payload (Formbook)", "value": "173557fb83b824c17433c9f5ba82c0d446a3fdad6e580c81795c4feadcea3350", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911578, "uuid": "5f7a227c-8df2-4050-81fb-ef38f0d10dda", "comment": "Malware payload (Formbook)", "value": "c29af19ca0f58be4867e2aa63c2838d4d0bbbf17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911578, "uuid": "c48c3bb4-197d-42a9-b143-cb4175c144bd", "comment": "Malware payload (Formbook)", "value": "8aee2b5b1b70f91b738dd12a59063d62075f88d67cdf39820eeb45a69ce5b90bf38946a4e9b3c5d653d56c85c4eb01a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911578, "uuid": "49a23156-45e9-466f-b1ea-1baa4a5f91e1", "value": "T154251268AA06D507CA915B348EB0F3F85ABD0EDCB802D7179FD8BFEB757AA504C44142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911578, "uuid": "fb0db773-9731-4dfd-b129-24dcb59b9bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911578, "uuid": "1c142bd6-165c-4635-a467-9eca5171591e", "value": "24576:eWsbJr0ycwmx1QJ8xwk2NVKuMF9nhpN+wKKg:HWrLcwmXVxP2NVTMnhv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911578, "uuid": "1044313c-b885-4ed3-b711-e0df2705a26b", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911578, "uuid": "1dac10ac-37a7-47f1-93db-ca6f6bfeab89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911578, "uuid": "f21e0f1d-2f3c-482c-bfe7-1adb31fffd56", "value": "173557fb83b824c17433c9f5ba82c0d446a3fdad6e580c81795c4feadcea3350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699db3f6-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907474, "uuid": "56a9a8d7-c2e1-4a1e-a73b-a4539f3dd57f", "comment": "Malware payload", "value": "4f1e2ab3c699250448e5d27da9838b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907474, "uuid": "96211bfd-fd7d-4080-8625-a44bd70b2f75", "comment": "Malware payload", "value": "178000b3303d7f1ca387f16858e60f73a0e37a7f2fe1ae47fe67e3d4350a96f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907474, "uuid": "f0b6de62-b440-40d8-98c5-c585bd2d9215", "comment": "Malware payload", "value": "4c1d2a5307cd13562414ea853cfe401f7ccb44da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907474, "uuid": "cc8f196a-ef8f-491a-869e-66e38fa1b2a1", "comment": "Malware payload", "value": "c5e37c02a03c07e86227f0dd6573608e7aec2150636e513fff9bdebdcf84fe8c93538f3a83124559e101d3cd11a7a007", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907474, "uuid": "6ac9861c-7ec8-40c2-944f-9587b02e7b2c", "value": "T1CE75D02D5E8A91C0C5A48F74E7364A6813F08E1B19D2DF2B9EDDF2F0CA377E66412152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907474, "uuid": "dc3cb9a7-728d-4091-a7e7-0939bdb25aec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907474, "uuid": "bb835257-29e6-4e37-ba53-caa5b034b259", "value": "24576:anr2MFjmUttJoprYDpnxjvCyvWtCaTweM0f3c:5MFjmUttdpnxjayetOoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907474, "uuid": "d207d220-60aa-4c1d-b099-c6c782546601", "value": 1574400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907474, "uuid": "c5147b05-3b9e-427c-88da-69be008a6abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907474, "uuid": "ec97c486-ed8d-4431-8987-c4bdd4553aaa", "value": "178000b3303d7f1ca387f16858e60f73a0e37a7f2fe1ae47fe67e3d4350a96f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d360689a-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780911088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911088, "uuid": "260c8c54-6655-4505-af0d-c68654c7bb6e", "comment": "Malware payload (Stealc)", "value": "51cc4ff8169091fda9afdf47d241ddfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911088, "uuid": "46d2c640-fc82-46e1-8c4d-fcd63138836b", "comment": "Malware payload (Stealc)", "value": "178b82e5e6b4b06fc20410f8bd6a81a5bca7e2514da262ebc3e4aa5743025ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911088, "uuid": "2375b0b5-9076-4d46-bf25-d6351b74cf79", "comment": "Malware payload (Stealc)", "value": "ff8a70d84c6b8d64932d00c58b6c8d1278e08f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911088, "uuid": "40bd74d0-3929-475b-b38d-a69a0b2dae34", "comment": "Malware payload (Stealc)", "value": "01668d4ce224dcbcab2b9543a4acc7cd67fd51356964ec014b05ebf1b76aba96ed48aceb1ce9c7bfc9d57aec35cd00d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911088, "uuid": "85efc69c-a2bf-403a-bff3-83b803380332", "value": "T1F6446C15B7A40CFDE97B813DC9524906EB727C560760EACF07A04A975F23AE09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911088, "uuid": "a972ce3e-8db4-4a01-9eda-74bcfaa2e770", "value": "a17f92348b4c8ca1121cd8073bebbf60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911088, "uuid": "4d8e7108-4d2e-43fc-b277-d538f1e53e9c", "value": "6144:IqloHD2cTDiKB/Ap819VlD+mvmSXnxNVZKoI:Iql6nTDiKB/ApY5+m+SXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911088, "uuid": "80896f03-01ee-4676-866c-673bc489025c", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911088, "uuid": "2f7630ca-e8e5-43b7-99b9-167d06bf4d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911088, "uuid": "28a7efc7-8267-4682-ab15-d9316504abc5", "value": "178b82e5e6b4b06fc20410f8bd6a81a5bca7e2514da262ebc3e4aa5743025ac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfd2b60-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780908606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908606, "uuid": "d3e55560-eddd-4aed-81ee-661d71fbf734", "comment": "Malware payload (GuLoader)", "value": "2bab2264e435eaff6704550c01cd2ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908606, "uuid": "7441b3aa-de01-4b60-bc05-4f520edb3fcb", "comment": "Malware payload (GuLoader)", "value": "17ad820c6a27854ee3b63c7c43131a58eca48dba8ddb56405bf11059f4a41bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908606, "uuid": "0f839477-11d4-4592-bb77-d3b8a40b582b", "comment": "Malware payload (GuLoader)", "value": "3fdcebc9b8ca9438afc54b8807c165845cca2c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908606, "uuid": "cb23f1a0-f32a-43dc-87c4-7b2b2be5d754", "comment": "Malware payload (GuLoader)", "value": "58120ec7f838172f28bd8ceffb384db721f78de9ac4eafe8b9104d205f885fedbc0d5bdb7b312b29cd2b2de92b88ecd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908606, "uuid": "ad2bdc0b-5a0b-49de-84ad-16956d97ed5c", "value": "T13A04F126B1A0CCA3E8E156710D7612F6E6FB9DA46014A7432F543F5B7CB61F2481F683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908606, "uuid": "aab658a0-08eb-4e47-8789-9aae5c49fb9b", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908606, "uuid": "d3fa0aa0-1e6b-4d9e-be87-378e19d7f423", "value": "3072:XuL3hi8lMcxVGbr+0nQ1yIRxjwqm0spsZcjhP2/8ZBi0kqscsGPpCXjDGHlxccZ7:X0hv5VQ63yMwPRpVtP2/oDsmpCvGHzbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908606, "uuid": "72bfc127-7f70-4380-8b47-76e358ca4c50", "value": 175952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908606, "uuid": "aea878f6-353d-42a2-a340-16f8a2dfec6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908606, "uuid": "05394bb7-70dc-4bff-874e-d1fdf5bf916b", "value": "17ad820c6a27854ee3b63c7c43131a58eca48dba8ddb56405bf11059f4a41bed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b341f6-62dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780883436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883436, "uuid": "dc041a76-af56-4aef-9bb0-e2eb73d1ffde", "comment": "Malware payload (Mirai)", "value": "45c0e85514c920776842ed56633a3f8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883436, "uuid": "f1eaae5c-e4c7-42b4-bba3-b54d68307681", "comment": "Malware payload (Mirai)", "value": "17dda1925bc305fab1cfe37901741929eba3518074c45e79b0f7b054b2458b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883436, "uuid": "5d43e10d-6f8f-4b45-bb46-a1b29994b43d", "comment": "Malware payload (Mirai)", "value": "e12401a98e5ba6c1790175927f0b1b00fb456f06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883436, "uuid": "b32bf9e1-5c60-423d-b743-766a6a43909d", "comment": "Malware payload (Mirai)", "value": "a48c23bb49a58929a7a163d37c9fa61654bb60763067ef98c9d778336147bb11a9734a5c2edf4fabeec871e970622772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883436, "uuid": "e241102b-66bc-420f-abf0-de05cdd12125", "value": "T1DCB30945F8515B17C6C212BBFB4E438D7B2A17D8E3EE720399256F20378B96B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883436, "uuid": "e6ca3766-cab6-47f2-bb35-c91e1677c1a3", "value": "1536:sAFIxbgnNpFk2/WB4VcL7v7Tuhy8CTj2eleWwyw1N+kxQ6+raiwm6HpvOkjvE+X:sAFgQFkZ46f6hC3qQP2xE+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780883436, "uuid": "d5d53f50-8708-40b3-9d63-7ba1d3a0d457", "value": 118144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780883436, "uuid": "50a3b590-83ff-47f6-a259-f4cfc5bada1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883436, "uuid": "100db8c1-9c89-40e3-8dae-c4474e169769", "value": "CRY.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e8b5ce-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912036, "uuid": "591644d8-4c10-4df1-a4d5-50673845f096", "comment": "Malware payload (Formbook)", "value": "961593528b94bc41da8408de36e6d3d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912036, "uuid": "cf1a7cee-cda7-43eb-8114-b0e270881d1f", "comment": "Malware payload (Formbook)", "value": "180ed78f5aa54c948ec93fd26a3a4d9c5ee3baf52211c827e19129e2b5516517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912036, "uuid": "4df7daf3-4e94-4ead-bd66-58ddc53c005f", "comment": "Malware payload (Formbook)", "value": "e53841537d071a11648727dcbfaea7c322380089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912036, "uuid": "7d30af60-72b0-4201-bee3-bedcf81ad822", "comment": "Malware payload (Formbook)", "value": "79383ef7489a353e98ba33bb3036035f8290e5dfb8f4bf45f561342359e2ed0167412e87014c795c70bac5ddb9af7bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912036, "uuid": "48492540-69e0-47eb-82af-1f4e6f1a4664", "value": "T1BE251258155AE607DA605BB88E72F278137E1DEDB500C2129FEC7FEBB976B111C04287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912036, "uuid": "50cabe81-4743-44d2-b844-4fc113f5c060", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912036, "uuid": "7bf88123-f737-4994-ad6f-adfb0e10f5e8", "value": "24576:U1Zvm0MlhTO/K7CpytiI7Ex9umP95AccBlyc:SO0MlhiUr7EHumaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912036, "uuid": "f8a6f49e-3e96-4cc4-b9c3-b26fb82c8f91", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912036, "uuid": "d4605746-954f-4510-b325-20743d58e7aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912036, "uuid": "6104638a-88a3-4c74-8190-a0587e12a753", "value": "180ed78f5aa54c948ec93fd26a3a4d9c5ee3baf52211c827e19129e2b5516517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa0d708-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780911744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911744, "uuid": "ca3af2d3-6b35-410d-b5e7-d4afe4bb6898", "comment": "Malware payload (Expiro)", "value": "66d7b0c05ee63704c8ed966f8d1e1e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911744, "uuid": "0c00cdb0-a193-432f-9b95-e40ccee87e77", "comment": "Malware payload (Expiro)", "value": "18e53ace8f5ac246907518eca1dac1fda544163727cd3f42fe06c7cfe19e06fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911744, "uuid": "73247fe9-7235-4b49-a69c-1c3bd2635973", "comment": "Malware payload (Expiro)", "value": "caf208889fdc24bc12ad03da6117ecc3c54b0b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911744, "uuid": "ef231104-9203-4439-b2bf-2757f30036ed", "comment": "Malware payload (Expiro)", "value": "969479a4fdeb0d12ad6035ecca14268e6c14561a942b5669921e24104fcfa1b829c5c4e4facbfe58c0c2b2a972a46e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911744, "uuid": "a5f7a98a-56df-4e70-8937-995374720271", "value": "T16875236D2B06E21AE69617384E71F2B63B791DCDA400A2465FFC5FE3BE3BB545C00291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911744, "uuid": "89f8117a-b29a-4361-9927-d4aaa0d21c98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911744, "uuid": "d8b52866-a503-43cd-a073-8c5db6478857", "value": "49152:vJZ5Flg/10fSN73oEUDL8rcHukN76OIv:vJZ5Flg/1x4lnnOkXIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911744, "uuid": "9bb7b0a1-e045-47e7-9934-5ad4037d3a87", "value": 1658880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911744, "uuid": "a049b2b3-f259-4c4a-b657-98cd41930f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911744, "uuid": "471d55bd-7960-4f59-91c3-d947abdf2c0d", "value": "18e53ace8f5ac246907518eca1dac1fda544163727cd3f42fe06c7cfe19e06fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2a6357-6311-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780906401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906401, "uuid": "ea72f834-a6b4-4ccb-ab43-b72767d079cd", "comment": "Malware payload (RustyStealer)", "value": "ed73908c65575cae4ae7debf23220056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906401, "uuid": "dff6ab75-fe53-4d27-9955-9f1c51743763", "comment": "Malware payload (RustyStealer)", "value": "1908667a279616de082f9f3a196fc1710ce5be9c85bdb2fe7100192f4d8d42f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906401, "uuid": "851a5626-4f4a-4e89-8842-04f5c53855ae", "comment": "Malware payload (RustyStealer)", "value": "6f7df270bd72bf3119403da9e738f7df8015813a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906401, "uuid": "a1e57b15-ef18-4d79-a130-5eb81cc01f70", "comment": "Malware payload (RustyStealer)", "value": "0ca7e41a95603cfdc1ca8da67d937bf896e5282e9e7880fcdc776bac209e7928002832aff0cadda61a9e10c3314ca3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906401, "uuid": "c44a87d4-9591-434b-8db8-d509523d3ae4", "value": "T131F55B43F28584EDC45EC079862B9632B633BC8906306A6F16A4FB253F76B511F1EF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906401, "uuid": "40bc37c5-d81a-43b6-8307-bbac755ee7f4", "value": "713ff4dd0f30035a9e8c8c906d73a028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906401, "uuid": "161ac0bb-da0d-4941-935f-72e5b8aa0876", "value": "24576:um+l+pISlYd2hsT1ORfXC9DomS4g+g7Qv/d3rmsrP1YtwUKBll6NqidVLnyx:umO+9YMhoMfyBbTlrmsr1YuUk4ZVLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780906401, "uuid": "5e96ab9b-da3e-40a6-8138-6d5ff5667631", "value": 3408384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780906401, "uuid": "f36ad4b6-284d-4c7c-a03b-727971e4e3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906401, "uuid": "2e7bd261-fbe6-47d3-ab16-1b436e6925e2", "value": "Protokol_Prioretnoy_Proverki_Obektov_KVO_19.05.2026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293d11f3-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "4ebcff21-6819-4636-adbb-d1c8f2edd693", "comment": "Malware payload (Mirai)", "value": "3a510a1c6a0e2f0becc4b08f4f31e8d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "f38f52bc-6545-494b-a994-07d2c341bbce", "comment": "Malware payload (Mirai)", "value": "191ff4047ee6d6d68a609cfb65531e6f55ee973a331ae2340f3827ec178951ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "d32d3263-b323-4f0c-bc96-a8613ddb4b1e", "comment": "Malware payload (Mirai)", "value": "a05a1b460323d4a5fd73d8f19aba5115f1246fdb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "046d60c4-5d3f-4cd9-be81-8d35d1899767", "comment": "Malware payload (Mirai)", "value": "768ea96c1971276d4625ba36864500667b0e758b61cb7fb81eb4972a48f70bfd3bb7dbe025ba5e8d5d1db56d2c5c6357", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939579, "uuid": "cfbc48b9-4d85-4c86-81d0-8ed6a9feb569", "value": "T137932894BC419B16C6C6227BFB6E028E372663E8D2EB32179D215F2137C785B0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939579, "uuid": "01810439-66ea-462d-b3fd-4deb67a3a031", "value": "1536:eyHRPRmLKhFIWcMlVW+GCVnB3foiMjqLonCQmz7bQ6dXxZPWlk7M2D3:eyxt7W+G+3QBBntmzg6d7WidD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939579, "uuid": "3a71c7a6-608f-4e4c-be61-7e6f70fb5a1a", "value": 91744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939579, "uuid": "3afbbde8-2a2d-4769-9f84-51a1d0bc2292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939579, "uuid": "0930c9a5-e70a-4936-bca4-81d05bfe0f88", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f085039f-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908560, "uuid": "f2b38a10-d987-4edb-8ded-9ceb5b30f72c", "comment": "Malware payload", "value": "fe03419b8b2b6ac6e6cd9693374d350a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908560, "uuid": "9da9f626-717a-4d18-aed3-58aa11eaf240", "comment": "Malware payload", "value": "198bc83f93a8538fd3f5fb84a6a0a40dad19a0feffece5d1bedf9272dccf4394", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908560, "uuid": "d0ac8a58-1f2b-4aa9-8bbf-b6938873a8bd", "comment": "Malware payload", "value": "3577949a9754104fcf5d59b0390a1821c3d44305", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908560, "uuid": "37e5234a-fe75-4507-a49f-52e2c62c03f0", "comment": "Malware payload", "value": "7dcaf29adf5d8101307dbb87cacf3dbdf0d291c50f3fde985ae3c9dbf825dea29403100fba3481d48fc08f60749d8ce2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908560, "uuid": "a5ee628b-59f5-46c7-936a-d441d23b77d8", "value": "T15D05F93DC814412DE572D129C58A092FF9922A8B123CD507A1CA7F5FAFA384677C739E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908560, "uuid": "20a76a3b-f1a5-42cb-a04f-8bc5250b9c78", "value": "3072:Y8BIg2W7kPbLuERYdrPB5RSYAIBZE+aFcj6TS4XSC8j7735LiSZXtcSBSinv0y8P:KgMLrYBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908560, "uuid": "cfeecebd-8cf2-4338-a2ba-456063ead64b", "value": 826318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908560, "uuid": "34ad1595-2bb7-42a8-8fab-1fb629fe6ad4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908560, "uuid": "b6c6f6c1-ec66-437a-adc0-78564a4bdd2a", "value": "REQ For Payment Invoice FER480120002600086230-734009_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10b37f0-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907594, "uuid": "7c9ea5c7-78ad-40f5-81a6-c1255bbd4a6b", "comment": "Malware payload", "value": "ad830ba30d33c5aca4bac899ee718ec0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907594, "uuid": "371022a1-2675-4f03-8c7f-11e4a3916f39", "comment": "Malware payload", "value": "1a0f9984e241be8e91d3d7cd886b82183f6fa37cfdbd8bf8bfa84155f61fa03d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907594, "uuid": "ae039049-e044-428b-8aa1-df36b37fe09f", "comment": "Malware payload", "value": "d70c1f38c871113a777a560ea2cddc37e20ac66c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907594, "uuid": "c4833e9b-843d-4753-8f43-76fbd9f15c7d", "comment": "Malware payload", "value": "9de5ee374b0a2d1e450b6b5b90acaff2b8b5933a6219dff493120721f9356cd5a5bacafad269e6c82092fb42f33ca253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907594, "uuid": "caf3967b-13bf-4480-a8d0-445d02ebb359", "value": "T12D45D01D23DC9F44D4BEDB79A73A066043F2AC078E92D77F694506E8A917BF25902323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907594, "uuid": "18523d88-cd63-47e2-ab40-f1bef095c2a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907594, "uuid": "ae07a83e-5fe9-4802-b65e-6d93cd9dde1d", "value": "24576:I7x32DUttJoprY9YDWzocEuei+ZcyB+VpWf:Ap2DUtt79zNEIoB6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907594, "uuid": "a0f7a3b2-df14-4abe-a2ce-c7a936cc00f8", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907594, "uuid": "96ba03c6-7d7e-428e-b49d-101cb15bc218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907594, "uuid": "82056078-1d0c-4b09-b399-cd628e72a941", "value": "1a0f9984e241be8e91d3d7cd886b82183f6fa37cfdbd8bf8bfa84155f61fa03d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b88ab0-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910530, "uuid": "67a20620-1ff7-4a9d-aa41-3726759f1b24", "comment": "Malware payload (AgentTesla)", "value": "55d754891068d51c9fcaf14f6879f3fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910530, "uuid": "07fd57b0-449f-4faa-ba3c-41552bdf709f", "comment": "Malware payload (AgentTesla)", "value": "1b17e489bb3d63f190da9245e4b742701dcb44fa5bc77da97dc682b3925baf03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910530, "uuid": "642f2c91-cb25-4c23-bff7-7555663bc6e7", "comment": "Malware payload (AgentTesla)", "value": "66ddcb862e80d4685007b8ee8187d90ea319178d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910530, "uuid": "bace2078-d122-44b1-9136-2af7ff79d124", "comment": "Malware payload (AgentTesla)", "value": "f6c4ab9570c8a3651d09b329c2ccca764852764040d699bacfd07f6a66eb78090a01e79151eb69e7deceef422c90b99d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910530, "uuid": "f3714543-ed1b-4f64-890c-6a18a51fb817", "value": "T199151254262CDA17D56D4BB01DB1E078577C2D8EDA20E613BFCA3FEBB5BA750090A603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910530, "uuid": "6befe5d7-9fa6-4ad1-a19c-ba249b17f532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910530, "uuid": "095de479-e4e5-4e0d-9730-50861d7f3a72", "value": "24576:WxnNrL5mvmczHW2WHN9exAuR/G3Cfy8KlmKV:WXABzrWHfEAuR4n8Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910530, "uuid": "b6689767-b879-4203-99a2-2a78d343fd81", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910530, "uuid": "b1afa94a-31fb-4006-ba11-68d646211a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910530, "uuid": "7b912918-14ca-48aa-bfc2-20d139567af0", "value": "1b17e489bb3d63f190da9245e4b742701dcb44fa5bc77da97dc682b3925baf03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8761f8a2-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780907524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907524, "uuid": "563be5db-0b60-41fa-b3d1-0f1c8afe5ddc", "comment": "Malware payload (njrat)", "value": "fb57cdbb2164dd3f36d1f738a04a89fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907524, "uuid": "9fc897bb-a627-4d49-989d-071aa4d7cf4d", "comment": "Malware payload (njrat)", "value": "1c0f7391596f096adaacc5d71a47ff47580f70c51b98603ccc9c800f1247fca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907524, "uuid": "ca01cb19-5829-4536-9174-fc57ebc2d2f0", "comment": "Malware payload (njrat)", "value": "815903e43c473be9791d06a3a43a25b3463b766b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907524, "uuid": "bde249d3-e54d-4f02-8c95-d6861048dc7e", "comment": "Malware payload (njrat)", "value": "ce18a794eb03fd4e4a507c1acc8a53b2f11077202a461b52f311a6b77e6871e81a794722d4a66ddee62825daeebc4119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907524, "uuid": "afaf8bad-94c2-4386-8c85-2570d2c28592", "value": "T1FC050158720AC826D8865FB49C71D1F427B49E98EC21D303EFFA3FAFB8763651516242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907524, "uuid": "435d6698-017e-4272-ac42-07ecc939bb84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907524, "uuid": "80d20405-0a56-4766-8eb4-cf9da32b100a", "value": "12288:dMMhz0ZtlwoGfMcrTWAgmYonze51hoQx1fc0s2eJFXxOTjN5ZGM+5AmDFVILTY:ThwZta0ceV51R1ftsFX8vNyWmDLIL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907524, "uuid": "83cdd699-5484-4eee-b78b-60008acca71a", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907524, "uuid": "1b888aba-8827-4ebe-af72-90a8b658273b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907524, "uuid": "871bce4b-0bef-4c31-811a-afce34c5b559", "value": "1c0f7391596f096adaacc5d71a47ff47580f70c51b98603ccc9c800f1247fca6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6a80e3-636f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780946780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946780, "uuid": "1be0a22b-233f-421e-8635-c13f141a55d1", "comment": "Malware payload", "value": "6bcd8fac90a526e3ed045c18c71dd605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946780, "uuid": "52efc1ba-70ac-4e7d-85f5-944081e192d3", "comment": "Malware payload", "value": "1c1b8a2da6ff6e838c32b2f7da2beb4f7f979a66cf2165a7e7d42eafb2a501ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946780, "uuid": "92e9b019-9a37-43ce-b594-cc44d2a6c564", "comment": "Malware payload", "value": "41a6a4752f8874e770e155b95ec8f416a3273efd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946780, "uuid": "60364039-23b9-415c-91fd-13e93604cc18", "comment": "Malware payload", "value": "45c193f609e20b534402f2f94422e67417b9609ad355f5606ea1e92df7742dc910ac9f0207ec87f0833470f101678ab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780946780, "uuid": "f5e6f079-9281-4dfc-bd3d-b03cdb004ea5", "value": "T1D482518DE6B923BFC7E173FBE7854ACE7B394E88A78727669124455033C0709B934660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780946780, "uuid": "a12d92eb-a084-40af-985f-c93e455f06d1", "value": "384:TVbqWzQZuJqIwkUndcorWzHfUELbUl0v27AGeD/NraemCv+i:T/QZ8q2QSrfPUCv27ar3v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780946780, "uuid": "3151491a-4f08-4c89-ba90-7aec29bdcec4", "value": 18140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780946780, "uuid": "0f2d6f02-a553-4f94-975d-6fe7c115c0e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780946780, "uuid": "b6777d31-8639-4e81-8ee0-abee7d5226fe", "value": "1c1b8a2da6ff6e838c32b2f7da2beb4f7f979a66cf2165a7e7d42eafb2a501ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2745ba84-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780910799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910799, "uuid": "c92c697c-356d-4f61-8e3e-a822e29f9b31", "comment": "Malware payload (DarkCloud)", "value": "c55afb257bd82a54395672cb7d3f45d5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910799, "uuid": "14cb710f-8559-47c2-ae64-ab30b23ceeb4", "comment": "Malware payload (DarkCloud)", "value": "1c2e8be7a102d68bcfd7ee30343f2e9150d0334123fd2a56771cfeb6a089d3d9", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910799, "uuid": "fb026f4b-9d4c-417c-90fd-8914baf9656e", "comment": "Malware payload (DarkCloud)", "value": "ed0eb0bbd7345fa47dd934257b24bf4112555d75", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910799, "uuid": "4a685f9a-6938-4ea8-af69-a285ab34027d", "comment": "Malware payload (DarkCloud)", "value": "df247f2796dd146d75e5c49e674e4c3e9a4427b2aa9fb1e583faeb5fd3b21868d2f2cbbb7a6d91ef71adacc3a181bda3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910799, "uuid": "ca81660d-2a2f-4b33-92c1-5f7bdc8f85ed", "value": "T1624523583B15D607CCA567742BB1F2781AB80EEEA601E3529FD9BDFF76B76021C04182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910799, "uuid": "348c0abc-cff0-4e83-ba76-3669e1edf4ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910799, "uuid": "0e96452e-be95-4b6a-a784-7a175b0146fc", "value": "24576:ldUBxM5V4siohsXeRLVFv2so9KUbmJ/lrlz9R71jLTNMhrgH3l:ldU4n4PXm/vFo97aNlrlZR9TNMrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910799, "uuid": "d9b85b3d-f6c3-4a27-840a-2b9419d0f1f4", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910799, "uuid": "2982e9cd-dfb7-4592-8c90-f640e39a2cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910799, "uuid": "0f8e9f26-2c74-4346-bd36-33934eb33a42", "value": "1c2e8be7a102d68bcfd7ee30343f2e9150d0334123fd2a56771cfeb6a089d3d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcf4332-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780928986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928986, "uuid": "96680d7f-4aa7-45dc-800a-4a350c1b22a3", "comment": "Malware payload (RemcosRAT)", "value": "e345027d08f2b17aebd21d6f1556209f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928986, "uuid": "d5f1281f-d7c6-40f0-9499-78a9398c2411", "comment": "Malware payload (RemcosRAT)", "value": "1c31cb888b12ea6f8ff24ef41df360bcdaaa148a2c0fffc6f53928a5cf6a1d4e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928986, "uuid": "93e2a390-e43b-4de3-9b5e-cd65ad62c140", "comment": "Malware payload (RemcosRAT)", "value": "d69eb1eccda8099a1d30987a2abcff870863b710", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928986, "uuid": "f60c1274-e5e0-4577-a1ca-ddbc9ebdb3d2", "comment": "Malware payload (RemcosRAT)", "value": "c5924a28705f1844994eacedc4fb357ed29aa664a548a5a55216ec6a4256e0c1819e859f761eb6a2aa03321464fe2d8d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928986, "uuid": "942672ff-e299-4e96-b885-1b33f98afd52", "value": "T14313C461C9D907743E9717BDFC803711ABB89BB4823505FCF6C91348A41E46DB73AAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928986, "uuid": "d11438d3-eaa3-4527-814e-425491437a2a", "value": "768:FPO9SzRLyxR5HXZhdMtWNGZiB0OpjvisP2l3yJBd:x1Cj/HNNnpjvisP2li9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928986, "uuid": "97c09409-eb0b-4ac8-8e5d-3458f91dd9c8", "value": 43993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928986, "uuid": "7486cca1-f440-42ba-9d15-92430a17b0ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928986, "uuid": "b3cda499-20de-4cf3-9262-b325f0d304a2", "value": "WTR-01032026-145041-02439268.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a785cf2c-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780911444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911444, "uuid": "b0135fd8-5012-4701-b7af-bd2ac2fd2124", "comment": "Malware payload (PhantomStealer)", "value": "ffa05a41615981e1dd6124146a070629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911444, "uuid": "0a18db1e-57ec-414b-8dc0-71a5a332b145", "comment": "Malware payload (PhantomStealer)", "value": "1c741bd95bf826f452df28045719ba5c1cfa3ebc8288ce226d1cb7db874329a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911444, "uuid": "b6e5a64e-6765-4bf2-86ff-93074d441bc1", "comment": "Malware payload (PhantomStealer)", "value": "e4542b6af678fd58047ba7749e7e58dcfc3a976e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911444, "uuid": "069bb564-a05c-4017-8f4e-380ff5f03c37", "comment": "Malware payload (PhantomStealer)", "value": "4fb4067e42a81917773583845a953f8e85b7c54d5b80c1db4205099c8ac02bba61ed1cdcd82f262c74565a25ab9014c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911444, "uuid": "5db1c612-86f7-4b21-9b85-a70ca87e6fb6", "value": "T11265237A9510E40BCAE95B781970F3B921BD9DDCF90193029FF96EABBC279781C441C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911444, "uuid": "2eabc613-9d6d-4efa-8e31-2a8f73e46b9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911444, "uuid": "cfbf7a59-6e74-4924-afbe-bdcaf40be504", "value": "24576:a3ZyRqPVH5nv/x+q/J72D/cn9Kj+zMRp/bznsG+j2Ve6G2jnuL0HsHS9KW/bnL0:aJm45nv/VR72D/cngj+YH/brD+CVBGU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911444, "uuid": "c09dbf62-8034-49e3-82a2-82157736090a", "value": 1505280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911444, "uuid": "177f791b-7441-4e72-ab10-9d8bbcbed621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911444, "uuid": "e801bd6b-6e1f-42fa-9c30-e51cf1003c78", "value": "1c741bd95bf826f452df28045719ba5c1cfa3ebc8288ce226d1cb7db874329a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b979f709-631e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911903, "uuid": "f7fc4adb-1b35-48de-adf3-27ab214fb98d", "comment": "Malware payload", "value": "9db4ee42f97aaba477f59c1c655fdadb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911903, "uuid": "9bd7e210-38b1-4fbd-8c39-0ac22ade2554", "comment": "Malware payload", "value": "1c96a6787e7da9fb6e2288db9391058b8d3e6ca76179d82d80ae49c1993bf73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911903, "uuid": "368c0db8-4893-4736-9466-05c72aac0d70", "comment": "Malware payload", "value": "9de7c8afefaae6027a5fc552b7df03870a64d181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911903, "uuid": "c9f15d39-9f1b-4c38-b981-60428fc160a8", "comment": "Malware payload", "value": "425c06389619329c7db04703e3ee73c5051dfb8975cdaa2b5e7dc9b8ceae23485187f3c7a0d2f9d8ea33d6724c44578a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911903, "uuid": "9a44ff27-7767-44b5-96e4-b39ab781b7a0", "value": "T1F165010623E89FA8F4BEAB795136051487F5F11ADA1AEB1E3D9C80ED5932B41CB41373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911903, "uuid": "37e4fc5b-54d6-4872-831f-192ca9b9660c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911903, "uuid": "ed9ce66e-58f2-4591-b25f-eae989f74545", "value": "24576:FJriyUoZNKedcYIesRiVZus+TCuX9S9FbCo6CJ/Itii3iqQdZuuAvppaeX:3riRoCeQsQ9FV5/3iTZuuAvpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911903, "uuid": "862e0894-bd3f-46c7-8651-6ba6654e2e9e", "value": 1469440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911903, "uuid": "db02b134-d2fd-462a-bf4e-a937c9e2a371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911903, "uuid": "3ff45a48-1423-4441-b401-d641cbaf5412", "value": "1c96a6787e7da9fb6e2288db9391058b8d3e6ca76179d82d80ae49c1993bf73f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49161be0-631f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912144, "uuid": "26e97f73-70bc-48a4-bf8f-86f314728078", "comment": "Malware payload", "value": "489ac34d06cf3d040d5f0763ededc72d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912144, "uuid": "d3da0130-f132-4915-b60c-f821115c55a5", "comment": "Malware payload", "value": "1cb986ecea70c56a87c610d0815f8811d51488b508814982d58211653db414b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912144, "uuid": "59836521-75f0-40d8-93a9-ad4169a834d0", "comment": "Malware payload", "value": "a2813c921a5fc2a49be736917ce12709832b0042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912144, "uuid": "c2d5b9d9-675b-488c-9bed-93372a142bf4", "comment": "Malware payload", "value": "391022d2fd795fcf684dd6a2aa7e3c802e1d41cb0408d4a14df29970a90038ffc5b583134f92d865200b8460f9d2eadf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912144, "uuid": "e614ad71-fe74-4dfa-9c0c-6f94c6c0f31e", "value": "T10F35AD1322989FE8E47F9736C0E9061443F3FD42EE22DB8D7D4929FC2921B958A51727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912144, "uuid": "cbeca326-ff83-4091-96c1-6d9a7e5e86f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912144, "uuid": "d6f7c3c7-fe12-42c8-b396-05412e39c761", "value": "12288:ojHzD31o0f/KCX+rNf1OV45vKgxPs3hHaUxe2Hg2EUgkrCdl8rdn0FSgaHwTq89E:EqbKd3Nxe6J0FhhTq8oyV2UaQOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912144, "uuid": "5f856ac1-9079-47ef-a7d4-5f1c5d14ecb7", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912144, "uuid": "7199703d-6e81-45b8-bdf7-f31db4d71e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912144, "uuid": "7b546e66-616d-465a-a6d5-ffd20573f983", "value": "1cb986ecea70c56a87c610d0815f8811d51488b508814982d58211653db414b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8439502-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911955, "uuid": "64e053b7-aee3-4f7a-8f39-34d958d2e688", "comment": "Malware payload (Formbook)", "value": "faf98ee6857d8d90d94ef8bd851a8d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911955, "uuid": "c302e92d-62d7-4fd8-b967-5fd69e45feb4", "comment": "Malware payload (Formbook)", "value": "1cf5d18006cdc8ecf109429eec354ede88145ad2d3be484dc5b8935afb3e00ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911955, "uuid": "1c0cd225-9d63-4c58-93eb-d5b558c027f0", "comment": "Malware payload (Formbook)", "value": "3a30c856bd194e96387fe713617091ace0b562a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911955, "uuid": "827b97d4-6890-4915-9436-59eaf501812d", "comment": "Malware payload (Formbook)", "value": "249b9d79f32dc5a33ebbc1908a8dc42d55b008b1349b47b83259017f61460eb5931030497a06bda611750d390d68fe35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911955, "uuid": "a9e0e129-1ded-4889-bd4d-14a94a5b4275", "value": "T16054231590F52293D6EA0DBB8883F3CB9298B577C1EA3343BBE1AD951C431657402F9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911955, "uuid": "0b5844e2-db9e-4e02-8be8-4d0b4e90afe1", "value": "6144:k6mtpZreMb8tS806R3lymJXGPSMfCN5M+ProoK:tmtrqM40m3/8ZCbMBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911955, "uuid": "e227ef7e-148d-4541-976c-87a6484f58df", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911955, "uuid": "e6f6d734-ef0f-42ab-a20a-dccb8195ad5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911955, "uuid": "3b3dd19f-b6ec-4a01-b2c7-b12588eafaa5", "value": "1cf5d18006cdc8ecf109429eec354ede88145ad2d3be484dc5b8935afb3e00ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f967dd-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908537, "uuid": "aedb157e-8d48-4582-8b34-fbb8c419781c", "comment": "Malware payload (PhantomStealer)", "value": "994aa57efbbaff2779bb09e26684d7c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908537, "uuid": "c82b9223-84f6-4a3d-94a7-9216edf188a6", "comment": "Malware payload (PhantomStealer)", "value": "1d3e20aef47cc1fd4392c6acb64f15452590794dcd8e90d8a69a151db9e8c000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908537, "uuid": "46efc2b3-3247-428d-b052-63fcf2f26dab", "comment": "Malware payload (PhantomStealer)", "value": "9450736326d8c74db754ddbc2a3ffa09c1d99dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908537, "uuid": "584b5912-b0f2-4333-83b0-4cbff3256b73", "comment": "Malware payload (PhantomStealer)", "value": "4033f924113f20dbcbfef43fc4e0e99fab4bc1a9bb18a3b745eb25b413b31f74346a9587a6f9657c618061f069cbd8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908537, "uuid": "b65f046c-7828-4a35-add8-979db4c76046", "value": "T181751355371EDD42D4E75FB00661E2B417B44E98A922E2538FEBBDEF787A3502806383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908537, "uuid": "3a4ec3f6-5bdd-4fb3-8778-dec917562cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908537, "uuid": "cab93394-c8d6-4326-8219-2f6d916cc3d9", "value": "49152:sZLN3FQ2lHCMq0jgtxRwLfEXBJGD7mGWYnsF:OFQ8HHq08BwL8XBUlWYns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908537, "uuid": "a9c80ddd-26f2-43a0-b473-3a45340bded0", "value": 1581056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908537, "uuid": "1dcddde4-4c7a-4fa3-a5bb-446a8d1d9f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908537, "uuid": "4722a384-a71a-4634-9427-cab83ab64447", "value": "1d3e20aef47cc1fd4392c6acb64f15452590794dcd8e90d8a69a151db9e8c000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35db697a-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911253, "uuid": "d466eef9-93ca-4bf8-aa60-00720a434902", "comment": "Malware payload (Formbook)", "value": "2214da9cb9e7ba7063eb7da82a085d0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911253, "uuid": "765abd70-9aa0-4097-ab5c-93f57ec2279a", "comment": "Malware payload (Formbook)", "value": "1dcf264b55ed2d7adfb5b5618ca2c5b2fde7f3f9027faa975cfd0a14f031840e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911253, "uuid": "461aac70-05ca-40a7-8f73-776304206a80", "comment": "Malware payload (Formbook)", "value": "e13f050b5d0b2a3eac2118af785b231ad191af72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911253, "uuid": "9b9310b1-96c1-4904-9a13-63413f1c8105", "comment": "Malware payload (Formbook)", "value": "5f8688724ce469a8d151f7b8502cce93e999e008e962872daf63e8fa6c6d5e48332f851fad74bf6ba7a09079a638dcb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911253, "uuid": "803fe7c9-28cb-4bc2-9a29-6356833258fd", "value": "T16D35125875AAC407C5A987B908A1E27843B92EAFB920D3C64FDEBCDFB5F5B014D14243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911253, "uuid": "a32e343a-54cd-4c17-b1cf-65a98fdcb5af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911253, "uuid": "2b7029b7-7891-4000-acf9-fcfd78b0c696", "value": "12288:3wJp1ZIrKyVViyF8k15TXEl4dGlbeUJILkLanVj6C8+zIasKNAbup4c3NYF2fJnT:AJ1Ip8knTXE+4BJQIMn08QkBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911253, "uuid": "8d796ea4-c662-4c96-a49e-786ce76b670b", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911253, "uuid": "3fbd08f4-6b80-4028-8f71-b6f417d3180d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911253, "uuid": "77c9b44d-5772-45a8-97c6-fcf210f8caf5", "value": "1dcf264b55ed2d7adfb5b5618ca2c5b2fde7f3f9027faa975cfd0a14f031840e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e60fd8-62e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780885163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885163, "uuid": "61916964-66b1-4de1-94c2-293de4cf9772", "comment": "Malware payload (Gafgyt)", "value": "de331d3601b2e250bcefdc6c12518e22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885163, "uuid": "a44490c6-0add-456f-b801-e440b187cbf1", "comment": "Malware payload (Gafgyt)", "value": "1e506958b92f8ef28fc1989ce79258a5aadc9d96f0ec44c05a1ff0bdcf5d4917", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885163, "uuid": "ef5bef50-25cc-4972-9f69-1d84a54ff922", "comment": "Malware payload (Gafgyt)", "value": "2e99ec30e309d99ccf7cf9a7cd4a967f2bbdd85f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885163, "uuid": "ec93de4c-350d-44f1-89e9-89a7c81a9203", "comment": "Malware payload (Gafgyt)", "value": "7ffbec9b12190204e4f8ebb1320c0c0050d68c298a57e18da053df90c09f29fe2866b6c8dc2728691e61146e21770958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885163, "uuid": "c50b3a54-c893-4992-903d-4559cdba0d04", "value": "T134C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885163, "uuid": "86478a94-d213-4d74-9444-32531e720762", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeOEdWfRZrmW+IFj:Ted0W0MZQHod6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885163, "uuid": "6c38ab8c-5c83-43f3-bbad-42c4f2c7d4f9", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885163, "uuid": "45042078-41a6-4eac-bd5c-d8d4590460d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885163, "uuid": "6fc99b76-05c6-4482-be3e-cb6e55360060", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85161857-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910097, "uuid": "190f01ed-c37b-4873-858b-083d03e8ab4c", "comment": "Malware payload (AgentTesla)", "value": "018a1cb52c5b33446ef6759ca399dc5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910097, "uuid": "99ec2222-262f-44f2-9a19-b7d8d9e8ff43", "comment": "Malware payload (AgentTesla)", "value": "1f1cf78513797910c0beffe5a1eb57cefe7748934dfd342fa6b2a3d00270de94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910097, "uuid": "08736965-b60c-4de3-9d5f-c0121a553c88", "comment": "Malware payload (AgentTesla)", "value": "0be7d12533d74a205bc7c2c2e087e085e2b4209a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910097, "uuid": "6da741e3-d798-4833-8cc7-d2f50270b0ba", "comment": "Malware payload (AgentTesla)", "value": "788bd37aee0c1a9669d8f850819211faa7133fa6e165fa521956b88265bf2e7f7671fe87ee23012e3e9243295cb5e28e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910097, "uuid": "775e4fdb-b2da-44b9-a227-a33b46e9d603", "value": "T14435E0E83A26E706CD924A70AA35DDB516F40DACF401BAE78BDD3F5B74AC1506E0CB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910097, "uuid": "156fee9a-ce04-43a8-ac12-04bc56ec025a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910097, "uuid": "30f5f8cf-f8e7-40b0-9f03-957941eeac56", "value": "24576:N8aCzZ5JSbPxB6vtlleJc9xnSfF90tk7XUeCbdON:KaCV5Eitllh9xnkFmCgeOdON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910097, "uuid": "f80057cd-9381-464c-81dc-3a7c2f470065", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910097, "uuid": "d3dbf19f-6a51-4825-8a70-75c72f401b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910097, "uuid": "13ee7b0b-e850-4a5a-9db9-1a0eb51bdb35", "value": "1f1cf78513797910c0beffe5a1eb57cefe7748934dfd342fa6b2a3d00270de94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "146e9b1a-6304-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780900459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900459, "uuid": "1aa670fa-3b7d-4c26-9329-2f6cd43e8ebf", "comment": "Malware payload (AgentTesla)", "value": "a7ebce745eefcde2e331b01b7e60a459", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900459, "uuid": "2a96359b-5459-4645-9248-24b30d08a4ef", "comment": "Malware payload (AgentTesla)", "value": "1f4b370a2d97e33e7cce55d224cf607ca49ce63a65459cb67b2d58c6b6eff528", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900459, "uuid": "83a15753-7da1-4f2b-9db8-ec1312054e1e", "comment": "Malware payload (AgentTesla)", "value": "0cc3e80385385b8fe81a55990d98c38d6805126f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900459, "uuid": "ab8262a0-de4a-43cd-8525-7a9f1a86eb1a", "comment": "Malware payload (AgentTesla)", "value": "8ea9899033e46e159e6a2524749ab0f497199d23bfcc79526a928f378e332b252d10e22944f77357af2753e04e3f8819", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900459, "uuid": "1fe1c45f-821c-44be-8dbb-b66958192f6f", "value": "T1797675300354C6B1D2585EE62AAA7168640D4DCF98F5FB027A6F87F5027A932E37B770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900459, "uuid": "d3d3cb77-38ab-4ebc-a25c-a9a7969ee7d2", "value": "196608:ZpP/0OnJXftbSNI1KvoWg3ZtsXL54qChZ:Z18OCNIYoRJtsl4qC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780900459, "uuid": "9e09ca67-1888-47c0-9030-92828a329bb1", "value": 7198846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780900459, "uuid": "3a335744-c121-4b5f-a405-097c8d1e2346", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900459, "uuid": "0f8bcd2b-c1d6-406a-b519-9a168a08aa1a", "value": "DHL SHIPMENTS NOTIFICATION 39952312 ARRIVAL NOTICE DATED 06012026_PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e717c2e1-632a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780917134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917134, "uuid": "0886da9c-0c18-474e-a66b-9500d5709ba1", "comment": "Malware payload", "value": "0d564d3341f37d5450db1474b5a33cb7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917134, "uuid": "7b5ec690-5f68-4540-81cd-44805d92fc7b", "comment": "Malware payload", "value": "1fe0f4da969f81c29c41d596435e088cb451d92645ac5579f6ee95347b7dcd4a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917134, "uuid": "f736a742-6d91-4a22-bd31-f0cd283db221", "comment": "Malware payload", "value": "e497825bde90d065b5c44ecf2b81ca55107db3e1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917134, "uuid": "057c08a8-d71f-446f-a279-466643897b9f", "comment": "Malware payload", "value": "e3f7f1d4aa5325525f3a72eff0f6dfd3baecd5901de6241d282e7e0b82ed2184b7da4b2203b1d16ed4352f7d999f10a5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917134, "uuid": "33c56ccc-0c73-4a93-860d-444e3942e803", "value": "T1D4D61233B38B653EE06E1A355A72E624543B7A516D138D0BD6F4086CCF652A03E3FA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917134, "uuid": "2af05c0b-b6b9-4f35-972c-0b086d2dae8e", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917134, "uuid": "1f363796-970c-4e92-8d40-f63eaaffadfe", "value": "98304:PL8NcDeSbS5ZyqD6WYClYCrqxux+MNXEaC9x/sCY8Jz1YpUUbSMK1C:GaIgqlvMA+MNUx/sCYWJgXbSMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780917134, "uuid": "54b33e1b-dd22-4fad-8654-16bc5389bc46", "value": 13180346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780917134, "uuid": "e44b5019-3696-4dab-bb6c-68fbc38e6f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917134, "uuid": "240321ca-97dc-4542-a67e-d66db1adbb16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c627405-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907989, "uuid": "52d1ceb8-c904-4bca-85ea-8ea7f1c0b734", "comment": "Malware payload (Formbook)", "value": "36f1e7caedc1c912bb53ebeee270873a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907989, "uuid": "847f7e67-15cb-4ba4-ab52-f1dd0c10526e", "comment": "Malware payload (Formbook)", "value": "1ff15bcca297834a13a4891d3f93991a77e6442e3d5c62bad68f2de560d6f543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907989, "uuid": "a7710dd2-62a4-4db8-a621-d602e4c54c8a", "comment": "Malware payload (Formbook)", "value": "0f013c0b5a539a306a2f8ef7e7baf5f69b9e8346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907989, "uuid": "8eb614b2-17f8-4269-a9fe-64a12b41b2c2", "comment": "Malware payload (Formbook)", "value": "7fdbde20af175b99f804dd00bd86a583fbff33ca9407f851557737f378509077801985c2a6ab094c96d49fef36f44319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907989, "uuid": "9bddb340-25a7-4624-b3df-35828a0b865c", "value": "T19B350214630FD902E5B78BB81861D3B40A746E88B975D3039EF6BEEBB835B525C143D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907989, "uuid": "1586026a-3172-498b-a340-2ebcde5e3839", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907989, "uuid": "6b2c00ac-88c4-4bb8-b36b-15ea3b2aa47f", "value": "24576:J5RE4k/VOwZtuQ3mF4DTbpC1vCaELsS+m5XJubd:bG0wZcynbpKqaEwSL5X0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907989, "uuid": "03e51994-8f01-4d5c-8a85-c07185440033", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907989, "uuid": "e91f409f-316f-4bba-9b3c-dbe0920f0a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907989, "uuid": "a115b3ab-96bc-450c-92aa-f8bb89d29947", "value": "1ff15bcca297834a13a4891d3f93991a77e6442e3d5c62bad68f2de560d6f543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8f3fd0-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907696, "uuid": "a6fa308a-4394-40a5-9883-2b01a74faee2", "comment": "Malware payload (Formbook)", "value": "d99486700e333e135c77246a8abac63c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907696, "uuid": "c6dfd2b0-74d6-4e23-b59c-2be35a3a5b20", "comment": "Malware payload (Formbook)", "value": "200423fce656eb3e7e4837302bfdc54ff74f646d68390d2ce61944f32a6a55d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907696, "uuid": "fc6cbcdd-c749-4c11-9d44-61a9d5ce0f50", "comment": "Malware payload (Formbook)", "value": "5b91d3343acb55cd23dabfb3a045707a0eeb01fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907696, "uuid": "9c0591fd-2a80-4f6d-a447-f06fea8281e2", "comment": "Malware payload (Formbook)", "value": "5c0e308fe455f110ca4cbdd18c7aa2444f9b52b40fbb19d6ee3a50a7f529df5d4e9b0089252861784a37f146fda9c96a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907696, "uuid": "90ffc43f-27cc-4e74-8c9c-bd8be6f40ed1", "value": "T18C351254630FC906C8D25AB01530E7BC52298E89D516E3238FEBFEAFF87E6563945381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907696, "uuid": "cd5793c5-5b7c-43a5-96e3-31c2321a45b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907696, "uuid": "66bfe631-ba85-4460-87e8-03d79414c030", "value": "24576:b4TS14YHG63gwn7fZv7aECcciRdPQ1LmAiawmn/R2:b44DG6lBv7CcjRdS7HnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907696, "uuid": "3e82abcc-e08b-4882-a281-8a1f84e53a61", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907696, "uuid": "a17f7f1e-d907-4825-98e7-d87c01f72369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907696, "uuid": "01547df5-c3e6-49c4-baff-55db92b5d2ce", "value": "200423fce656eb3e7e4837302bfdc54ff74f646d68390d2ce61944f32a6a55d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62c7396-630f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780905455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905455, "uuid": "ea162755-c6fb-449d-8f35-e447617e3fa8", "comment": "Malware payload (AgentTesla)", "value": "abb5833849e0e34713dcc6d87789d36c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905455, "uuid": "eeb57f12-0ddd-460c-a701-6e68e54b7876", "comment": "Malware payload (AgentTesla)", "value": "2012cf1cdc99abf2b23e6da45a576382659c10074a45eeb17a0641c7c3a8a34e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905455, "uuid": "cdb36620-6aeb-4725-a12e-1b07c1321856", "comment": "Malware payload (AgentTesla)", "value": "efd545f9208f531521bebdb466494449b1c7ee3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905455, "uuid": "dc757bc7-c55f-4e96-b944-8435d7a484e2", "comment": "Malware payload (AgentTesla)", "value": "1b935c736f1eccb23abb0b3d5fb5c47156578c7e978168385c520c0f56b15511711993661c80e55c492e14aeb85dcd01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905455, "uuid": "cd7729cf-b7e1-4e01-8eec-85b4141819a4", "value": "T15EA55C17D66F974D180E7B61106A5D9AFE89CAFCEF726BC4E0CF90B214EA1100B855B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905455, "uuid": "1ed32469-8eb5-4298-81e3-948a629ca77a", "value": "49152:LWCZmcFpp6ZGa4xjFkfhVxq1cnlyA5LnL5lNFptS:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780905455, "uuid": "fd46886f-a63e-4e9e-842c-0a80f033c602", "value": 2164004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780905455, "uuid": "bdf964ad-56ea-4ba2-a1ef-e39ab25dbe31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905455, "uuid": "cdab4001-3b98-4d68-ab10-14d31f00f494", "value": "HSBC_Payment_Advicepdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874b0829-634a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780930717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930717, "uuid": "1b979d03-c3d0-4c7a-bf9e-3253ac225efa", "comment": "Malware payload (Mirai)", "value": "92b3cad79a13628641b4bf4e82f7428f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930717, "uuid": "c87b93bc-9b1b-4355-ae8d-a98f50bae89b", "comment": "Malware payload (Mirai)", "value": "2023b2da23b40b20a98449aa05c270ae904730eefbb0428fe0580465bbe23a1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930717, "uuid": "abb7e358-627c-42c8-aa5b-25f58f011145", "comment": "Malware payload (Mirai)", "value": "ce63da9d3030327a70795956825796ca2636e0a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930717, "uuid": "26e47e9c-88e6-4f17-af9f-f46a8d5338fd", "comment": "Malware payload (Mirai)", "value": "89ed4ac08a7c63deabace1ee12d1f89774a8c9b0a91faa3c5f1c677efd5929703df9dd772a9d337c000af838fe4f597b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930717, "uuid": "3b10211e-978d-4f2d-94fb-f879548b4803", "value": "T191265B69BD1EF953E6C833707B6582C4323EBC889F8192236611FB6E59F675C8F12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930717, "uuid": "ba7fcce9-90bc-454e-a038-cf281694690d", "value": "24576:rGUV3R7mkebXmJpJ8oAUS8q0XwDGXCd4qFhw543ImG/UFAE4SOjOK0dQT9YJB0sr:r9Iz4b68AF2i15GeFMb5EIYWv8jvCB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780930717, "uuid": "b5d53c00-38d6-41f4-8f96-5ae747170200", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780930717, "uuid": "cd0de846-1e88-4508-a096-133e135f7b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930717, "uuid": "e74aed7d-10d4-4797-b587-0058ebada4c2", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17c984b-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912722, "uuid": "5300ad92-83f5-4cc9-a47d-8bdea3f94de8", "comment": "Malware payload (Formbook)", "value": "16b3109954cc78abaa0ca9050b17f171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912722, "uuid": "65efcb90-4ed7-445f-a7cf-9b6ee887e553", "comment": "Malware payload (Formbook)", "value": "2028ed4a8655fc6d6607aa3c56851a877200e02d622d4ff634101ab71d969bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912722, "uuid": "dd571958-b4c7-4c5f-9de1-50e070bfb1c1", "comment": "Malware payload (Formbook)", "value": "fb57c597c7a3d73db977f54d7d69e19d79530729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912722, "uuid": "9419737e-bab1-4a81-83a4-ce5c2ce1819c", "comment": "Malware payload (Formbook)", "value": "ff61532428f8037931b2a23fe07ab9db86aac64aa8ddebee09e4f1e06be15342c53ad9ead6d3f23b29b257b290ed0a70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912722, "uuid": "33b50da3-b267-412d-96f5-cea6d77c191e", "value": "T1BD151264BF98CA13D4A627741AB1E17063741E8DFA50D21E8FE6BEEF38397151688343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912722, "uuid": "4250eb39-3258-4d94-8fc4-9d5856af03f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912722, "uuid": "9f745bbb-3677-444c-b396-b5aaf8a00d4a", "value": "24576:JXAMqNWLlichRdXqQS3pCIjXd/UFpklX1gl83:JwNUPJq9CIrmylq83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912722, "uuid": "126d5367-6ef8-4aba-b959-46806aa82300", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912722, "uuid": "99204a97-c489-4b8c-b0d5-4d5eee6da6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912722, "uuid": "34c464a0-2118-4fcb-b739-2b177c55fe7a", "value": "2028ed4a8655fc6d6607aa3c56851a877200e02d622d4ff634101ab71d969bcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94046dc1-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910981, "uuid": "78a98c5b-3856-4ad1-8d85-9bc46a229ca8", "comment": "Malware payload (Formbook)", "value": "0cb7633274080ff2d0a829cb0313ed9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910981, "uuid": "8016794f-47ca-4337-be8f-aec74f6d62b9", "comment": "Malware payload (Formbook)", "value": "20c76c5189319d05bf70a914ac36888ac32d490aa15118dac53584a60a95d2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910981, "uuid": "4289eedd-469f-4cc6-b3a8-8812e0d6d631", "comment": "Malware payload (Formbook)", "value": "6d68c7f0b1068efc547b1db8fd813cdbd1545c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910981, "uuid": "6114e394-2779-4b4b-943e-56b3cd513663", "comment": "Malware payload (Formbook)", "value": "ffeff811214f12177b708d026890638de98f375eab327909edc749448bc46840d5229187c40eb18a67f838747f746aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910981, "uuid": "35421a87-937b-4fda-aa79-831738a7907f", "value": "T1042512596A26D213CC5197B85D32F278137C6EAFB051E212AFD97EDFBA32F050D04286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910981, "uuid": "fcaf504c-31b5-44dc-8d23-b0fe23679519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910981, "uuid": "5e709b6c-b507-4f74-9bdb-b95cbef5fa9e", "value": "24576:IYd9lESwBYUzy4KNrWc0oNMFKrORYjqW/QsYFvIEF8:Td9lCBYUV6rWc0otORYjD/QsoIEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910981, "uuid": "c3d955c4-dab3-4163-8f85-fdbc24cb2cc4", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910981, "uuid": "b3041cad-3aa3-41df-9fc4-fc0720d93963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910981, "uuid": "db443c6a-0f6c-497a-be07-39fa70689c82", "value": "20c76c5189319d05bf70a914ac36888ac32d490aa15118dac53584a60a95d2ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ad1fa6-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910818, "uuid": "431c80a8-327c-4562-8289-2792cadaec35", "comment": "Malware payload (AgentTesla)", "value": "74788528cf630956fc5bd644b35a1dbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910818, "uuid": "748f6805-8a53-4349-9ae7-18c2aae4f0d3", "comment": "Malware payload (AgentTesla)", "value": "2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910818, "uuid": "0dd6e253-8395-4a23-9b40-79efdcc20598", "comment": "Malware payload (AgentTesla)", "value": "506a3d7122d56128e06dbd2c257fa47bc8f0ea48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910818, "uuid": "5dc8888f-dccb-4a0a-a29e-2b25a9516a1e", "comment": "Malware payload (AgentTesla)", "value": "0e825dfa9138afa8e103e827ed1c68eaab5290acf148c147344b7cdf914ae909fd5b37e3440074c44c87dd4df422351c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910818, "uuid": "1eaf037e-e1a7-48bc-9a74-879c73b12d21", "value": "T1DC2512687615D11BC861ABB40D31F2B8073C5EAEB951E202AFCDAEEF7E71B059D04583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910818, "uuid": "73ce2ab2-acff-490d-82f4-8ccc2bfe0893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910818, "uuid": "bb23c017-227b-4d45-a8ac-eab36342a963", "value": "24576:GPdM/PrEa+1pllozNMmKu6E7yMQAvoIy:udMLErroJMdJEhvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910818, "uuid": "46659ffb-1251-432d-a616-3503fb23e1f6", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910818, "uuid": "533c5d5d-f878-4340-b843-f7d9bad08083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910818, "uuid": "ec8fe914-bb38-4932-8474-153573948258", "value": "2174f30d2f68ac9d025f9f6e0f1c20f9ecbfe9e5cd4fddae9cbbdfb7638d85eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe15271-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877199, "uuid": "702e81a7-d18a-40ff-a8e3-e7cda5556caf", "comment": "Malware payload (Mirai)", "value": "7da623a7bc1c7c6b709f8a25588f9a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877199, "uuid": "45d3950e-2a75-446a-a2f8-838217d1010d", "comment": "Malware payload (Mirai)", "value": "21fea7b6a2a985bece817ca3290ddafb48a5fe14766d9cbebc8648c56e442bd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877199, "uuid": "399676c3-72df-4078-a4d2-2e35c58bf4da", "comment": "Malware payload (Mirai)", "value": "043fa02620339ca78759ac22a24368974f7fca05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877199, "uuid": "8c6f57d8-a392-4e61-b4a5-ede45b10b90c", "comment": "Malware payload (Mirai)", "value": "40faef65f2787f84722b1d2346527ade2def18ebd680a1169252d22ac9fa78224553fb387c464cabdbbb8a3d84be0089", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877199, "uuid": "56915f23-c45f-4207-b53a-2a4c9184518e", "value": "T13C94A913EA1584A5D414CCF2137772559C47A37F88E632D3EE5A4AA2FF2091B42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877199, "uuid": "9f59dfc4-095f-456e-9faa-f42a8a65923d", "value": "3072:a50pLQs3buTuqhnfotMdc+mk5WD1ZhuCRjU40jh78vPfD4BAnNN3:a5aLuTThfjj+pR4YD4BKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877199, "uuid": "ce2d3613-a500-436a-98bd-6e9817b2ef97", "value": 408616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877199, "uuid": "e6dd474f-6efc-4fb8-bf69-c783a8ce8ce6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877199, "uuid": "c87cb4d4-41d1-4d2f-940b-91c7acd0696d", "value": "boatnet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1c355c-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911503, "uuid": "b38ed452-789a-466f-9552-f59fa125834d", "comment": "Malware payload (RemcosRAT)", "value": "3076ba3c4b5d7f6c4c2e45773a736ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911503, "uuid": "eaaa8d08-228b-4239-b2ba-5c22474815ba", "comment": "Malware payload (RemcosRAT)", "value": "2268ebd5f20123b98523a352599099ed8d0f6ba656c41d6e05ff46f920148f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911503, "uuid": "d2305880-6299-4f2f-85bb-e157ed054087", "comment": "Malware payload (RemcosRAT)", "value": "b8bd824980439f10c81fcb535e9899256c36a86a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911503, "uuid": "df831872-28af-4f84-80f9-84425f1dcf4d", "comment": "Malware payload (RemcosRAT)", "value": "418ddb6c39e5fb335948ac4a045ee60ea543e6ee59159ba1a94715bb14cebe7bc02bf0884230e05e40b50b2362df51a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911503, "uuid": "e332405f-545e-4fb8-9243-aa556da981a6", "value": "T163D402A13B54B49EC1500CF0A55A9B10C5A7FD7380E10DAA63F93F2F5B7B602544FAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911503, "uuid": "0a573960-1b60-469d-a804-bd497411c133", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911503, "uuid": "728eccff-8859-481a-b2b9-4081386a9647", "value": "12288:8rE1CC6LVTENtGblwa92RhZ1C8TmLf5+CaZTYV12I:8p3LVTaGz9yVC8ufbag2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911503, "uuid": "062ee647-6060-4bb5-a9fe-800a1bf4ca75", "value": 628190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911503, "uuid": "8a22ee5c-44b5-48ed-a70d-3c4da4b13c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911503, "uuid": "c996c4fb-f8ab-4527-aff0-c6687ca9a649", "value": "2268ebd5f20123b98523a352599099ed8d0f6ba656c41d6e05ff46f920148f86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbf149d-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780904981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904981, "uuid": "48b1c074-99cf-4c14-823f-2bea5db7bb7e", "comment": "Malware payload (GuLoader)", "value": "3970164bd18987cfc471ad7cc228b0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904981, "uuid": "4cfbfdc9-ff4e-461b-b9ac-cc55657798be", "comment": "Malware payload (GuLoader)", "value": "2343153b281c09a75624788bf36ec4ce24b03fa49765c2cca1fa025981b758dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904981, "uuid": "87ae4c20-51b0-4305-a554-d8ac0224afb1", "comment": "Malware payload (GuLoader)", "value": "47d4cc9959d92c7f19fe29fd7584d49100267710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904981, "uuid": "34dd9d7a-f086-46f4-9cd7-d3776be482a4", "comment": "Malware payload (GuLoader)", "value": "b47cea35ccb52d0139f577d058c8f7de37407b2286a83272986d3addfb259216121a2f3b373c76b04277cf42911772ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904981, "uuid": "d257a8c7-599f-48dc-803d-dfde84d411ef", "value": "T1A254E0867684D4EAD9366471C8BBDD220B277E6A97D15B0F33B1362E6873113072FA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904981, "uuid": "323b117f-f3dd-48cb-b707-51d241cfe05c", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904981, "uuid": "d41b433c-81b9-45be-9478-ea2f9c827c15", "value": "6144:5pZgUXltNBTzuVuEEpTsnKZ0+PtF3eh9GSBLkd:rF6uEEpGK1lBwbBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904981, "uuid": "dbc7596b-266a-4d9e-975d-1fc7f488d5d0", "value": 292440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904981, "uuid": "85292f2a-822e-4cf1-ab8a-02e7bb11c5f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904981, "uuid": "6f9187bc-b343-4c08-b586-1d4e7c2408bd", "value": "June 2026 Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d4f837-6339-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780923524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923524, "uuid": "a7284332-0102-4f28-821f-ded8317388c1", "comment": "Malware payload", "value": "cf2563b769470fbb2de9e20801d12c5d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923524, "uuid": "b5d46b6e-929b-430a-a0d0-4377d4a407b8", "comment": "Malware payload", "value": "23b577fca11c0d75ea70a3993816965c3eaefa8e76d1ded1d40422f3500edb78", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923524, "uuid": "8bec283c-88fa-4ecf-99bd-89e7cae8f407", "comment": "Malware payload", "value": "850ae2c127d25e55569876a4b95aca44c93206ea", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923524, "uuid": "1c05619e-bccf-4eda-9692-4bc6a3a5f806", "comment": "Malware payload", "value": "d3d09d39df301bcbb99092a14df99c9a328d667c526efce9575d510b36e5f7af283f056e5f0e2537679f5a93a520e98c", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923524, "uuid": "e71f3fcb-6bc6-47ea-a4d5-3ff2cbb40747", "value": "T16624E024209B5B79F109C0BB7F4CA10592CE13DA41357A9A58CD75DAEF632B7C338E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923524, "uuid": "46c45a8d-f16d-482a-bae3-203d8c055a11", "value": "6144:Lmhktl0MMGnjnM2x/U5nWBTtqJZ1+qPpu7g6e2zeuh:LmhkcMMardeO8JXpunLph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923524, "uuid": "08389667-d3c7-4c8d-b3ce-4804c8b79e83", "value": 224778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923524, "uuid": "6e7a87aa-1476-4f0d-9cde-f714c35916c9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923524, "uuid": "73e2a00f-90e1-48bc-b5fe-1a2cb2526e2c", "value": "P-37854 Po#175_VEETECH.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8640d2af-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780908381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908381, "uuid": "a4a9644f-0bed-4a17-9671-5248f139754d", "comment": "Malware payload (RemcosRAT)", "value": "a1f7bd10e132dcacd6050ec1514e9e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908381, "uuid": "64dd2d53-6bfa-4109-9383-029166d7ecc1", "comment": "Malware payload (RemcosRAT)", "value": "23f6495b8709a670c1fe62c94483c04e056b5b4863e002c720f6d6cd774eca8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908381, "uuid": "58c87994-ae15-4a9c-b21c-1299cbbaae56", "comment": "Malware payload (RemcosRAT)", "value": "a5ab47544fecd528322e88f667fa61c8ae0e6904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908381, "uuid": "e8928a05-7270-422d-a320-17176053390c", "comment": "Malware payload (RemcosRAT)", "value": "f30e01278de425a176d74386aa430f32bae2869a4e14d3c1b9ac74e300d62d1f02335691cec0b3a3d22c939fb0738191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908381, "uuid": "61229a74-8fc2-46fe-9853-362cd8e807b2", "value": "T15115F104235ACD06E4F79BB858A1E7B407B46E48F530D3039EE5BEEB783679158493D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908381, "uuid": "8aa03786-a463-42ba-9f6b-9518660a719b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908381, "uuid": "dab41e32-db18-43e4-bad6-099a7ee31251", "value": "12288:YHN/L9MArx5e/fJKZCNjmR9uNTwePwRS+6qzFkT4NRouDPQUP5v1v/9L:4RLVwoI6AwLcT4NauDPQUPvvVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908381, "uuid": "be75d771-6518-44c1-94a5-cf83c7e46062", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908381, "uuid": "66cbd0a0-dfb7-44be-a9a7-18803ecf7339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908381, "uuid": "d10f7249-3b82-4cce-b984-eb2ba6f681a9", "value": "23f6495b8709a670c1fe62c94483c04e056b5b4863e002c720f6d6cd774eca8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8173eb57-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941444, "uuid": "a8f4afa7-719d-46d0-8a5f-a541d110436f", "comment": "Malware payload (Snojan)", "value": "0cebad371fdf3844b97d7e73254eca5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941444, "uuid": "3e09881a-7506-44eb-a5de-497c7db2f8e2", "comment": "Malware payload (Snojan)", "value": "24314c1c180e18e52f5e2b119e5fbac5efc27d480de6176beccbf7d9e60b05e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941444, "uuid": "6ac49977-839d-4901-9aeb-9c5611d13b16", "comment": "Malware payload (Snojan)", "value": "6837be1a24fc0168757e96ba50f00a4f64a5e9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941444, "uuid": "13fd3f41-f4ab-4a60-b55a-bf30ace118e2", "comment": "Malware payload (Snojan)", "value": "9f2457490230d32c1e19552f8a2f49a47a49bd39d0f651dbc26144af64461521f329ca7dda4850b04cd1844a5112ae2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941444, "uuid": "1528a323-7b72-452e-b7f6-de97b8d3ca2e", "value": "T1F7B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941444, "uuid": "c1284d1d-9e51-4324-916e-edbff92ad2aa", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941444, "uuid": "e919344a-09ba-4f82-8cf4-4f868497aec8", "value": "12288:/bE+uXh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+0k70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941444, "uuid": "9f9f4d09-efff-4134-8c09-a34bce8a92d0", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941444, "uuid": "4b759af7-06e5-41f9-8808-071bacac674f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941444, "uuid": "b4bfb554-9ea7-4807-9f4a-7b14767d7901", "value": "6rNLWlusBk5bGh53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dec3d22-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941465, "uuid": "556d4941-3b3a-4c94-8933-9cf344625e3a", "comment": "Malware payload (Snojan)", "value": "0ecf729af7c29e9c4b06abd1049635a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941465, "uuid": "5bc1637d-ae58-4945-accb-74efb9b1e74a", "comment": "Malware payload (Snojan)", "value": "2486ba4e7e69fec60464e83257aa16611eb5a615f46a1216176e2c60b74c16e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941465, "uuid": "9458ad49-9534-4b86-a8d1-fab76b7e44ed", "comment": "Malware payload (Snojan)", "value": "6af1d67418116ca9f0d22857df028d831014375e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941465, "uuid": "8f717d85-2230-461e-bfba-9b8640db660f", "comment": "Malware payload (Snojan)", "value": "55970db690e4e3bd129f8557b7944bdec70dcf183ea50df1420eb7b866478992d740f4146b7d4b3d5a1b407dd345fd33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941465, "uuid": "dc92ed46-a656-47f6-8166-3ce7c4836cf9", "value": "T1C8B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941465, "uuid": "5a1144ae-9539-498a-b2de-1d0651adf389", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941465, "uuid": "a13d3e2b-ba35-4b5f-acd8-6da5e0079cab", "value": "12288:/bE+unh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+Mk70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941465, "uuid": "ba6a282d-e934-4fbe-8455-71e5e36b27e5", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941465, "uuid": "fd5d8c06-dec1-4873-8ec7-77d0a7dee30a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941465, "uuid": "491a3dea-46f7-4258-b47a-51b0e1e8f784", "value": "Vh4VIFbcqgSmI4nD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48e5760-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941557, "uuid": "1da78af7-329e-4ae9-aec7-30e981206207", "comment": "Malware payload (Snojan)", "value": "972370a89ae2d89edf23e8ddee816b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941557, "uuid": "bef1767b-fffb-4029-867c-1d56be522db0", "comment": "Malware payload (Snojan)", "value": "24e993be122763ab7ad40122a01ce1486327546692f0ca0e7afb50589d12641b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941557, "uuid": "a2ec04bc-b94b-4da8-b813-5011286a1a76", "comment": "Malware payload (Snojan)", "value": "bba6c4983a3b7c1a0149143a40bb79a9a2065e96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941557, "uuid": "64cb519b-d0f2-42a3-ae73-b230639caa14", "comment": "Malware payload (Snojan)", "value": "7381337b3ec9fee3f50d72f656e54d203a9562619e3b6af6596793382481dbb3551e7e6a9824f380a38798a24528cd41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941557, "uuid": "33faf5dc-a9d2-4bbc-ba24-6e1ad5452f6c", "value": "T17B35222471C0C4B7E46B403544C9CA76AA76707247BE89DBBBDD63E9AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941557, "uuid": "14c98b36-df07-4c6d-8f70-57df3293cc52", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941557, "uuid": "ddee7147-3b14-46ea-9af4-a1b69e93ce6b", "value": "24576:/Y+fk70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyT:1kQTAKYS/v6h3+1uhZcT2NnvOyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941557, "uuid": "6ec95f0c-8ada-4ca6-921d-6bd53acf16ad", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941557, "uuid": "c2c80e70-36c1-4e80-88de-55e95c9e294a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941557, "uuid": "ed35eeb5-b659-4bd2-8e17-5db0a6ebed49", "value": "pBNLUyY2AS9bekaD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15e5bf7-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911916, "uuid": "519022cc-ab3c-4eac-a564-5164f1aab30e", "comment": "Malware payload (RemcosRAT)", "value": "d610d31fffca506bec8303a58e5c9d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911916, "uuid": "84966586-d86d-484f-a1b5-0350e2d68140", "comment": "Malware payload (RemcosRAT)", "value": "24f76d9a3ec747835c0072a6a9ab2faf8b29a10dbf4ec1b7ab37de350cd3f6be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911916, "uuid": "702fdb3c-60a7-4646-bc63-06cfdde03406", "comment": "Malware payload (RemcosRAT)", "value": "f52c76d09f0f9714fa7c623b3983a73ad83f3ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911916, "uuid": "30bcc395-b5f9-4624-9ade-43f53176129f", "comment": "Malware payload (RemcosRAT)", "value": "deef7d206603337898f2a0c77d32fc442529b69f4418f3bf27f824fb6f80cbaf6deb0f3f2ded65f893696c46f08e7236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911916, "uuid": "5a4739b8-2327-4db3-b326-2927c1fd36fd", "value": "T1C7C4128595D0D8BBD23A45B0CE74C9F666E09CA0EB212A4F92C03F4FFF3AA114A5D547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911916, "uuid": "941e524f-5da8-49bf-af1c-6c296122f887", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911916, "uuid": "cf3b3321-9d78-4563-aa35-9028217fc3b8", "value": "12288:N+CLHlOKP0hr2NdlMf4MHfjwRXLdtCP5EBH0jrsbF0qIs:N+Czl3MrglMjecP5gUAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911916, "uuid": "542f8275-8986-44d5-9603-541ac84c0af7", "value": 590264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911916, "uuid": "9f9c9f4b-5bde-42ad-9f44-ded477dde1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911916, "uuid": "2abf7cd2-94d9-4065-a85d-98594b310aec", "value": "24f76d9a3ec747835c0072a6a9ab2faf8b29a10dbf4ec1b7ab37de350cd3f6be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904cf1a5-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780910975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910975, "uuid": "ec844ce3-9d62-4fac-a7ac-13ae14294a8a", "comment": "Malware payload (XWorm)", "value": "23165cce4678b060e05e8516a36aa7fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910975, "uuid": "836bd570-4d5f-43cd-b955-279c36075bd8", "comment": "Malware payload (XWorm)", "value": "251acca5da8553bb32b9de05a611309c9021754664fc3b5019a12527ce1edb1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910975, "uuid": "017d39a5-0aa7-468d-b951-343c3c4cae9b", "comment": "Malware payload (XWorm)", "value": "fc37db40e1dc50ab05dc7f416fa94ac47bc38baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910975, "uuid": "a6d84439-7281-497a-b40b-efaf545ea95e", "comment": "Malware payload (XWorm)", "value": "fcd37c37609c1b8486ac33fc2f68281190dd66f1b724629165d5ef67f3aa4c0dfad977f99bd1d607a6b1021c2c722ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910975, "uuid": "f746ef70-b306-4d10-a63f-a3841616ce58", "value": "T15EF4011C6705EA23C56057B46971F6B8173C5DAEE812E613EFDC6EEF7A22B119E00243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910975, "uuid": "715b3c72-6184-45ef-b4fd-14fbe118a124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910975, "uuid": "322fac12-104f-4f6e-9b38-f6d556077c89", "value": "12288:hyYvFwAGqy6BJglBm7DUB6gtlg0VwWuiWhJf14skwaoIgCLqCxxo14zmgfUwV08I:hXdbyoJqE9SVu5VashiM864fFOgBVZsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910975, "uuid": "31619437-ee19-45b8-9b65-1b83e9eab52c", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910975, "uuid": "38ec68cc-afed-4b73-933c-1c67a82fda45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910975, "uuid": "dd57456d-9d11-406f-8644-6cf8059e3426", "value": "251acca5da8553bb32b9de05a611309c9021754664fc3b5019a12527ce1edb1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ecf9a8-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1780912734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912734, "uuid": "cce7ef88-6af8-4747-b74d-5edb9a194f7a", "comment": "Malware payload (PureCrypter)", "value": "2b39a27d4b3cb71d14b64decb19f6422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912734, "uuid": "0b60081f-271d-4a83-ad46-2678f9e927d0", "comment": "Malware payload (PureCrypter)", "value": "256043f1302524c009cec7f2d1b15509e526d9d774bf603809221d5f292dc5fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912734, "uuid": "8daf4249-6f25-445d-b055-a9bdc7fbca74", "comment": "Malware payload (PureCrypter)", "value": "42f8e2f8824c1bcf5ea415e6a5af01626c302081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912734, "uuid": "97c81d7a-5697-4924-b5d2-0a9560bbd1a4", "comment": "Malware payload (PureCrypter)", "value": "7d73bf89b8608551c215233a3a8008e4d338881941da3b76e6878cb5dd4580f178f31b7f1269d66bd1a936130ef396cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912734, "uuid": "c0b8d37a-2bbf-4c0c-9e50-995115d6a507", "value": "T13935DF101E866F45D6AF0BB8C05214A4B7F6CD479FA6E7EB6FD818F47AA7B40CA45003", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912734, "uuid": "544c8e7a-1a6c-4e0b-a34f-f45e4b0333f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912734, "uuid": "1eb40dd3-a380-4fdb-b80f-9e6dd0ebd675", "value": "12288:2u+QG07WsE4wPeiMxsefO+Oicj58bl1M+ptwQ0k/DIY3INSwZYd1C1dNLHPGBIaP:7tG0vEhFMxO+Nm5olKEKU4NS4i1cPGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912734, "uuid": "667df690-cda2-41c5-85f1-e1092c607102", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912734, "uuid": "11efcf07-96ff-45a7-aa3e-e2f13400312e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912734, "uuid": "ead2daca-503d-45d2-a105-7a765bc54ba7", "value": "256043f1302524c009cec7f2d1b15509e526d9d774bf603809221d5f292dc5fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b899f6f-62ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1780889385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889385, "uuid": "1ab47227-6658-4cec-8517-293a7d75d487", "comment": "Malware payload (Meterpreter)", "value": "2d05e608cbb2a33d3f8e6ffd5ac483aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889385, "uuid": "ad45c4a9-84cf-429a-973a-4ba04efc5b97", "comment": "Malware payload (Meterpreter)", "value": "256276fff6c7cd3e49367e506471128a308d5c8919465e355a37972215868522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889385, "uuid": "99ab75f1-ef7e-457f-89ac-a5d6597d947d", "comment": "Malware payload (Meterpreter)", "value": "1ace9f5aeafa0fb3677c2f6b5fad26f20801cb3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889385, "uuid": "37b5f395-87a0-4751-87f3-56e6baad519f", "comment": "Malware payload (Meterpreter)", "value": "5be8539663e5d55bac06cb614f4ba4abb8c9a69ef15522e568aadb143f6cdcbe578f698013f5a1524705176bf8ae9c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889385, "uuid": "92e994ea-e7c6-4a14-b547-6ca9998d1dab", "value": "T137764A07E8A548E5C0AEE1318A729162BB71BC484F3127D72B90F7282F77BD06EB5754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889385, "uuid": "b2063781-450d-41cc-84b0-b3f845e65a5b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889385, "uuid": "9cbca7f1-15c4-4fe7-b0ac-81b91a67e468", "value": "98304:O/evbYwn7dinh6QJRjutqzN9WEQ69NnE:Om/ncnhjNeWGEQ69NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780889385, "uuid": "a1914cf8-0e38-490d-8611-72bf044fdd05", "value": 7709184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780889385, "uuid": "67765138-bcdf-442c-9cec-340025e8bd21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889385, "uuid": "bd7ef89c-8ade-4330-8475-233f804be7db", "value": "2d05e608cbb2a33d3f8e6ffd5ac483aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785454dc-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907499, "uuid": "f52d2d98-efd2-4752-b12e-7094f470119e", "comment": "Malware payload", "value": "6d54244236988400ed801b154fa12084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907499, "uuid": "6f735d60-7920-4aeb-8663-61062929a791", "comment": "Malware payload", "value": "25c17b3b8de6485845bc7568a26fa5e2591eaf417b1ec2fc370c9653059b268b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907499, "uuid": "0a7c746a-1b09-40c0-8976-cf78d2469939", "comment": "Malware payload", "value": "9bec9380e317f2d27591aa150ffc179dd7a8e60b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907499, "uuid": "93d59a43-daf1-406f-a7b8-2ebe389c3563", "comment": "Malware payload", "value": "4efca116bcda9a1e0467f014816cb58cfe1b426aca5ff452c23922863643953d1389487e83df3fc2193728cae2257104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907499, "uuid": "23312e00-f051-42b2-b8a0-b86caa5099fe", "value": "T10025E0151D872B95D6EB0F7CC0121864B3F0D88B83AAE7A76FEC40F56AA3F45CE89511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907499, "uuid": "fb1031e8-db6c-4ff3-8b4d-7bdbf8d49019", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907499, "uuid": "a6430b4e-d906-402e-9927-e5d4c6a43a2f", "value": "24576:RIm27EhFMxO+Nm5olKEKU8spF0RoGdK4C:RRhFMXNSooTvsQRvdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907499, "uuid": "edd7df42-e85d-4549-8c98-110270f07072", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907499, "uuid": "afd00fd9-4e63-4b9f-ac86-2a65acd28f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907499, "uuid": "1eefb9be-134b-40a8-af82-da20cb9ca2c3", "value": "25c17b3b8de6485845bc7568a26fa5e2591eaf417b1ec2fc370c9653059b268b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852dd767-62dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780883898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883898, "uuid": "99d661a4-f892-4531-b4f0-29b00714faef", "comment": "Malware payload (Mirai)", "value": "5ddf02aabefa7611b936de990704b2a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883898, "uuid": "756efe8e-5e0e-489f-a25a-581598f4eb8d", "comment": "Malware payload (Mirai)", "value": "26344f698ff13d039c539e9f67225eb51ee94b557be5db0ba765c84ee38d110f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883898, "uuid": "82bda997-cc90-45e2-987b-abc210c500b4", "comment": "Malware payload (Mirai)", "value": "d5cd4b541a30f7bd3ecdb9e261e2191a25f2c7ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883898, "uuid": "ddc3f994-0a00-4755-acd7-40ee285433a3", "comment": "Malware payload (Mirai)", "value": "179e6f2c40556d56e193fc8aa39027a50a154fd699fc9d2015f3b01e28bbd225c772389decd9a1fc8d62a03000bfb977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883898, "uuid": "f3a51315-b94b-406e-88e0-78cac14d1064", "value": "T18FD3E80FAE629F6DF32882354BB78B35A755239523F0C585E2ACDA005E6038D587FF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883898, "uuid": "b018bd23-7ecb-4265-845c-9a74e12fff2b", "value": "1536:U+yidvu1iasfWyRqiyWiyHHy+wVp+OsdQbUd/aylMjNr4VReIOeNO/lsKf:Up8u19+VRM6OBbUcylM58dO/hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780883898, "uuid": "555b231a-cc96-417c-9fb4-e2dcd98f16c9", "value": 130772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780883898, "uuid": "fcd75625-0cb6-4d02-9e25-36311dee0d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883898, "uuid": "e3f13f94-484b-454c-8002-3e53cc38f5b2", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d28469-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780910548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910548, "uuid": "4e62b347-c57c-4e76-a5f4-c75e945ab462", "comment": "Malware payload (DarkCloud)", "value": "d92277a3b2c0361be28e591344ae9df2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910548, "uuid": "fc90b638-8988-4ca6-b239-c2320c92c397", "comment": "Malware payload (DarkCloud)", "value": "26587efd6f043836e59060f9693f5bc85216530feadbc5f5bed00a921795f405", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910548, "uuid": "635b9348-bc51-4660-96a1-61f13340c276", "comment": "Malware payload (DarkCloud)", "value": "eeb9136bc95279952a45dd44dc92053818c45d7a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910548, "uuid": "30e4e769-0166-48f2-8309-48f62476c671", "comment": "Malware payload (DarkCloud)", "value": "cc318c2c4a3938c5c47b6a41ffee12ba8ab414d6b266363c019b2171c7b8ac1b2053e5340525783ce82789000430151f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910548, "uuid": "d7122f32-a0c2-4d61-a458-4361005264df", "value": "T1904522A9120DD90AD0865BB41CE2E0B02B349C98E925EB17DECD7DEFB5B97300A0575F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910548, "uuid": "277545c4-47f8-4cc7-944a-a3ba59264eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910548, "uuid": "b9ebcf47-2bf8-4150-88a0-fc06f6c8339d", "value": "24576:wez1Bh39vy/HBs6z5I0FA0NHramkCnPzGN9gaPhd6aXa3P8zWCQgrnNr:wez1Bh34PRKH0tjkCnPzGIaj6aXa/8i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910548, "uuid": "d1f4fa6d-951f-404e-b35c-fada95e554d4", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910548, "uuid": "b90a30e4-9efd-44cf-b61b-3abc343085e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910548, "uuid": "a4823013-32ff-416b-b233-2a713ddf6bca", "value": "26587efd6f043836e59060f9693f5bc85216530feadbc5f5bed00a921795f405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa84c041-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780910294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910294, "uuid": "8fb0b6cd-89e6-4a10-959a-b02ea3851a72", "comment": "Malware payload (DarkTortilla)", "value": "8c701744a7e430519cf2b4e544aa3cca", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910294, "uuid": "c6ceca59-abd5-4d86-a7f3-76d3cd3ce164", "comment": "Malware payload (DarkTortilla)", "value": "265a01ce90b9a511bfb608537eebc81e6b3bec330ebcf5b613d1900a43cf4e89", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910294, "uuid": "c5c717e9-3f86-41cd-8406-cf8b4c2694c9", "comment": "Malware payload (DarkTortilla)", "value": "097611803a046ad7939950fc738d3030d4459519", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910294, "uuid": "410636c1-b54e-4dd7-8435-3198b2bc0fa9", "comment": "Malware payload (DarkTortilla)", "value": "e10b1c8b9fab30c133fc2692b614cf65328812754049c02e821c2ff94c7270152d89c3985fe76230e49f04ca631fb641", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910294, "uuid": "b06a7e0f-4dc4-4020-b7e6-9c3a923759db", "value": "T19B25AE1517C36F85C36E0674C166191B93FA89454E21D38BBED10BDAAF02FE1FA4325B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910294, "uuid": "d35e2184-16e1-4852-b7e3-1d69b071c7dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910294, "uuid": "86443ff1-9cec-4b5d-8e22-ac8a80e0c672", "value": "12288:Ubk955o9D863OwhIwMQPCLXMH5ugthDBiwE0sh7ytgfBKd+1EhVEvgKV5+eKewKB:Uwh6o3AhDBiOdgfA+K/8KJtZJ2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910294, "uuid": "41d3d542-0216-4d3b-9fd1-1195de287644", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910294, "uuid": "3f6d8aa1-af23-47dd-b574-f9e3dc4c4764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910294, "uuid": "53f883bc-428e-422b-80d2-f6b9f9e3aa8e", "value": "265a01ce90b9a511bfb608537eebc81e6b3bec330ebcf5b613d1900a43cf4e89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e14dad-6348-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780929887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929887, "uuid": "449a031e-62a9-4e9a-86b0-d9c9e108749f", "comment": "Malware payload (Formbook)", "value": "191a5145e127d08ae81c45e68ea037ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929887, "uuid": "66ac00c2-4289-4724-a37a-9ffb03ee2480", "comment": "Malware payload (Formbook)", "value": "26a0c3085bb3d27082618dc5e7edb5d3e9c7a4af3d731d97a42c5f831dc91dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929887, "uuid": "6cbf8323-2fc7-45ac-8c61-9bdd1ed55779", "comment": "Malware payload (Formbook)", "value": "084c3049a2a3f43b2ea6952171a73c80d6131794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929887, "uuid": "41d74084-06de-4693-b3eb-4e1b4bf3b143", "comment": "Malware payload (Formbook)", "value": "669618053215ebd15ee2ac425cd07bcce36830c6fb7d216b4adb6945fa124ec84fe0b4f57a65dda9a5efc0551e850fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929887, "uuid": "e8b812fc-3729-4e23-af9a-101e983d8d9d", "value": "T14235E11623E89BA8E4BAAB394178045487F5F437D322DB6E7D8D61EE1E21F40D612733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929887, "uuid": "1a198ba6-20de-4fb9-97e2-2933fe3ab91b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929887, "uuid": "92bb6b3b-6aeb-4c36-b271-95533e8219bb", "value": "24576:IKjN7z8Po44LTd24Ec12KoyfJuz06y+3bZhEEv:BjPs4NoycrykIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780929887, "uuid": "e5e42b14-0b36-4304-981b-777a4ada5471", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780929887, "uuid": "09a49ab9-9228-4049-9a66-bf9e3124f54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929887, "uuid": "0e9f36f1-72fe-4283-92a5-82e176b9d808", "value": "New Quote.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7530625-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911497, "uuid": "f8fcaeee-e302-4dc9-b052-3deab1db810a", "comment": "Malware payload (Formbook)", "value": "a6b45dd5d032cdb331ae41b34a01284a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911497, "uuid": "7ad33b14-5c58-40c3-90e8-7201166e7c12", "comment": "Malware payload (Formbook)", "value": "26d162331f7179d6978fd35569baddfba36f1dae069b3d748ebfe5dc366bcafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911497, "uuid": "63cdf2b9-2f8c-4d14-b795-5ba1f9115e89", "comment": "Malware payload (Formbook)", "value": "96e51f6f617d1be806cd702cd29299ebb2747faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911497, "uuid": "914c01a4-7302-4aee-a997-b72f083fce2b", "comment": "Malware payload (Formbook)", "value": "9fb672853322bd446b2edbcaaa3915bb23a38cfae77d18404c043448b02d9f5b609d654bb3e2dbda5a3fef5d5645dd3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911497, "uuid": "9d84f82c-83a9-46be-8b67-d472444ff607", "value": "T1EA251228660AC00BCB866B761FB1F3B5066D1EEEA502D6175FCD7DEBB873E441C44262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911497, "uuid": "caa7cceb-a9c3-49aa-bdca-1fc968213196", "value": "24576:5vsFl3jdIO5CkPKBxwUG+YuGQTtMbRGyNDbpF+xkb+5:y3jT5sv90RbP+xkb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911497, "uuid": "debfec1c-ede9-4aa5-825c-7f8a39847964", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911497, "uuid": "1ef55d71-1f6c-48a4-ab3b-4c2ada5bf29d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911497, "uuid": "d09e592b-8dce-40aa-b377-ae73aadde04c", "value": "26d162331f7179d6978fd35569baddfba36f1dae069b3d748ebfe5dc366bcafc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8baed12-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780911150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911150, "uuid": "a9b90fb0-f649-49b4-8a09-a00c7a7f509d", "comment": "Malware payload (PhantomStealer)", "value": "ebf4a880a65dfb73dd05a290a286cea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911150, "uuid": "8878ea11-43e5-4d08-a6e2-a5a8cd4f9652", "comment": "Malware payload (PhantomStealer)", "value": "26de53aa1d8c9911d7ed6063d5923e72e96fc85acb5187de4adf2f7a6cff656d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911150, "uuid": "074004da-e45d-4a95-a860-f1c37e3fe928", "comment": "Malware payload (PhantomStealer)", "value": "34125f214731bce8c582e4e41ebbfa4c2a177f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911150, "uuid": "11eb60ef-4891-41bf-b77b-9c0b07bc925a", "comment": "Malware payload (PhantomStealer)", "value": "ced7d57a1924b7fc505db81e43af5fbab8ecb4c6a736ea5c0cbdc18530bd8b5ca29d78b4e7ebbad498fd81fc1138b77a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911150, "uuid": "01334ea3-c821-415d-b092-92780481e9de", "value": "T1C46523851996D21FCA9297340970F3B427B99EEED401D2474FEDADEFFA7AA108C14183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911150, "uuid": "6bf1b72f-4831-4f09-b821-9b6b0c6ed12b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911150, "uuid": "8f94ad9c-2ea4-4fa6-b9a0-c1de13bdf825", "value": "24576:WwIs6fZRFz5GcGlktwCsFykV23j9MtdHJrJXwA5NqDAsEbbWwyqTNgFuZ0AafQGR:RIsKTccG4feyAQj98dprJg0woutCNgFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911150, "uuid": "df341228-8053-4dff-bf85-f74db3226563", "value": 1519104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911150, "uuid": "2e6b7eeb-3e36-4b09-975c-114decfaa8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911150, "uuid": "65e2c6ea-e58d-4388-9f9e-4d7647029f40", "value": "26de53aa1d8c9911d7ed6063d5923e72e96fc85acb5187de4adf2f7a6cff656d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc83b946-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780910190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910190, "uuid": "bf05366b-396f-4188-9c0a-6bdff378a97c", "comment": "Malware payload (RemcosRAT)", "value": "2723f8763a4459a989ecbf74f1ee673d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910190, "uuid": "8f176e80-cf63-4260-9119-ce5f279ef7f1", "comment": "Malware payload (RemcosRAT)", "value": "27196415f5175e2284957e00f1623ff0d99b24d87ff24b7a592c2f297029e983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910190, "uuid": "4a5d460d-cfb1-456d-8c88-4d1e2943092a", "comment": "Malware payload (RemcosRAT)", "value": "215f71acaf58df05e66a711004feb0c09a000a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910190, "uuid": "a32d03b0-a6a9-4e7d-9153-41ac5ffb48bb", "comment": "Malware payload (RemcosRAT)", "value": "3c2bea2306b642aa36276e7ee7f9e9e2636f49230b4de1d335f2543c671693d6a82c4238f769a85e95f8a0671a4dc608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910190, "uuid": "f5e0cc8b-0290-44d5-8af3-875463be391b", "value": "T193C4F152BB00A4C3DC31C93526566262177AFE37ACE52B1273D1FF0D78F7D86602A19A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910190, "uuid": "8d4fe99e-4055-4f97-a539-16bd2aee7410", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910190, "uuid": "a17732a8-3a19-4769-99d5-e54a0847af46", "value": "12288:6T3pPfVF/GSNnFKkOb3lwbd7j5aQExiUZ/GMTW8cTq:6TZPfVtGS5FKL3lsdaQ0TWZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910190, "uuid": "4c9c341a-1750-48f8-888c-a9881636d7cd", "value": 552848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910190, "uuid": "976d96f6-7c39-4244-bde9-c7203ab96c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910190, "uuid": "a39fb2f8-b001-4e77-9001-6ee10ba41d38", "value": "27196415f5175e2284957e00f1623ff0d99b24d87ff24b7a592c2f297029e983", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f543fa-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941377, "uuid": "00fe57ee-d02f-40e1-95c0-8bfbd5b45562", "comment": "Malware payload (Snojan)", "value": "5713f1ea9b6288bbb6e91cda48713b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941377, "uuid": "5a1ad349-8e2d-4da0-afdc-e5464ad76958", "comment": "Malware payload (Snojan)", "value": "273fd7233cc243ebb04fce4c03af392d6d175530b5fe2262828527298a5bf6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941377, "uuid": "ed7ec844-9009-4cd8-a81c-28d7c6358714", "comment": "Malware payload (Snojan)", "value": "4c3ece9437ed954a47ce4bb9d34a8be1f85f616b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941377, "uuid": "e10cace5-cee8-4b3b-83eb-2816deca788e", "comment": "Malware payload (Snojan)", "value": "8ed5f41522e97418967a9e01b79e7002c7eb260b32c2372e964b7a132ec26bce25bce187422c3504a281b2c0509d2acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941377, "uuid": "6820d0c8-cb98-4809-8510-bca1b3247879", "value": "T1E735222471C0C4B7E46B403544C9CA76AA767072477A89DBBBED63F5AF203E1A3352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941377, "uuid": "404f5fb6-d139-4ac4-a974-d17e8d97a325", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941377, "uuid": "fbfd86aa-d462-4885-9c93-6f7ce806f1e0", "value": "24576:/Y+1k70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyLBw:/kQTAKYS/v6h3+1uhZcT2NnvOyLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941377, "uuid": "fe3a7d53-160f-40e3-973f-7235c656ebc4", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941377, "uuid": "481a528d-a7c5-4366-84d3-99507b0af18d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941377, "uuid": "e89e9706-9ad4-4cc9-8a06-9be2f6f49eda", "value": "Wn9TPh0LzG46bady.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6356989f-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912188, "uuid": "8e1be1bb-e4de-48f4-befd-745012f0dddb", "comment": "Malware payload (Formbook)", "value": "60f572c5bd665cddd5c3ed15a524701d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912188, "uuid": "5d054b77-5846-42ce-8bf5-b6eebecc7247", "comment": "Malware payload (Formbook)", "value": "277556241393adfada4af71feb2311991578675838a76b48cc6439510c9b5605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912188, "uuid": "1b6992ae-e44e-471e-b4aa-5f4534944ccb", "comment": "Malware payload (Formbook)", "value": "0a953311f98a50f4ecd091d3b743bb238a7c4461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912188, "uuid": "14965480-8813-4364-bba8-b1620dcac147", "comment": "Malware payload (Formbook)", "value": "c316cf2b2649a81820e7efa3fb18a749fe06dbe51a4c7a43099e15cb1ff1d340dfbf7ff5f7cf9164739d2251f26131a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912188, "uuid": "1cde2ed2-8c1c-4ce5-b416-a24a712ca53d", "value": "T1EE2512F06759F613C9A687B50DA0E33643A91D9FE830D3AA8FE9BDCF34213521525293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912188, "uuid": "ef71be58-601a-4bd3-9021-b1b80942e47e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912188, "uuid": "aa01f748-c3c3-40a3-95db-0112cd2b11bd", "value": "24576:lu6DYExSBWQbwYzayHMaWXwII5rVFyg3dSdnyVYs5:ZdxSBWQbwYz3H55t5rVF/34dyKs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912188, "uuid": "33bdd892-b526-4002-9b3e-321393a60f18", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912188, "uuid": "caf2d3a9-597d-4efc-830a-f0146aa34f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912188, "uuid": "e66ac620-dc7e-4df3-ba90-317f204c8ca3", "value": "277556241393adfada4af71feb2311991578675838a76b48cc6439510c9b5605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76463dba-6377-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780950016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950016, "uuid": "5aaa9c57-4e88-4486-8cbe-4b77ae7139ce", "comment": "Malware payload (Mirai)", "value": "80c3627ea8f03557b77969402ef57d84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950016, "uuid": "a5301298-51fd-4008-b882-1cfd39de4815", "comment": "Malware payload (Mirai)", "value": "279d3d0f301fa2bba43bc916f9988a51e86df92f2d01ab842158832d084f6396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950016, "uuid": "a9ee79d2-342e-4666-b3f0-c7eeaef99683", "comment": "Malware payload (Mirai)", "value": "a75f06cf22ea2d7708ad90a1e97f58912d011e7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950016, "uuid": "971a2eb6-4472-4a48-93a3-f851cc961e11", "comment": "Malware payload (Mirai)", "value": "5da79f8b26b79385dc0316994a23a0a64aacba38b507642b4e8dba31430a043f886b42739a85f035556af1496e775598", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950016, "uuid": "1a2811c2-56c9-4606-b04f-c7fc3812f54a", "value": "T168937BC2E683D8F1F8160136613BF3376632DDB90968FEE3F7559632A4219A0B146B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950016, "uuid": "9f2de20c-e301-4aea-8079-fb889f286299", "value": "1536:yUOZc8RHwCaFtFAtl8ukZ7MFYZ4OKwI2JU7asHtWUW6kNPE/TU0E:yluOwCStFAj8Z1sYbKwIaU75w9xN0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780950016, "uuid": "821a3b63-8331-4414-aa8c-a13d7fb7f58b", "value": 92924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780950016, "uuid": "d4b7ea96-d98b-4910-9ac8-d3c8a332bae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950016, "uuid": "f65113ec-f8c8-4910-b1d8-5cdbcc369f91", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd76c4a-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912068, "uuid": "d2f1f150-a258-4f8b-a2a0-81ced6ed8f36", "comment": "Malware payload (a310Logger)", "value": "4f53a48fee660e40e6576745edc2a478", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912068, "uuid": "13ce31cb-6a99-4449-97a6-b325ba19b25b", "comment": "Malware payload (a310Logger)", "value": "27b707d23c4726721048553e6abc1bb354a4168e0832a6912dc23517713ed0d9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912068, "uuid": "07aaf5a1-8c64-4be1-80cb-64719e956636", "comment": "Malware payload (a310Logger)", "value": "ee41b87a38ad7528414ba8f33c1b8dc905454fb7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912068, "uuid": "72032f00-4c41-4e4f-9984-8b3bdfb00d2d", "comment": "Malware payload (a310Logger)", "value": "26491a006e503e2b3bf05c3c9349ecbf0237b19134cc8d206eac5739ed6ee38454dc52e419c4688728ad4da1ab04003d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912068, "uuid": "8823d765-5e4d-46bf-9dc1-fc14099e11bf", "value": "T118351238F6A4A742D893C6393920C27547B40D9DE432D2E76EE58CE7F7EE3255618283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912068, "uuid": "f0340833-2979-4d6a-8189-6ad6b7bcf521", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912068, "uuid": "021d3ed8-009c-42ae-afe7-19be1f29e2f8", "value": "24576:sFKzv6ZW9vdVHitPjU0c0eA0XkjMpnPxvdIb2H9:Db6ZW9v2tP00IBlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912068, "uuid": "2e23609d-139c-4c24-8df8-f813caa489ef", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912068, "uuid": "362a5185-785f-4f6c-9e28-de26bda3f3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912068, "uuid": "36d2c835-ce10-4091-b0e7-ea187b0ea2e2", "value": "27b707d23c4726721048553e6abc1bb354a4168e0832a6912dc23517713ed0d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c5ed74-6328-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780915924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915924, "uuid": "b4d6b6f0-3da4-4968-aeff-73ad7c0af764", "comment": "Malware payload", "value": "8b5d1d90dc712eb7e7388261c248261d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915924, "uuid": "0c58d447-2810-4054-b774-b6d5161eecde", "comment": "Malware payload", "value": "27cc47596f9207018771f5dab54268d219dd96cac9cdce5ef3ae70e1ee3c704e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915924, "uuid": "6306c04b-1157-4b56-854c-d315c419c727", "comment": "Malware payload", "value": "a540b9674f2edaf488ab89187f421822da3d0995", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915924, "uuid": "4d6b0bce-b2ae-413c-b37f-4144493fadd1", "comment": "Malware payload", "value": "842a6413f650fe31c80c5cdc2c2c0106b32388885de1af7129eb230a2f1552d8d78eda19930085bfc57ca158e3afa385", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915924, "uuid": "610d26c5-2e82-4f45-a172-9af386354bb6", "value": "T1486593CA5319AE98CBD85BEC0730CCEA87BD40626981652EB44978E7CC9EF5F19D0371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915924, "uuid": "96707b55-7ceb-4bfc-a22c-b5165ab52545", "value": "6144:vld6db2fficrNwpNtUXqrXnsYPT3T3T3TCGu58WMboXXOfKm0zQCN9NuoXXOfKmp:vlMODmamY1JT2+yYlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780915924, "uuid": "64e6aafb-6dd4-434b-8115-580a24bbd5c9", "value": 1499154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780915924, "uuid": "d712639a-bd53-42d1-a54f-5a08f9ed61f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915924, "uuid": "691dddd5-794e-4138-b0e6-0770268317df", "value": "27cc47596f9207018771f5dab54268d219dd96cac9cdce5ef3ae70e1ee3c704e.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2491bd-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908388, "uuid": "a5f86768-76cc-4199-897a-8fe59e93fd37", "comment": "Malware payload (AgentTesla)", "value": "2fd9ff302c8b65b2b6234a6ab7075d2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908388, "uuid": "d7862322-3224-47f0-9c33-f464d75d919e", "comment": "Malware payload (AgentTesla)", "value": "27ce11b6c6e9c6419caad0a144ea96411c0fbd2df2b0021b44e828a8e1f9ff6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908388, "uuid": "238851e4-59fe-43bf-b248-76618d4aa632", "comment": "Malware payload (AgentTesla)", "value": "3797583ce06a7321fc683fa5fb7226eef1db39da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908388, "uuid": "4e9a0024-800e-4bd3-a005-5292c6cc3dbd", "comment": "Malware payload (AgentTesla)", "value": "8f62d111043ebbc18f29e245f57774a3a1c62306d13ec3c24ac2f657722f5f74e3e288852d26a31fc56e06defdae2d84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908388, "uuid": "ed249d83-cf77-4e48-b5fb-c85db6646c2b", "value": "T144350244325ADD03C4964FF40971E3B407B89E95E952E303AFDABEEFB87A7542901386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908388, "uuid": "e576a901-d31a-4af7-b068-df30a88e6900", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908388, "uuid": "cc6811c7-200d-4010-aee2-32bc0ba75fc2", "value": "24576:SAEFT0DM6xEb0v+9JM2Qe2p+/71j7bwTsjYeZ:S3FQ4Y5Ypj1j4T/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908388, "uuid": "4c814353-8cac-4a96-9728-64750e0edbc7", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908388, "uuid": "95ad94be-5b67-490a-a91c-dcfcc2328ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908388, "uuid": "7685d1b5-ae3a-4014-9a71-aaf1ba83d0c1", "value": "27ce11b6c6e9c6419caad0a144ea96411c0fbd2df2b0021b44e828a8e1f9ff6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5aa15c9-62e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780885671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885671, "uuid": "e3bfdcc3-7b30-4461-a349-5783b26d2bf4", "comment": "Malware payload", "value": "3631572a90657ef45947176b25ac521c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885671, "uuid": "60d1c370-c827-479a-bcc6-1166369291ce", "comment": "Malware payload", "value": "282d918a5cbc4133105cf78468020623bfe2b7795069b0006ca21a5bcd8db4d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885671, "uuid": "25ab3617-af40-42c4-a288-5d6f4ff22030", "comment": "Malware payload", "value": "f0a58e186b9733c347443466d6fdfcc909145771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885671, "uuid": "501ee80e-0425-4b69-89a8-cef8339b0bcb", "comment": "Malware payload", "value": "f8208650cf2c65287451a5fbe6aa3a1a6e1ee2579c1859c408b31211e9c69fb39182e7a7ec079859ea3a4efc5c754491", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885671, "uuid": "1018b963-2398-40ba-b4fd-98278179d8bb", "value": "T1B59533B18E39AE68950E68BE47DD0A8855C41AFD733ED51F83B8D4BD126B0D2CF0A14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885671, "uuid": "4c84d04e-55b6-4847-a25d-b4608dda62f7", "value": "49152:jSNcXyrrBO+EXYALok6UKobLRkKabkx+3FCey:ONcXyM9YmrKIabks3F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885671, "uuid": "89477c0d-0089-435d-b6ac-b6c4d65e7ad2", "value": 1959112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885671, "uuid": "b8fe78af-edc4-4eee-bbea-c1a368d3000c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885671, "uuid": "0239000e-4cc0-4b85-bb5f-eafc9cce4e7a", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed00a9e-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780910812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910812, "uuid": "04a00f4e-d678-4b1b-ba82-f3eb308aab1d", "comment": "Malware payload (PhantomStealer)", "value": "c73a4d53f55b5116750378b449dbda84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910812, "uuid": "29f4c277-536e-4a18-bb03-458afdeba802", "comment": "Malware payload (PhantomStealer)", "value": "28309bcca3bd453fc1e328b3c808e6c8c47c6607258c46e4b5e36d9a6a7e8fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910812, "uuid": "9e9fb465-3d52-48d7-9be7-6ff21ad405b2", "comment": "Malware payload (PhantomStealer)", "value": "3b82cb46b6bd9278410523304366297f1a5a3560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910812, "uuid": "42b8b69e-18e2-4074-af57-da3d8d211eff", "comment": "Malware payload (PhantomStealer)", "value": "e8c6e4b5d5db0ccc8340bb74ef9ba3a9664610ccd975717f6de56aaf4d21f555e6414eac9193a59e56cbe0118d22a5d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910812, "uuid": "dd068843-83ba-4225-b6c1-777220f4a7c2", "value": "T19D65DF06F3E416B4E63BD278CAA64233E6B678450770AEDF0254D5192F33AD06B3A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910812, "uuid": "2ffac575-5d32-4227-9a3c-db10d0e5684c", "value": "8aacfebbd525a9c11ae6974f92e62a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910812, "uuid": "23de07ce-d26f-4e72-bf5a-ac8f21ce6b7c", "value": "24576:fjX6CckUUTCJgxvVC2czWTbv6vBqGZVsL64qvc8XMxq0EJS3RvD1CrcjuQ00fTI5:fjX6C0UOJ9yTbv6vBXjy+wrC5KErDvzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910812, "uuid": "3772aa5b-522d-4c1f-9f4a-0fb084a2bf38", "value": 1531988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910812, "uuid": "3a57aa75-6273-4426-9354-7551a5f8bd08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910812, "uuid": "8f7932e8-24e7-43ff-919b-cfcbc6d54098", "value": "28309bcca3bd453fc1e328b3c808e6c8c47c6607258c46e4b5e36d9a6a7e8fc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2d8e51-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "8d303fab-f368-4274-8a80-a8b55514ce9f", "comment": "Malware payload (Mirai)", "value": "4591590ead8067044cb3664f6f024a10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "b10a2e0a-1d2c-414d-8f31-2377a47f2763", "comment": "Malware payload (Mirai)", "value": "284276487ba1f56937a2550018f506fbb956cd7d59dcff412b8544a248bfc561", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "578e3fe7-e4ee-44dd-adb3-32a4609e5f01", "comment": "Malware payload (Mirai)", "value": "eb990f162609a61851fe36c7ff70bd469109de13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "98479ce3-469b-4837-a69b-6a3ba430b77a", "comment": "Malware payload (Mirai)", "value": "a34d29c3de7c402d88012d2de311872021547f73d6654873d91db97579934bfff76b064cae4b5985a60df608ab6e976c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "cd0708f0-5ff2-4904-9f3f-bd9c9521dc27", "value": "T1EEA35E97F401EEBDF80BD5BA04674A0AF630E3E11B930B366397BD57ED351A50826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "a72f2ee6-fc19-45d3-965c-cada8b14636b", "value": "1536:iPhR5NUppD0SKDTh7BN8H9/oRLfZAufjW1t0NPtwCki8:ipqfoS+7BsKLhzvNPtwCki8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939580, "uuid": "9892d694-1ace-414b-b30e-fc2fb8151dcb", "value": 106760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939580, "uuid": "3c66553c-aee3-4292-8337-caddffc6bcb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "a6738d5b-3037-439f-8497-45f2a00e7847", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe08d4d2-6327-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780915884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915884, "uuid": "e92ec936-891b-4d88-b7ad-e424a0b412a3", "comment": "Malware payload", "value": "45dd77532b153eff616a0f0af365d7d8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915884, "uuid": "c078a253-fdb2-4a0b-aee0-52f785616de3", "comment": "Malware payload", "value": "284dee06472d75e09c1362fa373e9bf7c5c73bc910a3b63db350318dcb7d57c6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915884, "uuid": "472e7d83-029c-4c1b-b930-b045142624e0", "comment": "Malware payload", "value": "8a29654757de853383c03cc903f2aae53beb89db", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915884, "uuid": "0ed5c69e-315d-401e-82b8-ad0eb45a18d6", "comment": "Malware payload", "value": "ec8667861a8f8d9141d643ce2f347c5fe6d8d926ee2232d3051ed66f12d608be75235b7edb105569a8dec20a3b540e7f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915884, "uuid": "d23e0c48-ee2b-4a23-8a19-b111468619e9", "value": "T1DEF551C59FDA2D5A20C3E81DC24616616DFC7EFC79B31559AFFA35BC8E7000A4086A72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915884, "uuid": "0d011285-9039-4967-9fc5-bd72e9db4acc", "value": "768:/s+tDdYRskwFUXmGFMPd4dhtyQYAhr02o+z5rs2xvgjGhiUEDbcm/9SY8Yo5cnOV:2dYlC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780915884, "uuid": "198191e9-ec57-4eed-893b-2bcc991a91f2", "value": 3600131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780915884, "uuid": "d3cb23c9-970a-4965-ade2-7fe5326d2033", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915884, "uuid": "c08e29d3-43d0-43bc-9607-6900725ac4c1", "value": "Lab_Results_Dermatology2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93637170-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780912698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912698, "uuid": "1a7f5e4a-eb20-46ca-b3fe-08f8c4e28009", "comment": "Malware payload (PhantomStealer)", "value": "52497dc64b11a1e303f84290e8c4ccb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912698, "uuid": "1ad6dfd6-d4de-4623-ba8c-5418952c6a1f", "comment": "Malware payload (PhantomStealer)", "value": "28565f7ca9ece44e1833733c0bf65b31812a275bba6d8f1de50944545023264c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912698, "uuid": "e426f7c9-739a-460d-9bef-a2d84f200c50", "comment": "Malware payload (PhantomStealer)", "value": "36774a1c26e5f9ca01a847cac636cea02bdce366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912698, "uuid": "1cdb218e-538a-45e8-b885-2e5be57bed5d", "comment": "Malware payload (PhantomStealer)", "value": "137163ba8b0a5ce9c224e5176d74853e3fb90dc0964c963f2f144268645146dc36a4bcb6fd33143044e985612cba2dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912698, "uuid": "ee0b6f28-c8d6-487a-b494-b889e3f31839", "value": "T1536523204A9DC946C9A92BB80A61F77427B19CDCE721DA539FE4BDEF3839B101D09707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912698, "uuid": "ff174ebf-5fae-486a-9600-61764f6c7f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912698, "uuid": "c5345fcd-73e1-470f-b96d-6048cdc8212c", "value": "24576:3QeToV5fahB1C5zf7r6TL4WcTqzOGQrdCf0+o2ONQyhkmbLX2bwHRcdU4:RoVA3Cdf7eTLcqzO4N8h7/2bYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912698, "uuid": "fc2f610e-1cff-4952-9736-bd3df2533f26", "value": 1529856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912698, "uuid": "b6f45009-6d6f-4003-899e-17114aeab13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912698, "uuid": "8b7ad800-fedb-45f9-9667-1653ffbeefa4", "value": "28565f7ca9ece44e1833733c0bf65b31812a275bba6d8f1de50944545023264c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a883771-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907315, "uuid": "79ec8b7b-d622-4cdc-9293-56064b3fa4e7", "comment": "Malware payload (Formbook)", "value": "bdd6293fda0b09aace02bf82712d0ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907315, "uuid": "f775b9cf-50f8-4e8e-bc31-8ca9fc0bf915", "comment": "Malware payload (Formbook)", "value": "2887e94cae0ef35418957b8ac546a55ea8f80446395c43e1c484792ea2f6f469", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907315, "uuid": "322e3fe1-fb91-4505-aed3-190e31399554", "comment": "Malware payload (Formbook)", "value": "e219f1b74e802ec1fc6f3a7a40b67a41b8df23e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907315, "uuid": "b207f72f-39f6-4073-8161-1da881e75dcc", "comment": "Malware payload (Formbook)", "value": "e2701646d3cec33cfe57809c386a1adece10f2206e0eaf43625da43a4d7f84ba7886004ecd9dd172691e1cf67c3de9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907315, "uuid": "6f4f088c-0989-4a2b-b226-a31ee900a6c7", "value": "T1AE250250232DEE02D5AAAFF44C22D1F41BB45F98E925D203AEDA7FDFB47A3240556183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907315, "uuid": "3cebc2dc-1828-4739-8fcd-bb4af3b52d28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907315, "uuid": "dcfa6401-6581-4cef-ab6c-9c5d788ff1de", "value": "24576:ghwZtvUCB3cnt5q4xc6MuxlopomsJwBt:AwftBs/fc6JxlUomkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907315, "uuid": "e5ba51eb-8ea3-42b1-ae60-02f006adfb49", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907315, "uuid": "830ae92a-15bc-4302-8600-4dfd7fc332e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907315, "uuid": "fb741e26-2821-4912-bec5-0bd2a386885f", "value": "2887e94cae0ef35418957b8ac546a55ea8f80446395c43e1c484792ea2f6f469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f63a6b6-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907430, "uuid": "3251b28b-4d82-436d-90e6-8ab6ac53c35a", "comment": "Malware payload (RemcosRAT)", "value": "33f672525efb15c9ce8d3232ee5fa7ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907430, "uuid": "dcc166dc-05c5-4490-9195-ac8021a97f77", "comment": "Malware payload (RemcosRAT)", "value": "288f474a44962da3e32a966c52bf54642b60ecc60f97b97ca50af607d999b42d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907430, "uuid": "7360913d-7c89-42dd-ba9c-127caf099046", "comment": "Malware payload (RemcosRAT)", "value": "44301968026b51277ae60b902270f47804603d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907430, "uuid": "9c004717-7e5b-45e6-a526-eb87a6735c76", "comment": "Malware payload (RemcosRAT)", "value": "39ba5b131b52705bcbace7e6dd84db1c659633931ea30e4b511c547bf42fa62193fa2473b8d1c34b88c98a68955cd216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907430, "uuid": "d870ca8a-1d37-4bd3-b023-3707426a9b66", "value": "T174C4F112BF50D6EBCD2C0175845F0A6E2F755D2ACB816B8713D8FB3239E2549812F29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907430, "uuid": "5943cf05-be1c-4f84-871d-9a803fecfa4a", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907430, "uuid": "00d8e8dd-cc92-4c00-8274-ac95e4241ded", "value": "12288:1ZDilDunN3skTtwxqtg9/Ar41fmtV9duQCGRr0p+Mg:1ZDGutF2x4gR5mduQx908j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907430, "uuid": "e310cdbd-c21d-4603-81f6-169e71b571f2", "value": 544424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907430, "uuid": "538f6e27-3ffb-4db4-9aa4-772fd28cba44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907430, "uuid": "bbab7c3d-cecd-41ae-bfd0-4bf362c3ea84", "value": "288f474a44962da3e32a966c52bf54642b60ecc60f97b97ca50af607d999b42d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efc3c79-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911725, "uuid": "ad26db31-a2ea-4b5e-bfd5-11c0c48ecb6b", "comment": "Malware payload (RemcosRAT)", "value": "98ed0e0badb6721786a1748894872136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911725, "uuid": "e12f8155-7cb2-4f12-a094-6928a6871840", "comment": "Malware payload (RemcosRAT)", "value": "289bf0024a3d41fb216f7131797879dff3295bcb49b08c1270aa29aa8da0f8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911725, "uuid": "73701e3a-f7be-4ad6-afb3-75e8ac562729", "comment": "Malware payload (RemcosRAT)", "value": "0f4678926d0708d9abc3d955c88a8e862bca1e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911725, "uuid": "b319db42-6c8d-4c88-a708-fa6222f5be88", "comment": "Malware payload (RemcosRAT)", "value": "91b7724f0e90ecc0df49d7f3e879e60aacde55db00985f638033b62978e394b53d8aebd53951a91c651c9240636274a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911725, "uuid": "d912693c-6c00-415d-83cb-966d843fd659", "value": "T1DA641340DE10CDFDC67512324ABA93BFEFB2C946015529672B983E86B873391EC2F591", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911725, "uuid": "0a8c29b9-6828-4109-806a-55d84e840dd4", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911725, "uuid": "42fe8887-ecfd-4be1-8162-cc33a9fa6a51", "value": "6144:l1ssjCzp55rUBdM/3Sd55MahwsHFa/U1bLaENy6l7gCAB/W7bMAL/tjHsUca:wsezi+/EgafldV2QTZgCo6dma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911725, "uuid": "08722c59-bbe4-4ca9-89aa-9570e47361f1", "value": 312688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911725, "uuid": "3e7b886e-5f04-4c2b-aede-26811489ab5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911725, "uuid": "a87a2061-8b36-47d7-809e-a34c7604b902", "value": "289bf0024a3d41fb216f7131797879dff3295bcb49b08c1270aa29aa8da0f8e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56206cda-62e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780885537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885537, "uuid": "e3478b81-5d04-47a0-bede-64d7c34db380", "comment": "Malware payload (Mirai)", "value": "d52e3ca02d907a15c4ee9e01f50dc823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885537, "uuid": "52ffff93-5441-4747-a792-a3e220aa6e67", "comment": "Malware payload (Mirai)", "value": "291cfdca65e890c5038f4cb4b736f2c4921064b997ed369d5b29cfa647e8a436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885537, "uuid": "5dbba407-4d03-4f59-ab64-2f896f80b539", "comment": "Malware payload (Mirai)", "value": "fc0ec3b065a04e7f7523611d00d3185f849e6b29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885537, "uuid": "b3854790-0a1c-4e61-97a4-deab93d7d03e", "comment": "Malware payload (Mirai)", "value": "1cd61eca689bafdb41b2b63ba735b27483bf9f17adb57dc6fadb180406f221db3dbdefa1bce2081f9f6ed2cf25eeb556", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885537, "uuid": "d4d6979b-bd13-4b47-bec3-04fadedb2d4a", "value": "T1C5937BC2E683D8F1F8160136603BF3376632DDB90968FEE3F7559632A4219A0B546B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885537, "uuid": "1a0f5e71-3362-4544-b78b-b6b6a3d05fee", "value": "1536:yUOZc8RHwCaFtFAtl8rkZ7MFYZ4OKwI2JU7asHtWUW6kNPE/TU0E:yluOwCStFAj8w1sYbKwIaU75w9xN0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885537, "uuid": "af739e4f-5efd-48e5-a681-ef60de766ab1", "value": 92924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885537, "uuid": "27f0cad5-38c5-4682-bef2-d6c79665bbce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885537, "uuid": "3e78cca6-7325-4541-ac07-41f08765f4e2", "value": "jklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94d70b3-62e8-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780888683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780888683, "uuid": "f35a4c75-9223-4817-84b8-07fe035cda50", "comment": "Malware payload (Vidar)", "value": "fc4f92a6d7e83de7b377ff9e04a32a9c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780888683, "uuid": "210795f0-865a-4feb-a709-25261a078e00", "comment": "Malware payload (Vidar)", "value": "29449de9ad9105829aa7fdc0aa25dc272df1f85f6fa50b580ab2102cec8f7947", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780888683, "uuid": "a1e6b01f-d801-4a03-a0bc-47571cadafe8", "comment": "Malware payload (Vidar)", "value": "2bff60e953d6973a8c1e7c3f048597f1a9f25e76", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780888683, "uuid": "cba3b9a9-bfb6-4180-a4b2-34e644fcb63a", "comment": "Malware payload (Vidar)", "value": "21db363fef2a1e05028463963b9afbcc6f98738cccb595a3b51072752ef25fe7eaaba80b7334905d1ad6050b50b5fb03", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780888683, "uuid": "99a81116-88e6-4a1d-8264-5914e0b9324b", "value": "T16D85390BBCA549FAC4AA9231897661927B71BC490F3123C73E90B37D2F726E0AD75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780888683, "uuid": "6b6c6fbd-9797-4560-a9b9-4efe435a979b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780888683, "uuid": "325e28c3-3eb2-4951-a001-e356311cb6f6", "value": "24576:F3UK1ItsLzTfMtowcwOskrJr/BXzlBeleX7KDg7eIW:F3UWIQzTnwi1rJFxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780888683, "uuid": "f1358dcc-a3e0-4381-8343-ba9214a89e83", "value": 1739264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780888683, "uuid": "f722bde7-89a3-4a09-accd-d029a3fa84fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780888683, "uuid": "f1b95211-b0b3-4060-a30e-15274acacdd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f96a36-631f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912219, "uuid": "394cecfe-d451-4d84-bea6-6ab41a901590", "comment": "Malware payload", "value": "4d11127942f842d4ed7534a4182bf0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912219, "uuid": "3239c701-a89a-4439-b352-378f2fd5d0bc", "comment": "Malware payload", "value": "29eb0a9e167e6e54893bd98149e89515693aeb8472ea9533f580667dd6cfe137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912219, "uuid": "7cacb535-deaa-4a6e-99cf-7181cda1a141", "comment": "Malware payload", "value": "7d80ac542d3398e207d32b9deeceadccce48b62f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912219, "uuid": "96297da4-39b2-45f5-8725-fb05d91bee11", "comment": "Malware payload", "value": "71ae5607e7781456e2aa54641f92791bd9c5cc007f4eaf5f79b942046139d27a6268b8c0580947920c3a548306aabe5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912219, "uuid": "4b4ab2fe-7617-4005-bdc1-6a6f0453be37", "value": "T17045AD1DF39C11E8D227C134CBA26232E6B578960361BADB176AD6152F73ED02F3A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912219, "uuid": "a4e4b081-75a8-41c4-b96a-cbc2a985ab7f", "value": "06efed3f07d93a3ab9d198ca5eb08693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912219, "uuid": "cff018f1-f710-4eca-9412-9876deec0457", "value": "24576:WYamVlr6H+ZP732aw7OYn0Vz0HDd6T7DtcGTz49SAEm+:WYambuHH7OYn0Vz0JWtciA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912219, "uuid": "66916b50-fef4-4512-9ffe-eaf411319f76", "value": 1246720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912219, "uuid": "11306f95-ab0b-4809-934e-5e0385d3db58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912219, "uuid": "7440de3d-0213-441a-9b72-94c2fda44e66", "value": "29eb0a9e167e6e54893bd98149e89515693aeb8472ea9533f580667dd6cfe137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9deb55d-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780910669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910669, "uuid": "fa33e0e4-7094-4987-b097-a0cad7c51c1c", "comment": "Malware payload (RemcosRAT)", "value": "e1eecb91dbf63fab11a58ea49b227efe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910669, "uuid": "fbd1e569-a7a2-44a2-b179-f4cda9c20178", "comment": "Malware payload (RemcosRAT)", "value": "2a412de246786b5de31cca476e2439a5a100a965739bbb1538c4b3bec367c22f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910669, "uuid": "fd8d4d35-6fd3-4500-aea8-47eff200058d", "comment": "Malware payload (RemcosRAT)", "value": "241017b6afc8c68244e40cfd726e96496f80eb1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910669, "uuid": "c243bef9-dbe0-4a72-9486-2e024df640a3", "comment": "Malware payload (RemcosRAT)", "value": "79c914a7f3255d29388fca0751f92a156775f8493301aa0fc55f707ae3676ebafcef0ad5c059be0a62f633e4b9394344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910669, "uuid": "b5e7ab42-bb35-464e-a40c-68bee79565b4", "value": "T19CF41249290DE907D4856BB48DB7F17447784ECEE560DA03EFE8BEEFB4B63A15142202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910669, "uuid": "5d5cf332-7922-4e42-908b-b958808c45ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910669, "uuid": "40a46e6c-76f2-440c-82ac-fc0e3edd8e43", "value": "12288:pnxX55pseXZcs/nNk60uXd54JsbN13M+W4tj46hbXeogwrOx/sv/O6YoPpd:pnNrJ2s1k60ut2IMF2DbXeodyF8GiPpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910669, "uuid": "07433a13-9be2-4d77-935f-5f1a042f31f4", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910669, "uuid": "2d396ae2-b5f5-48e9-bca4-25b5119efb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910669, "uuid": "379c742a-63bb-4bfb-a873-b965d490c83d", "value": "2a412de246786b5de31cca476e2439a5a100a965739bbb1538c4b3bec367c22f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88a72c9-6356-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780935953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935953, "uuid": "44cf1efc-18f5-4f57-83de-e9da9bad4fe0", "comment": "Malware payload (Phorpiex)", "value": "3f4f8c3fc21f89a401bec1a7af6f5638", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935953, "uuid": "4884a65d-5fe9-4900-b40d-79f1e5e1630b", "comment": "Malware payload (Phorpiex)", "value": "2a6342b0d750915708fa702b5e4f8c4d69bdc7c1f5c8e3dd575009dc510862d6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935953, "uuid": "05104b4a-166d-49d9-9495-6b9220465670", "comment": "Malware payload (Phorpiex)", "value": "bf19606a84ef5832380792bb318a30130e0077f7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935953, "uuid": "a4fed509-ec80-4de2-ac52-df41d4ff7e55", "comment": "Malware payload (Phorpiex)", "value": "409aa8d39d0408932a0a405d3b7166c2ae979edaa56464598d7853aeaf332d286c755e7b879e70304ef02f977bb62cef", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935953, "uuid": "63632700-d564-47b2-bd82-37805a865ada", "value": "T192825B0FB8424726C1E100B09636967BDA79A87137C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935953, "uuid": "952acf6a-c9cc-44b8-9962-5d1c746d5b75", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935953, "uuid": "88246400-b9f6-4a7d-8ed1-b7ef5864dc01", "value": "192:IKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSvu9zw+ghSSCgbO5qmEd/FN2GJxC:K0W/ytwEN/0Gu9JgwOcoav8U9ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935953, "uuid": "9b765574-d104-49a9-9527-e508d10f4bfa", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935953, "uuid": "9fc415a2-0268-4c24-af26-cc916c8313ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935953, "uuid": "0099783b-424f-4df2-a373-2af362fec126", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162d3ec5-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911200, "uuid": "be986fda-9abd-4b66-a648-77754be15713", "comment": "Malware payload (Formbook)", "value": "d4c1d77cb510768d6e6464e2617dfc98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911200, "uuid": "9dd3682b-72fc-4af5-90f1-4910e42461bb", "comment": "Malware payload (Formbook)", "value": "2a9060e190eddef05690de49007fd643a26b54a96bf24c06623fd53f56aee8f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911200, "uuid": "7f35b78d-ab7d-4103-99a9-e8e1cf6ee99a", "comment": "Malware payload (Formbook)", "value": "250c0fe615f05a8d09a71adff3c6cb01ce13bdb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911200, "uuid": "16a864b7-ed8d-4662-a86d-5520fcbf4c3e", "comment": "Malware payload (Formbook)", "value": "a2508269855276c017cd510f5af253d0da109e96b375ee8cb0a5defecc5c4ea376dc06ff32444eaabbb974e16fbc6ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911200, "uuid": "54d14ecd-4f63-4c56-87b7-a2a10fdceeec", "value": "T11054138B2E084013F86187FF7B8547E73D1EBC3981A7E29B2550667E9B1AB6148DC317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911200, "uuid": "e512ab7e-67c4-4081-aa3f-1a5e66f7a4db", "value": "6144:sq5HFDYhMjwK653iNv3gJJVzczNC8X7/KbOoqqYr9R0xjx+pXjrc4ER:75J/oov3gbVIzNC7sBr9ClxWfc4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911200, "uuid": "851bd2e3-ac7c-4dc4-b943-e455966abe9b", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911200, "uuid": "715eb451-140f-44b3-8c4f-acf21612db40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911200, "uuid": "4bc71b73-8ca1-4ec3-b861-819afcf8340b", "value": "2a9060e190eddef05690de49007fd643a26b54a96bf24c06623fd53f56aee8f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6819ec6-6339-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780923575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923575, "uuid": "abb33780-b642-4eef-96cd-2e8c76d9a1bb", "comment": "Malware payload (XWorm)", "value": "a7e70d48b022d71d5d57b57eab6467d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923575, "uuid": "87714d62-a5ea-4d7e-a9e1-901720e9aeaf", "comment": "Malware payload (XWorm)", "value": "2a9533cae947e4232cc85dc368109d52c69a3b8e43e8667872671da34052304b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923575, "uuid": "a82f96c7-7012-4ed5-9706-e0df345a880b", "comment": "Malware payload (XWorm)", "value": "653f922e919fcada4b3ff351e2b980ed3fc7a89c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923575, "uuid": "54ff7fa5-28c8-4ac8-922b-29ed9e44e3e7", "comment": "Malware payload (XWorm)", "value": "fe505bd1f7e0b0065b1fa20a11c6fac21b802a39efda7db5944a5172b752163d7fbe165bbb88db39be320d31f957eea1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923575, "uuid": "b7b8e937-c3b6-458b-a0d7-c77c842dbd00", "value": "T1B56601300354C671D25C5FAEA6B97118640D5DCE94F9FB093A6A87F1027A832E3BB7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923575, "uuid": "91264f5c-93ec-4334-b826-533bb9d5b622", "value": "98304:pSjLc+OUOU1B8QHDhSXrchnW9UPF/3mh4y8HuKCbky6U1OMKxl6y9CJ:AcyHF/v/3myy8Ovbky6UqxYmCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923575, "uuid": "e553eb33-237f-49ef-b918-156650bc87c9", "value": 6526095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923575, "uuid": "ea6ace54-0137-4d33-96e5-f6a074760153", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923575, "uuid": "a11979c5-d086-493f-9a96-59bcfd4635b6", "value": "INV08052027.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03ccfdd-631d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911485, "uuid": "a0fdb457-e3fe-4bf8-81a5-e7fbee97a214", "comment": "Malware payload", "value": "4696c12d00191f6051104860356b2eaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911485, "uuid": "fb70290d-8d36-40ec-9df8-07693b093ffc", "comment": "Malware payload", "value": "2af1bf9fb877e1fe1d7608dc1a6192ee02681bd34ee44d4867a3ba884272de68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911485, "uuid": "3e808458-d7ea-4967-8add-e20a99afb57a", "comment": "Malware payload", "value": "947dd3c67423038843c91a02d4d60a4c6ae8e2bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911485, "uuid": "823ada90-0390-43ad-a4e3-256a19d104b8", "comment": "Malware payload", "value": "c477b0f5a8d078e6ea06e0bcbea4f3aec618761b773cbdbeb2bdf815b478f88d7c032bc3fa23635354d6cea50e2d35bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911485, "uuid": "757350e7-6fd7-474f-b372-b7cdd5920470", "value": "T10C45C02D364F844DD591EB788F333BD41770D47648F2D31ABBDC6338A62A6E19A8C642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911485, "uuid": "ef7db21a-8e6c-4148-9a8c-1ab614c972c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911485, "uuid": "33a03cc1-9408-4861-ab64-d4103c439f2f", "value": "24576:wPRkPCmQui1rBgc+9y66LghoGFq4H/+Qa7KB0y1:0iYusP6thv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911485, "uuid": "1e8843d3-e472-40fa-bc06-6960903e0c35", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911485, "uuid": "8606493f-c937-431a-8b78-bddf95bca565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911485, "uuid": "d5916905-421b-4679-93ae-337cfe4d6d63", "value": "2af1bf9fb877e1fe1d7608dc1a6192ee02681bd34ee44d4867a3ba884272de68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43daa016-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910417, "uuid": "d078a11b-2ee1-4264-8924-2e639681e5c9", "comment": "Malware payload (a310Logger)", "value": "3270fd4a29df18cb114c8eb84ba3059a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910417, "uuid": "e05a7529-0b35-46f4-9cf7-770ca9ae74d1", "comment": "Malware payload (a310Logger)", "value": "2ba76b2e9f714f216f628ac02d8b0052b0dd7f661054ec2eab1e6cb35333330d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910417, "uuid": "7d3d7403-0984-4aa5-8cc7-c8bcb94eeb54", "comment": "Malware payload (a310Logger)", "value": "0b6b6ab5b6238ed2886fb691b0d462c0595171b5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910417, "uuid": "b35833ba-8a5e-4e6c-83d6-519135c425e0", "comment": "Malware payload (a310Logger)", "value": "ce60d0597b10c8a98fb852adc86ddd438c02c6c9a93f2dc0c799568c429f7ed83e9a79ae9675019df414fab3b483b18b", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910417, "uuid": "314e6db3-52a1-4566-bd47-ff69bd7ee29c", "value": "T15F4522585128C703D4B61BF01DA1E0B92BB4AC6EE528D647DFC87DEBB47AB54080276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910417, "uuid": "83b0ba12-35c6-4442-92f0-6c83d1fbefaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910417, "uuid": "4f5d04c3-a03b-435f-9a29-d7dd17f15bae", "value": "24576:rf05nNryyeHJDFyhc3uYTrlmR7BIehGDGgd2mGRh8uaq3BpKI1FN17Kd1qP:rimy0Uhc3Plm5lsRkmIh7aq37tz17AoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910417, "uuid": "f9d61731-d2d0-40e2-941e-9086fa25b422", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910417, "uuid": "ce86e34f-9c2a-4a40-a65b-5b8f7c171646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910417, "uuid": "f3712a24-3a34-4501-a036-fa2260745211", "value": "2ba76b2e9f714f216f628ac02d8b0052b0dd7f661054ec2eab1e6cb35333330d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf09af49-6390-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780960902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960902, "uuid": "dd0b7f6c-9767-4651-8d8c-94d1ae72af7b", "comment": "Malware payload", "value": "fc39e08334fa9061a734418eade538f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960902, "uuid": "d9d9d4e3-053d-4d4c-8400-5840af1efec4", "comment": "Malware payload", "value": "2bfd86f869a091400d1d6258deb6040cd0003883c9dd09dc3f8abef572a09c60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960902, "uuid": "54df2c29-4abf-4beb-a74e-d1bb85dfbdc7", "comment": "Malware payload", "value": "5e53eb112dda0105b222dfc95dd78bd6658a26af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960902, "uuid": "59b4055d-5aaf-4b9a-ae68-880d209cb89f", "comment": "Malware payload", "value": "5950aeee15d8e0cba05a224a3021d3e3fafc4f6feb32863737284ba5b7d69e33643b8badeab15a9729eaa54b472760b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960902, "uuid": "356663bf-fd81-4357-a27e-5df043e39ec9", "value": "T147A65A0B7CE409EAC4AA63328DB25192BB75BC490F3263C72E51B7782FB26D45D75348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960902, "uuid": "38147775-16da-482e-8dba-2081a79fda56", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960902, "uuid": "de1dad2a-336a-45dd-ad1a-18adaf4d5e17", "value": "24576:wyy8uYp5q3bN9Fpdphd79nT5esQ2NcZUQn0rMWO/nBele7tKDyi4rO:wyyZYp8bHdDd79n4sQ2MUQ0rMrnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780960902, "uuid": "b6b2b08e-ca97-4c8c-8c8a-329d6a46dcfb", "value": 9497760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780960902, "uuid": "a50e12de-48f6-4c80-ac1e-17482e6643f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960902, "uuid": "1c5b0b9f-43fb-49b5-b907-0f59c2def849", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9169b24c-6385-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780956074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956074, "uuid": "e530d6df-a530-4473-85df-eb48b04fcb74", "comment": "Malware payload", "value": "1a158c6f62a778f3a90431948afc0bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956074, "uuid": "31f5c7bd-3b25-4623-87a9-bef0c9ba6f71", "comment": "Malware payload", "value": "2ccbab8b636de6a35fa5c29abeb43f5cf41fa21b28e1c2206d2b0cd71b114e8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956074, "uuid": "92108e48-d668-4ccf-b5b7-eb9c66719f85", "comment": "Malware payload", "value": "48573d0fcaeece0c7ec3abf34467c2d2e73b2f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956074, "uuid": "a1989a9b-3674-411f-8d94-d0c88186095c", "comment": "Malware payload", "value": "6456ccc824c85d071af44679f6c8dd636947ade3068d95308f4088eb1a26a59881fea336c11830d19673373a859e9d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956074, "uuid": "07edf1c0-7017-433f-bfb8-7df50656d1e6", "value": "T17C764A2277A8CE61D87E12310D8BE9B4A572FC05AF1B41C73229B76F6A73FA01811757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956074, "uuid": "130976b4-51ec-42f4-ac25-0ec05a5f4cf6", "value": "2d9e242960f84bc7c78a2273ba553d9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956074, "uuid": "b2f9dbf5-903c-41d4-8166-0e7f9d525fe5", "value": "24576:bbptR7AVRd6fosIZwJGWWyeBE9KfjNGUcdNYtmHeG7mjdkDedCt43y+3/Hd7x4ng:xS7wosyw/Mmqc2XHcQWJB319", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780956074, "uuid": "66057d67-937f-4129-8cdc-e2c920f13279", "value": 7143424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780956074, "uuid": "06aaa5f5-ce0e-4f74-8dbc-fd7a8b2db0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956074, "uuid": "67d9cc7f-24af-4ad2-876c-6167dff65b8f", "value": "z53SCTV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c136cf35-631b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910628, "uuid": "1ec51613-17a8-4df7-b6d8-d711b939f0ab", "comment": "Malware payload", "value": "a9ab81ee0642dabc360826750facbefe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910628, "uuid": "51bc9eb2-d20d-47ab-bccd-6ff1f1c61b61", "comment": "Malware payload", "value": "2dc916a66d1bf1a8f6d3168fc13f4915d67333365f91f1d3206b7d36fac133f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910628, "uuid": "af3887ce-a30e-4ddf-979b-fb16383896cd", "comment": "Malware payload", "value": "f00ca10863730824ed7bbbeb0f838726dccbb7f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910628, "uuid": "7014e096-c752-42af-a60d-c1fa6b9bfeaa", "comment": "Malware payload", "value": "b03e749691f93809348d12629f59506766a898e6b9b5df167c69cc916cf685e83dfa1218999af6ea214e6366c3a7494f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910628, "uuid": "064fb9db-4eca-45a7-9e04-e513359dbf9d", "value": "T1F745CF9623E8991CF0FF6B75A9B161168BF0F913C632E65EB190419E1E71B81CD26333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910628, "uuid": "89ff1f60-1e06-4e5c-af99-47b84169297a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910628, "uuid": "216129df-24de-4320-a0f6-13022a8249c6", "value": "24576:MKDUyAzyNshz/N5VpMeOJ/Itii3iqQdZuJAvpp98Zz5T:QfzyN+r3VpPt/3iTZuJAvpoF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910628, "uuid": "43c9c019-0814-4b8a-b6ea-d5a31e9dd9a7", "value": 1237504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910628, "uuid": "6fd9b166-a7ba-4b91-8c5c-d15818d886a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910628, "uuid": "1cff9c0b-d370-458b-a53b-4f5d5cdc6b6f", "value": "2dc916a66d1bf1a8f6d3168fc13f4915d67333365f91f1d3206b7d36fac133f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa946da-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780912692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912692, "uuid": "a5324186-dbb1-4007-bc86-dbbc13803055", "comment": "Malware payload (RemcosRAT)", "value": "7de5fff582904de40be5e5df843b1fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912692, "uuid": "2f2f7492-df0f-4218-9669-909051eb7dbb", "comment": "Malware payload (RemcosRAT)", "value": "2e0de81a63e34de5337e31356ff87acab04f06e0280344fa93079c43ad004f8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912692, "uuid": "f717cf60-2f20-4022-b435-4c117084e3c8", "comment": "Malware payload (RemcosRAT)", "value": "5efa4bf8f95729caf7437bdc4b4b32097c0a1690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912692, "uuid": "dd586bbf-99c8-4ff2-a0a5-45a1d4625e45", "comment": "Malware payload (RemcosRAT)", "value": "7d1fe2f8e57946250338c09167b4454bec9ffd428a4c154041931899619b754599454602779286b7f1c6007098391141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912692, "uuid": "c9ec6d19-d6c4-4e63-b148-b1087be336c5", "value": "T1B7051229AF59C443C8C213345BB2F6B2627D8ECDE500D253AFECBCDB397A9512949352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912692, "uuid": "73186113-5fb5-4b67-b077-3477b7f3d9dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912692, "uuid": "3590f517-bb6c-47da-b7dc-ab9cf1c6ebec", "value": "12288:GjvbQkVI+hV9Jv5SHEde2Y1dHkKFzJP78dP3ZTobpJm8h/Fd+E1UKIqjld4:GTI+zjRlde2Y1dHXVJj8/cFA8hb+AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912692, "uuid": "116a2cb3-46d6-457c-88b7-f25fc9426f63", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912692, "uuid": "ee20dac8-15f7-4fce-acbe-d78d55f978cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912692, "uuid": "ef7aae56-ab48-47b4-a8db-b0bba8315901", "value": "2e0de81a63e34de5337e31356ff87acab04f06e0280344fa93079c43ad004f8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5e2b76-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780908095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908095, "uuid": "4e317fe4-2580-4a6a-9f14-fc03745d041b", "comment": "Malware payload (XWorm)", "value": "8835a6e317c02c434aa97194c01a0e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908095, "uuid": "b7b1093f-97ab-4515-8de2-e41911c3f7dc", "comment": "Malware payload (XWorm)", "value": "2e37ef62eae24ccfbbd022aafa0850ce1b0bf87808d3206ca675b9d277e8d58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908095, "uuid": "949f50bd-5593-43cd-9420-60e3b3e3cf47", "comment": "Malware payload (XWorm)", "value": "728884867c4d43740600f71eb405d5e1bda2106b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908095, "uuid": "000409dc-e6da-4dc7-b5a6-9fd5fdde4d29", "comment": "Malware payload (XWorm)", "value": "fb3a9540a18e8e0beb65bd673d47c190978a388fc2be2126eb71f2e6e3c5fdb0132189c7d63b18b731bab82ca671d19e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908095, "uuid": "8d0280fc-a5e9-48e2-bd8e-5fee37cefbc6", "value": "T14205F118231EDE06E4B78BB85860D7B417B86E48F930D2138EE9BEDB78357919D053D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908095, "uuid": "98a64109-7258-49fb-bb62-1264ab45b80c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908095, "uuid": "32bdd5ec-0f68-41d9-b07f-3bc1b86a146b", "value": "12288:N5mNYL9MHgWNJTR71keI1c1xjNdf3kXJJbr859pjIOmPoOO:jtRUNtt1keaOjDPoJH0IOmQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908095, "uuid": "0cef4869-01e2-4625-ac74-08129faadc66", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908095, "uuid": "308fb1c2-92d4-43f5-807d-c15cb1e6ab86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908095, "uuid": "fe666e64-3703-425d-a9ad-d8838d5f7007", "value": "2e37ef62eae24ccfbbd022aafa0850ce1b0bf87808d3206ca675b9d277e8d58e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d4a118-6319-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780909537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909537, "uuid": "d817b71c-75c2-46e5-b646-a85a7ace9137", "comment": "Malware payload", "value": "4adee1b041e36149cc0b918cab77b718", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909537, "uuid": "032851bd-8c10-43ed-9fbb-bc4f32f542ed", "comment": "Malware payload", "value": "2e4989f75e702e68d4d6c75a4e7a5d8faa5fcf4611a67f018e94dc90fc7e65c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909537, "uuid": "910e2655-20e5-4473-b1f5-b789c44b0e08", "comment": "Malware payload", "value": "4095484d73686912f1edcb9eec62dd735a7e2d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909537, "uuid": "07d4bbe3-9bc0-46e2-a2af-cd25e5bdda60", "comment": "Malware payload", "value": "d32ef9a25fe4d260e686ec4cd72fb332660ad60c2d3b2529ef158fb979afbed4a1e8b59cafbe5b1599e49129bfbd4ffd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909537, "uuid": "0ac2bdc8-16f8-4228-9471-991e17d971b6", "value": "T18DB73753B4A1D194C599C174C229D2D3BB623C864B2427C77BECAF6F6F32AD4963A310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909537, "uuid": "92e1100c-bcb3-42b4-a651-6653af33aca8", "value": "196608:mDlrkdUarwuPZn4bPNE6k/KSM//oVPKRjfEFro/N+:mWuarrPZ4xpPS4sKRjfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780909537, "uuid": "7e4b61c8-f66c-4c39-9bfa-eaf2b1e9c275", "value": 48156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780909537, "uuid": "8f4a9053-bf55-4993-8bac-4ea10a624ba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909537, "uuid": "fef9d7aa-7389-4068-bcb2-8f215b06ef44", "value": "fscan", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae94c7bc-62eb-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780889981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889981, "uuid": "2ad82ff8-bdf6-4762-b265-c7e0493fd7aa", "comment": "Malware payload (ConnectWise)", "value": "be4ffb2f7fa4ef38574ad81ce40340c7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889981, "uuid": "03eb79f4-0677-490f-b9e1-86400a2efac3", "comment": "Malware payload (ConnectWise)", "value": "2e577af3c5fd087a06f7b1cf40641d38b2ff438c83ce34b14a6eb534a06eb837", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889981, "uuid": "9c5a0bc0-1e49-4505-8ac5-fa7d10aa0e12", "comment": "Malware payload (ConnectWise)", "value": "48c86dbc8624a4029e542f03e7f7b51e3a1163e0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889981, "uuid": "6d56daa0-3bc7-4203-b374-10500fb8229f", "comment": "Malware payload (ConnectWise)", "value": "f1936720b19fabb35f30729ad9e5a5f977957adfcc46a1b693c26b1b1855e34819e98d0b94f0c2af2e9785fb38e7b9fe", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889981, "uuid": "5d8e59a7-84f3-48aa-b026-b4eb8c58a93e", "value": "T1DE646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889981, "uuid": "e2afcaef-b96d-4575-a87e-9d1a70313eee", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889981, "uuid": "663a5bfc-fdad-4407-a3e1-3b9c3fc2fafb", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9X:h1iw7gryNkSV1hy1Z1u2JLu9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780889981, "uuid": "b249bf96-a00b-4e09-8072-c2b16879d26c", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780889981, "uuid": "da16c4bb-50e4-4c22-b952-45facb98a848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889981, "uuid": "63883827-3356-42e2-8d3c-9dc1c35c581b", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41e8328-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780910203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910203, "uuid": "0375715b-2e29-4cc2-91ab-a1ab825b8657", "comment": "Malware payload (Expiro)", "value": "5d6e252cc11d0839742349f752b895d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910203, "uuid": "b428e5b7-ffe5-46f3-8aa9-340b9581c0a3", "comment": "Malware payload (Expiro)", "value": "2f2d129e4bb5bd850996fc59c9d06d2a85d08d51e3a2694501e9eb52b187230a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910203, "uuid": "65984150-65a4-4e14-9f0f-168fed5157b1", "comment": "Malware payload (Expiro)", "value": "e88ad6bb48a3612c45e6b5774634dd39d1ce4bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910203, "uuid": "284f1c32-38d6-4203-888a-1ccd5247f981", "comment": "Malware payload (Expiro)", "value": "d564a2dfa74ee11b22b1f595ec9b71f6bb59509a4d157f62a382d73c3bce5c06e624406d57938fb130a69a4636c1e009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910203, "uuid": "c53d7d46-5963-4bbf-a4ea-80a9530a7e79", "value": "T1309502D43A3AE71ACE624A759A65DEB516F40DACB400B9A34FDC3F4B74AD0606D0CF81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910203, "uuid": "dbc8aa9c-5870-4d8c-baab-8897cfea671d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910203, "uuid": "c1b273dc-f581-4159-80e1-d8b28184e416", "value": "49152:UaCV5zCnICSr4Pq6auIll1QuXlRpQmbRjq46dJtJ/wl:UpV5z1CSuq6al1Qu1r304O7JIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910203, "uuid": "b93e8656-73cb-492a-9779-235718e56232", "value": 1952768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910203, "uuid": "cbf9b459-43d3-4fa0-983f-c19eea65a7be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910203, "uuid": "22287d56-94d4-4108-84b7-dc555981513d", "value": "2f2d129e4bb5bd850996fc59c9d06d2a85d08d51e3a2694501e9eb52b187230a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148b77eb-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907761, "uuid": "25a16188-cfe4-4ad2-a9ec-abfe5c64e102", "comment": "Malware payload (RemcosRAT)", "value": "7ef34e615351e8ad70aaebdae54e7150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907761, "uuid": "428dc71d-4804-4af4-898b-dbd60d10f1b2", "comment": "Malware payload (RemcosRAT)", "value": "2f5c8a96ff4519ae5d39f3a30cacc2d2d7064e0de52972523adeb441e4bd9389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907761, "uuid": "f8774803-1e31-4ed9-b761-798028c3131e", "comment": "Malware payload (RemcosRAT)", "value": "b9dc6fe941fd9ea07fd25642e212d5c6cef5d992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907761, "uuid": "372d11f8-a5ce-494b-aca1-e16851e4c9f5", "comment": "Malware payload (RemcosRAT)", "value": "0550d8926d1bf0d9c2acb584057f4bc2981bc521e87677762aafcb2a98a77a29312c3a4a1b8a6f2a444d7659210864a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907761, "uuid": "b327348c-f979-43f0-858d-9bd1571e56fe", "value": "T117050155331EC806D9D60BB01970E3F956788E88A901E3139FFBBDBBF8BA55539442E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907761, "uuid": "349e6181-bee2-4543-ba8a-c9fe90d6dcf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907761, "uuid": "bd878c6a-c1ab-4344-bac3-96b13a556cc5", "value": "24576:a4TS10lfCrvdk+W9tX4fFpqAtqFbnebbqfX/:a440qdMbar2ebbqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907761, "uuid": "7e120f97-62d0-4de8-bee0-9e9edddc82e4", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907761, "uuid": "0b5d1d58-6071-4f29-92e8-ab50f337fca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907761, "uuid": "8ebcb3a2-ac64-4a6c-9fbb-8da4c8435673", "value": "2f5c8a96ff4519ae5d39f3a30cacc2d2d7064e0de52972523adeb441e4bd9389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869613d6-6304-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780900651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900651, "uuid": "61439a57-2ebc-4284-949c-d284753dede9", "comment": "Malware payload (AgentTesla)", "value": "0554274843610eb9226e3534a8a8de10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900651, "uuid": "3d5d7410-c395-44a5-b422-f60f19f5e865", "comment": "Malware payload (AgentTesla)", "value": "2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900651, "uuid": "fa9241d5-ade4-46f9-87e9-a3ff0dea8111", "comment": "Malware payload (AgentTesla)", "value": "1b60010484b70216cd75c1af7ae6af6d5f687724", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900651, "uuid": "513a3d66-6fe7-4c4b-97c5-61f501a7b333", "comment": "Malware payload (AgentTesla)", "value": "8ca8a9a6a1d849d20e7ecb1dc2f72997bf3c9162515c48f0afe685e8339fea4e02a2abade3f3b4c367ddb16289c52655", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900651, "uuid": "bef574f5-e687-4ff0-864d-14fd1cc56247", "value": "T1A935F1101E9B1B84E8793FB4C0235D21B3F8F567327ACF9BAEE820689D97745CE05916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900651, "uuid": "377fcbb8-430d-419a-bb04-1db20823f6c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900651, "uuid": "27ef939f-6fb3-486d-8a12-da2357ba5521", "value": "24576:eZPB3mZHQvlAVW07yyF4OHEQCvoGFRYo:uPRvKVJyqfHOvvFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780900651, "uuid": "7ba36d01-d062-455d-8dc8-183eaa25ef9b", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780900651, "uuid": "c1980f62-5d7f-4012-9ef6-5dd4db573371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900651, "uuid": "b31ac6f5-d06d-415f-8706-2f8384ee1a9d", "value": "Cotizaci\u00f3n del producto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3855199f-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912975, "uuid": "7534d2a8-3210-44b5-8478-185231c6ec8e", "comment": "Malware payload (AgentTesla)", "value": "93e8f216301e7349b3b2bef8a91abf10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912975, "uuid": "ba0bf86d-4fd4-4ec1-b342-7d057622d337", "comment": "Malware payload (AgentTesla)", "value": "2fbd83294f77550e8f9bd13ff100efda0e63854f267dcce90028b53edff6ab69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912975, "uuid": "bf91a763-f0d6-4856-a04a-403653207a50", "comment": "Malware payload (AgentTesla)", "value": "f6f1201b331581eae4f6df57ceb54f2e933cca2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912975, "uuid": "a690b79a-6858-4808-a791-115614c2f230", "comment": "Malware payload (AgentTesla)", "value": "e1c85423a232b3964567b9a1f0d2144027663466b730e16d3804d35b336f01c1346a12933d85fd0bc983a22a4475d3a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912975, "uuid": "60515ed0-56f5-42a6-bfed-a9368fa505e0", "value": "T18925E0141D972F84DAFB0B78C0520854B7F0D94793ABEBAB6FEC10F99AA7F49C909441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912975, "uuid": "1ec13e5a-bbc1-49b2-872c-d66907a04b54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912975, "uuid": "75f2de20-06d1-46b6-b782-a489cd7db5a2", "value": "24576:1zkrEhFMxO+Nm5olKEKUq66LghoGFq4H/+0a7KID:1AwhFMXNSooTZ6thvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912975, "uuid": "d9f66cb6-07dd-4dc4-9513-9ae1dcc641ae", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912975, "uuid": "2110b21f-b70e-4612-ae17-613f71d0e300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912975, "uuid": "46b010a8-6219-4927-8be7-b55f0ec7b0a6", "value": "2fbd83294f77550e8f9bd13ff100efda0e63854f267dcce90028b53edff6ab69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccfd405-632c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1780917841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917841, "uuid": "15cfc28b-dfdb-4910-baac-1b943e8018dd", "comment": "Malware payload (NetSupport)", "value": "78b06525c6a3c70ab3dfa37b5489609a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917841, "uuid": "ef9c3ca4-d909-400c-8136-6ae509495397", "comment": "Malware payload (NetSupport)", "value": "2fe7b6aeeea82a71d754d61bd2e0edf592248d01e0f81c7bd3e7b1a5be1da2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917841, "uuid": "9c2dd875-7614-429b-8e30-94ae025c1145", "comment": "Malware payload (NetSupport)", "value": "e8f4b7b65451a8cd3b66018f6707f122b5244886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917841, "uuid": "180c2267-6496-40f8-9c4d-912dd1b57979", "comment": "Malware payload (NetSupport)", "value": "0ebb72990f0fb7047f3514ff27e021f5af5345b5be7df5cd74a1985f70b77543765f4228928de392d3917aaf8d0268ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917841, "uuid": "a27a9581-5f35-4451-a2e0-4a070edb91bf", "value": "T18CC6AE21B64AC53AEA6E41B1592CDB6B61797FB20B7144DB73DC39AE0F704C21232E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917841, "uuid": "35f67a9f-dbf2-4f55-b769-0a100c8ebd1f", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917841, "uuid": "595b0f70-c442-4958-b43f-6b7c2829e49f", "value": "196608:i9upko8Rr6rAHc3LkyjLCUMquQ9oCwBSEfykx/DPlRWq:i9/o8/HcbkG25quQRwBzfyQLXWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780917841, "uuid": "71fb358a-e1f3-43dd-850a-09d88b30a9a5", "value": 12434608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780917841, "uuid": "f3fb2a07-7b77-4292-9a2f-77ec1efe94b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917841, "uuid": "3caf5aee-d444-4dbc-b55a-a21c1b681f3c", "value": "alexwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50ac6d2-62df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780884891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884891, "uuid": "8d559cf5-c442-4d78-8868-97d60f2cad16", "comment": "Malware payload", "value": "8c9df7e5b3d88989f20d92749f5daa13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884891, "uuid": "250e92ef-6266-46a4-b5bd-37eb80156c08", "comment": "Malware payload", "value": "2ff2cd8905d460657accda31408b249329fd39810cac556ab9b8a50c6a25d44a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884891, "uuid": "4b29093d-3ce0-4f4e-8292-d8177431a3db", "comment": "Malware payload", "value": "8061f6f91a0e85ece9d26642afc22ad86281d2c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884891, "uuid": "d4271a67-71c4-4361-ad82-478c8ebfee6e", "comment": "Malware payload", "value": "4ab95c71a088092972e047009c863f6d7fed148ccfad8786fdc1192e5e0dba8d81b3d6c6614c88a7fa3590bed38ab8e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884891, "uuid": "68ec1f0a-4bbc-45d6-84b0-450c9ef515be", "value": "T17B953382683E49F29DEDDC7B2B1FC981909C9DFE37E6E936099788AB10C5D697074070", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884891, "uuid": "0c6f4929-7ab1-4e08-a1b7-025b66022446", "value": "49152:VSJ1a5p3/1jF24xFyn2vnFKrHS5VUEEMrJEbl+Umws:VS2Z9Fcn2vn2+LJEBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780884891, "uuid": "feb939bb-54ca-40cf-8759-2b9f7707726a", "value": 1949524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780884891, "uuid": "29591f32-4eed-4246-ae46-0c2cabcff7bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884891, "uuid": "5c5699c2-93a6-4fca-a243-fa421e358835", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8d55cf-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912551, "uuid": "af93ef7f-f65d-42fa-a02c-1d1468e7e2d6", "comment": "Malware payload (AgentTesla)", "value": "eff9710bcbdf4208bdb25015117fbbc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912551, "uuid": "076eacf0-5ebc-4d44-885f-6c9875f7f6d7", "comment": "Malware payload (AgentTesla)", "value": "3031302885e4b193166ff7bc9cb50429be8bb8e62d99f655dcdba1cdd41ac17e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912551, "uuid": "3cc1e6d0-4443-4b02-a2df-74f6186060b5", "comment": "Malware payload (AgentTesla)", "value": "47a04ac1dab52fdbaab6650d0d51d24e1be8dae2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912551, "uuid": "082e2f7c-e65d-4dc3-b3e1-e01a1733e2f1", "comment": "Malware payload (AgentTesla)", "value": "8d0c4c3d84c4af6ed459235e98158b298066a0124289765cce561d3b2be0ae837bedbfdd1415dd312b413ee8c1d2c50a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912551, "uuid": "4020af4e-8b73-4505-96d5-91ce4e455861", "value": "T198D40E12ED31A02BE4D789F42A78954B7C192D320690AD0FBB602B5634765AFF1F4B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912551, "uuid": "333f3e92-9826-4cc9-92a5-aa706e0502be", "value": "86dc77a40f56cdd481e5c8ac7080171f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912551, "uuid": "5cc3621d-ee73-4b9f-88d1-80d6a0b30ae0", "value": "12288:vO9Rmu41yro1PwUlJEDh33ciHfHj0t+U7E0bvn5:Wjzrol7lJEdrQwGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912551, "uuid": "62c784a4-8a98-4254-b7a2-bad9bd891f65", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912551, "uuid": "f267df68-c54f-43f3-b6f6-bd613ed02b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912551, "uuid": "955efd3d-a3c0-4ca1-b91b-9c01550c147c", "value": "3031302885e4b193166ff7bc9cb50429be8bb8e62d99f655dcdba1cdd41ac17e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082368fb-6317-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908599, "uuid": "c00bb855-ff02-4b42-b6b2-a422f743b5ae", "comment": "Malware payload", "value": "b9600eae927334425e7dd909d437970a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908599, "uuid": "89258fab-cc09-44d9-b826-1a020738b441", "comment": "Malware payload", "value": "306bb09345b70f70d51e4665c48c64fd00f9eab9523613f8e9a3dd30147211f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908599, "uuid": "134e0df7-3b64-4fc5-b04c-52fff30b1e4e", "comment": "Malware payload", "value": "a1cbaacafeb06b92fe0cbe1a3c46b887c64b5950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908599, "uuid": "64a2291b-de0a-41a3-9250-59e357fe8612", "comment": "Malware payload", "value": "30ccab256a8e8a83ee4aaacb8f2db0a8ff6c11bfe429d9abfc47aa26caa1e18eb7c39bafe94f38215e135590ec9334c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908599, "uuid": "7de06f5a-8fad-4fbb-9caf-7d3cbca95b91", "value": "T1E9551245330ECD0AD4B74BB44960F2B057785ED8B921D2439FE9BEEFB8BB3519509282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908599, "uuid": "4c899917-00af-4d5c-a33d-c9e16005dffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908599, "uuid": "c7e62387-2a86-427d-b987-36c8fa66fcbe", "value": "24576:GZL1dYAEFT0DYUGaQ8mfgaG/g5PlevviOSi41nBlppcCMDm2F+jWWcmBH0o/WxF2:GZLw3FQ8Ffq/g5PC6OE1DpSJmBjWWB0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908599, "uuid": "5d5f191b-5f17-43e1-8bb8-d4782abc5727", "value": 1408000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908599, "uuid": "63614940-93e7-4532-b2df-977046d0f9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908599, "uuid": "be10af1a-30e1-409b-b22f-f438f854a598", "value": "306bb09345b70f70d51e4665c48c64fd00f9eab9523613f8e9a3dd30147211f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100611ad-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780908612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908612, "uuid": "b68babcf-9dd1-49a3-8b77-e7ef2b585d64", "comment": "Malware payload (Expiro)", "value": "894478f9b4edd7f512a78833e3e18355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908612, "uuid": "968a0f9a-98e0-403c-8338-e9498479db68", "comment": "Malware payload (Expiro)", "value": "30aac6903b2a6617544e123af032109ef8a690186556066e72779cdb9f17489f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908612, "uuid": "28a00c38-78b8-4559-a0f4-ffae2e3a6dbd", "comment": "Malware payload (Expiro)", "value": "c150c3dfa1285e4377d7a01fd72f2f4c81eed7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908612, "uuid": "038a11e3-97e7-4ad1-a0fa-84c8d2705acf", "comment": "Malware payload (Expiro)", "value": "0dbf69bc17adb42cbb76ff5c51515b6532bb7a2577f35af0d63c5620693490489d44388b640a611d048d66fd22d0ff0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908612, "uuid": "48eb8470-f337-41b0-b0e6-2b115e9fa44d", "value": "T1BAF523943226DD02C6FA4EB41E70D2F56BB49E88F521E107AFE66CEF783E7645D01281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908612, "uuid": "da25e3cc-8391-4e19-a9df-f96af275b608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908612, "uuid": "63912523-88b8-4687-bde5-d7f626aa4ba0", "value": "98304:rFQStp7qg50nUTbm9zdSjylwG33JLis8IU:RQSXeg686JWyh33NiGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908612, "uuid": "fd1a49c7-dd4e-430d-897a-469b147674a4", "value": 3482112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908612, "uuid": "d7de0677-94b2-4d81-aea3-f757acdcb9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908612, "uuid": "b4f4e4cb-e59c-4a43-81f1-0fdf7e3e47c9", "value": "30aac6903b2a6617544e123af032109ef8a690186556066e72779cdb9f17489f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b460214-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780907799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907799, "uuid": "3552f34e-f946-46f4-bb82-13f4e8a30b67", "comment": "Malware payload (SnakeKeylogger)", "value": "e9d63220067d98044ae92db4b49dbfcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907799, "uuid": "3e4a1bee-bf28-47d2-900a-a01c4b7532d1", "comment": "Malware payload (SnakeKeylogger)", "value": "30c1d4924b55decb7c1ce0edc7c4914293de3abe215a9e0e85d5ef767702a28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907799, "uuid": "c502943e-d8ab-42c1-bd9e-3e62636cae94", "comment": "Malware payload (SnakeKeylogger)", "value": "fc4aa8a713cdaaa7908ff4fedf30e62e6a81d3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907799, "uuid": "77e33ae7-ae5c-4239-9fbe-c43179be1fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "355443df36e4181100b3c93466bbc4bf4b4fe3b71ccd0002968991a7f1b78760fec86c3ad734ccc95e66fcd1887ad61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907799, "uuid": "db506e30-c1a5-4212-b2cb-3b6d25436ef4", "value": "T114150165631ADE06C8D10BF01970E7F857B48E589915E313CFEABDEBB97A74138042E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907799, "uuid": "a5b45f08-d429-4a34-a97d-731e165aa596", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907799, "uuid": "c53782a4-a17f-4e7f-918d-6ecdd3e34017", "value": "24576:21w4TS1OLBdv2gqlN//cKJTq3giJsP8Fq1geJH:/44MN2gqrJJWQgc+eJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907799, "uuid": "304d5369-e6f8-407d-82a3-f61044935cc4", "value": 921088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907799, "uuid": "c867f5e9-2d0b-4430-bb40-01cb54b46603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907799, "uuid": "8ba1d1f3-f3bf-4c38-9853-bf8f966056e9", "value": "30c1d4924b55decb7c1ce0edc7c4914293de3abe215a9e0e85d5ef767702a28d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628f24a3-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910898, "uuid": "343add91-725f-4137-91f9-bc64653d5cf7", "comment": "Malware payload (a310Logger)", "value": "5d9edc54cdc69e7d0c7d7495492f30da", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910898, "uuid": "54521d43-c92a-4bff-a30d-515120f3be3f", "comment": "Malware payload (a310Logger)", "value": "31a63b0c113cb3bcb232742214df92e7d3f77edb7862375c84daf67c7350a5cd", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910898, "uuid": "90937232-287b-4744-be50-000956e281e5", "comment": "Malware payload (a310Logger)", "value": "c273e1faa5d98410e7018b95cd3b2ee2bba71a2e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910898, "uuid": "bce58085-b1de-4ab3-93a5-f8ef89bc62b3", "comment": "Malware payload (a310Logger)", "value": "30edc1783afe12b2e188345fe1bb2281165daab37eba40c4fd4072f7ce1b17db6ef7f6d88b458fbfa23ec9563047783e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910898, "uuid": "5a961a55-a391-414e-a4ea-7ad75f6f159f", "value": "T1FA45126C1B06E416C8680BB51DB3F3F4106D5E9EF511E502AFECAFEFB667E912818142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910898, "uuid": "756c5cd7-8a47-4013-b3b5-917e44bd23d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910898, "uuid": "a1c7f654-e7ed-4166-8018-9aaa0da497cf", "value": "24576:idtyb8pEf+E3mAQW8DGhc5OhMqbrI5SQV/x8mK1t5Hgeki:idrwvQW3hMi0H8ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910898, "uuid": "f8f0bed8-a5ea-401c-96b0-9b77d468bfba", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910898, "uuid": "11894650-6ed0-4b7f-ab06-4b96f3ce5cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910898, "uuid": "2e17b536-f747-4088-8518-bdfdeb043cb7", "value": "31a63b0c113cb3bcb232742214df92e7d3f77edb7862375c84daf67c7350a5cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06db0149-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912463, "uuid": "4fb18f1d-192f-4f6f-92b0-504e6603e533", "comment": "Malware payload (AgentTesla)", "value": "3920bc55b0eae8aa8dbe30ab79f020e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912463, "uuid": "ea585998-556f-4a78-ad11-976fb8214d0e", "comment": "Malware payload (AgentTesla)", "value": "31b62db93d6167effa816246e7e8c6d8ee86b865e529e846a628feac6dc1589e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912463, "uuid": "522c77d5-344b-46e3-93e5-41535d4d1d36", "comment": "Malware payload (AgentTesla)", "value": "e7cc420f444105b52121c467cc869053055a83f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912463, "uuid": "f3ba9835-4909-41e1-be45-4f738b260a3b", "comment": "Malware payload (AgentTesla)", "value": "a8a8c15cc6d3de585abce83d9db05cda22cc944a51fbd3d294c7209762d74b09e363312ae8ade99608a4480b3f4d6511", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912463, "uuid": "6cea8ba8-b2c7-44b3-81b7-82921fd4387c", "value": "T17ED46816ED20AC3BE59389B0293885567C1D2E7217E0AC4BB7805BE930745ABF5F4B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912463, "uuid": "985d6272-06b3-4647-a6d7-5853ff5c77fb", "value": "f2e342821fa4475bb79f956f936ce7ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912463, "uuid": "3927c10b-ebd8-49e5-883e-9a251f3be730", "value": "12288:fQqWmmT71s2qkcEuLtZgCIOJGhpC1IeWVz2jblzWyI8LP:fM1s2fOJYcpzWB8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912463, "uuid": "65afd827-fb2b-4d95-a79b-459ac376f435", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912463, "uuid": "5725a1d3-7b02-44dc-8d8e-f788839f55e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912463, "uuid": "f55373e1-5529-423c-97cb-b2660b0851c3", "value": "31b62db93d6167effa816246e7e8c6d8ee86b865e529e846a628feac6dc1589e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce081834-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912797, "uuid": "d02bb24e-6c81-4806-b2b9-734bb132da63", "comment": "Malware payload (AgentTesla)", "value": "bccfd1ccc670878cf847fefe920662c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912797, "uuid": "29676ccb-949c-435f-b94d-e135e959097a", "comment": "Malware payload (AgentTesla)", "value": "31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912797, "uuid": "31e76f43-34eb-4c48-9d4b-2750c94dfc14", "comment": "Malware payload (AgentTesla)", "value": "82eedb0c2e6c3007494a98a1c762de0c6ea3d562", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912797, "uuid": "35a5fc29-2d58-446f-9a3b-a7bbaedc4c26", "comment": "Malware payload (AgentTesla)", "value": "e9105913cb5200d75d9fc664b3ff88f751ff0233cea411f955d75867aa40aa5a8f50c447f29094cd5a29f97c018802a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912797, "uuid": "b36af861-18fe-4453-be73-d23269f7477b", "value": "T184252268AF08C847D9C627384A60F13537769ECDE610D2238BFCBDE7783A711655A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912797, "uuid": "03d986bb-02b0-49e3-888b-41a6ce625e0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912797, "uuid": "2b24b729-9feb-4325-af18-f2eb67845e20", "value": "24576:cgNqMj/eiYKCmvOE3uwEySd+ZJ96ZWmybE2mwkY6VRQPAir:gMjjPCmmE6Zy90WmkkYuRQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912797, "uuid": "5d81a172-8945-460d-a0e7-3e1a617124c8", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912797, "uuid": "d37f809a-5def-4dcb-aa5b-37677c51aada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912797, "uuid": "e706d684-b49b-4bbf-a774-86848b926371", "value": "31e865593612d7aaaf78295fbcac8bbb765349eafa691fdf4fd624e0d2880a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94b4ff4-631c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911044, "uuid": "7a456661-f45e-4375-8c76-c6bb8b792fcf", "comment": "Malware payload", "value": "4cf18d9051f8da432b1c60d968760b8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911044, "uuid": "875cfbdd-6583-46ed-9916-0744c1b54eb7", "comment": "Malware payload", "value": "31eb872b184de4ce99fcd8408abb3be01d8cd98c3a94d2e1968ccc33b5f06984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911044, "uuid": "9d02bfb7-f7bf-4665-b678-ac18f9c4daf4", "comment": "Malware payload", "value": "218361d04c1807c6295b322312988024e0437fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911044, "uuid": "08372715-c825-452c-8783-13c8b9d1f88e", "comment": "Malware payload", "value": "77a1eda2ff08da0681284c6fd4c78d906d25b0b6a488a9278e5532a5dbbb729b62c059bd012b741061d58135c0cf1055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911044, "uuid": "104e06bc-8c00-41c0-a66c-a8f8ce19ddea", "value": "T1E345CF396B83469DD525A778C9333BD20B70D52AD96EC306BFF84274993B7A19C30B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911044, "uuid": "5312d5fb-484c-495c-aa57-c1ef643c6859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911044, "uuid": "fb893e4d-e509-41d8-a3e5-cc7dd7594895", "value": "24576:JPYL/9GUN5AidLVkzQU/Q3RvIvWMEk8IAoG6IOPuaj:JP61G0bhmzI3R4EMAvUua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911044, "uuid": "7f2a1480-48f7-4ab7-9487-9283c39b2810", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911044, "uuid": "e5caa910-5891-44ba-a904-7d59f9eb4710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911044, "uuid": "ffaf0b3f-6241-4765-bfbd-77cd23322e5b", "value": "31eb872b184de4ce99fcd8408abb3be01d8cd98c3a94d2e1968ccc33b5f06984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c7652d-6378-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780950557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950557, "uuid": "33b40dc4-08bd-41e4-8df6-bf7d016e8ad6", "comment": "Malware payload (PureHVNC)", "value": "e6b7956c2cac3d7aca7c53105b392ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950557, "uuid": "0778ee1a-7903-4bf7-8b8d-8be843e848b0", "comment": "Malware payload (PureHVNC)", "value": "3235b753c204a9f7164c5f287463b2a28a8aaae8b9ad869fec7c0bf543bebeaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950557, "uuid": "b35afb8a-728a-4696-97c2-d43ef47265a5", "comment": "Malware payload (PureHVNC)", "value": "384b58eb1a39cf53e6ac5f8150cc8174446f87df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950557, "uuid": "2d971c51-85a2-4548-bb5a-02d1b67367fb", "comment": "Malware payload (PureHVNC)", "value": "bf0a66f06be3072d4268ffe64be6970abfd00273d985896bdfdc536657af2a8c51447712b50559ac9baa2dc27fc1c32b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950557, "uuid": "4c8895ed-09d3-48da-8d3b-a99f72950dc4", "value": "T104C412063E946701D3D41A79C4E34A7843FAB8CB3AB3D34A3A0A079B9D517D4DD0ABD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950557, "uuid": "1293f228-3376-4002-9abf-82404021fa6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950557, "uuid": "296051a4-cb13-4ac8-9995-698a4227341e", "value": "12288:nBr5MEQr9nqABZCbUqlKIq6/FYhEwG1wUSxCnAML:nFhQxpBZCb7KdhEwzUSUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780950557, "uuid": "ad21910a-f6b2-4da2-a88a-eec0d90f63e9", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780950557, "uuid": "7f7f9767-8013-4757-a039-7972d350d31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950557, "uuid": "cb3aca53-6595-4580-b433-a7bf2cd22049", "value": "SecuriteInfo.com.Trojan.Siggen32.41680.18698.26174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea457a0-631a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910221, "uuid": "f2225a78-5c73-4ab9-a9a9-7a6197ed43cd", "comment": "Malware payload", "value": "8b8822a2edcab012f2f7dd5ea9b4490c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910221, "uuid": "d803ba9d-6666-4070-9ff1-33f401711f9e", "comment": "Malware payload", "value": "32475a2dfaf4b47771da2f739557154464bc0ae2ffb13d9ca29edff4f6851499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910221, "uuid": "8cf8aca5-b7ef-4262-aaaf-bcc5f6bc89d9", "comment": "Malware payload", "value": "945400cdc3e0ca96f619fdf319c50f8d0b06d92f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910221, "uuid": "edafc7bd-37e9-460e-9aa4-42d853a3a4d2", "comment": "Malware payload", "value": "eb5b1caad5c1ee54a0ae8b45acaf37671caa8d53fbe49b47c5042c0d0dbd7a26826278afa073a0cce9d9ee3c20c6f351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910221, "uuid": "a75b7250-2aeb-4336-932c-b94e1d312eca", "value": "T11C55BEC62BD51F90E67FEB789674009093F6AD27EF21C3EE3C4465D86A21AD68503723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910221, "uuid": "41189ea7-6392-4158-bb7c-7a1a53a5960a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910221, "uuid": "fd8cc33e-2b95-4a67-bd0e-97cb2556571b", "value": "24576:rRsOqROw5yU74dtlhDSsZdLl1t8LnTyN2xNDvu1fUqekk7n:rRz6OwYqK/DxjyNDDqek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910221, "uuid": "94e43390-3165-4144-8b9f-327fa4c4371c", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910221, "uuid": "147762b5-a631-4c33-b2a1-5fbafe2dc921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910221, "uuid": "49aa79ec-8dda-4ade-9d53-0db7a4066ab9", "value": "32475a2dfaf4b47771da2f739557154464bc0ae2ffb13d9ca29edff4f6851499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc53974-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910271, "uuid": "631fb789-ea3a-42bd-8f00-593a2a98a802", "comment": "Malware payload (a310Logger)", "value": "cdd015274cc3dfa56bdda0bf9e8bfbc7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910271, "uuid": "55928ec6-eb2e-4383-a634-3f9f566d6a5c", "comment": "Malware payload (a310Logger)", "value": "32560e0f4530a5008856533eb40fe82345190ac3584616d12821522052aca1b1", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910271, "uuid": "4fb4591d-9fe6-4af7-a6d4-bdefc5c9398a", "comment": "Malware payload (a310Logger)", "value": "548ead61ea1a81923a7c8bedb76fa2c5e26433ab", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910271, "uuid": "855a5823-c3bb-41d8-9513-e384d5078db9", "comment": "Malware payload (a310Logger)", "value": "d1c32f6069e26bdda7841bdef8d1ca137a8fe4dbe8bd886131e138698bec26599d3a9595907fa5a50c9ef28d3d95bf19", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910271, "uuid": "716e7c3d-8476-4b28-883c-4bf1fb3d6f95", "value": "T1CD55F1E43A2AE70ACD920E709A35DEF146A40D9CF511BAE39EDD3F9B74AD0506D0CB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910271, "uuid": "2226a07e-82e5-42fb-92a8-165b0a6bcb59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910271, "uuid": "566353eb-06ac-4787-a34b-30eaf7fe713c", "value": "24576:IaCzZ5tkycy5koGa6wYc0QHGK4Ltxb/a0qWu5Nll0pB3k:IaCV5tjcy5kFrwYcQKEb/a3NeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910271, "uuid": "511414dc-f76c-48f4-8ba4-2e29f03bd0cc", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910271, "uuid": "d65e0668-246c-4af6-b63b-4e2bd1d2c2a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910271, "uuid": "028eeb11-8fcc-405f-85d6-0fd7031e5717", "value": "32560e0f4530a5008856533eb40fe82345190ac3584616d12821522052aca1b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a647ee-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911221, "uuid": "94a49c44-f3b5-47e3-8708-093df07f4195", "comment": "Malware payload (Formbook)", "value": "1cf5289a69d350c855f33143b30f8958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911221, "uuid": "63922ad4-f852-415c-b801-5d676eb25161", "comment": "Malware payload (Formbook)", "value": "3258281b08c02612df22e87f5616c82a3681838c4c10e63d0de0e2740af1c4bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911221, "uuid": "f0ef1997-afd4-4bae-9f98-ccde6f2eb78b", "comment": "Malware payload (Formbook)", "value": "cdaca92b4e434a203b23fc5e1a4c0d425a5eae3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911221, "uuid": "697c0ff2-e48d-410e-b784-bacf67843c81", "comment": "Malware payload (Formbook)", "value": "f1541cf09501c3533236d0c550e5dfea228b4a2974ab97582dc9addc3188e984b20086067daa93da2c55e38f05b7dd1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911221, "uuid": "6e882a99-2c04-42d7-af60-1dafa35b8acd", "value": "T15D351218B379D90BC65586F409A0F1B443B96EDFA810D28B5FC9ADDFB9B6F054A04383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911221, "uuid": "43518b20-e219-4435-aa9b-2a9a24da09c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911221, "uuid": "86236330-84bc-4810-9d83-ccb981df976e", "value": "24576:QtIsQnYCl6uU2ywHzs11qdUeqmdAOMdHbVnvw0FgF6JrrNeKkE:MIsQ/Ntg1QdUeqmwJVnYX6trAKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911221, "uuid": "d3b3fffe-a08b-4f76-9da7-10e28ee6bb47", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911221, "uuid": "92fa7a26-04ae-4fcd-a10a-16caf974b4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911221, "uuid": "011d2fe8-e3fb-4a21-b448-65c90aebd61f", "value": "3258281b08c02612df22e87f5616c82a3681838c4c10e63d0de0e2740af1c4bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf2e210-6339-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780923609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923609, "uuid": "48d1d66c-822a-427e-bb00-c2b341eb116a", "comment": "Malware payload (njrat)", "value": "6e7e0f6d2841ca43b4bff6838a472462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923609, "uuid": "78d678fc-f7ff-4d84-b172-07c67ee62e4d", "comment": "Malware payload (njrat)", "value": "33657bbc3062e52c00430069482bd6075b8d5c3b1f70affb8755b4d7a3d082cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923609, "uuid": "6798263f-343b-4823-a8e2-f85ba3689b48", "comment": "Malware payload (njrat)", "value": "eb32a578eca5e3c0dea3c78fa7a5b9084f7e8c41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923609, "uuid": "199ce860-9ba1-4743-990c-3528203d1f4b", "comment": "Malware payload (njrat)", "value": "cb18f5c4fd1fe5fe1f6e0fe86eddf49e0a0c6608fae1087b58ad95f2959d383d34aa923d9955e9949617a6799e058e28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923609, "uuid": "9914bd46-7250-420d-a4a5-27ed0db64416", "value": "T16715F058171ACA07C96567785E70F17A07BDAEEEB510E2169FD8BDEBB932F000C50293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923609, "uuid": "fd1c1860-1e7f-4ecf-b2f5-8daf377395a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923609, "uuid": "2b3b614b-f431-439d-9a34-58a3fa2eeb63", "value": "24576:2IzYN/jZEFGtSMW1Q8TwVqLKdSLqNGCH7e:2OYN/jaFGt2aDVqLYoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923609, "uuid": "c753c0ba-7342-4cdd-bdd8-8163043d3cf4", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923609, "uuid": "ca1ba2a6-c990-496d-8e47-660bdc38791d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923609, "uuid": "ddfd3ac0-33c1-40f6-a93b-4717f618bb76", "value": "docPO-Q-260603-ASN _ ZBSPR26-007.PDF(849KB.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bff252-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907308, "uuid": "3f976f0b-50d6-4a14-aef4-36ecebab47bb", "comment": "Malware payload", "value": "755c125fe2c8e61a4e515a35f30a8a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907308, "uuid": "e8a39585-5cd8-49e9-b90b-f399caba4a63", "comment": "Malware payload", "value": "337c2b95c3dcfaed752c007a342b4b175b43f9374ea22fcb5294726ebf3d6dfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907308, "uuid": "173cf940-4db0-4876-b56c-0c65c0725b72", "comment": "Malware payload", "value": "28036f2afd1e3d45b0dccbb283fc9a4cc2ffcb49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907308, "uuid": "80e21d40-6914-471c-8354-f07ddbf976da", "comment": "Malware payload", "value": "037329eca71f716182a07a0f35721df3a5a19317be4646bf8d124af3638d216802a69e42d4fb138413837eed2a1d7f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907308, "uuid": "60b763cd-f2ac-450b-8fb5-b9720bb8aef5", "value": "T1F055E01A0EC71AF4C1EE4F78C2A604AC63F4855B5291E7AB6EDC02F4DF57B46D9060E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907308, "uuid": "b57fffcd-ab51-47d9-8e0b-de5e9ddab1d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907308, "uuid": "f9590b9c-b158-48c6-926e-5bcb6e3d9807", "value": "24576:t6tEhFMxO+Nm5olKEKUfqQI58i9x3NUYQNotS:7hFMXNSooTZmQ3mBSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907308, "uuid": "e82591c1-c588-41f7-9d50-df45164f72d8", "value": 1387008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907308, "uuid": "41c286fc-da2f-4b9d-975d-b965c3087965", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907308, "uuid": "b076125b-fa1e-4ce1-96ce-a8848a17cc85", "value": "337c2b95c3dcfaed752c007a342b4b175b43f9374ea22fcb5294726ebf3d6dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b7d591-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911437, "uuid": "d57b3073-c6b8-4a36-adad-a862525f3c4b", "comment": "Malware payload (Formbook)", "value": "c334aff06310f7e8d87d28d77a3a0d8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911437, "uuid": "21e361d7-7e8a-4996-96da-756737e7eb5a", "comment": "Malware payload (Formbook)", "value": "33c35a6c061c0e7db64a16f71b4d765588728dc2c8cf8efbb0763fa1d836a17f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911437, "uuid": "ecd49f4c-fabf-4911-a5b0-e3645304f2fa", "comment": "Malware payload (Formbook)", "value": "23bc2a58357c44971c76c80ff82b56cc8c3bedad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911437, "uuid": "ac580782-35aa-468f-ab52-e0d1756b4d39", "comment": "Malware payload (Formbook)", "value": "5a4a2040a30423704d1cac2e2f32a9c40411a906a440726698ad1fe666320d9e08067e919810fdbba4e3c56b57b6bf7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911437, "uuid": "6a9bcd5e-7bb3-4a30-b730-502d7f04da91", "value": "T12F3512282662E603CA6057F84A71F2B5137D6EEEB810D31A5FC97DDF78A6F054D08293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911437, "uuid": "f4060e2d-5c6d-4e19-a63a-70cb253e2124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911437, "uuid": "3ef8e90c-97a8-45b1-8c94-fecdc0381572", "value": "24576:sdQv4MFBoyIZkdao1xYz/IEUL06fcyZHtJ:jv4MnoNZeaocwT1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911437, "uuid": "ee197f1a-d8e5-455d-bff1-3e7ef4809994", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911437, "uuid": "5c7ba1f3-8d8d-4853-b0c8-c84b2a750072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911437, "uuid": "ba23a186-0d9f-4f64-bf9c-298c00bd28b8", "value": "33c35a6c061c0e7db64a16f71b4d765588728dc2c8cf8efbb0763fa1d836a17f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f52068-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877194, "uuid": "36d894fa-35d5-47ec-a74b-9e46bf74f913", "comment": "Malware payload (Mirai)", "value": "c9ddf362a3d9fd837be1ec9fee142290", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877194, "uuid": "0653f800-0933-4106-ae29-cf181439eced", "comment": "Malware payload (Mirai)", "value": "33f5ae4b9e98dee037b9b54bfe1bde27dc8501ac33d0240952aa5121d9decd3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877194, "uuid": "96c1d76c-6caa-43de-a801-2230747b7684", "comment": "Malware payload (Mirai)", "value": "ebf8e4e95a107baf27cfba99304af2b07cb31deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877194, "uuid": "987b1d12-bd76-46fd-9470-9bf83d18d0d1", "comment": "Malware payload (Mirai)", "value": "6f40c5426065aa3d9fc0e1bcc9ec7f49949d0e094d93eb45f8ccc2e08a2dc0fd07af43880b3c9c92ee8b3cec11f2d388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877194, "uuid": "9d96b735-40d0-406d-abc0-1a5057b3fc01", "value": "T17294A813D9114992D0A44CF222773245B94797BB8AE732D3ED2A4EB0BF2151F46BBEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877194, "uuid": "b9d4b52b-b165-4c1a-b06e-e31bf30df172", "value": "6144:kZNO0H9wUBoP0vrHamfZ6T6F3+SY4joHGB2w8M/9LwyS:ky0HOsrHamfZ6TSDNjgGbd/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877194, "uuid": "221b758f-5334-4b76-add2-6623eb35ea20", "value": 423257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877194, "uuid": "a0311705-14a6-4560-b23f-d862abc51401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877194, "uuid": "e51372cc-36d1-4f36-9459-4ee6fd069028", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd93fff-6318-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780909063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909063, "uuid": "f0a57ef0-c082-4cef-9884-7f0b8f6e570a", "comment": "Malware payload (MassLogger)", "value": "646527a8c028b53c184c86a1ca2cfd12", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MassLoggerRAT", "colour": "#8187BE", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909063, "uuid": "41795bf0-4bb5-4732-bbe3-28b9e56fc695", "comment": "Malware payload (MassLogger)", "value": "34aafa6b2eaad03352ce67a2a1520bdc217e1a1ec8c35aad16c09577cb6d7204", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MassLoggerRAT", "colour": "#8187BE", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909063, "uuid": "dc65b78d-e696-49a6-83fe-e4d7b001dc77", "comment": "Malware payload (MassLogger)", "value": "a03998c4b16202155689ad77379e943442de042e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MassLoggerRAT", "colour": "#8187BE", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909063, "uuid": "4faab8fc-bf07-434e-bd99-15fb7ac36c1b", "comment": "Malware payload (MassLogger)", "value": "05300f2ab346a444f858bc7738e6556e0ab3e8b37d1f6063091185cce1dc8353ccca6ac55ab53db67eacc8cb3911608b", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "MassLoggerRAT", "colour": "#8187BE", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909063, "uuid": "4369d5c0-dcf4-4c3b-bf35-e79ac97fe85a", "value": "T19C94CB3CEDEA402EB173EE598AD47597E95FB663371E980910D203864723942FDD223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909063, "uuid": "de7bc3b2-bdb7-4000-9916-7dc3a36d42af", "value": "6144:dKla7UhmeuC7QsHh/xilQBAWAxdbkpR3ZRs:dKla7Imn8QI/QlQBfsdbkP3Z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780909063, "uuid": "0d08f694-274f-4180-84e9-e8c570f7e557", "value": 424024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780909063, "uuid": "f1ab18fa-3b63-4823-afe4-e3986e05e5a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909063, "uuid": "ce73c061-146e-49c5-8485-d32c54c9de52", "value": "RFQ 6200839416.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b102d0-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1780907818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907818, "uuid": "b894e050-590e-4299-bfe8-7e174f424e38", "comment": "Malware payload (PureCrypter)", "value": "db6e463e0be490147ae69043ca60339c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907818, "uuid": "8b9d3e4a-d310-4fa8-8e63-5447ca530dee", "comment": "Malware payload (PureCrypter)", "value": "34f080ee32ffd713c88770c53bf4a3436c120c36317d7f09ff6bca1c3e223a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907818, "uuid": "350d34a9-6756-4d59-9abf-7d8ebd59bebc", "comment": "Malware payload (PureCrypter)", "value": "8dc9b8d02a19f1bcb30af70ef81de24f4caa286f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907818, "uuid": "6b1b548b-2a74-426b-8de8-58807bdc7bcc", "comment": "Malware payload (PureCrypter)", "value": "86f9f7a24a5545106209202ec22ccdb212c4b2a03a16f9982d0a60a9a0be99a4f8486eba215e088d4458f7ef65c95aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907818, "uuid": "9e086cf1-a72c-4607-8e2a-3635cbf714bf", "value": "T14215D0283B0E9104DA75CB7DD9275B9123F4C0135EE7C72BEFED11A88A5BBF29812251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907818, "uuid": "9ee51a41-4a03-448f-abde-f946b0a28f0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907818, "uuid": "b2a05066-db46-420d-8754-8e97890cb7fa", "value": "12288:mp7NLA7dBUqtAxFNvJoUqTrXoqFrU5ZNR3O/WoGYdyQANh:mp7NaUttJoprYn73O/WoGYdT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907818, "uuid": "7d4808b1-37c7-4b8b-a82d-fe44233a6931", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907818, "uuid": "0f7d67f1-bea3-4631-aff4-f85836793fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907818, "uuid": "854c3f8e-93bd-4169-b914-53e610bace6e", "value": "34f080ee32ffd713c88770c53bf4a3436c120c36317d7f09ff6bca1c3e223a87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f971097-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912075, "uuid": "e6092310-fac8-415c-98b4-cc42d5353a9e", "comment": "Malware payload (Formbook)", "value": "d5198b6de7d0e9cf41406c470357ccff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912075, "uuid": "0885a0d9-6941-47cf-ab3d-1f60b5e40b37", "comment": "Malware payload (Formbook)", "value": "35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912075, "uuid": "a5e88316-6f73-4201-a520-b53b8be38597", "comment": "Malware payload (Formbook)", "value": "d84be06391ac8934aa8c13663a20932056517595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912075, "uuid": "0d3289e7-9281-4215-a8ad-1beccfb29701", "comment": "Malware payload (Formbook)", "value": "0e0f928499ecc4075932f01737a838b407368b671d1b1ed9bd569e4f4c5254c55ded50f89887ad8bfe1090daf6b39696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912075, "uuid": "52c3fee1-33d2-4179-8138-049fb4a937e1", "value": "T18C1512F026DDE546CC6643F50DA0E33213BA1F6AF521D35B8EEA6CDB791A3750918283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912075, "uuid": "1dff6a00-ec8c-47e6-a2f5-d06d124696f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912075, "uuid": "7948da48-004f-4b6c-afa3-3511b998ed36", "value": "12288:O9EC7A2mVfXgyZ6abe3R609gTjQ27Cw2i50NS89+zfbBr+JPga7V/rJzLBjpWeI2:aABmyJq6qsj7Cw2i5qlE/CLtp4F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912075, "uuid": "4c1f78d7-c4df-4b00-b76d-f39b6fd1daec", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912075, "uuid": "7f32b3d6-5687-4d6d-ba78-dc03c5743fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912075, "uuid": "564cc6da-055d-46e6-a7fe-9f85d142cce0", "value": "35460d0ed6ddee3f707f73eaacf6e49f09f789bdbf460c21f491ba2ff2bb78ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930a104c-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941474, "uuid": "678a8504-16fd-45b7-9cad-0bf1cbad7848", "comment": "Malware payload (Snojan)", "value": "1ec6c0f0b8417c7769ef7ec71547e506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941474, "uuid": "6cdbdd5b-0146-4c90-9c68-508c7898488a", "comment": "Malware payload (Snojan)", "value": "3547e69fdc79cd1df61bd7660d579a241a08ca6b7aee6576c61d9deeaa3d2552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941474, "uuid": "6de20d31-f6b6-4d5e-9f65-64209aed9c15", "comment": "Malware payload (Snojan)", "value": "84f2fd97efe2c029161f9a9ca3ed3685fea66184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941474, "uuid": "2c73a58a-ee8e-4665-92ef-c31d424353c3", "comment": "Malware payload (Snojan)", "value": "ce1eba4651e54b5cf71222684b94353d34424ba748a4c25d6fe839130d43572cc6214603cb9d463a48f1ac536a37b69f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941474, "uuid": "720b00a0-f421-44b0-8496-e4169e3b8013", "value": "T1C7D5DF342DEA502AF177AF3D8AD07596DA6EB6A33707994E10B103C60B23B42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941474, "uuid": "48d2e0e7-c753-4bdd-a915-6cc9236882b8", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941474, "uuid": "aaae7bb5-6455-4b02-aacd-6d297e22a362", "value": "49152:7kQTAKYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpoa1ZFC/k:7aK5CbhZcT2lvnDFpFW/twU7+oU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941474, "uuid": "7efdbe52-e14a-46da-a6c1-b9f8bfecbea9", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941474, "uuid": "3a0ba1af-bef2-4800-bfcf-71fe94c4ea0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941474, "uuid": "a45effab-3088-47b1-b7aa-de0eadcd398f", "value": "PyLtoqB3QwqNkLHZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42dc3ec-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1780912753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912753, "uuid": "7ad115cb-25cc-4b13-972f-0aee9cebcda6", "comment": "Malware payload (PureCrypter)", "value": "79c0dd8d9175224a0c2dd743d90f7df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912753, "uuid": "fc6a175f-9be8-445d-b87f-7dc91ad6595a", "comment": "Malware payload (PureCrypter)", "value": "354a9acbe773149ea4c7e49d900836ba49aabce27d799ac1c6d5fc2a3664043e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912753, "uuid": "8a8e8fee-93b2-425e-a058-3e1a00f6300d", "comment": "Malware payload (PureCrypter)", "value": "d899a6b7a5a8ebc1e507396b8277dc2ce19cdfa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912753, "uuid": "5e9d92e1-a4d9-4c29-85b7-7555807fbf0d", "comment": "Malware payload (PureCrypter)", "value": "f633357c8e155aca244eb75e76e4128ba2d33cfcb148a9056c4518cb7c35478fec5916d50e7b4a950f660c5628af8b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912753, "uuid": "ca47090f-93e0-4707-9b34-5bb46cb1362e", "value": "T18975E0154C835BE4C1E60F78C16504A8A7F08E9B5391EFAB1EDCF1F09E73BCAA906552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912753, "uuid": "0bf6bb36-1066-4eab-b3b9-2eae3d958065", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912753, "uuid": "b03bde92-6080-4090-8fcf-dedab19486c7", "value": "24576:kT9cl6LEhFMxO+Nm5olKEKUrhb+zY8GqzFPBgZs9yImSEc:khcphFMXNSooTIhShEsFEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912753, "uuid": "6d0d3736-c216-4a9f-a369-4ae54c744649", "value": 1599488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912753, "uuid": "4bafe518-b64e-4426-af56-f41cb0d57765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912753, "uuid": "39117696-71f4-4bd8-b2e6-0f3383237236", "value": "354a9acbe773149ea4c7e49d900836ba49aabce27d799ac1c6d5fc2a3664043e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b833aa4c-62e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780886131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886131, "uuid": "37425b19-7855-4652-ad94-32e0001e63e6", "comment": "Malware payload (Mirai)", "value": "3c87c37efacadd41d2c35ca70adb2094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886131, "uuid": "f0b9c052-ed7a-4506-a209-89a56c5e6739", "comment": "Malware payload (Mirai)", "value": "3593f42cb9f63aa7a8bf1ffa54cfcc3fc9f5bc12d6e0a510b5c46ff14ca5b7c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886131, "uuid": "bd9f2edd-27db-475c-ad1f-1d30c7f69234", "comment": "Malware payload (Mirai)", "value": "b0c1b9e90a50fda8d5ae5c865095e3abc8e338eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886131, "uuid": "a587b655-bfd4-4738-9add-b2da854a9718", "comment": "Malware payload (Mirai)", "value": "5152a9ca0f82c82c8f30bfe40f50143d46530923b6bcf0466c905dcb64ab7dfcc7e19ad3fd768f7f3f4306005fc16d43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886131, "uuid": "fa13ffb8-1357-4990-954b-99827c84518d", "value": "T1CAC3198AFC818B11D5D525BAFE1F518D33134BB8E3FA7112CD145B2A638AC5B0E7B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886131, "uuid": "9f0d4dd9-761a-4057-bfc9-bb5e9469f8b5", "value": "3072:frgRAlPvuXDoxUE8ddPJAZQOjdjE65zang3zFkfp7Z6xeofWmz:77xMTPJBSNzang3zFkB7gecWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780886131, "uuid": "83adef25-46dd-498d-9826-8b167111a67a", "value": 128804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780886131, "uuid": "bbbde636-0e8c-449a-8a06-79547333dff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886131, "uuid": "173e2703-0a5f-4edf-b04d-623c4811fdfe", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da92f8e-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941358, "uuid": "34c5bee4-a8ad-442f-a399-ddb5f91e2b8c", "comment": "Malware payload (Snojan)", "value": "bf6603be8f51cd2dd0d4e034d1212f66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941358, "uuid": "ec5beae2-bdd0-42d9-8057-b898f750b34b", "comment": "Malware payload (Snojan)", "value": "359c5e35d59fae328844085782570e4fa424b7130b68357e10c2abec299a031d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941358, "uuid": "1bdeb6c0-3094-4dc7-8d81-2960d505eedf", "comment": "Malware payload (Snojan)", "value": "87e5c2c0c5fb59f548ca1fe978de00979cf13086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941358, "uuid": "b6840839-d3f0-40cd-a462-fcd692f2c42a", "comment": "Malware payload (Snojan)", "value": "c4d4628763c6be2ed1bf3b6e249f8de78f43e6a84c0927a17faf499bf8ee334a9e6fac55fa687e6818582ad626127857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941358, "uuid": "5017fd5b-1806-4a40-ae84-76e48f3c1d50", "value": "T10635222471C0C4B3E46A413544C9CB76AA76707247BE89DBBBE963F5AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941358, "uuid": "3603d126-1362-4b48-bae6-27f23864c1ce", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941358, "uuid": "f409e551-31dc-4f8a-b9c4-b7d3e079e0c8", "value": "24576:/Y+lk70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyN:vkQTAKYS/v6h3+1uhZcT2NnvOyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941358, "uuid": "80732452-0516-4bac-9d58-2078f6e06269", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941358, "uuid": "21dc856f-0f7c-4c3d-b86a-c3b3ac5cf9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941358, "uuid": "e6a7ff92-099b-4df5-afb3-afeaaf280f68", "value": "TB9H6nRYBkIGzGV5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0b21c0-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910886, "uuid": "b797067a-ac14-4e4b-9a62-bc2560c673ac", "comment": "Malware payload (Formbook)", "value": "b0308cef1d332be8ec1dcd3a170af38c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910886, "uuid": "1d044b2e-fb3c-4226-91e9-d9b6fba4e2da", "comment": "Malware payload (Formbook)", "value": "35eda09992c83562e1ac9c2e93bed64f888fb0ddcf46be42a26f1d56dfea1521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910886, "uuid": "a3ef62c7-c31a-42e4-93f7-78e537f4e260", "comment": "Malware payload (Formbook)", "value": "0b788a99dae27a756b9b7d0f42852ae7147585f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910886, "uuid": "4aed4d9f-3dd9-40ea-b08b-077fd5538c89", "comment": "Malware payload (Formbook)", "value": "1d701442df35334326fd7790ba710098105e5d45cd3258ee0504ab9d5782490ca5a6a53ddf83e69021d58b9c9a8057fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910886, "uuid": "8a6a1556-63a4-406c-89c6-45c49e3a51de", "value": "T1AD2512586613D906C88A9B352A71F2B8173C4EDEF902E3539FEC6DFBB6A77110D05241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910886, "uuid": "6910e2da-a2ca-4f24-bc85-1ddb68870ed1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910886, "uuid": "9f000128-cbe3-467f-887e-b6f6cf980370", "value": "24576:gd6g1Fr86G4gs5XVONYFC/1g+mpxJJzxXqFfXJ7V141:gd6g11HG4gnNj/1gbp9xmX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910886, "uuid": "dee6102f-ce5c-4e06-9dce-287b98747dd2", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910886, "uuid": "825b4eb4-1ca1-41e2-b07a-677e91a7d99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910886, "uuid": "2451bff0-e4ac-44d0-be7e-21fa3b3d7209", "value": "35eda09992c83562e1ac9c2e93bed64f888fb0ddcf46be42a26f1d56dfea1521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6ae4c2-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780908638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908638, "uuid": "89b8722e-869f-44d2-b1a3-e591ac0097fa", "comment": "Malware payload (AsyncRAT)", "value": "91fc08ed9f40f9206b717a3eb363b49a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908638, "uuid": "1bb5d91d-45ca-474c-a673-845ebaaa08f5", "comment": "Malware payload (AsyncRAT)", "value": "35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908638, "uuid": "c5a10001-834e-411f-8b34-8311771ff807", "comment": "Malware payload (AsyncRAT)", "value": "9e7dc5d33c559c1d1d12c174109ca478b22824e6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908638, "uuid": "65897b0f-5d13-49aa-8a5b-ee477efe50d8", "comment": "Malware payload (AsyncRAT)", "value": "c685cd01cff5812af6623bb66daf0455bf9b99f517903abe8dd18e34f241cc8f22c61d58feb5383d5f4c2d72f5aa7153", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908638, "uuid": "83ba5152-96a8-45b0-9d00-46e50914ce80", "value": "T16D05F1553359DD02D8A64FF05D60E2B41B745E98E822E6139FEABEEF78BB3101C05386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908638, "uuid": "8381de07-2c04-4f86-b454-697114c799af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908638, "uuid": "c61c64ad-bfae-4e15-bd8b-29ae0094696d", "value": "24576:YZLojmAEFT0DREGJXg3D12bbE8aaqQHHs6FGs+a58wDLz:YZL/3FQmGJQ3xKbHam1cfdwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908638, "uuid": "cc1c262e-ed12-4dc0-a2b9-8e84691c6577", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908638, "uuid": "23133313-c98f-4fb7-b4dc-1e32f1778350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908638, "uuid": "5d065d31-c3a5-461d-8de8-b7a17c267428", "value": "35f6b5905b4995c50de76e54a05e644e9d384ec0101e7160685d57df9e831584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c5255b-631c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910988, "uuid": "7480d0bf-a46f-4ea0-b0e1-def4b594ac9c", "comment": "Malware payload", "value": "69525b30396fe01675b724b25567b4cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910988, "uuid": "a93ea79b-84f7-4ec4-9784-3af4f80514cf", "comment": "Malware payload", "value": "36effd1114e259a97dd64a09f6e4265e547d64bdc18103ca3718fa7325c990a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910988, "uuid": "feb15625-6e08-482e-ab4f-59af8bfe766f", "comment": "Malware payload", "value": "57c8647fc5a8e8b07343920a2e9a672079a1d4a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910988, "uuid": "0b68155c-e6d2-4d9b-a418-c60ab7c2dd6d", "comment": "Malware payload", "value": "fe3ad0d29c15babcb8a7c4f07945673a79a139a56d395d3cc784935198ded6f3def35f4c995247d18c417f4077370ed8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910988, "uuid": "c695ef6c-e8fa-4251-a49b-57c2b647202b", "value": "T19845BF16E3E415B4E63BD238CAA64233E6B678450770AEDF0355D6192F33ED06B3A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910988, "uuid": "5b45512e-25f0-403c-8f92-03ca3cbea0c0", "value": "8aacfebbd525a9c11ae6974f92e62a6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910988, "uuid": "679ed3f0-7413-44e0-aba0-157fddc90aec", "value": "24576:fjX6CckUUTCJgxvVC2czWTbv6vBqGZVsL64qAc8zANB71mUpN1o31KD:fjX6C0UOJ9yTbv6vBXjcZUv5D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910988, "uuid": "3f23f8d5-41fa-449a-8df3-b12b4a1d422f", "value": 1204415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910988, "uuid": "20ff086e-cbe6-465b-8891-23c4f36a6c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910988, "uuid": "8c8658d3-024b-4cd8-b6f2-528ba1f0ad05", "value": "36effd1114e259a97dd64a09f6e4265e547d64bdc18103ca3718fa7325c990a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd049e24-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907722, "uuid": "ab1bbd18-61ce-4dde-97a8-42960669fd2f", "comment": "Malware payload (RemcosRAT)", "value": "38255356e2a23f7e942a7641cd55e9d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907722, "uuid": "5a44c10e-5b2b-44e2-b9a6-4ff5e9d92ab6", "comment": "Malware payload (RemcosRAT)", "value": "3703d16f10ecd7ded0bb82164cdd5757d2b992cec36a4d7082beae0af3d7fe26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907722, "uuid": "6f57be2b-f4a3-42ff-b903-b67dc4f55e40", "comment": "Malware payload (RemcosRAT)", "value": "69bad1478fd6ba6dd9109ef5f688022a4e765826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907722, "uuid": "1a28ce7e-8cfb-4e02-91b2-2745f0c5c80b", "comment": "Malware payload (RemcosRAT)", "value": "2e51c7850fb1dcfc136b81284a31628a59176a491e4cc1a4f9e6b7ae2439f49f51e39cb383bf8b9c1083e1a9f07331e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907722, "uuid": "cffbfc05-70e6-49c7-beda-152b0bcf7a55", "value": "T17F551254320BCE12C8A24BF04860D3B456798D99D816E3179FEABDEFF8BE74539442D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907722, "uuid": "45114396-f7f1-41a3-b62b-abcfbdb8c417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907722, "uuid": "a1a391ec-5c9a-414e-bd21-38a53c4991e0", "value": "24576:DL54TS19PJ2r/p/WcyeOGH3T7KqPPQfzd5/9fOZU+j1z:5449PJ6/BWcLOyLAp9xOZHhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907722, "uuid": "8fdfe08e-7413-459a-b01c-ddfa7d93cb98", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907722, "uuid": "b07a8297-cb95-4857-b0c9-d756a2a8a4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907722, "uuid": "7aeee5d7-6253-4174-9981-8ec70de68078", "value": "3703d16f10ecd7ded0bb82164cdd5757d2b992cec36a4d7082beae0af3d7fe26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d89519-62eb-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780889984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889984, "uuid": "9e932f4e-79ca-48c4-9847-64a4c3834f8b", "comment": "Malware payload (ConnectWise)", "value": "516ee88b4631df7c6cb9acc5108eca9a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889984, "uuid": "55c43fe8-1b0b-457f-b570-68d204c43db8", "comment": "Malware payload (ConnectWise)", "value": "3728e67dbccf9da6fb621e90e283502dd2b7ac8839052215a06d4dad25a9b155", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889984, "uuid": "e42a9b2e-1f5d-4d28-8167-4231f32b4170", "comment": "Malware payload (ConnectWise)", "value": "69cfbc6e6a4d6b48277ce8317ba63cc32383fc25", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889984, "uuid": "b9281f6a-e478-4470-8910-6ec84dd49c63", "comment": "Malware payload (ConnectWise)", "value": "85edafbfc9530829718cd6f727b2dd1702795bdf96b686c3d760a0d0e1d20afe0e6d33fc2b8e709231b04ebca2dd847d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889984, "uuid": "860ad1ed-d426-4c79-ab2d-e8757d2308ec", "value": "T18C46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889984, "uuid": "7bdcba2d-d727-4051-8c93-62205c67f14c", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889984, "uuid": "ecc287ee-68be-4d68-9b21-6402fb63f6e4", "value": "98304:ozIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ohfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780889984, "uuid": "a65dfc3d-93de-457c-9fb2-c19f202fadd7", "value": 5643040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780889984, "uuid": "312e2a54-f88b-4a18-9fea-dea2806a91f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889984, "uuid": "e25590fe-0f9e-4c88-bec3-34bfe810f2b0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b7c6b7-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911974, "uuid": "a1cacd4c-2b0c-4349-8980-cdb416cbd37f", "comment": "Malware payload (RemcosRAT)", "value": "897abf678edad72998554ec18675092f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911974, "uuid": "6f15518b-3cfd-4f3f-b6b7-337bfd8facf2", "comment": "Malware payload (RemcosRAT)", "value": "372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911974, "uuid": "236ff222-d210-4f40-b7c0-0bce6f30f499", "comment": "Malware payload (RemcosRAT)", "value": "be36ef651eed6808760153200a3a2a2b7060cce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911974, "uuid": "32259e69-7b07-4e3a-b1c0-c708f9e05c56", "comment": "Malware payload (RemcosRAT)", "value": "f76241510e4035cf8e8b9f45e5721685ba6272c5c942930851bc447cd80ce7c0b5e46003d2b30d27d1fa859b5f62e0ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911974, "uuid": "711e3de4-1ba9-4484-af78-0b48c4af0885", "value": "T15605126C6A01E507C9D15B385F60FBB502A96DECE502C21B9FECBDFFB927A404D18162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911974, "uuid": "47e795c0-b2b5-4bb0-8876-e6ac18c70db7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911974, "uuid": "ac28fd2c-962f-4137-85db-7e9acd8f47e3", "value": "12288:xgo9w60PqBA0dfSFOrWyziDZUYBPu3bdyY/euBkVaryapVRd:a4nffyU9cYWu+VaO8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911974, "uuid": "ce61e02c-9d52-402f-8b6f-45b3f7565e50", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911974, "uuid": "d50755a9-a238-48c6-988f-dec24392e7c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911974, "uuid": "29ac2cec-abf2-454e-ae14-b8d6deb5d8a0", "value": "372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8eeab11-6334-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780921378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780921378, "uuid": "b64c7880-85a2-4faf-80a4-f13275a62257", "comment": "Malware payload", "value": "0b6781350572ee540fcf01e3b3253e5d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780921378, "uuid": "08e97ccb-93fd-4a85-aa3f-b1da6896e00e", "comment": "Malware payload", "value": "376156b497c70912416a80737d8fc30c324b477dc45858b8b4ea35b153069e43", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780921378, "uuid": "5e5cf17d-cc86-4284-8ffd-45e3e7dee8f5", "comment": "Malware payload", "value": "a95c55b6f453a0d186a79b9e3c6f6d816252618e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780921378, "uuid": "481a4400-beb8-4a44-ad97-1ec0bdfd1d8a", "comment": "Malware payload", "value": "c13bb8710a478f9b09f80631fe3ac62d9bd8fc94b1498acf0d5c0c7d7d4bf09116dbc117f1a9ad5d58379b37ad1ce430", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780921378, "uuid": "46f3a6c4-c0fb-4514-ac66-1960d7efdae4", "value": "T1CF016FCEC513DBA08185E89E72EB51847410C3CB55564BA8BF9C443D9BB9B48705AF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780921378, "uuid": "0073a1ba-cc23-4e9e-b6ba-1bbfcd9d5457", "value": "24:kXCKysE2hi0ziQvZohaQ8Nj5i/X525lmgu6N7:e9Qp+MsQE5i/J25lmt6N7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780921378, "uuid": "e0000daf-1549-4db1-be8f-9c80c7941766", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780921378, "uuid": "df0d2fa6-5501-4b11-b068-d8d955804c92", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780921378, "uuid": "4b5c6ec8-b3be-46a7-9103-6bfddca1a289", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8375b06-62d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780882346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882346, "uuid": "94d77eba-bf55-41b2-933f-09919501877c", "comment": "Malware payload", "value": "5c0583e89505912035aab64ce4f88d04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882346, "uuid": "62863723-a053-420a-b8d2-ccd62a3beabd", "comment": "Malware payload", "value": "3795e51403c53b6c6406d25ee5a09e942cb8801035ae89ca8b42434473954032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882346, "uuid": "34e7ad97-593e-4c13-be4b-287010cb2546", "comment": "Malware payload", "value": "525e28467f641d1006ec6b182738f14fd7f75ef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882346, "uuid": "c0a132f6-c650-4e7a-9b24-52b546a31735", "comment": "Malware payload", "value": "1f3757a16014a011aa2ad53fda5d6d22bb1df1580ac3e6c6455038881b7ec9cf822bbe3da6f29c4c57f6513956593e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882346, "uuid": "2a8f3171-e65c-4041-86e2-432e90c48149", "value": "T1B0F69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882346, "uuid": "b44038c7-f4c6-49ba-a4f9-abdee06f01d4", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ3:cqYUQuVDt0TZEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780882346, "uuid": "f72b5615-777e-44df-9f65-e8e07298dfc1", "value": 15532032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780882346, "uuid": "331eca25-6478-4821-8e95-10dd2a47c6f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882346, "uuid": "48d0ecf2-5ae1-480d-a701-4d60e25c4a40", "value": "3795e51403c53b6c6406d25ee5a09e942cb8801035ae89ca8b42434473954032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47ce445-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780912324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912324, "uuid": "72b92d26-1fd9-4a35-88c5-91d8bec1e1ca", "comment": "Malware payload (njrat)", "value": "92a82c47950e62c98c90718ea629ef02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912324, "uuid": "edabc039-e8e0-43e0-aefd-0d2b68873c07", "comment": "Malware payload (njrat)", "value": "379e6cb508ab23ca6511d455a4afb0fc19365d97d865eae48cf8ed581cf58018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912324, "uuid": "dd8e318a-7566-463f-8c47-0e109c0203fa", "comment": "Malware payload (njrat)", "value": "dbc2d71b5451601661b18a9b4e1e29868334ccbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912324, "uuid": "4b4e437d-5776-4098-9a73-e23c39d17323", "comment": "Malware payload (njrat)", "value": "50858acaec25649cde9ee3fa7ad66d68dde174be8ad3db5d250e4c0ecfcc9518904eec9bacd2206b6fe6634696d006a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912324, "uuid": "a23b95eb-18a4-4958-84c8-15fb1c11b7d0", "value": "T1220522F49B9AE502CAB597730D21E37507788E1CDE20C3978FE8ECE73419265B9192D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912324, "uuid": "069d5c69-612a-43b0-8fc1-ede688abc7a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912324, "uuid": "f1d5d8a7-e497-4d3d-8725-500e74eb4e4b", "value": "24576:SIdH4uFHcK3HxzpgiI46BbtuF/3/QbHlo:9dYuF8Cpak6R8FnQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912324, "uuid": "eaf2f3ef-9d42-4cd7-8712-0e98b3a52f96", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912324, "uuid": "c23a9362-7a93-4842-ad69-3e60f02a7463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912324, "uuid": "d3351322-5b75-4e23-ab06-1f2a1898f98e", "value": "379e6cb508ab23ca6511d455a4afb0fc19365d97d865eae48cf8ed581cf58018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768c5670-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780928971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928971, "uuid": "308b3279-069f-4f78-a45e-9389450a95f9", "comment": "Malware payload (PhantomStealer)", "value": "6d77c80a1b4b970c20ea7cfc9fab8e18", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928971, "uuid": "d01db2fb-d274-4be2-b717-4837a0370528", "comment": "Malware payload (PhantomStealer)", "value": "37a35df92f7d1e3eefb08d264527ca35fbf9af3a4ffdc625a2c99081004480bd", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928971, "uuid": "03b17145-6cef-4092-a048-f39c8c589e37", "comment": "Malware payload (PhantomStealer)", "value": "7d8cb08fb98beeba94c25d6d99bcbcd170b9bd11", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928971, "uuid": "07eae2f4-baa0-4c77-a83a-d7798c42f9a9", "comment": "Malware payload (PhantomStealer)", "value": "f9590d8e12808dfbf052ed99de0e34c0434d268cc7ef7922983360a482902c1c504686daddecdb1fdf3b319f98d609de", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928971, "uuid": "8186d45a-3cc8-495a-9139-3404a83feecd", "value": "T18B514CE958FED629373515F4014C14E7D69D92B779A7BD63C86138F8CB2E30941D2405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928971, "uuid": "fd111b94-64ff-44fb-a5cc-04067f136071", "value": "48:ZS/W15Swj/TwUtDDKEElGfev0RwpblID8s06sUNfQyMj30/gAnoEU8spePZMzaOV:ZS/W117hN/ElGGJqO6sUlQH0IioEjspf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928971, "uuid": "2675f6da-711e-4090-9b69-a19ff08037d6", "value": 2695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928971, "uuid": "d8341268-892e-49ac-8a0b-f5efc3494abb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928971, "uuid": "5bb92334-e921-403e-8b79-bb08cd663840", "value": "RFQ064-S-700470-2026_Item_list_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac24e8b-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912281, "uuid": "c03f2a41-5b32-4e14-85b1-50ac246ea3ac", "comment": "Malware payload (GuLoader)", "value": "04734ead5d40aafc86de7bbeed68ec8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912281, "uuid": "e284076d-f07d-4dea-b503-feafd4e9d836", "comment": "Malware payload (GuLoader)", "value": "37aff605de5c517b583434a156a0f4156f7eab40ef2d83380e18655f56b5a727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912281, "uuid": "b3079cb8-b9a6-497f-8a9a-e859039dadb9", "comment": "Malware payload (GuLoader)", "value": "a95b42b690c7bb31f58f49e1fabe8d066af37820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912281, "uuid": "f2419afd-85fe-4335-a63c-bf5797c53db2", "comment": "Malware payload (GuLoader)", "value": "154ce083e71591cdf944f8c0914f6048a252593e3b1f15944dcd0234c0b26e53207169a6ba4ee210cc13efe7224d6249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912281, "uuid": "1bcf2d3d-8d38-4204-bcc0-ca1b71d13c64", "value": "T1214412417644E9B3C51977319D37AB39DFEACF294220935BBB80B52F6833251981F096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912281, "uuid": "0fefe4c3-1781-4141-91d1-7aecabd9d15f", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912281, "uuid": "2b5ab05b-de07-4cb1-ba6a-159163d3d7ca", "value": "6144:y8dWR5vTvHJuOMnZMqPI60Q93SvoP8UC0MWKE5sHfQttQOr2wyzKN:DMR5TJuO0CP+snUHgLjOra6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912281, "uuid": "b9238fad-3250-40d0-9da3-a2be55cbd6c8", "value": 273704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912281, "uuid": "756661c5-ea79-436d-9f67-93498c7d158a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912281, "uuid": "a59b159b-51fb-4cdb-a563-72e8ef012a69", "value": "37aff605de5c517b583434a156a0f4156f7eab40ef2d83380e18655f56b5a727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daeacc3-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941438, "uuid": "94b181c3-95db-4b26-b03b-6963d90cc5a4", "comment": "Malware payload (Snojan)", "value": "15778506184f3241f367c2e47a712365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941438, "uuid": "c2452881-5988-429c-920d-1e1faff90e5c", "comment": "Malware payload (Snojan)", "value": "37c2f87d00fb114b179218f229278f6b67ce413356213c0250f3db0826861897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941438, "uuid": "3ef7149a-074b-4c26-b938-e097f783746a", "comment": "Malware payload (Snojan)", "value": "ab029e9a346f11acc13e9b8e55c161a715a1d482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941438, "uuid": "fabb3081-8027-4d35-b5a1-617f431fc1e2", "comment": "Malware payload (Snojan)", "value": "93b10577355a30cd609f2ea6bced8d4580c697ce60c87c3740349a3b0a4ddbe439e0ded3aed1f940e0be969b614ed57d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941438, "uuid": "8412a140-9419-4ac1-a31d-a4d8f951baf5", "value": "T1F8B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941438, "uuid": "c6a27c7b-b715-4975-907b-3f3346e234e4", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941438, "uuid": "03bb900f-4518-4d93-8b88-2a6950beba6d", "value": "12288:/bE+uCh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+xk70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941438, "uuid": "129805db-d641-4773-b770-47e55bfc69c0", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941438, "uuid": "9be5bb61-6c47-4193-913d-6667affc7048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941438, "uuid": "289c6e70-28e6-4e5a-9731-9c3af9b0bf81", "value": "PcIEiVhvXTYQlLtt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3f4f82-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941432, "uuid": "61b285a0-5ed3-46fb-b796-b861d416f086", "comment": "Malware payload (Snojan)", "value": "98a52d73993fb4a173ea11da813ac5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941432, "uuid": "5b4d1c59-66c8-448e-8ba8-e821f0685034", "comment": "Malware payload (Snojan)", "value": "37d9f1134fb01d0845e692934f23ba7e947c6594d30ef1ade34bcf9c486aeeab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941432, "uuid": "b9898f9e-df2a-480f-b274-a951f5bdd27c", "comment": "Malware payload (Snojan)", "value": "e3e581bafcc7d0c41015335fc069dec57a75f1ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941432, "uuid": "f61bf37e-d5e4-4887-b190-fc5b23c5fb29", "comment": "Malware payload (Snojan)", "value": "613fd62cb5e04837dbe2389b655c0808fd8abc7c7abdac1b7ecac116232c7daca1453e3c6bf04add906a1a394e2f7369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941432, "uuid": "8fbcd8ed-4efe-4c7e-b774-73633d258c57", "value": "T1E0B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941432, "uuid": "4c3cd5de-c4e0-43e7-b84a-52b7923b4637", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941432, "uuid": "4bc99dfb-dd2c-48ef-bab3-4d212d405b25", "value": "12288:/bE+umh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+tk70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941432, "uuid": "93edb57a-b265-4510-9ea5-f6d427446455", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941432, "uuid": "b95ee5aa-9c04-4a4b-9530-7ba68386a395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941432, "uuid": "3aedf981-3642-42bd-88e4-2dd001c20e48", "value": "HgXfCiVR5SAHqPeE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9b3058-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904929, "uuid": "9eab236a-cdc5-4977-832f-dfd0aa585fa2", "comment": "Malware payload (Mirai)", "value": "57942f560ae85aea336fb45d0dabd6a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904929, "uuid": "0e1e134a-012c-4e41-9110-a8e11ff1a837", "comment": "Malware payload (Mirai)", "value": "37e79ac50b5b2c77f7f26f913ee32b80157622dff05e95424ae8002f553526e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904929, "uuid": "90258780-af35-4c48-8a41-7186914f0180", "comment": "Malware payload (Mirai)", "value": "66e0a0259e15f560ad4ca498ddea65586ca58707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904929, "uuid": "640b9342-6f47-42e8-beb5-364e9bbd58eb", "comment": "Malware payload (Mirai)", "value": "5dcc02baf0add46b6fbfd1f5019b61e540aee9a41da80e9ae76a21e221999515ee3c3cd7ebf3625adc1e11665c619ce2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904929, "uuid": "1707b474-bacb-4a25-ab3e-5458f2e81e55", "value": "T1B5F32902770D4F43D2932EF02B3B2BE1979BFD5228B4E544751EBEC982719B2504AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904929, "uuid": "b3c7180d-23ee-44bf-b8f8-be149dcfba33", "value": "3072:8lCXhsbejJV/0J9je33ixWpyvzs+w9xaDkOAab5DT8:qCRsajJUjenixWcvzs+Kxy1b5Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904929, "uuid": "58b61fa3-b79d-4e1c-a271-661296a5ba4f", "value": 158964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904929, "uuid": "18485f92-8769-4600-8d65-945ff94dfc56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904929, "uuid": "c4656e94-dad2-4810-aedc-d3820db5a76d", "value": "nova.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d200d078-6373-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780948452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948452, "uuid": "2804be8c-ae49-41c5-8e92-b73778ea000e", "comment": "Malware payload (Mirai)", "value": "a4fa053f2adb74e9108c1b3c6f2d52c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948452, "uuid": "ef6fb006-3817-4eae-bc79-e1028843cf74", "comment": "Malware payload (Mirai)", "value": "37ed12fe9c5b247e9c015938fd19204325413c083294a76f4f93e313d612a89a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948452, "uuid": "8c60d47c-ad4d-4d72-aec4-cd28f5710988", "comment": "Malware payload (Mirai)", "value": "be4d055ba1486f5fec0164523766694a286e645d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948452, "uuid": "b2461285-726e-49ba-b8da-7d042372bb7d", "comment": "Malware payload (Mirai)", "value": "bf44e5f4aa5973ed85712276f1f2ae37a4fc60aff7b11464ac0e777d1477391d586ada2c4dad166ecd04831513d762dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948452, "uuid": "9fc1b07c-8930-4248-ad41-ed2dcf79906c", "value": "T1FC26F7C1B991C24AC63D6E31EFD9EFC8D2277E315CC46A4BE9D4F73E18B614484A94A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948452, "uuid": "2ad71137-ad30-4879-90bb-f934ec54413d", "value": "49152:kUE/PI7mWxoKjvIEDyj0+Ysns0iN3pLV:kUE/PIKWxoKjvIEWj0L3pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780948452, "uuid": "3893e01d-13f5-4029-a97c-28a29831ce96", "value": 4784128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780948452, "uuid": "811ed29f-94c8-4766-9d31-73d910eeb4bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948452, "uuid": "43bb83c0-dae2-4e2f-af47-d2d4b7c97157", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f20e0f-6356-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780935899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935899, "uuid": "321fc119-070c-4417-a84b-be968361a35e", "comment": "Malware payload (PureLogsStealer)", "value": "80124bc6b0e6070c6554e8dc5ed874e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935899, "uuid": "22b36888-8d98-4a35-ae08-48b654cb9fe5", "comment": "Malware payload (PureLogsStealer)", "value": "386793476ba094dac1371ef925bffbbe0990175a3a1abdc17637cf52a6288c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935899, "uuid": "b726ffa8-5139-4dc8-95cf-ff90634fdc2a", "comment": "Malware payload (PureLogsStealer)", "value": "b0c20020f4d7fac423e24f792e36698e11f640f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935899, "uuid": "603f912c-c0fe-46fb-8f62-57d271deeda2", "comment": "Malware payload (PureLogsStealer)", "value": "4e7aa3b5270433c5e7800e349661a605f31a8ea24dff845102f31537110f47cadfdbf7e81647f1ea0f0c7c22f34888a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935899, "uuid": "2f0a94b1-13d3-4a4f-9089-c0b2dfdda773", "value": "T1D4C412463A8C5702C6651EF9C4E35A6403EA71D735B3EB063B6487CB2E813E5CE59BC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935899, "uuid": "09c55092-a03a-450a-b405-a7d595ca3423", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935899, "uuid": "e9f12fee-9a0a-430a-a821-07bdc2452e97", "value": "12288:LIT8XgHHvsTY5OGkm31lmDB6K4OiIOER+UsEQ:LIT8XGi5m31sDUKJjOERhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935899, "uuid": "a05b3263-59c0-4873-a113-848283177b16", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935899, "uuid": "6bd22f3d-2c76-473f-855f-bd4ba896baf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935899, "uuid": "1ee5d2b8-6f2f-4e99-9ddb-e7c1d8ff1a48", "value": "SecuriteInfo.com.Trojan.Mardom.MN.11.44588326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cb1d3f-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912545, "uuid": "4af8df13-32b0-4b69-a0a8-de1e3b211cb5", "comment": "Malware payload (GuLoader)", "value": "9cf6d8fff6007295059ef53afd86b3ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912545, "uuid": "e0fb9996-cde9-4eb3-916d-7144f50d97f6", "comment": "Malware payload (GuLoader)", "value": "38687ffc58c6ef27c5f46fdf5215d9c4a267e54cb68f5515fc18ef00c7246278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912545, "uuid": "b0056e3c-1a20-45b6-a42f-4c8e09a37db6", "comment": "Malware payload (GuLoader)", "value": "114fa12274775b8102fa8a2446450d7ddc58b91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912545, "uuid": "c35d2c92-a8bf-4057-9895-05b5a1c3abcc", "comment": "Malware payload (GuLoader)", "value": "0e8a237268a2cfd290bbf3f3d60c4b03744e974d37fb7681bcafc74bac5369ffc8bbac469e9297b2386470b2b047a7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912545, "uuid": "56dbdeff-52d8-4f24-99c8-b94e99408fa6", "value": "T17FB402182F7DDB07E2864C74AEB0EA6FC3349D469D2E5602DF313D0E99397C4AA4DA41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912545, "uuid": "3ed11eab-b8bb-465a-8e73-cdab023ded8e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912545, "uuid": "c58dbca4-cb05-4636-a8c0-cdd90297e95b", "value": "6144:epkXGh6aeKHGX2RK49s2GelZhXeBXbTzQqdoZ44WpRv+RcvNetXe0K4LZ8RZrwWh:3BG3KXfz9d34WbvHOvVLZObrTdY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912545, "uuid": "56f2013c-4e07-449a-bd33-a0e5b51636ed", "value": 542888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912545, "uuid": "359df317-e0a4-41ec-b5d2-f5a47f150320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912545, "uuid": "95d66724-790f-4391-bd58-424b59865de7", "value": "38687ffc58c6ef27c5f46fdf5215d9c4a267e54cb68f5515fc18ef00c7246278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b45d90c-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907423, "uuid": "0d419262-d005-427f-9c42-54460ba93975", "comment": "Malware payload", "value": "eab2f1da471c48b0891daa6e901fc1f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907423, "uuid": "fc39caf5-be8b-4169-b0af-12c3b78a86f4", "comment": "Malware payload", "value": "38dc196b31745047def86b4fe5ee1f46f7ff7b37f2c856ecc606c079431d6fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907423, "uuid": "212160c3-be7d-48b6-9f40-797ce0d6d010", "comment": "Malware payload", "value": "2d31744da801c832adae4fe46af3a35b30913b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907423, "uuid": "35fd2ad4-d21d-4133-91f2-514fc25738fa", "comment": "Malware payload", "value": "91a99cd4180b345c360d9ebc54265a105dc45e91263afabc1d065576484329e6d4d5a6922095094ae7de41ff481ceb9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907423, "uuid": "49820450-ee7a-45e6-8c2b-4326aa825598", "value": "T1D125E0115E831FA4DAAB0B7CC052089CB7F0CA875396EB577FEC10F49AA3F88DA59451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907423, "uuid": "de8e610c-a3d7-40e4-93df-1409f1e49b37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907423, "uuid": "23ca3573-8834-4166-8b3c-2fb08dc2fdb9", "value": "24576:0BN1EhFMxO+Nm5olKEKUfHEQCvoGFtYY8:0BNChFMXNSooT6HOvvFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907423, "uuid": "d567526e-103e-4e90-8a6c-ebf807221e7e", "value": 1035776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907423, "uuid": "79517716-9ac8-465c-805a-f6ed84150443", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907423, "uuid": "27c26346-d4d3-43af-a1de-5a8c8f2d0a98", "value": "38dc196b31745047def86b4fe5ee1f46f7ff7b37f2c856ecc606c079431d6fb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4604d57-6311-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1780906419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906419, "uuid": "096b7065-d0f2-4117-985f-b94009effe14", "comment": "Malware payload (RustyStealer)", "value": "9ff0d43cc02136108bcc9744240c3aa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906419, "uuid": "ea0c493a-4e72-4736-8816-7110a4bdcb5b", "comment": "Malware payload (RustyStealer)", "value": "38fe33553dd2882a03adf8f51be173e5ac4ffb8aaf39d6f2785c7f74c6868a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906419, "uuid": "b248b71d-1f51-41fc-b8b1-daacaa70e5f6", "comment": "Malware payload (RustyStealer)", "value": "744b7b106286f67a8704d6d1c358ec6a6f215ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906419, "uuid": "589ba7d3-60d5-418f-8c6e-adb56f5463a0", "comment": "Malware payload (RustyStealer)", "value": "d1565560311d82b6f0aab100cd71c9e17b9af831416340812877506cd1da2407e2a6087c6488d970deabacdeae85786a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906419, "uuid": "15bbeea8-168c-45ef-96a5-ae0665174c91", "value": "T18EC55B43F69584EAC55EC178835B9732B632F88D1630BAAF2794CB242F16F505F1EB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906419, "uuid": "fe2cf1c1-dee1-441d-8e11-61691069e9ff", "value": "15b82f52f2583edef42df25b4e39cea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906419, "uuid": "7114fd9a-172b-4d25-9c94-178924ae92b8", "value": "24576:kYd2hsT1ORfXC9DomS4g+g7Qv/d3rmsrP1YtwUKBll6NqidVL:kYMhoMfyBbTlrmsr1YuUk4ZVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780906419, "uuid": "6177b663-549d-4f22-879d-8e3329264278", "value": 2685440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780906419, "uuid": "b00fa554-7fc5-446b-9c9c-2d6ef6d07281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906419, "uuid": "7a80bdec-a19c-442c-8a81-4737885cd104", "value": "nxlog community edition.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa806b4c-6357-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780936359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936359, "uuid": "f69c8b1d-c45f-4c91-a08f-8bb7899bc57f", "comment": "Malware payload (Phorpiex)", "value": "6247b8f4c67b91d04788239d2560c2f8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936359, "uuid": "96373b38-d65c-45e8-8836-7ac842579239", "comment": "Malware payload (Phorpiex)", "value": "392169374cc22b9e5037431eaf79ced6f575a921c0dc834f61da240f17ab669b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936359, "uuid": "39e570af-d88f-4e33-b105-e559d1cb56b8", "comment": "Malware payload (Phorpiex)", "value": "8dc5412ce606fc50825b711917ca03d9565df076", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936359, "uuid": "e45df9a3-e490-414b-b198-ea333e85f52f", "comment": "Malware payload (Phorpiex)", "value": "9e9b5f0d7a44d358e3cc00a6e470ba9440759c9a750f1fbf8c8792bb1c7fe5ee5dae033ad04cceeeefe4abefdd100eca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936359, "uuid": "2eed62c9-06cd-42d9-be33-21b9d074c372", "value": "T1B7825B0FB8424726C1E100B09636967BDA79A87137C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936359, "uuid": "31e0521e-40e3-4be0-8ef0-3310a03bad2c", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936359, "uuid": "c4dcc2ce-ba32-4577-bc55-ae2347e3b95c", "value": "192:NKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSvu9zw+ghSSCgbO5qmEd/FN2GJxd:P0W/ytwEN/0Gu9JgwOcoav8U9cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780936359, "uuid": "91c310d5-e1cd-43df-86ce-161b29cce4be", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780936359, "uuid": "f312f912-7aa4-48d4-9883-b95039327397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936359, "uuid": "19d537e1-ebad-46c5-8e56-dc76f20d9eed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5654f3-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780911131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911131, "uuid": "bf0f1c0c-a645-4c55-aa7e-1fd2c2d3e8a4", "comment": "Malware payload (AgentTesla)", "value": "68fd2ed74f821322da32c65d8e39b389", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911131, "uuid": "8c7f3365-fad0-427d-8b67-a0b57025a246", "comment": "Malware payload (AgentTesla)", "value": "3923fcc6b919af06ba2d11ef19ec7b62c142284906df35e71dc6348394d5aa99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911131, "uuid": "3561d519-96f6-4f70-b3bc-dc5cf5432a10", "comment": "Malware payload (AgentTesla)", "value": "7e53f964a1104f1c0cf8f51bfccb7e8cb931c05e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911131, "uuid": "d5cfbfb0-8212-4d3e-bfda-4b29d6cf09cd", "comment": "Malware payload (AgentTesla)", "value": "9d5514d18b920adb2f7102ce27aca0b2a2e6e5cf8387513877fa8e9d53f7c4f874d5616e993c9f5686667a527b831879", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911131, "uuid": "0c1851b9-d9e7-4c8e-b774-04f6d447aafd", "value": "T12845CF2A3A8F444CD5A5DB788F333BD41770D47658F2D31B7F8C5338A626AE59A8C242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911131, "uuid": "d104fe07-7c9f-46ff-975b-b86f6f35c1b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911131, "uuid": "bf903413-515a-4d13-8aae-c749c6ce0d6b", "value": "24576:eSfMPCmQui1rBgc+9C66LghoGFq4H/+Qa7KMGx0:eSkYus16thvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911131, "uuid": "ff6b9ed1-9fd0-4ae7-a5cd-45654f366cf6", "value": 1275904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911131, "uuid": "56b72e93-0905-48f6-8310-286a1cbbb9e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911131, "uuid": "3a6df847-d326-4dca-bd08-fc87a3d70528", "value": "3923fcc6b919af06ba2d11ef19ec7b62c142284906df35e71dc6348394d5aa99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef98598-6303-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780900343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900343, "uuid": "7fb37a91-0ab7-4676-b9ef-c8e14af0da98", "comment": "Malware payload", "value": "05e87218cfafe7a53dd350d283f3627f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900343, "uuid": "23390c64-9167-49a1-aaf1-74ccda6be35b", "comment": "Malware payload", "value": "39319f0fc09e6f038864a5e35603f1f5a9f23b2a5744b991efc5f4c368891943", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900343, "uuid": "a63b4e39-20c7-4907-b38c-683dce0f3982", "comment": "Malware payload", "value": "9d0e741dafa5596a22d4588eea98d322573d0a60", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900343, "uuid": "c4d44fbb-8a79-4825-96b8-75ed8211f971", "comment": "Malware payload", "value": "ffd4cde2d46ff7197b6c15de072801eaa893f457821d6ae3e990d99503329fe1d9456df88db9a8caa78816c9947a4cf3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900343, "uuid": "154a7988-fb65-4cf4-8f44-a6128fe4eceb", "value": "T1C071B54160505AF2D98CA3BF8487B895FD4EB248A2C84B0F0798981A3F7607BB4DD613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900343, "uuid": "01d4a261-a7a1-4aaf-9003-459b2c190c38", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900343, "uuid": "30c725dd-3635-4add-be60-5b69de6386d9", "value": "48:6IZUBQYxZul2EywS6Dq8jk7QLzgzIzQz4zAzo157D9N9XM/geu3ahr0/x:2BQMZ7EywS6DqG++D9vXeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780900343, "uuid": "2c5c8d2a-f9d3-4671-87c9-d34d6c63b0dd", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780900343, "uuid": "e6507fe3-0db1-4dd5-8bbb-d89c7c859012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900343, "uuid": "1c812c90-0587-4731-a738-dd5018fe41da", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f567a6-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907302, "uuid": "f7ce64d5-a5b0-417f-a530-503f8bebcad4", "comment": "Malware payload (AgentTesla)", "value": "f1e3abb440c3566c180278d268686ac5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907302, "uuid": "e39309fd-d713-481e-9e9d-42f6e5b77dca", "comment": "Malware payload (AgentTesla)", "value": "39f088251624e62117546d2773c52119b98b2b75d0e14a5c52e2e0a58f4d3d76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907302, "uuid": "2f951f54-4359-477f-946f-074617a04884", "comment": "Malware payload (AgentTesla)", "value": "550201aaabe8bab6e830a0d495bb165a690684a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907302, "uuid": "7f0f110d-d30b-4f19-a703-426c192d74bb", "comment": "Malware payload (AgentTesla)", "value": "ec67f148f324e4758b470346bb5952c680d256e1ae835cb27dee66e481aa0a669ae1d0fc811bb938e9d06562e06d282b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907302, "uuid": "316e9903-b29f-48c5-971c-1fb5349bff03", "value": "T1BB251298A75ECC16C1838FB40EB2D6F956785ED4D922C2079FEA3E6FF8771255402382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907302, "uuid": "13944f00-8c54-4828-b5a6-90e38fc895c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907302, "uuid": "57ab45ed-de3f-49d6-b9c1-e74532ce78a3", "value": "24576:ALhwZtbSWxWiphSs+Eg4Wy4ION0CW6kT:AFwdWDFjmdgSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907302, "uuid": "fad611a9-4da6-4cdc-8b98-5ede752875cb", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907302, "uuid": "413c6f2c-868e-4aba-84ac-3ddc5dbaf5f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907302, "uuid": "a0b25108-216d-48bb-9ca4-96f67e0220bb", "value": "39f088251624e62117546d2773c52119b98b2b75d0e14a5c52e2e0a58f4d3d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9a5f49-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907825, "uuid": "3805d15a-e03d-459a-9175-3f9430d66c51", "comment": "Malware payload (Formbook)", "value": "0e90079de68744f17532fdb71060e054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907825, "uuid": "04bc07c4-e89e-4514-bca3-abb799f3557f", "comment": "Malware payload (Formbook)", "value": "3a0ec4421c92055d16ac60d761f944d4e811fef7e7231a35a1a2461c73638e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907825, "uuid": "ba6c1871-2acc-4e0b-a834-8d30357a03ef", "comment": "Malware payload (Formbook)", "value": "791b545b57f12001e544c4d67e44878d6f3df9a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907825, "uuid": "751d1586-631b-44ea-aa62-8c3edf5d461b", "comment": "Malware payload (Formbook)", "value": "77ed792cafc6379d6d7de92da9d9ffcf6313fb90ae5bae62081c87a5c244303955686a10bfabc8f385fbfcaa7329fa5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907825, "uuid": "e15c9587-f395-473c-92b9-4f676bc2f34d", "value": "T146251208631DD90AD0A69FB50C71D3F41BB45ED9F126C2439FDA3EAFB87A351484A782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907825, "uuid": "f836b67c-47e3-4b38-88c5-2e9db964fef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907825, "uuid": "2bc7824a-3dbb-4cbb-bff3-513a283f918f", "value": "24576:DZRhwZtaE1uz9DrZZHFtT7qgvMsa3b/19LKffUbGJhGSn1:DNwsfZlxqmOD19Wf8bGJhGC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907825, "uuid": "b777d170-1371-4e96-a40a-604a3c9f3621", "value": 1046016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907825, "uuid": "45457ff7-02e0-4d20-96b1-5ccf0dbed75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907825, "uuid": "c8f1c878-b040-415a-8f73-a9ff7367e2ab", "value": "3a0ec4421c92055d16ac60d761f944d4e811fef7e7231a35a1a2461c73638e65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce0218d-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780912822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912822, "uuid": "0bd4957a-c134-4f66-aa23-9cbcc76ec6f7", "comment": "Malware payload (DarkCloud)", "value": "a84dbaa832ba2ef9c79bab63c61682b4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912822, "uuid": "21ef2267-acf9-4b54-bdb1-42298f5565ce", "comment": "Malware payload (DarkCloud)", "value": "3a987fa4a27d9f55a06621e8bc00519e96797fe29160fd8d2cbe9663c50c0599", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912822, "uuid": "bf9f3ea1-56c7-463c-803f-950c94519278", "comment": "Malware payload (DarkCloud)", "value": "c4ba330d049b50d8398d0aefca8f33a4a64e83b5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912822, "uuid": "3b55858e-270e-4336-a89e-c61b5807218f", "comment": "Malware payload (DarkCloud)", "value": "aac99d8f9547d66701c425180063e00dc690f4f9a10dfb29851bb68ac8e1f1574449c877f932224ac73dcc2eb7c9a39a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912822, "uuid": "a9a8c1d4-4573-49be-a5bf-3343bc67cea1", "value": "T10E35226467A8CA06D4DA0BB81A70F3B023B56DDCE700D2568FE67CDF3972B225A45743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912822, "uuid": "953967a8-2f69-493c-a80d-3fa3d9139c51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912822, "uuid": "60561180-35d7-44d0-87be-abd19ffd23a3", "value": "24576:ZHeZvbIpwtdl/k80+xp9LEH7zB6psmoR4SnTXpYyCFULB5xNe1w1Ld2Y:heZvspwtHT0+xp9wH7zspYRfnTX15xNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912822, "uuid": "35edcf7f-db5e-45b6-9c7b-fb9af56400e0", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912822, "uuid": "03055269-300e-42b8-9e54-e9c6eac50f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912822, "uuid": "5ff4f3ba-b077-4eec-b7ae-271d534bb103", "value": "3a987fa4a27d9f55a06621e8bc00519e96797fe29160fd8d2cbe9663c50c0599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15932b65-6370-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780946847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946847, "uuid": "ccc5ecea-e8eb-448b-b24d-2794e09aca67", "comment": "Malware payload", "value": "fb86150e0aa94fdbe09972bc892a2df6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946847, "uuid": "048acc60-6dfe-45cc-b09c-06a230aed3f8", "comment": "Malware payload", "value": "3aaf423098ef9528340909eb04ec15d7957820a9e23b58d3a6b55ea065ca7c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946847, "uuid": "3a2ae2d1-68a6-486e-bc3e-166aa96bcdbb", "comment": "Malware payload", "value": "ccaf4b032fe8a9b40817aba74339b824995cfdae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780946847, "uuid": "9febd858-205a-4d6b-9073-4bcad171beac", "comment": "Malware payload", "value": "2a21b539eba5dc6a4bf26ada5a118c6f8abdf73cc928d7148b67c21caffcf25986757323df49f7a6564c797129e8c9f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780946847, "uuid": "ae67688f-d965-4aa1-95bf-fdf54654b80e", "value": "T100E2B73EB7B2EB3AD09173340ADB512095B474F4EB33902B671115B73D92B984B39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780946847, "uuid": "dc40a781-9e67-412e-a53e-089d302b1205", "value": "384:MTdIXtTYEA14ejeDwduOa7H693HS9CahjkNEOyvGGgOOOWJKvwcA5jWMKZ6CViBs:MTdUMT/aW93yjU1tCyS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780946847, "uuid": "b9de297b-d186-459f-ac99-15fa808aee68", "value": 31808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780946847, "uuid": "76def009-5be5-43d4-9727-99c1f48da13a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780946847, "uuid": "4ee9aa03-2f57-48b3-b291-c9f5d45686cf", "value": "3aaf423098ef9528340909eb04ec15d7957820a9e23b58d3a6b55ea065ca7c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f06aa7-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "b8b5bf87-943f-4a05-a8e9-9ce04adf4625", "comment": "Malware payload (Mirai)", "value": "1155c2554413a6538a37a4020ea938f4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "60f9e542-e63c-4329-8920-515306108d93", "comment": "Malware payload (Mirai)", "value": "3b6224b9ca2de083f50e9df99738d9b070d986f2f772bccd3ce232b6fd93eff3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "cb8203c2-d2fb-4894-930f-e8e922df98a6", "comment": "Malware payload (Mirai)", "value": "59ce4797e73218ddb06d80d760c007362ff4bae1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "efa6efd8-518e-446d-9830-b1453c835894", "comment": "Malware payload (Mirai)", "value": "b0f04f0a33b0041ab75582f0735ca98dd9ec489e09acdfa1b6a986fe2939ea29f1bec74b810205cbbf632e2513b49a4b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939578, "uuid": "b8fc3e63-26b2-49bd-aa54-5c04f303bd8f", "value": "T1BEC33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939578, "uuid": "aada7b05-fc29-46b4-8487-d9d3b972158d", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPjO:LzhWutxBaORaebXQd+mzBzlkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939578, "uuid": "2f013f4b-f23c-4923-8faf-2e66e110c1a1", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939578, "uuid": "237241d9-658b-4085-897d-aa95696eecc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939578, "uuid": "fd08bb72-754c-4d95-b56c-0bc80d6ab867", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54566a9-633a-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1780924029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924029, "uuid": "bfc9f622-9a65-403e-93d0-f7e007298373", "comment": "Malware payload (KongTuke)", "value": "baa732585a95afc62b2041e20c265b3f", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924029, "uuid": "2c22ae9f-b6d2-46b2-8bc2-f8fd45fd6f1d", "comment": "Malware payload (KongTuke)", "value": "3ba5e5ee550ae3c50554f30fc6a1feaad9b29073c851cad57fd4d2be2f0cedb6", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924029, "uuid": "124c0e7c-6c4a-456d-bf7b-5c1f77a5bf94", "comment": "Malware payload (KongTuke)", "value": "7c714250c9a9b8ac85cc3165bbb4010ac1fefd42", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924029, "uuid": "f8f470a1-f3f7-4cc4-abdf-0285922c0bdb", "comment": "Malware payload (KongTuke)", "value": "0150946b5a282de5e639443cff747358521a81ba828c03f4aa35cff313be8b6a218247f3d4971ed4a07f908b538dabb1", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924029, "uuid": "755ff23f-378b-455f-b083-0be561c91c76", "value": "T12AC16C5A6FA244BC139EB8A19E96472793943C0BE46480C1719E76C25FCF34C8352BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924029, "uuid": "97c75552-ebab-4db1-b22f-ffe03678144f", "value": "96:1qeXhQSgxOGLV5uosU7qWnTPXui5mFvRe3wr9C+3M0M8bba9xoyXv1D6rUkLySxL:cWhQSoL7unUhT2i4RYwr9CaM0M8fa9xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780924029, "uuid": "978c0c50-c6ef-405f-9229-29eb0795f54f", "value": 5630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780924029, "uuid": "9ad0d589-9c8d-4fa3-a0df-10da054cbfed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924029, "uuid": "4bfc2cf8-9088-4e45-9345-d868d192af81", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a757c8d-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910026, "uuid": "a4354c67-16a7-4ad7-91f8-7d02098f1671", "comment": "Malware payload (a310Logger)", "value": "c1a4e7af8104aea0a6e42e70ed1ce67f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910026, "uuid": "32d62832-5646-4294-b5de-81a8a6735a4c", "comment": "Malware payload (a310Logger)", "value": "3baa767112e87559e453c04baf11f18de2509ccc1f7ec91504d49ec98a349952", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910026, "uuid": "32eaf921-76a9-47aa-9402-865e095e209c", "comment": "Malware payload (a310Logger)", "value": "8ed07edb868bbd865364ba2901d4a353876106c0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910026, "uuid": "bca4ed1d-0f2b-464c-92c7-28431b5a2012", "comment": "Malware payload (a310Logger)", "value": "27de37e804ff9f358945046310506e4582429024fed57c1ec8290f7e68008f5efd1fb79895ff3bc9710d78dfe49343ef", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910026, "uuid": "e06b687a-651a-4cbe-bb2d-5d7b03e07f04", "value": "T16D943A13EB60601EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35725D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910026, "uuid": "bce91bbe-848f-4860-92cd-7a46ccfa9659", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910026, "uuid": "919f3478-c158-4dfe-8036-546cd89755b8", "value": "6144:d38d1/w5KA81IJ8GpF6nuTmOOUiBUrjkHnSQOnPcWF7hS58eyOeUXeI:dMjYKkJj6GmZUiqrOsPPxeyOe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910026, "uuid": "773d09e0-9bf1-419d-8dfa-680e164bab53", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910026, "uuid": "799a56a7-865c-41ac-a314-56eccd5af225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910026, "uuid": "8ed23e35-1735-47fa-bdbc-52c06c36ffb0", "value": "3baa767112e87559e453c04baf11f18de2509ccc1f7ec91504d49ec98a349952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85cecd59-637c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780952189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952189, "uuid": "2f1649cf-6d37-43e5-a17d-d981a5ca8713", "comment": "Malware payload (Mirai)", "value": "6541c97aebed7d48dad863d137a4cedb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952189, "uuid": "57676d72-e8b7-4d57-8ef8-fa9c3147f94c", "comment": "Malware payload (Mirai)", "value": "3becb3d0241f52819ea7ecf63429f0f736d6c172286aea8194e6cd727b739759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952189, "uuid": "10687bcd-2ecb-4760-88b0-26d539a3a742", "comment": "Malware payload (Mirai)", "value": "f989a557dc56ef9cd7fc35521d7104ca0edb6d89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952189, "uuid": "9783a247-14eb-4442-9992-155eacacfa57", "comment": "Malware payload (Mirai)", "value": "5b7e79a401f4f5830b1ee25f4b129d9746eb70c95c6851de0600c06b6d8108b2a039a62f508e240172c237ed7ec4b653", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952189, "uuid": "af4df148-4128-430b-96dc-3559e8965996", "value": "T1EDD3190ABF711FFBD46FDD3306A90709299C590621A83B3A3674D81CF65A64F4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952189, "uuid": "18ada0ae-0cd2-4159-a2cd-9f47eb90a3df", "value": "1536:Ocgzh/YLB6xAp9LD6BoByGG6WXxTAiQhyofDd8b8IPL5fMoO95aqyhAex2KzUdIX:OpzmxByGGhNA8AIOF6nCfcrcK2oGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780952189, "uuid": "d8cd8abb-7516-4fdb-9637-52e3413c7af3", "value": 134644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780952189, "uuid": "d10a0d8e-d0c0-4d90-9a61-1cc27c3b55f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952189, "uuid": "f0979847-187b-47f7-8d82-bcea8aebbaa5", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f225c9db-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780908133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908133, "uuid": "18180286-55da-447e-8ea1-1665276ca279", "comment": "Malware payload (MassLogger)", "value": "deab9f549ec190eb3ab9e8e625f3d546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908133, "uuid": "d313f62e-3bb2-41f7-98fb-7f9a088f208f", "comment": "Malware payload (MassLogger)", "value": "3cc6a6eefacfb216b9941d31393c3d7efc7ac9ac12d172d866af04250f49bfe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908133, "uuid": "9666da22-ee69-482d-ab4a-9396e3167fb9", "comment": "Malware payload (MassLogger)", "value": "7a5d2b71aa29448ffd293a72c69b2636142864ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908133, "uuid": "824f3b0e-904f-408d-a07b-987aacb1be4f", "comment": "Malware payload (MassLogger)", "value": "0af67f27519fca82f5a6f903612db73c6fddd8ffe51666f1b94508491e8628248bc0483bafa954f77b119f2309ae7dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908133, "uuid": "9213d61a-a005-4c69-9ce2-d6dcf5968fb7", "value": "T14015F104224EDD06E4F69BB858A1D7B416746E88F931E3038EF5BEDBB83A79548143D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908133, "uuid": "f2effecb-8ead-425c-9803-247d622349e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908133, "uuid": "f59b4f96-28d2-4e36-9287-0f3581065eff", "value": "12288:9oNwWO8hMoxifCkDAu76cWANW82O3jtot3nImAWQN7Y5lerjskm8imL9M:H8hMosfNjeZ82OJot3dAWzjUIbOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908133, "uuid": "63baf7f4-6fd9-4291-8f58-693f418d3ba4", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908133, "uuid": "d9b63b7c-5f00-4e02-9a35-86541dc99f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908133, "uuid": "887b0eaf-7b64-45fd-8581-defbba2f2def", "value": "3cc6a6eefacfb216b9941d31393c3d7efc7ac9ac12d172d866af04250f49bfe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a50cd6-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907518, "uuid": "4f5996a7-6a99-4e45-aa20-dfa2f11d567d", "comment": "Malware payload (AgentTesla)", "value": "663cad0473d338c9bfa3a06af56058a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907518, "uuid": "bdb0b2c2-99fc-4ad3-a5d4-7088585cf18f", "comment": "Malware payload (AgentTesla)", "value": "3d598d95b0c985d9a1e2fd399f00ebfc5177539b9e0c814ae12abadfc4933e0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907518, "uuid": "a609cdf4-f824-4155-b36f-d671ec2dea63", "comment": "Malware payload (AgentTesla)", "value": "ba5b406883f3d7bbfb98b96d020c4f239e8724dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907518, "uuid": "9fd8e884-0d0f-4936-8040-c420e2f1ee62", "comment": "Malware payload (AgentTesla)", "value": "2467ffcc2b86a8770083659bc588d2855725beaa8a6f23200e4a106d3f594974e0863e99cbaa49126a9dd67d736d995c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907518, "uuid": "73a47a01-4e41-42ad-9e6e-a8f43d655bcd", "value": "T120F4120B7B649993D021AF344DBEFF213724E9992A61971B3610B61EFFF67809D0A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907518, "uuid": "dced5c65-b5fe-4ee1-90a1-ed111fe8cc70", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907518, "uuid": "51c650bc-e7e8-4f85-a084-3442dd6f45d1", "value": "12288:Plnbd/HClId9wadaYOhHHkB4HhP3E64RDGdJtySuio+Uz74L0WZ4oburZTWDMdLo:9n3IFHHE4BfW1aJ3/2ELkeYZ2Mdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907518, "uuid": "f644513f-f768-4ec2-b9c1-3e38625d3eb7", "value": 755464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907518, "uuid": "a9ba1e37-8304-4d06-a94a-dc2f7ec291fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907518, "uuid": "a7804f2c-ca30-4557-999d-787f8d6d2264", "value": "3d598d95b0c985d9a1e2fd399f00ebfc5177539b9e0c814ae12abadfc4933e0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4041f7c1-6311-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780906116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906116, "uuid": "a94788fb-a837-4efd-9741-02dcf45e34a8", "comment": "Malware payload", "value": "d2ec16db8621508cada2d9fd60127409", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906116, "uuid": "fb616a0d-1bc4-4d4b-bb09-5dcfac9213f8", "comment": "Malware payload", "value": "3d91b861984bda9fb52b9c082a2839d0a11a9d83979c79676a8667472da8cc09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906116, "uuid": "c4cf5f2d-5c82-4814-a103-9351bd9596d6", "comment": "Malware payload", "value": "9f36ac3143357a25935d812f3cc738129188ec84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780906116, "uuid": "3605dba0-6819-4016-be26-83d32b9b40a0", "comment": "Malware payload", "value": "c22b26fcbd67e9e4d706ac576b6839d28fa6c89b60557a30cf5f4e0f4eae76590afbe2a6de3d6f00d530d835d754fa07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906116, "uuid": "bff8b0e4-d69b-4ce0-93e6-24d53449a5cd", "value": "T15C158D96FB189E67C5B5023E88DB83142331CD8137869B076B6CF27CAD77638AF06585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906116, "uuid": "f6919c49-cdc7-4559-a45c-bfd6c7d6c35f", "value": "12288:myMODLy1CG161nsNv6iw3+vTHpvvlKfmIigDUcN9SF/EyaRHgy:PsNplGN9SF/laRHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780906116, "uuid": "e7d21722-e083-4104-9ce4-ed433ae56481", "value": 901540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780906116, "uuid": "bead59fb-0dd2-4bb1-94dc-df76d7898095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780906116, "uuid": "edde232f-2f42-4167-b869-44bc42e4017a", "value": "bot_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6afb933-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908114, "uuid": "65f625b1-ad15-456b-b3c4-9909ae120c97", "comment": "Malware payload (PhantomStealer)", "value": "9743f6e6eeeb7aec1ba0424b19d2fa6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908114, "uuid": "42f3dd79-3bf7-43bd-979f-cb870666c1d3", "comment": "Malware payload (PhantomStealer)", "value": "3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908114, "uuid": "f00c01db-6780-49b9-84cf-30e088f4306e", "comment": "Malware payload (PhantomStealer)", "value": "64531a956caa5220740fb87b1955ee1a3f1a3910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908114, "uuid": "3c7edebc-84de-4ead-9d9a-f3ca70b3b218", "comment": "Malware payload (PhantomStealer)", "value": "cb679641980f84af2a58133b2e82c76e558ca0d316eeb3a0e2c9ac45118793b1042ee63d3d05595e5677128d16ec32a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908114, "uuid": "05b857e0-64a2-4be2-a1ec-f11326c6f693", "value": "T123751245225BDE05E0F69B7948B0E3B007745F89B570D2039EFABEEB7476B9058183E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908114, "uuid": "023583b1-7c08-44d1-9170-9a1e63d965e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908114, "uuid": "68fef127-4753-4ad8-bd47-0bb4d53e20a8", "value": "49152:/hfR7nOFPX8TvO3d9LTdb8nE1sni1xXQA:/BRyJX9vLG1niTX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908114, "uuid": "3c0abbd4-bb85-43d1-945e-144fcdf9120e", "value": 1586688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908114, "uuid": "64cef403-1559-4d88-ad18-ce5d3d2b10ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908114, "uuid": "5af2690b-ee9b-4080-bc99-55d19b5b8688", "value": "3e0a071cde2ad22ba0d3c7bb1f8a838e4e5f1661cbb582bfdba3dcd91e25e63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cd1906-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908568, "uuid": "6b51042a-b19d-458f-91db-9781120b14be", "comment": "Malware payload", "value": "270f40e0d5c38f7252deff100eb0f2b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908568, "uuid": "0294becc-c6e4-4fa7-81b6-396d18cd3d05", "comment": "Malware payload", "value": "3ef8c70c9ef0ba8a9e986ed8cdda7b91858c3efd177d0bf14d582097cdce3a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908568, "uuid": "7cc674f2-4c03-48cd-ba62-2fd005dcf7fa", "comment": "Malware payload", "value": "2953df9225ef3b860c4c81e2ec2e55f175f2745f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908568, "uuid": "e4e8157e-b647-4b58-9818-c4851fd90478", "comment": "Malware payload", "value": "3e7baefeffd6547bb771f314e09de4a95547a5e1e2a3d534426030c91c4530bf28477e2a7a432b1c0b20bd2855929df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908568, "uuid": "81d2b821-04fd-4860-8afd-e4cdad80c111", "value": "T13F55C543725DD70CF43DDA3430390EF927B0AD279512AFAA7485BD5EF831769CA0A292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908568, "uuid": "41ddd70d-ad43-4a94-b8d1-b3209d0546c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908568, "uuid": "751bbdb6-d497-46fe-9920-61b34283e9f1", "value": "12288:oXeYLX/w/YScvdO2TZrBRh5le5WYYYYYYv2v3gkxRcefJbp1X8U8tnelcf:HQXucvdO0VRh5QqjeRbp1MU8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908568, "uuid": "60caef97-a235-4122-9e5e-70e92980c688", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908568, "uuid": "99ebca63-57dc-48ae-976a-3cc73f563880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908568, "uuid": "c4ec725a-2d1c-482e-a3da-6fbfaf44f09b", "value": "3ef8c70c9ef0ba8a9e986ed8cdda7b91858c3efd177d0bf14d582097cdce3a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916560b2-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1780908400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908400, "uuid": "a5f22614-e7df-4140-8091-e5068456533a", "comment": "Malware payload (LummaStealer)", "value": "7977b1e3f9e4a13bcbc4862d75d1b277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908400, "uuid": "6406d2ad-239b-4855-b9a7-d0b10af00d86", "comment": "Malware payload (LummaStealer)", "value": "3f7d51dd1fd7024371b155765420f2220d247a49fdc593b2eae02bc96b2a206c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908400, "uuid": "ba1e09d3-5566-422c-8b92-1d9bd770220f", "comment": "Malware payload (LummaStealer)", "value": "c234ee75f50fa881dbef9ada7540b7d6c9a3743f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908400, "uuid": "05f2711a-31ad-462d-bb9e-3d8fcb23ac73", "comment": "Malware payload (LummaStealer)", "value": "ad1b9697321f693506105f300f0eef8d8750eea28fc4a70d028276a76c5c30d879f55f8dc2a557c12732c57905aa6c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908400, "uuid": "1bce0825-1d54-45bb-820f-93d4ca399e6e", "value": "T1A2954A10FDC749B6E402223699BB22AF2735AD054F329B9BEA44777DE9772D50C32309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908400, "uuid": "2792ecf3-3be6-4613-8287-638f874efb9b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908400, "uuid": "e50a8367-408f-47eb-8107-fa6cc5514872", "value": "24576:s6H70luF0g/L8B4fRRlsALbWlyGn2Il048MdV9ZH0mIBbkHQgy3daj6b3cOlTbJ:sI7LZRIF8BgHQpwj6bsOlTbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908400, "uuid": "abc1aed7-420d-4194-8e3d-d7151fe1b6d3", "value": 1926272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908400, "uuid": "4d0ac8a3-efda-468d-a464-eee3900ed4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908400, "uuid": "e596a7bc-966c-4b47-93b1-2e59cd9e10db", "value": "3f7d51dd1fd7024371b155765420f2220d247a49fdc593b2eae02bc96b2a206c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1251be6-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780910171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910171, "uuid": "50c5c1cc-a46b-4bcb-8cc9-6a44ad9875a3", "comment": "Malware payload (MassLogger)", "value": "d15f67f42f5c581a5535d957ecb84d7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910171, "uuid": "c9b22fe3-0c5e-43cc-a96d-d99bacb69b57", "comment": "Malware payload (MassLogger)", "value": "3f8054136bf16e1aa184a275e7252366ebf577932f632ee75aee2e1c477955e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910171, "uuid": "80af9943-7658-4899-90a9-15ee8b5759c2", "comment": "Malware payload (MassLogger)", "value": "ede231bd8bafc3b693947f030815998ed327d8d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910171, "uuid": "70a3ae52-6b07-4d12-8aab-6e1ed6aeb03d", "comment": "Malware payload (MassLogger)", "value": "da6a6f92024dbdabb40fe289d8f7cfce1a2e7ed96bc2284bde520bf69ce18444b718f1963dc99ec1319511a0973fcf12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910171, "uuid": "6d46d1e5-0538-4ba4-a23d-1158557cb783", "value": "T1A7350248224EEE02C4914FF51931E2F40F785E8DE542C30B9FDA7EEFB8BA7951585292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910171, "uuid": "e34d77c6-5f23-4da0-a72a-a0fbad747f4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910171, "uuid": "d5f1c40b-1fd9-4a3d-95a7-46c87114b6f3", "value": "24576:LtzZ5IOKJL21oBSrIcP9UTcigXTl13M5F6w:LtV5IdJLaoGTP9WcffM5sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910171, "uuid": "144d0e3d-0b47-4316-9846-089ac5aed771", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910171, "uuid": "828ec8e6-73ee-4701-8c0c-2ff7ceacccd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910171, "uuid": "6199ddfe-26c6-42d5-bcee-64ce7691e9f7", "value": "3f8054136bf16e1aa184a275e7252366ebf577932f632ee75aee2e1c477955e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78000d3e-6356-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780935845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935845, "uuid": "e57b51fc-4361-46ea-a9de-a8d220bd8563", "comment": "Malware payload", "value": "44da3f4474dd47703972aa60954f7425", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935845, "uuid": "ad86941f-47a7-4ed4-a2f7-5d6b8de46a4b", "comment": "Malware payload", "value": "3f881606130dc85d6a11cf5cec9222fe6bf7da974ee3632f67dc7433af42a8e5", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935845, "uuid": "0235d2ea-5056-4cde-8ff3-9f666eead9d9", "comment": "Malware payload", "value": "1e6622a213b1aa863c52b2f174b63c846ecc6dd7", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935845, "uuid": "017d0662-f4d8-4b07-b0d3-67e2752546d0", "comment": "Malware payload", "value": "c2860d6bcab37b908b5db1b811e13f1c031a1bc893a8be9f1bdde6ffc057893bdee815fba1854b2a0c22a9108facb8a9", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935845, "uuid": "cf9f8bef-075c-4aa5-af80-20122fbdb261", "value": "T13DF44A6B527AA4D4EC4732787B8A3BF7EE40B47763B5E4A9AA42513488F3374513021F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935845, "uuid": "3ee3b7c4-1d64-40fb-b8df-25dce0be6373", "value": "12288:bUoLDfDCf5ATJthqgQZcotxO4yWZQYLEeulVkc/Z1uP:bUoLvCKTCx1IVkcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935845, "uuid": "07dea883-82cf-4903-8818-2c5b3d0dce17", "value": 723072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935845, "uuid": "a31c1603-7907-4259-839f-60bf52945f15", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935845, "uuid": "e810d9f1-d55e-487f-9967-67d38976d484", "value": "GITHUBCODE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20686f3-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908562, "uuid": "ae311edb-8f7a-4218-b899-a3fa610e6e18", "comment": "Malware payload (PhantomStealer)", "value": "abc9f54ec1aa524b929195bbe7c19059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908562, "uuid": "9ffc88a9-af81-4648-927d-70284cd51662", "comment": "Malware payload (PhantomStealer)", "value": "3fa18cc53e1e88e8c62db1e4b7202e9bd71fd90d019e02e2a5ab7e0992bdad41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908562, "uuid": "2aa0083c-7aef-45de-8d65-b670f3cd96d6", "comment": "Malware payload (PhantomStealer)", "value": "fa298494e8f6e9a46d2fd229cd877544005749ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908562, "uuid": "155a00d2-1d3b-40b8-bccc-71f5627f3df6", "comment": "Malware payload (PhantomStealer)", "value": "db8b35601b0c9785878755b5dc7d6e0a71edcc7d658899e3e231c60dea1646470e5c3a450cd80eadc68d97fedb3b64a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908562, "uuid": "9f0f8109-89b5-4890-ad89-0029e55990ff", "value": "T1AF751215221EDA07D8F64FB45A60E2B117B89E94E825D6038FDABEEBB87B3411D05343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908562, "uuid": "2c371069-1f86-4340-ba5d-604d559840f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908562, "uuid": "91e139de-a36f-48c0-8952-0cf9b8e04c08", "value": "24576:fZLidWSBB3NIWejyT6ANDEccPyH0Jr4Jk97v6JmK062O6CYPaEZ13/UMuhaEqAE8:fZLoX9jT6Lm8JOT06xfiZJ/3FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908562, "uuid": "0cc6fa33-8b79-4a29-8f46-f3771553cf92", "value": 1583104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908562, "uuid": "64734217-fda9-45f4-8096-9f6042e3b769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908562, "uuid": "aec0aecf-c585-42a9-bef9-383c4a251473", "value": "3fa18cc53e1e88e8c62db1e4b7202e9bd71fd90d019e02e2a5ab7e0992bdad41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c194b2-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877190, "uuid": "dee77a0e-e190-4886-b52e-7e8d9d70c411", "comment": "Malware payload (Mirai)", "value": "bbd951d7c24b6721be6aa31beaebda83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877190, "uuid": "929fd1d5-ceb5-4495-a681-1647663bc3eb", "comment": "Malware payload (Mirai)", "value": "3fee9387980f52a9019556e7bab45bd93eeb6e7697ebfc16614c0b1fd1920c07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877190, "uuid": "d3473e62-d26f-4957-83fb-479a63482fb5", "comment": "Malware payload (Mirai)", "value": "b1ee4b1b72de9a546c1283ca1e324f9ae96c5a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877190, "uuid": "78f0c73f-d1d5-4d12-be5e-d031633805cc", "comment": "Malware payload (Mirai)", "value": "c704548a7cd0d5d3a63ac5d1d5712983682e18ded65721ab33b1f492ae92141ce753e1eb84d94534bfbd53f007dc3783", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877190, "uuid": "7f6a7f6d-3189-43bb-9f1f-2dc3116da7de", "value": "T1BE646617D9154895E4A44CE322773246AC4B83BF89E732E3ED5A49A1FF2141F42BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877190, "uuid": "4aa41b80-7b61-4d74-84dd-02847969fff1", "value": "1536:mnVKIS+Yyma9JNj8F3YzT2UCt9sqoRs6QquNScjHejTstmGbLcZNHsUE:mnVKv3ymy8F3Y2t9Lcs6QxNP+joC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877190, "uuid": "e5588a0c-e12b-435e-a78e-e30e8ecf359a", "value": 310024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877190, "uuid": "511ac062-31cc-4fe5-b33f-50f7ca5b166c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877190, "uuid": "849060b0-8117-4a49-beb1-e30f4a8d689f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009e7ce3-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908587, "uuid": "ca442c4c-5456-4313-8783-339152c27e33", "comment": "Malware payload (AgentTesla)", "value": "82359e0a332525d016d04cbc1f70578c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908587, "uuid": "cdcd1ccb-97a3-49e1-bc72-eeeb9b8be414", "comment": "Malware payload (AgentTesla)", "value": "4085d77e5d4acdba609981f805b8e57f51db76caf829ac2c91aaed7162e36ee6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908587, "uuid": "3272beef-04ed-4670-a167-61a133b3c85c", "comment": "Malware payload (AgentTesla)", "value": "2b8585f66bfd1c5760171eec8f526a88d114c9a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908587, "uuid": "85450841-114e-4b18-904c-76e7d8651e1c", "comment": "Malware payload (AgentTesla)", "value": "333a7e3ea73f5489b72dcb04164c5a562b126e68260314dfb6e92c5e544c8c634bd828e3a693799ba892a461bc4c0a99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908587, "uuid": "0ed19efb-d67f-4fba-88e8-9d50e03b9046", "value": "T123350241220ADA06D4A74FF45921E2B017B49F94ED11E217DFEABEEFB87B3402D05293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908587, "uuid": "0ff07abd-9ee4-4926-bd18-7d5d88d9ad6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908587, "uuid": "5fcafbcf-6ab9-4f3b-b4b7-0508a50a7d63", "value": "24576:ZZLNdqb1xjr7NXErW0WMl3SSl5QxRUvFAEFT0DDeZ:ZZLodrRXEbDliSYxSd3FQ/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908587, "uuid": "c287a97a-326f-484f-919f-709ddd1701eb", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908587, "uuid": "a4706a0b-13b5-4184-bda8-ff403fc28ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908587, "uuid": "e6b547c1-1de0-4320-bb3d-feaca91900c3", "value": "4085d77e5d4acdba609981f805b8e57f51db76caf829ac2c91aaed7162e36ee6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197af4f5-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912494, "uuid": "4ab0751a-fa93-47e5-af7b-e837c8be5380", "comment": "Malware payload (AgentTesla)", "value": "233375ad3f6a4733f213f08610cdaeb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912494, "uuid": "48820118-f64a-4c8b-b1af-f6921d65cd7b", "comment": "Malware payload (AgentTesla)", "value": "411b3e4c693c18b6cbb74d1b64c5ae064e0e80486ab01daa6b781dfada495517", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912494, "uuid": "54095f88-02a1-4a0b-8b49-b05a02e6fdeb", "comment": "Malware payload (AgentTesla)", "value": "2ca5b5dd2596ad4dd6a443cd90129c5bea35a263", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912494, "uuid": "f3e3a896-f764-4b3e-b4ea-d2dd3e5a5f13", "comment": "Malware payload (AgentTesla)", "value": "693bb51f70d1de158d3cf53b8ba4f29bccce621113046cbe2ea4dcff2451f423eaec4dbf2dc01ea41e58874893dbb0ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912494, "uuid": "217fb0f0-912d-453a-8d40-266e3fe21b00", "value": "T1EBF4321AFA10A06BF49749F1697889467D183D362654BC0BF7402BAA30747ABF5F0B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912494, "uuid": "22da6ac9-b40b-4122-892a-50658f87d5b4", "value": "adf22634a8ba9df7ea7b45f4cefa77a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912494, "uuid": "5e1ca163-d223-4ac0-a922-42cfe566faed", "value": "12288:tSBmNL22iVZoTNh8EP75dMusxExVOkm88MGu8o/gOgfky0NAgnko6:MIiVJXLExl8g8Tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912494, "uuid": "b9d74f11-46ff-4c54-86a5-d51700fbbbac", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912494, "uuid": "84ffafa2-397e-4701-a338-3da0a111f983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912494, "uuid": "264ad01a-19d6-4404-afc0-fc25b6bdc824", "value": "411b3e4c693c18b6cbb74d1b64c5ae064e0e80486ab01daa6b781dfada495517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea99ee3-62dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780883538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883538, "uuid": "fb62a7cf-1fc3-4e28-b28c-9589e09d594a", "comment": "Malware payload (Mirai)", "value": "95f12bc4fcae6948a4b07a8ca5943542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883538, "uuid": "4c4391c3-b542-4309-99ed-67d38421c660", "comment": "Malware payload (Mirai)", "value": "417540002165ae9c7edf056e7f086d916adffa07fb5ab93a16b9d7483d86ea60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883538, "uuid": "75b72d28-6dc4-4d66-bfd1-170a109bebb6", "comment": "Malware payload (Mirai)", "value": "eb943c225568f7da28cfc697b6f0efcc9f874560", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883538, "uuid": "1e1cc058-102c-4d8b-840b-28022ce20cd0", "comment": "Malware payload (Mirai)", "value": "1340ae57902e624cb46bbb54db7bed12a02d11313a75ff32848b105fd69c469a77888edfa50fc5e7a6b5d23a72d394a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883538, "uuid": "72097593-f7af-4fe8-b8f7-59af138533a2", "value": "T108F3C71AAB510FBBDCBFCD3702A90A0539CCA55722A43F763674D528F54A50F4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883538, "uuid": "a46743c7-c2fb-4178-9fd3-5f7e664cd039", "value": "1536:ycQAW0sBqR9azJWDlVzVxkl0J1shIwkMxrFZ1zs9ZMP90e3PbGhqOtbTgr34r8+n:y1AW0sBq+96vixrFuG90aDGBtbTgv+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780883538, "uuid": "2940aa5b-a36c-46c8-8770-03b5b214cba7", "value": 161144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780883538, "uuid": "7f35837c-ea03-4c58-be6a-a9b0b5d94b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883538, "uuid": "7b7807eb-0a2d-4e42-af90-5c0cd7620e77", "value": "CRY.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0555fe3b-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910312, "uuid": "ea3323ed-cc3c-4bc9-ae03-7d7a6b69fc31", "comment": "Malware payload (a310Logger)", "value": "7ff4866828dd3acb8c72874fb1205256", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910312, "uuid": "f16d9c17-177d-4688-963e-570078d28e33", "comment": "Malware payload (a310Logger)", "value": "419429f540f598b5a60767a6b31b4fc48a40607b76cc6fe4cfde48311bd94f8f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910312, "uuid": "5ded83ce-b0cb-4734-9242-6a8d93fc8f12", "comment": "Malware payload (a310Logger)", "value": "d922fec39e4773684137dfae3b691c4e2e68b1b4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910312, "uuid": "029b27f6-b75c-4990-a360-f39689b6d47c", "comment": "Malware payload (a310Logger)", "value": "8d97dd770e3e27af7bc8890958d23d905a086f5450b40fde7700f5ec0430b7c06945af98e2bce3d6c3a9325fa03735c6", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910312, "uuid": "cd48b960-bd5a-4b73-8760-316650d03339", "value": "T19D352229361ADA07D0961B780A72E17163788F1DD525DA03EFEA3EEFB87E7940119703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910312, "uuid": "8427af8a-babf-43b7-b22c-4a516fa531f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910312, "uuid": "172aba54-ec9d-49d8-a354-8c16e27462c9", "value": "24576:ojf1IPNTtyVLTZMmouAzipLSMXKBIGBB/jepCOUl6vT6pvHijjeCvnNr:ojNIlTtaOvuAWLFRIICOUQT61CfeCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910312, "uuid": "13a00981-0f10-4967-a985-303e5f065597", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910312, "uuid": "38bb1ff7-b120-4858-80c9-0fe217a265e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910312, "uuid": "2fb1ee58-f15c-4bb7-831d-510d9bd48b32", "value": "419429f540f598b5a60767a6b31b4fc48a40607b76cc6fe4cfde48311bd94f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e029be6-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908206, "uuid": "49960bd7-d357-4f02-9326-f28949491d86", "comment": "Malware payload (Formbook)", "value": "431ec56085a842f1cb61e21ea667def8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908206, "uuid": "a51549c0-e139-4dc7-8cca-97b74fa93e8b", "comment": "Malware payload (Formbook)", "value": "41b29339665e6cfb63bb28d4939f985cce1b3c09a8a3b8e14234a34c7e40fe0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908206, "uuid": "44cb2e4b-a463-43f1-b38d-f0eccaf6aa0b", "comment": "Malware payload (Formbook)", "value": "598efe84d8cb520d2f9f84e71d82f8446b62a16b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908206, "uuid": "a6741a65-36a0-4ca3-8961-ae9233df0e2b", "comment": "Malware payload (Formbook)", "value": "aa8e51c56b89f6ded5b5fed7b074111e0a453fc7d4bb413417f633ea4e76bcfb5f21e8ac48ad3823bcaaed084ac095b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908206, "uuid": "cada58ec-5621-43c5-a3e5-5b0528798645", "value": "T1BA350214231ACA06D9E65BB11860E3B917744E886621E313DFF7BEFBF83A7413945392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908206, "uuid": "42a71802-1a45-45b2-ae9d-be4a78b44612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908206, "uuid": "0a4e8843-dca0-4749-939b-8295fe8bb99c", "value": "24576:O4TS17IttzSV53+iD8AX+x+JYYfgh8gyOLH8KAortVLbalfBf:O447+lriYAOMSB1RJrt5alfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908206, "uuid": "a1aee4d3-6171-44ef-948c-855e7c0de09b", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908206, "uuid": "86b80c79-a035-4e1c-a757-2fa91c05d807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908206, "uuid": "e9fbeb28-479c-4d8c-8c2e-0a3f7cfc3b96", "value": "41b29339665e6cfb63bb28d4939f985cce1b3c09a8a3b8e14234a34c7e40fe0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c95154-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780910578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910578, "uuid": "d6b2264e-2893-4405-81bd-bb31aa144178", "comment": "Malware payload (AsyncRAT)", "value": "85812fb32d79fa193c6f046ab3614ba8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910578, "uuid": "609677e8-086c-4ad8-a6f4-e4908c293c41", "comment": "Malware payload (AsyncRAT)", "value": "41d0a449e657da1473447ca21ed3dea47b3d311b7ebcd73413d62bb5e139748d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910578, "uuid": "11b32c15-c940-4c09-9112-5faafd50031e", "comment": "Malware payload (AsyncRAT)", "value": "dff4255f779225d40fedee38db209b262850c762", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910578, "uuid": "c5f086d0-1a97-4d7c-89e7-cde07840c350", "comment": "Malware payload (AsyncRAT)", "value": "0cf7dc4a861f8e51fb4ad4da13a11351091ee8279f720d07e455d4f8575b7f974b48519c4dd447a053e14cfce4bcec1a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910578, "uuid": "a9fc3e68-4296-4da3-9342-c9b6a30c1032", "value": "T11CE412282A1CE846D4961B751C72D2B46B3C8E99E520CA43DFDA7FEFF4BA2541C05392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910578, "uuid": "f0c53958-084d-4f64-9c75-b3e33d46770e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910578, "uuid": "69cb5082-d1e6-48ce-8ff3-ddc0de43a5bb", "value": "12288:nnxX55Gof7QArZjfU5V9B2P3+KoKpiTcc80tmJo51HW+udMITxG9K:nnNraAxUPq+Epie0sJIWjTxwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910578, "uuid": "e7b833d5-677a-419e-9ff2-ce35c8612b83", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910578, "uuid": "b6ad4120-6ad6-45d1-a2cb-41c77a0a8aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910578, "uuid": "fa5391b8-d273-4b4f-92fb-e8819b8253bc", "value": "41d0a449e657da1473447ca21ed3dea47b3d311b7ebcd73413d62bb5e139748d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d8f17d-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780907600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907600, "uuid": "4bc28a90-9fa6-4e89-9ca4-e88a92d560f9", "comment": "Malware payload (SnakeKeylogger)", "value": "50321b23400695398f15385bf250f524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907600, "uuid": "9d9f16d4-797e-4143-bf9b-dff7d67583df", "comment": "Malware payload (SnakeKeylogger)", "value": "41eb85a9e62da2ee9f42eb771c6db43096202cfc7559645ea1e57fd8793ceb96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907600, "uuid": "2a22cf73-3929-4cea-a9a1-72ad36453d68", "comment": "Malware payload (SnakeKeylogger)", "value": "6cebb0683c96c0ff6eb7e2b04f1b411ce7edaeca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907600, "uuid": "11c8428a-19e0-4eb5-9f7d-ba4f669da69d", "comment": "Malware payload (SnakeKeylogger)", "value": "87557b42a819ac35d22db3466bbd80de97ca3a752e7bddb533c23e5ef4c942c46fbda3124a740d8c3a2a4df8564e8d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907600, "uuid": "91920359-ed73-4beb-810a-e162570654b4", "value": "T1DE0502156619C822C8925FB45C31D1F81BF49E98E912C3039FDE7FEFF87A7A4055A282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907600, "uuid": "f73fd716-c0f2-4404-ab76-076da313c4ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907600, "uuid": "212213b8-7073-470e-ac9d-bd58ef521bd6", "value": "24576:LfVdHhwZtDXPNjrFHtyMGSk7qlvQFx0plx2bpJUAKyR3qr:LfVdBwrlPFHEMFkGliglKpOAvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907600, "uuid": "eb29b2c8-94fc-4487-a835-b7252f61482e", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907600, "uuid": "08c92d9a-e1ed-49b2-a5ea-3018a7b51e2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907600, "uuid": "dcfb319f-c606-48f8-8151-f03035811a1a", "value": "41eb85a9e62da2ee9f42eb771c6db43096202cfc7559645ea1e57fd8793ceb96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1e8c95-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780907881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907881, "uuid": "385dc0b2-0644-4bb0-8048-2d65c011fa04", "comment": "Malware payload (njrat)", "value": "99d3381e41e87976cfa2c3d16214667e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907881, "uuid": "842b2637-b1e6-4ec7-a14d-90eb221e6696", "comment": "Malware payload (njrat)", "value": "4205d7fb94e2f9896e18546305528a7edc46766ce9d220200b3e4d82228f463e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907881, "uuid": "dfb8be4f-da19-42bf-8a3d-61cf11fb5ea4", "comment": "Malware payload (njrat)", "value": "0f243c2947d8f0240c8d4901ca7f746c914f5887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907881, "uuid": "d37e40a0-cc05-4c16-b3c1-9b6918b69a8f", "comment": "Malware payload (njrat)", "value": "a3c740d56286d0fd709416f128ed83114e1c70cf0b94817a06244353470c422febc0d65b1f854e0c1d9277ddf4c08515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907881, "uuid": "e490166f-2373-4199-94e6-9719292257f3", "value": "T1DD05F150231ADD06D4D25BF01860D3F503B88E98A915D3139EEABDFFF87AB8539492D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907881, "uuid": "8987faf2-44c7-4bfd-a32f-d934f3d26449", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907881, "uuid": "02139002-f344-4529-b5e5-ffdbbd05d7e5", "value": "24576:n9N4TS11keDSRSm5kJ85gnK/BVFUqJz+j4aniq:P441WRv5keyK/BVFUqJz+0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907881, "uuid": "0be4198e-8d95-44f1-9d1e-8ae92418597e", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907881, "uuid": "cc24c5a4-6052-4dc1-950c-3273ff796d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907881, "uuid": "6fdac694-7e50-460c-bd67-bf3f9a9e1aff", "value": "4205d7fb94e2f9896e18546305528a7edc46766ce9d220200b3e4d82228f463e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4fb667-633e-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780925407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925407, "uuid": "1732e014-aea3-4b73-8b72-e33c22aa84dc", "comment": "Malware payload (NanoCore)", "value": "321a3484c002a13027b30990f9542037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925407, "uuid": "8f53bf21-00de-4612-99bd-4b7a958dab63", "comment": "Malware payload (NanoCore)", "value": "42096c25d984649b38930437d79ed3bcb3bf8e2e52aea01578fac943b793eafa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925407, "uuid": "21caf9ab-2d72-4dee-9ddd-e5a154894e2e", "comment": "Malware payload (NanoCore)", "value": "1093605e41773f87305322c47d82c0ed82493933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925407, "uuid": "cbdd8360-874a-4d6a-b9d9-34d6c06d92a6", "comment": "Malware payload (NanoCore)", "value": "4acf218ac97d1120d3381eebe98b229acf378b8da60fb62eb9332e283067428f7a4002acd5145615e2a5684d2ef81090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925407, "uuid": "aa4eb6b9-ef24-420d-b2ba-bda980ae4565", "value": "T16314CF567BA84A3FE2DE857D601252139778C2E39CC3F3DE18D865B69B263E00A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925407, "uuid": "f22a8424-9107-439e-883b-b6780ca97313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925407, "uuid": "02327cb5-f681-4e5e-8829-02fc55f17c1e", "value": "6144:QLV6Bta6dtJmakIM5ujaSdHlHMLHLpnN52:QLV6Btpmkt3FmHLpnN52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780925407, "uuid": "345fdc26-ac6a-4d96-832f-a745410dcee7", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780925407, "uuid": "3bd8a795-5fbb-4d8d-8da4-69197a934e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925407, "uuid": "eff516af-c2af-4a0f-93e3-97201acad0a4", "value": "88aavn.one.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea7bca01-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908549, "uuid": "448195d8-c761-405b-b13c-726bec14f9d0", "comment": "Malware payload (PhantomStealer)", "value": "5dde11e44d06131109688e6375be6ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908549, "uuid": "df315296-a9d4-4d47-90e0-d6ee03aea6a8", "comment": "Malware payload (PhantomStealer)", "value": "420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908549, "uuid": "36229dd5-c8d6-48a7-9302-edf2cb013e03", "comment": "Malware payload (PhantomStealer)", "value": "7adad0266e5301ff6caa2b774d271baf638e77f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908549, "uuid": "7d6995c5-decc-497c-9962-00baccdc89da", "comment": "Malware payload (PhantomStealer)", "value": "a82f5af22cc6523d4dadb61c01d6b3daa80549083d09ad48f76326a8848d1af47eb5460299e2b3113ed5db0b30812bf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908549, "uuid": "81de2d3c-2c08-4273-a941-c8a31d684e8b", "value": "T14E751245225ADD02D1E60FB459A1E2F027745E88E936D2478FE6BCEBBC7A7406C093C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908549, "uuid": "fc586b88-c292-45b6-8ddd-98cdc915c2e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908549, "uuid": "8af8faeb-fe23-4e0e-9fdf-7e1bc7ff6334", "value": "49152:ZZLyYulNFwjhCivtkazKSGUSv3Xhfjmo3FQ:nulIlfvtFeF/xf9FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908549, "uuid": "c17f84c9-103a-41a1-825a-38eb61dd3e2b", "value": 1585152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908549, "uuid": "0ff52f07-2d5d-4692-8398-0fd99043f84d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908549, "uuid": "f10818cb-2bec-409f-82d5-de8fcedc93a0", "value": "420eaeab7871c7c8f6dffaa6ad95ea564b44952b1edfec858d69b53fbda4ec89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db6999b-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780912716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912716, "uuid": "e60edac1-709d-4c46-850b-7434960bd78e", "comment": "Malware payload (MassLogger)", "value": "c8f3ae8a6096dc5d7177f112dc132aca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912716, "uuid": "d142a662-e97e-4d44-8ec6-eb7bc1a5c050", "comment": "Malware payload (MassLogger)", "value": "42b24642c77c39f7520664a257ebbb3b6478ed4c14c9ea89fcad75b49ab29772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912716, "uuid": "fb48cd57-1c54-468b-bf59-a5aa02cc1cfa", "comment": "Malware payload (MassLogger)", "value": "302de0536ab6cca43e118d5bae20f891e6e5b67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912716, "uuid": "43306cee-4414-4914-89d9-01bf33792c52", "comment": "Malware payload (MassLogger)", "value": "246ca9b97e5f5289ed5a2d5f0eec1f3de134ced0dc78dc4bf85894bcb5d91ce3e930e7e7f686fe413a37c7b8c6d6e4e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912716, "uuid": "076e8388-952e-4014-a231-79fbf0e57e1c", "value": "T1C10502586B58CB42D4B92BB80BB1E23123B99DCCFA11C22A5FD5BDEF3C6AB510545343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912716, "uuid": "5c1a5aa6-2d16-4e2d-8c37-d1ae7b3e68c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912716, "uuid": "412a7c23-8527-467b-b50d-28e6441f01e8", "value": "12288:8uyI3W/SzBvbQXsoY6aW01BxoYhmXFTxSEBWLHfXkyg/Od+Ymt0MsVHb+cpUS6N:M4yY6aW01BYuEAfXkyg/ivmt0MeHXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912716, "uuid": "1b90608e-147d-420d-92e9-593a33e0ca41", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912716, "uuid": "39c808df-e9b2-4b0a-8f8d-da331c06926a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912716, "uuid": "aa2815bb-7546-43da-a120-9ed1fbb3fefc", "value": "42b24642c77c39f7520664a257ebbb3b6478ed4c14c9ea89fcad75b49ab29772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d620b3bd-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910663, "uuid": "b08b3199-b18b-4512-9a5b-f44f4edded54", "comment": "Malware payload (Formbook)", "value": "118d413aef53a4c644ee10acfd96dbc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910663, "uuid": "915773fd-0fc4-458e-9bc2-752f4a4673eb", "comment": "Malware payload (Formbook)", "value": "42e34cc17b95ac48cc7664bf5bf3b31740cb2106ebc3e3b2c468f2d874f45540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910663, "uuid": "f0b9c9ca-3494-44c5-993c-d85c7f55c002", "comment": "Malware payload (Formbook)", "value": "24de0c3eec378a0e0effcd4012138456e987fca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910663, "uuid": "97acfeaf-9d5f-43d2-96e3-f68acc065afc", "comment": "Malware payload (Formbook)", "value": "39196c5a8014f62c087733baf1ea9f85561f7f7ed47134fdd3b6bebf5eff46f6ea6b22bed0636ee62f28cffd08e715d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910663, "uuid": "c402a08c-ba57-461b-8ace-4854b9d64e8a", "value": "T1C345F1089AE71642C23E07B9C0430548D3F0E65FA293D79FBBCC96E46E52FA6CE47591", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910663, "uuid": "63864193-fbe4-4a7c-b0a9-efe4522776cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910663, "uuid": "94087084-173a-4d21-8bc1-3b9fd8f478b1", "value": "24576:lHFrghvPmyAzyNshz/N5VpMeQoyfJuz05y+3X7X:liVmfzyN+r3VpPQoycwyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910663, "uuid": "030f4ebb-2e82-462e-86dc-90c2109b8634", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910663, "uuid": "ebda7561-54d1-465f-910f-5e1a1d76bb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910663, "uuid": "2d356888-703c-4639-9c68-eb386f1a4718", "value": "42e34cc17b95ac48cc7664bf5bf3b31740cb2106ebc3e3b2c468f2d874f45540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c3be84-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780913080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913080, "uuid": "417bc7a8-8f37-4ccc-b93a-3a70f42a4fc9", "comment": "Malware payload (njrat)", "value": "e8561dc8c5d0aa41f3732d36487526aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913080, "uuid": "53469ad2-72ec-4c40-b297-f937d965706b", "comment": "Malware payload (njrat)", "value": "43f8759b645306ae5a89ed8643d774648fc348a3aa6a0f8f4b0aa929ec203440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913080, "uuid": "42dc2b41-02ca-4d00-85a8-1f6f94e02152", "comment": "Malware payload (njrat)", "value": "7ba2fdddbf8ee9fc14dd67dba20089aec29e62dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913080, "uuid": "3957e3b8-85bd-498b-bcc1-cbf99eeacde4", "comment": "Malware payload (njrat)", "value": "eacac4ef8153aab2812b6df17236bbe73e0774f45ac26954350015707bbb608dfd8f1f0fb8709a0ad23f00f8375547c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913080, "uuid": "c5e50961-e905-45e5-aa15-72a464583f76", "value": "T1AE0502545319D807D0A65FB44DB2D1F81AB4AF88ED21C207DFED3F9FB93A2646846342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913080, "uuid": "4c78b341-7529-471d-9660-0244b1bd74ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913080, "uuid": "0a3b2c45-aa37-4845-b12e-9554c2f1681a", "value": "12288:UQDhz0ZtEpY4EIumfOEpLPA/p9TjgwF0ZlEpY2sjJgoeU/bO68Gb3SiUj2vN+sEd:hDhwZtdTo7FY/pRzkZVM0O682LxEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913080, "uuid": "fb34e848-9e3d-4ee4-991c-4ff22c38b06c", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913080, "uuid": "35f8fca0-0fc6-4d0b-a484-cedb4ba12ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913080, "uuid": "433850c5-c503-4cab-b4df-7a91c9b08058", "value": "43f8759b645306ae5a89ed8643d774648fc348a3aa6a0f8f4b0aa929ec203440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08342b36-635f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780939523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939523, "uuid": "419e9ac7-46fd-49a2-afe2-b60b7b072f6d", "comment": "Malware payload", "value": "41638fed14bc13c19d47d506ed091a27", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939523, "uuid": "6ff7db8c-9ac2-4390-8105-4d51f10b1b56", "comment": "Malware payload", "value": "440455d3e1e1266135fd55855ab23eafe0cbe50b7fd5de627da5acf94b518099", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939523, "uuid": "b618999c-cffc-4f74-aeda-688996d415ea", "comment": "Malware payload", "value": "42a58151ad6af0a1f90db50eea89f91db682e13a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939523, "uuid": "9da3dd47-97b7-463d-85ee-5c7078d9ae60", "comment": "Malware payload", "value": "a628ecae6d01d40a9488c9bb71f42afdcfa90105e8a3dca1bd220fca46a8b90af151331390a42f0509acfa8894a3f074", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939523, "uuid": "53734495-b08f-44f5-b5bf-36f755c5e943", "value": "T12CA423A6FDFC977ECAD394E21F28DA80471970FC233D8102499A91B27C9DB49C70659E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939523, "uuid": "af6b3bd6-3b6c-4bb4-bf2f-418927594a1c", "value": "12288:2uMJpIn8bbEdZ9BcahigQL9wtb+BkgHVQNiaeHYuyVu:9MfInDrQQo9wmvSNibHYFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939523, "uuid": "efede305-2567-4fe1-8e29-4f6ada6ba951", "value": 477340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939523, "uuid": "e60b57ce-e54e-4141-b2f5-d7a88a92be66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939523, "uuid": "deff404b-e34c-4c01-819b-86268ab13fd5", "value": "Crypto_Market_Executive_Deck_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336b7fcc-6328-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780915973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915973, "uuid": "c38f662f-277b-48fb-a54a-3224172c7a4b", "comment": "Malware payload", "value": "3cf041bbb82d5badb46e9ac0a8f0a33a", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915973, "uuid": "72443871-4c79-4a8d-a3a1-c9e24454fe8a", "comment": "Malware payload", "value": "442e0f4e822842922e7e4685840194e99fd68c7f0ec38c1925914b8f724d5865", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915973, "uuid": "b89a403b-a2c0-4e62-93b8-dcd17ac8379c", "comment": "Malware payload", "value": "2a7a822fcb86b37cec2b0a9833042121130ee0f8", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915973, "uuid": "bed5e7f5-a95d-44be-aa2a-14850593f509", "comment": "Malware payload", "value": "8f0127d060f43deb309309c7399bf3d9f0b5856cd51d071befa52e961cdf01fa3a5e5c90c47ed41f7c1cdf3f156d1ca1", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915973, "uuid": "b06fcdcd-a002-4826-8efc-bc5a09be98e1", "value": "T17996B7FC54B12EACC89B6AA0CF9D5AA4CCFF042B4CD7025FC1487899772063AD5269DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915973, "uuid": "d67d9a42-016b-44dc-8cdb-854cdae8f109", "value": "49152:z84n0PpDSkJ0sNn2gJlOkCh+5Hs1I8AY4zKp46Hq:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780915973, "uuid": "c7f3d2c8-4222-4f9b-b54f-759f8c0e2d48", "value": 8628255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780915973, "uuid": "5b7387d0-0586-4d08-8565-34d6a7741634", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915973, "uuid": "991c55b2-adf5-4a17-83d8-94bc8e5882ee", "value": "sim.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfb6bf4-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780911800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911800, "uuid": "3bea92bd-f480-4d0f-ace2-61ef7489bc71", "comment": "Malware payload (PhantomStealer)", "value": "1428fe8bb45e7872e17f5031ef85cb41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911800, "uuid": "3e8c5992-4951-4973-9082-3a833574202c", "comment": "Malware payload (PhantomStealer)", "value": "44fa0154087e70f9e72557af44dfda762849e510a7c4acb369fd9903cf6c3c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911800, "uuid": "6da4f9d9-057a-44d6-938a-632c960eb3b8", "comment": "Malware payload (PhantomStealer)", "value": "a58291abaafd63df517feb68dc3c1efd02c33acb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911800, "uuid": "8ac1db51-70aa-4e93-a3a8-82d99693256a", "comment": "Malware payload (PhantomStealer)", "value": "938abd1beca8c410e8e6d836e866011689244bd0ddefd247830cf346e92548c6fab6240355d481bb84f619d8aaad9b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911800, "uuid": "6285d4ee-4762-4cc9-8b91-4d51c4cabf8e", "value": "T18B6523B8A612D913DA811B386F10F2B4277D5EDCB900D652DFE8BEDFF9799649C20042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911800, "uuid": "10c7019e-ee7e-4204-a05e-e8861d97273e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911800, "uuid": "0d95f12c-4e33-485b-8a78-3690c60733bc", "value": "24576:az8nQU42tLhZNawY1oz33cVX61jwJiETuqOxqmSFiK94rZ/CpGfMx8V8YmCC:DnQU4gNrhr3cVXh0ipOIiNiM88Vnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911800, "uuid": "5c9794a1-a39c-48b0-b380-3f1d9dd08f29", "value": 1515008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911800, "uuid": "62f4a626-f54f-44d4-9cab-7340a2c67968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911800, "uuid": "eef788b9-110a-4d75-a9ec-92d18fd681dc", "value": "44fa0154087e70f9e72557af44dfda762849e510a7c4acb369fd9903cf6c3c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef2f3f4-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780910651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910651, "uuid": "4e313b48-6c4b-4b00-8f0e-eb3ac8e3d477", "comment": "Malware payload (RemcosRAT)", "value": "435ee9c6ac7e886ef32c4a51fef75240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910651, "uuid": "1ed69ee1-4dff-459e-b0e5-38f6f77d6888", "comment": "Malware payload (RemcosRAT)", "value": "457f3938d26e1b395e359b6e250460f5e938d02e62f0edb2ff0134764eb82c78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910651, "uuid": "baa4b219-171e-4964-be96-50aaa4149b92", "comment": "Malware payload (RemcosRAT)", "value": "e0327fdce9bce7397de61f6249087f219b159b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910651, "uuid": "a6421a21-8274-444f-b1e6-07ad9399f0f7", "comment": "Malware payload (RemcosRAT)", "value": "64afceafc8d62ff51d09040e8a9d9d5d4c09329faeccc8e8282e766abe1a9634293c31a6dbef6867766dfd64a92b67c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910651, "uuid": "0a94d161-fb1d-4c05-aa22-b872608effa1", "value": "T11265F1E06745C826D46796B984B6D5B36733AE0DDC65C60E2EC6BF8F7C723420053A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910651, "uuid": "4d5eb724-cf75-42fd-8ad9-de677ecdd17d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910651, "uuid": "725e0b48-b253-4be6-bff0-aee8ab523c1a", "value": "24576:jgzGnNr0+dg9wE05gxwKfGnmZ1kAgMtkazt/gDqEITj58mfmIPhbCEA:j5Ah9w3GGmZ1klahgXEj53fP5+EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910651, "uuid": "b89df5ba-da2f-45e6-bc3e-8a507ee0875d", "value": 1418240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910651, "uuid": "7a3099a2-7aad-4a6d-af28-e12b55330030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910651, "uuid": "45a38e64-e2ff-4e80-818b-b5eee3875554", "value": "457f3938d26e1b395e359b6e250460f5e938d02e62f0edb2ff0134764eb82c78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0291a6-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780928982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928982, "uuid": "10008897-ec50-465c-9579-fe56a6dd2456", "comment": "Malware payload (PhantomStealer)", "value": "d0b6a574466148b439bc61bc443481ea", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928982, "uuid": "5d77d14f-e979-4b41-93e5-0c22b49598fb", "comment": "Malware payload (PhantomStealer)", "value": "45c3f029ae148a6ea1d565aad3d5d936449c544b88814d504771826466677948", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928982, "uuid": "78a02273-c31c-4a82-aca0-ffd629b81531", "comment": "Malware payload (PhantomStealer)", "value": "4b4ff07559ad8e318435bc229af4e658c58154af", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928982, "uuid": "61ab3feb-4ead-4289-bd02-e548b85ff238", "comment": "Malware payload (PhantomStealer)", "value": "b71e24d425dacbd814de3209a6c7fd94ebfb7cfd4fc9a072856b8e057772c82326af3c1349865ed64c7a0dcd581c93eb", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928982, "uuid": "e94c2385-94f5-45bf-8801-3dad0806322c", "value": "T118513A255F981418DD4E34F8F73F90F030D7128DA99B93EFDA3BA82A920CC919801A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928982, "uuid": "16aadbd6-db4f-437d-b2d9-c56720a6427b", "value": "48:ZSuTOdv2xuMI+z7aP1TiRWGsKXuBHU5hkqoILJGc3/nopiprP:ZSuTOg1QWW5AHcruNo0pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928982, "uuid": "a431c0b1-c3fc-4264-91e7-d06b01bb5ecd", "value": 2746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928982, "uuid": "8c0e58d3-50e5-411e-a882-8b6495fba96e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928982, "uuid": "568fb93e-3de9-4689-bb31-e47439044388", "value": "VULKAN_ESPA\u00d1OLA_SA_REQ_080060026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dde744c-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907562, "uuid": "3cce1381-6c69-4595-b9af-c220a4772abb", "comment": "Malware payload (Formbook)", "value": "5e1f6d7b7d29135dcab5986c8be55ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907562, "uuid": "d4f754c4-c3df-4cd3-b9cb-63ff2e3dee82", "comment": "Malware payload (Formbook)", "value": "4679887e9d1fcbe491e0222af00369adbbe75a99762b614d76bf8aa42a235fa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907562, "uuid": "a941073c-c76d-4221-abd4-6ea2970aea75", "comment": "Malware payload (Formbook)", "value": "c5d703de5c71eb2af0c29115aba796022c80b486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907562, "uuid": "34f94165-3032-4a6b-8f91-203f4ed31474", "comment": "Malware payload (Formbook)", "value": "2ef2816ab0fe231aadaa98bb3d6cab56394d18df432bfb6eef9a1cabba58da011224ad31dd3613314f3fd3a22a7799b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907562, "uuid": "31260a07-6007-40c8-874f-6afb28da412d", "value": "T1AC2512496309C816D0925FB45D71E7F417B49FACE921C203AFE93FEFB83B2254946292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907562, "uuid": "5b7402e8-59a8-4e94-ac5a-39f3937502a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907562, "uuid": "649b8a7a-401c-4c65-ac23-74cd29a2c05c", "value": "24576:QhwZtV7AconrXVhUZGKH54Q+pZmfp9U4/Z0E:QwicOXVhUZGg54zk9U4h0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907562, "uuid": "c5c5f35b-a8a8-4d31-b487-d8f4253784a2", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907562, "uuid": "b0642d77-62f6-4537-a7f8-5ef1c0c30a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907562, "uuid": "1dc5488c-7223-4e5f-8274-ad69213d7e21", "value": "4679887e9d1fcbe491e0222af00369adbbe75a99762b614d76bf8aa42a235fa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b882abdf-6339-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780923498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923498, "uuid": "b475ada3-a8c4-4820-b928-494185aefe29", "comment": "Malware payload (MassLogger)", "value": "93e7df348d84f50798f172857a4f6a4d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923498, "uuid": "150c8ad4-564d-4de4-8b0e-098402b2a002", "comment": "Malware payload (MassLogger)", "value": "46bea9db5db69285b5ef7385aa816071b81c015dd353075e72f56e1ea9ac5665", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923498, "uuid": "8968d73f-4780-4a27-ad4b-9126bddc734e", "comment": "Malware payload (MassLogger)", "value": "f91993ee277fdd58c6a4b6791f7b203846cac955", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923498, "uuid": "acf5b602-c701-4416-9699-20cd0300262b", "comment": "Malware payload (MassLogger)", "value": "93e683ca679f881fbbaf70d667ff9f7ecdd20a26c681d5ca80f5f4fb7b39924c56f3c68468120555a120d00e1761cfca", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923498, "uuid": "9cb184fe-c464-48e8-ac8f-a47ce4eef109", "value": "T1F9B5FDC292A7CB15532103F72BA6D4E0554FE1E7EE03416537336AE099660E172FBCEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923498, "uuid": "f077e15c-bb50-4663-a62e-3dacdaee348e", "value": "384:tUvO/XaR5aHWaR5aH4TBWv/5QFOAlkyqqDg/ywjVSBltjM/9At+R5aHKvOwl9E8A:tRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923498, "uuid": "eecdda4e-826d-428d-b118-c09688c6adbd", "value": 2474986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923498, "uuid": "ed64a1ea-f74e-4c41-a346-c9c15ca116c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923498, "uuid": "39013aee-0a43-4267-9dd3-29cbd52e3b2a", "value": "SIP-114405.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79ffb0f-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780912866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912866, "uuid": "170d1223-7f8e-4887-b39c-2ceb71c0d7ec", "comment": "Malware payload (PhantomStealer)", "value": "2201cdd0365d0f98e30a97123d513c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912866, "uuid": "ee4ffab2-803b-482b-a900-ec3551a5862a", "comment": "Malware payload (PhantomStealer)", "value": "46c05cc1177909866f9957c0dd3d147ad19932f7bc8b9cc4637acabe90cf9cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912866, "uuid": "de380e19-1e80-4ab2-b9e0-27e7896b9804", "comment": "Malware payload (PhantomStealer)", "value": "490260bf683a48d46009aa7008eef645e43d99c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912866, "uuid": "997ce9b4-a285-4fbe-9533-8acc6245cd2c", "comment": "Malware payload (PhantomStealer)", "value": "126ff69951da35b6c5748eb6e493e6d201405934ef58b591ac030cb935b24b96f35c011d8e96b56f22b8ed9f861a2657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912866, "uuid": "6cc5689d-1be7-42ec-9d35-7b9e0aceb934", "value": "T12E6522086F9CDD27D8DA2B742A61F23233745EDAD604C22B4FD5BEEB7828B549644313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912866, "uuid": "9ce07db7-d08e-4e01-aeb9-6749bf29f214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912866, "uuid": "bc180916-bedd-4461-935f-1fb81361c6dc", "value": "24576:THM8IDd8xx8kIFfUQz9KQ8uCYJMHZ/kn8DSc1tJJ3fe/T7rRmpgJiJp:E8xVIFfUDuCYeHP31t3m/T7NmpgsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912866, "uuid": "09c55585-6441-4e7e-a73d-43c01bd82391", "value": 1525760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912866, "uuid": "21dfadb2-b867-4c6f-a7c5-8b788226d8fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912866, "uuid": "8ce82efa-1283-475b-940a-6965345cb395", "value": "46c05cc1177909866f9957c0dd3d147ad19932f7bc8b9cc4637acabe90cf9cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acae46c4-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912741, "uuid": "d8030dc5-29b9-42c2-8621-cebf6fe11889", "comment": "Malware payload (Formbook)", "value": "bc38aeece60fe3c05b63f2575ef7cfde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912741, "uuid": "bcd0a232-6674-41fa-b51d-798aab33f7b8", "comment": "Malware payload (Formbook)", "value": "47c49ad0bd2ec1c5840fbc8e9c6e797b522319ce8194d25aca69a5cd48b4d8ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912741, "uuid": "813c252b-455a-4951-8821-b389d5532c7c", "comment": "Malware payload (Formbook)", "value": "1b41a18ecb8d39d2a669e92bea936664cc951fc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912741, "uuid": "5e6e5572-5568-40e5-94a8-04c9a734e384", "comment": "Malware payload (Formbook)", "value": "4c7bd9cb14ae086799905b4219bfd1ab5aecdf8a2d6c4f1a7677ca74e7d2de12a69d5104067d62fbe758b1a75097d390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912741, "uuid": "67465bb3-c624-4d80-9025-1bc08e68eafc", "value": "T1E62512984F4CD002D99A17344E71F6B432699EDFE605C61B8FDE7CFB386D6912A89380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912741, "uuid": "11021623-a90b-4e4d-af67-ec3ffbaca7ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912741, "uuid": "d368d2ab-48d4-4758-a722-6bc7555f844c", "value": "24576:Ih2VaOWg/LlsJlPjeWU8huuWObxyIaJi9S7SwdFlFSxldbpTg59:2gTkVU8sxPIPSSCmNpTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912741, "uuid": "a3a083de-d65b-453f-83be-c6e99c6fe342", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912741, "uuid": "1feb14d9-04b7-4901-987c-fdf9ca8577c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912741, "uuid": "71235456-4de3-43e4-bd02-92c6bad91ce8", "value": "47c49ad0bd2ec1c5840fbc8e9c6e797b522319ce8194d25aca69a5cd48b4d8ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a40be6-62dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780884089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884089, "uuid": "865e8f8a-9415-4d15-bbdc-f0b8c0b401cc", "comment": "Malware payload (Mirai)", "value": "91bbdf2737fe17336f384350fc91157f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884089, "uuid": "6e3f5418-dbb0-468c-b34b-1aa67d539d8f", "comment": "Malware payload (Mirai)", "value": "47e534043afa79c25bd83f292844a48b81e49afb08369207c28931d6738dd7ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884089, "uuid": "c4a112da-a97c-4a9b-aef6-e535099040a7", "comment": "Malware payload (Mirai)", "value": "96d9b4f67bc40203437c3a5791e840704c8a2afe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884089, "uuid": "354b90f1-bda2-4963-8c51-859d5b718ff8", "comment": "Malware payload (Mirai)", "value": "07ba1b1b3b322ffcb3c0455888f330e89d8e0808d43b9b198b148923a3c75c7cfdf554e944b27d983668ade4d2d76763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884089, "uuid": "be1e5652-e0b4-4528-949f-1c5209a60e7d", "value": "T178B32986BCC18612C5E1A0B6FB1F91CD376643ACE3E67107CD18AB29734B8670E3B255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884089, "uuid": "67fa8acd-d490-4fdc-aa5f-0de1e39bf89d", "value": "1536:MDKaexByb+nA8iL7pFOS3hDs5ofEw7VGt6TA44YtVXHzqvLk:MD6/yqnOHp8ihAgVGt6ThBP4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780884089, "uuid": "de013818-f6a1-489b-8cb0-ccbdb2dd8470", "value": 109420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780884089, "uuid": "aa88f5b1-1489-4ee5-9f3b-754cb20b3138", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884089, "uuid": "d9eb9202-68f0-4e75-875b-cff0af47c4d0", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da55d716-62e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780887048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887048, "uuid": "c048b590-c9e3-4eec-9c53-4fdebe051c7e", "comment": "Malware payload", "value": "85349d139ad59e1fc0e105c6cc3daf22", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887048, "uuid": "fe864945-14b2-4ac9-8144-ddffd761b083", "comment": "Malware payload", "value": "48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887048, "uuid": "fa14189e-45d7-4eef-b68a-dbf4dc15af5c", "comment": "Malware payload", "value": "e31e6441f66300639d951ee44938282d7936f4d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887048, "uuid": "7a6a62bb-4454-4278-8ec6-b3622d78c853", "comment": "Malware payload", "value": "5036d4b933d3d5e03aa66f27684ec7d25f46cb098929854d0c9434eb3dc5ba751d986dfb6a8de6b089bd0f4a71409eb3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887048, "uuid": "c59a7b5e-4680-41da-a8a2-cf933d0b2bdf", "value": "T1620159CAC0059A6051C6F8AD26D7A084B42183CB2A858BF9FEEC543D9BA5648B019EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887048, "uuid": "872a39c6-2125-46bf-9961-5a37221d2fb2", "value": "24:kXCKysE2hi0ziQvZoha38FMFaYk0819FlwXX:e9Qp+Ms38FMFaYk0819WX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780887048, "uuid": "e5502aa7-ace8-41af-b3f9-19cd77461f36", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780887048, "uuid": "24d09267-861d-4393-9fd7-eea2ef2dff63", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887048, "uuid": "73802352-c336-4d29-87a9-a696b18c9004", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f5d47f-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911112, "uuid": "6ebd465b-0ea8-491c-8056-144b0fd2012a", "comment": "Malware payload (RemcosRAT)", "value": "19f45d5cc50bfd494f1137d368c97225", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911112, "uuid": "e29e48e3-56f0-4276-afd9-cec8fd98a075", "comment": "Malware payload (RemcosRAT)", "value": "485ff689cef4080138ce4736a53762d77a306ad9f00a172a549445812c267438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911112, "uuid": "13bb9fe2-e825-4a3d-b6dd-c48af1e9abab", "comment": "Malware payload (RemcosRAT)", "value": "c7dbf3a6ed77a59ec9f9772a07bebfbdd9ad28c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911112, "uuid": "d1ab5fbc-b5ab-462e-8140-e5a12ccd5218", "comment": "Malware payload (RemcosRAT)", "value": "e209c48cd8c19c41cac9627a8b3a7f8cfe1bd5e8720a53170a4d3a0cecc4e403c057adbbd1bfcd5bd3a52b1c2ea3f438", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911112, "uuid": "6e05f105-00b5-4613-b2e4-35459bf22c19", "value": "T15E0512AC1E66C507C66197784972F2B4163E1DEEA802D3039FEC7EDFF9366144D182A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911112, "uuid": "d4c06114-aabf-46bb-9f00-fd8c4056a40f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911112, "uuid": "163c73e5-1e4d-45f4-9eb8-a0fd3ef4707a", "value": "12288:/ZIrK8VEGav7W0Eg0PHr02TWDa5S3pm9KC3jr5KKBObhJWEhgkquu6vwGfto:RItEGg7W0Eg0DLkQ95BHEikm64wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911112, "uuid": "cd27e644-2167-42ed-a804-8bd7fcc0ebf8", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911112, "uuid": "9c0ab825-d8e6-46fb-8dae-5d17b64e2452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911112, "uuid": "dd5fc15e-0ac9-484a-af09-ae1591471167", "value": "485ff689cef4080138ce4736a53762d77a306ad9f00a172a549445812c267438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec8368f-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908449, "uuid": "e9a9a17a-924d-44e4-b97b-0fb7dba8a698", "comment": "Malware payload (AgentTesla)", "value": "3cba7f2ba237dc44bd0e447d96888c88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908449, "uuid": "561beb1d-08db-4933-bab8-c964c3f7a366", "comment": "Malware payload (AgentTesla)", "value": "487ee1b851692e64b5d6d32b9a587f4ccc9b8ff17571ab493ed102cb81a136e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908449, "uuid": "c9a8e185-1b4e-435a-aa4f-3289e896e2af", "comment": "Malware payload (AgentTesla)", "value": "1aa3fdc810ccb3e39c46bef42da177743bc42452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908449, "uuid": "da8f1396-738d-45c7-b18b-c2e1d2c960cc", "comment": "Malware payload (AgentTesla)", "value": "b489735db20cbf38f3039de9c4227fa1ee42607abdb50f54eb57320cddf72195223e0d10422f34214653512388b60950", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908449, "uuid": "6d02761d-b0a1-47f1-a86b-5f43b7ebb0cc", "value": "T1F2250254224DED07D4A60BF45A71E1B527B84E89F911D743AFDBBEEBF87A24029013C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908449, "uuid": "eb9faa18-11b2-4ea9-87bd-af9cf4cf5e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908449, "uuid": "54fedefb-23f2-4459-8fc1-8383e086e3be", "value": "24576:EFL2Ejj4oIrDjTq0F+3U5Pu2EgshOduMYAEFT0D:uexq13YCg6Oduh3FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908449, "uuid": "898fea9a-ed71-4fd2-8ae9-41acab2d25e8", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908449, "uuid": "0efc7825-49fc-4bb6-b4fc-588bd1c85f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908449, "uuid": "c96ba236-3b4a-454e-b28f-82549ea44268", "value": "487ee1b851692e64b5d6d32b9a587f4ccc9b8ff17571ab493ed102cb81a136e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2250a011-6310-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780905637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905637, "uuid": "80cd6cc4-cc84-4ab1-b536-6237108d0c23", "comment": "Malware payload", "value": "4337149116622c6727518851d75e754c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905637, "uuid": "e49e326a-54ef-4979-8c89-551d05c8f160", "comment": "Malware payload", "value": "48de47338e4ee6d141ca4355eae868f99180f5a0cdf494fbf906b648f1bd341a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905637, "uuid": "cb7ff544-f592-45a6-afa4-d3a77b71aeca", "comment": "Malware payload", "value": "7a2693bf25f04ba72ea68783b0dc7d88b19a6745", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905637, "uuid": "3c922bc0-e044-4955-abe0-5123f56c03a5", "comment": "Malware payload", "value": "fde8340c9980d928c044294287545b4a9d3f8066b840eb9ef4828df1ad2e3db7bce28089c4ed91197944d9c5941221f2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905637, "uuid": "8ad89347-9c82-4081-8871-f516f910caaf", "value": "T140137D6526953C25AE99883B5D7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905637, "uuid": "32460c68-ef6a-4c78-8d90-cd396cac9b24", "value": "768:vr9NyXsZztCcf9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:THusZeco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780905637, "uuid": "af169859-4181-44c0-bc8b-aed7ee594f80", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780905637, "uuid": "a91b172c-1166-4f81-8342-7a4660a089bd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905637, "uuid": "7c62fe0d-fb82-4704-a5c3-b119afdfd4f7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5469e3a3-6304-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780900567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900567, "uuid": "c4750769-7161-4cc1-a9d6-e05d69c31e56", "comment": "Malware payload", "value": "90d376293456932440b07d3bdb6545b9", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900567, "uuid": "9f6ba61b-c126-465b-bc21-bcf67f7d190a", "comment": "Malware payload", "value": "48f8316c16120c550208b127ad42d3c12da388693046d871bdfa7316e77bc43c", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900567, "uuid": "26183bd3-8954-44c8-bce5-410c1b44b86b", "comment": "Malware payload", "value": "82144a847d5596a5c0de6379763983b674f2c150", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900567, "uuid": "cdc0d19a-c018-448c-9e72-a2493ec0fc4e", "comment": "Malware payload", "value": "665d2ef8d3e72809c5ba3792a52433bcb783326c0507b5703347d9825ea1964236c74a93e415640ab3a6de265b8548e6", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900567, "uuid": "30142ced-ff9c-4c79-a75e-a0b996d3b9fc", "value": "T1B194BA3CECEA002AB173EE199AD47597E95FB663372E981910D613864713942FDC233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900567, "uuid": "c7c5dd83-e37b-47c2-b780-fdf8120e351a", "value": "12288:NHZKvaic3/A4LT2yyEsvPepjtwEIKBRK3MMg:N50GT6/+jIdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780900567, "uuid": "2fe24c2c-c1c2-4d87-b902-ec92ef18ec99", "value": 438620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780900567, "uuid": "f425b15b-377f-469a-8a54-7669f7aca905", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900567, "uuid": "80e3ee49-3758-4185-89bf-4770e605b0dd", "value": "ORIGINAL INVOICE COAU7230734290 1055272307342901.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9c0b9d-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780913006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913006, "uuid": "a9c7467d-926f-4aad-86cf-6a010cbf4a45", "comment": "Malware payload (Formbook)", "value": "283dcca1d62f0d6e139a30beacfd374c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913006, "uuid": "890f3cec-6bfb-4832-9674-a3ff1f1ee8ec", "comment": "Malware payload (Formbook)", "value": "491dab158ca711b09faac6a22fde891fb70956dd3ec0c39811f0fa4053a6213e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913006, "uuid": "eb747781-368d-47d0-a3c0-a1187b66ea5a", "comment": "Malware payload (Formbook)", "value": "0ff8392b2a08cbeeb71a57f1c3c4b6e5fa59e4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913006, "uuid": "4b344a3a-6cb2-4f7d-81d2-1f9402d1d98b", "comment": "Malware payload (Formbook)", "value": "658677d61410a583ab3ca425dd459be4ba84fc2660f851b2b88d657c29d362937130c271097bb026062c1c3763c3d3d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913006, "uuid": "bfa96b8c-4267-4be1-a091-2e8eee1ef5fd", "value": "T119251254634EDA06D4E24FF41932D2F91BF49EE9E911D2039EDA3EEFB47A7100961283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913006, "uuid": "aac835bb-89ae-4df8-9d34-16ec22d08d1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913006, "uuid": "c6fb2ecc-6890-4e52-8dae-735691df63ab", "value": "24576:ZhwZt5g147ILrCDH8IqxVNk2tju4ZD8iTEMzIDA:Xwo47zj8D7tiWD8XMEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913006, "uuid": "dfa0eaf8-f8b1-4d80-98bf-73e794b70607", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913006, "uuid": "618fc858-e87e-4e76-9fcc-15529e469ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913006, "uuid": "80466654-0756-4829-ac3c-ba49f239ec43", "value": "491dab158ca711b09faac6a22fde891fb70956dd3ec0c39811f0fa4053a6213e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7830eb93-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911794, "uuid": "e4b9cbbf-c4a5-4055-be1c-3c58856687e6", "comment": "Malware payload (Formbook)", "value": "f01591f112cfef8b3f40021a2f150761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911794, "uuid": "7323969f-b256-4d3b-b80a-2198715880cb", "comment": "Malware payload (Formbook)", "value": "4954418adaef22b8f70bd03d05daf3fe790a4c21ec0ecfd40b1727297019832f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911794, "uuid": "ffaef47d-8e42-4845-9572-78c9cb06ffe3", "comment": "Malware payload (Formbook)", "value": "907d5264cce73dd4710dfc802a31f86afdc56ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911794, "uuid": "2be8d7b4-6c11-40b1-b4d4-7221bc2cb761", "comment": "Malware payload (Formbook)", "value": "a8195a27775e6f236f32be77eb453f16f41923cfe7a4cc2b2eba95f2e9a183a6277eccd2ee3b1b81ab8a5329bdce5e16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911794, "uuid": "c7986140-e431-4414-a630-046c95c4bb2a", "value": "T1A9251298661AE403CA8157748BB2F3F922AE5DECA801D6178FEDAFCBF977E540D14050", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911794, "uuid": "bb470714-dd21-4db9-9a4a-975b35dcf212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911794, "uuid": "d839242d-d323-4ce6-b363-3a0771a689e4", "value": "24576:eQKyC5GGigWUmpNJopXg2DsgKodyuZyM:FtC5G4mpNOQ2gUyAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911794, "uuid": "6ee594b5-f0d2-4a58-9b77-c473113bbbbc", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911794, "uuid": "3e62b813-a8d1-4e78-8772-27e6168083e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911794, "uuid": "96a447b5-f311-43f8-85b2-10b4fc534b64", "value": "4954418adaef22b8f70bd03d05daf3fe790a4c21ec0ecfd40b1727297019832f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe6bcc4-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907512, "uuid": "c97b2820-070f-4a74-b158-2fd6906c2d43", "comment": "Malware payload (Formbook)", "value": "7d77fb88f5997276ae1e5ad41348a1bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907512, "uuid": "796ea44b-bc41-4a93-9587-50f370f1739f", "comment": "Malware payload (Formbook)", "value": "49a02419bb0788c56ab150706fbad89f5660df289f23135827590641a17eeddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907512, "uuid": "952facf5-ab22-47cb-9322-713566dbc483", "comment": "Malware payload (Formbook)", "value": "ed986ef4dba6f943d6c08e85502179117e831d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907512, "uuid": "f8f27448-1d83-4191-8445-0beab62fd1cc", "comment": "Malware payload (Formbook)", "value": "afa0320a51a3fae83f19bd1a03c44ba7f82314ec1c232ca7fee67e6af109f2df9bb8aa61d39651fe16e6c3e9f578ba1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907512, "uuid": "e101b16c-00dd-4eaa-9ab1-fbfba2a45d09", "value": "T14A251254670DEB12C0A69FF04932D5F417F4AEA4E915C3028EEA3FEFB836765445A283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907512, "uuid": "d6e669c9-5716-4a09-b36f-d80c36ce83a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907512, "uuid": "c786304c-cffb-4193-95ba-c0d033a23bee", "value": "24576:fhwZtL1t8BdOx8HlKpguINYZYVw/P4EjAgpzwPKiNnkBaehkU:JwR+PI8HlKwG+w/PQgdiEhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907512, "uuid": "339cadc8-adc4-4f84-b879-8854484f7f57", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907512, "uuid": "cfab2a15-6556-4fc7-b83a-d7dd91186dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907512, "uuid": "3c67238a-e781-4043-ab59-3ea0e9d65bde", "value": "49a02419bb0788c56ab150706fbad89f5660df289f23135827590641a17eeddf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032f3786-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780911597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911597, "uuid": "9635a7b5-f35a-4c1a-941c-87f55a9b049c", "comment": "Malware payload (AgentTesla)", "value": "95a025121923f038f7a49a5b6e2e9750", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911597, "uuid": "f36cfe6a-d01b-4dae-bc24-f42fc14d5904", "comment": "Malware payload (AgentTesla)", "value": "49ba20cde2a94d0f765022fcb03f8f61b7ba7e3503a90c4b371c3b37c54f80dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911597, "uuid": "e20d127a-bd26-424e-b018-cd5dbefa03aa", "comment": "Malware payload (AgentTesla)", "value": "68822615f7f9973e48f481a066a119a992dd59c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911597, "uuid": "d635c53b-ee49-4aa2-b329-0a24ccb3c664", "comment": "Malware payload (AgentTesla)", "value": "7b2a97260c8ff2551d5f704e42c4d92778e7e33a0b83c1e6e3abaa114cb86a3bd20461c1585d3b82c536ef3ee5eb73e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911597, "uuid": "4366ea82-7cb1-4f06-8586-203c8fc208ce", "value": "T1FA2512187665D203C96057F44AB0F2B427BD2DDEB521E2069FC8BDCBB97AF108D581A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911597, "uuid": "52564df5-e58e-4877-9464-b59762df4649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911597, "uuid": "d29e1d98-6aaf-4e7e-abcb-5b04a0562125", "value": "24576:4C35qoUc75Nms8XnquKyXiBV3dj6EQBknUe0mhb:MqTb8auKSkFQ6nUeRhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911597, "uuid": "4e9f16c6-d3e0-4085-b5a7-e3fc1344f8cf", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911597, "uuid": "88fd48ed-a23c-4b8a-8baf-d820e0c6d383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911597, "uuid": "4a9eac97-1732-4441-95f0-8ca20bcbc2e0", "value": "49ba20cde2a94d0f765022fcb03f8f61b7ba7e3503a90c4b371c3b37c54f80dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb42c64e-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912765, "uuid": "aca7dc8a-3ccd-4187-8db6-f838e055570d", "comment": "Malware payload (a310Logger)", "value": "d0b9c781c2f213a822e2a695328d07aa", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912765, "uuid": "3a621a00-ca09-4ab2-8460-7871e5e23a55", "comment": "Malware payload (a310Logger)", "value": "4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912765, "uuid": "cb593096-9aeb-434c-a9ea-90c112ee55f0", "comment": "Malware payload (a310Logger)", "value": "e7b4002f0a5eac2f40299175e219b513b87ddba1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912765, "uuid": "a5d05846-91d4-4bfd-9746-701f99199cef", "comment": "Malware payload (a310Logger)", "value": "65cd7c28b1b63f411768e70576da6aceb0c9260c60854b922319153a43e7f5378beb8e14d0644bc5baab31bde6a60d7e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912765, "uuid": "25627d2b-1946-4d59-bcdb-9b2c944b1df7", "value": "T1FC452358AB04C80ACCB71BB50A29F3B55269DEDFE910C2179FFBBD677775A109898300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912765, "uuid": "de1a65bf-4ef9-4aa3-9327-ec7b27862134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912765, "uuid": "a9d6832d-7ee0-411e-9ef8-2c5df4735063", "value": "24576:IKxzaoK+wecdRMsKS8NbKBqpJQFo0AC4LdYCVib9:pzaoK+w1vgSAbKMQo7aGG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912765, "uuid": "c7e58f92-ef6c-4bde-b71c-2d77f3a4404f", "value": 1206272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912765, "uuid": "726120d0-1e84-483e-9082-fc8f05234d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912765, "uuid": "4a901989-67d6-4705-80b2-f4d236c05709", "value": "4a6f8a2ff7bfe6e2851afe73b059281c2235ec8201d021743ed7b00fcee63177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53ec1f1-631a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910259, "uuid": "fb81d307-97a4-4d44-b73a-f1790d15a164", "comment": "Malware payload", "value": "39d299f131f917160125bf18acf6fc6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910259, "uuid": "b8009418-ab7c-432b-a5e3-d285654419d0", "comment": "Malware payload", "value": "4b355046f9c6b75d5a13be08d65c002e07e70b6fb17107af18d7552770fdc627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910259, "uuid": "676f3964-644e-41bc-9c02-4774d54885c3", "comment": "Malware payload", "value": "1cc39f5e92892081eda533f9055012a6e1efc8fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910259, "uuid": "7fadd2f3-18a5-4ec8-9b03-157f72b97b1c", "comment": "Malware payload", "value": "280acfe3f6719801edf70005a127b38a05c9a966e24e6962c748a5f72304cef24a95b53cb482fbc031de57e955e28a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910259, "uuid": "93ceae7f-1bb2-43e3-bf52-85b650dbe9f7", "value": "T1A055CEC62BD50F90E67FABB89675048183F2BD17EF21D3EE3C4425D96A21AD68503723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910259, "uuid": "535635a3-c71e-4fe6-8501-a59a6ad361de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910259, "uuid": "6913de25-c9ab-4b2c-ba5a-fb0b409422d8", "value": "24576:URsOqROw5yU74dtlhDMhb+zY8GqzFPBgZs9yd+pI8rxkk7n:URz6OwYqKghShEseOxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910259, "uuid": "2d663c45-f890-4c94-abaa-e643216dbd8a", "value": 1403392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910259, "uuid": "8538f500-d160-4753-8e7c-cbc68eb3e6e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910259, "uuid": "7bbd8519-b722-4e7d-a765-39f6f19e726d", "value": "4b355046f9c6b75d5a13be08d65c002e07e70b6fb17107af18d7552770fdc627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9291461c-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780907543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907543, "uuid": "5c015b19-6705-4501-adbc-a11f8c1f4c10", "comment": "Malware payload (a310Logger)", "value": "86ddbb0b80b50129595df102d023e053", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907543, "uuid": "e8f45de3-52c6-438c-959a-388b2e8aa5da", "comment": "Malware payload (a310Logger)", "value": "4b5d822aa175dad9ef28a68cb5cb8c865d7b12de19ca951a6e1e32fa3b467858", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907543, "uuid": "9605f44a-88bf-4a0c-a938-af7413b3995e", "comment": "Malware payload (a310Logger)", "value": "210724d34d43273363cd418ec3b6344ebe3a0aa0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907543, "uuid": "6a3a0376-4c64-48db-908e-2c14ec2630df", "comment": "Malware payload (a310Logger)", "value": "61e650443fb05ab1eb1a6529cf0406f1b0b051d8ca3fa6dbfc04c45118b07e52ac34c0817c56d83113892e1b528de1ac", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907543, "uuid": "696d3cb8-40f6-4071-8097-5b27cebe7d45", "value": "T10D944A13EB60A11EF1A389F1A8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907543, "uuid": "31df8cb4-8db5-457e-87ff-ed3cae9a2b6b", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907543, "uuid": "b1a68d36-3a7b-46d5-b005-2cc554314bc2", "value": "6144:dLUI8d1/w5KA81IJ8GpF6nuTmOOUiBUrjxBix1OZtmN+tJIab/Iy8OqcPWn:aLjYKkJj6GmZUiqrKMmXwIy8OqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907543, "uuid": "47d94ebc-581b-4609-961a-ae6bcaf16e77", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907543, "uuid": "923445d2-88ed-493a-9dab-4c660714837d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907543, "uuid": "5cfe0167-55da-4607-8b62-61b29b48cb33", "value": "4b5d822aa175dad9ef28a68cb5cb8c865d7b12de19ca951a6e1e32fa3b467858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25a4671-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941527, "uuid": "19743f5e-7380-46ce-aba3-ad001843ecf8", "comment": "Malware payload (Snojan)", "value": "55f817dbaf5155ae176238f41b1ff0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941527, "uuid": "e61f25c2-0c2b-4374-8136-c6b8771f9390", "comment": "Malware payload (Snojan)", "value": "4b9b8edaed3692da49e8b4c105a192836a62909cbf3994f860a7271479ca2203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941527, "uuid": "b8f8a92b-e341-4e44-b378-4f25b7285bd1", "comment": "Malware payload (Snojan)", "value": "edb13d444ba47b0b00812e23224ab92cf8995186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941527, "uuid": "8801fa3f-7160-4ba2-aaa0-a0c0072d5848", "comment": "Malware payload (Snojan)", "value": "aa055bb1ed0a3a08dedc0780e0a0a9be2e2b28fe1f55f6575f43e87806aae1f9d38713af6f44a3b7d4253b81efde2d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941527, "uuid": "76e4ea5a-375b-47fd-8ded-6cc7b5c8f20c", "value": "T13625222471C0C4B3E46B503544C9CA76AA76B072477E89DBBBED63E5AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941527, "uuid": "4fd7e4ff-bfc9-4062-a832-70fa03718f49", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941527, "uuid": "ef79b13b-0fce-493a-8e42-f0d6927df608", "value": "24576:/Y+Sk70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOq:QkQTAKYS/v6h3+1uhZcT2NnvOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941527, "uuid": "6d8d7056-6703-4ae9-916c-63d8c344d28a", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941527, "uuid": "bbfec61a-a9e5-476b-a53e-b3254c4272b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941527, "uuid": "caeced66-0d8e-4630-8417-92ecbfec87f8", "value": "rAIm5zEyoS8zQkfy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdf9f80-637b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780951750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951750, "uuid": "decc262b-2fb7-4b05-8d2d-7587daa264b2", "comment": "Malware payload (Mirai)", "value": "f7d558b7085ee912bd49f43a5a98069a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951750, "uuid": "42235657-6833-4eb9-8389-9fcda15cde35", "comment": "Malware payload (Mirai)", "value": "4bc1716417b7cc819c0309c22855357e0ba6360af5af02bcca8a97fb3c55d3f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951750, "uuid": "3b72436e-6caa-41c9-adc1-3669d47417cc", "comment": "Malware payload (Mirai)", "value": "48352ea4f319200f8c58462096526913485bb511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951750, "uuid": "d520999a-c160-4e8f-a440-ff6705b1a6fa", "comment": "Malware payload (Mirai)", "value": "fe1c3ec38eaefc22e79f8ae208b2d44b278b0cc16b71a65487efdcb7edbaf459777add244b793c7d7cf750e4fce0f4b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780951750, "uuid": "a9e6528e-4345-47ad-ae3f-87d4dab9a271", "value": "T1E2B34CE2B400DD7EF817D7B780530B16B234A3E54F922B277617F923DA790742866E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780951750, "uuid": "0e3b63d5-1b79-4df5-9986-2bc6c431dc1c", "value": "1536:gyQxkgff2OqKhThS47vhaQxKIF8/ncI8fUwTTJSjH+dtoDEqlNLoxg1:g3xkg3yWU+ZLxKIhBUwTQbDEqHL6g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780951750, "uuid": "8db1a27b-ddff-41e4-9b6d-c80626e6486d", "value": 109380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780951750, "uuid": "6b492e75-9b18-4dd8-8f29-8fb416e785ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780951750, "uuid": "c43bf98f-f7a1-480f-9231-6cac9a83481e", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d95781-6368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780943596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943596, "uuid": "1c88ee10-607c-4e65-b224-1672b60cf4aa", "comment": "Malware payload", "value": "cdaa74c023160aed4c86893fba58beac", "object_relation": "md5", "Tag": [ { "name": "C2:docrack.me", "colour": "#8CEED0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943596, "uuid": "9412513b-dbb6-4726-bf0e-008d3ccb75ed", "comment": "Malware payload", "value": "4c0ef7fc28255f8375876fc771026b9fb3629569aae1c211a01ecc9e48a955ae", "object_relation": "sha256", "Tag": [ { "name": "C2:docrack.me", "colour": "#8CEED0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943596, "uuid": "e738f848-7656-4fbb-adef-398e21fae02b", "comment": "Malware payload", "value": "844c21f311763570db67da7ced8255313a608cb9", "object_relation": "sha1", "Tag": [ { "name": "C2:docrack.me", "colour": "#8CEED0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943596, "uuid": "391a9ab8-3bb3-498a-95d0-14e76ea6c9ca", "comment": "Malware payload", "value": "530a40324393199416d0196d21c65371444b48212784750cf77a108e9029b69588f2f845eae529dbbe3353386920d55d", "object_relation": "sha3-384", "Tag": [ { "name": "C2:docrack.me", "colour": "#8CEED0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943596, "uuid": "588f3575-b20a-4f88-9c72-f26f0baf9b88", "value": "T1F4F36C4773E521FAE1778335C9614A46FBB2B83207209BAF07A446765F237D09D2EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943596, "uuid": "d44ffda7-3fd8-4692-a3ff-2b490657f515", "value": "fd2801c75d276d177a9d888f6113fd05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943596, "uuid": "a1fdfd86-6a32-44ae-a8e3-6228c89a2a03", "value": "3072:l5CMR3U13mFU1I57KAq2WshcIQ2/BHg2sr0RHmCEBp69Pp:l5CMc3mFU1I7qjsz5Hg2sIYMVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780943596, "uuid": "4d49cb59-1738-4c57-bf0d-3467f78fddb1", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780943596, "uuid": "1eff130a-b985-46e5-90d6-23cccd449338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943596, "uuid": "0ea12e59-b771-4214-a711-c347db6d32f0", "value": "AFT Impulse 11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cef6026-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908231, "uuid": "2f3ed2d3-a41a-44fe-a770-8c406ee8b18a", "comment": "Malware payload (Formbook)", "value": "7c5281989ffe71187f929bcb3194a585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908231, "uuid": "91996e1a-2840-42cc-b235-0023c804bdb8", "comment": "Malware payload (Formbook)", "value": "4c41eeda925a9eb54ee04e92a3c2ca594c866ce2c0c12806fc87354af2177381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908231, "uuid": "d4c745cf-9faf-4842-8c05-2824e18e2f21", "comment": "Malware payload (Formbook)", "value": "5d677786ae4e0c270a9e06a3914080a6bc239c93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908231, "uuid": "9f07d366-73cc-4ab2-abd6-3b3f5cf6417f", "comment": "Malware payload (Formbook)", "value": "ce907fcd7fc40b55171da7f40406c812835350886788b3d46ee4ec0bc1cc87a6027dbfd4f5b7eb5ab38286bcd957438a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908231, "uuid": "93103489-8fea-4527-95ba-ebc8bb1d64de", "value": "T13C251254270AD802C4A60FF149B0D6B056285ED8E912D257DFEBFFAFF97E6593804382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908231, "uuid": "2ae8df36-83c5-4c76-8d63-dfbd3e39372b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908231, "uuid": "5ada9681-bd36-4632-b384-db589f01a0bf", "value": "24576:n6JAEFT0DmMYQFIDh3Rxdb0DBAYNlWf3E3o9JjzJ5v38:83FQyMJGDh35bIjNlO3tJf/v38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908231, "uuid": "8ebc4aee-d20f-4e01-8b9d-ab11eae86a18", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908231, "uuid": "52bd75f4-6867-4a50-b41a-7bb67ccf7a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908231, "uuid": "d3d4b9f5-79d1-4f70-ad10-8f4efb467ad6", "value": "4c41eeda925a9eb54ee04e92a3c2ca594c866ce2c0c12806fc87354af2177381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd554236-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1780911534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911534, "uuid": "af63889d-72d6-457a-b28c-193470a090b3", "comment": "Malware payload (VIPKeylogger)", "value": "520687169f0502de0e044a9d31e645b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911534, "uuid": "235cc7cb-4a60-4b4f-8365-624e1232002f", "comment": "Malware payload (VIPKeylogger)", "value": "4c641df2e4ba6ede0916b22008a6bf4e539fd7581c9ebec5f63afec985853d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911534, "uuid": "7ec30989-5caf-4df2-8b3e-9df84b8fe213", "comment": "Malware payload (VIPKeylogger)", "value": "5effa57f08e9536d6c9e8275ec4e5180be1d8eb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911534, "uuid": "12e1b847-77ff-4eec-89ee-0482ce6bf0f8", "comment": "Malware payload (VIPKeylogger)", "value": "cdcd17aac0499966f1ba9e4977fba4a220fb892769ea9caa00979924e1b06c659e0a8417859c3bac0d188f3fa5d4bc61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911534, "uuid": "7af135c3-e44e-49c0-9ffd-d306758f75d3", "value": "T1B025129A6A06E517C9A0573C6FB0F3B4236C0DEDA511D7168FEC3EEBBA36D064C54182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911534, "uuid": "d83e63ce-2b05-40e7-aae9-75f43a0ce5d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911534, "uuid": "c87028a3-a7e6-4b14-bdb4-28cab9379250", "value": "24576:iExObQ0MSvBi5wDLMcB+FdQqRjsmtwdgNckQo:i0GWSvB8wDLJB+FRps44hkQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911534, "uuid": "5fec3c94-5741-4313-8f18-12eeb874fb52", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911534, "uuid": "18e334ee-dde6-4acf-8c3a-a416d521aef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911534, "uuid": "d500886c-b50a-4f59-af60-657d2351e7ba", "value": "4c641df2e4ba6ede0916b22008a6bf4e539fd7581c9ebec5f63afec985853d07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f825edcf-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912438, "uuid": "4a558339-9190-4087-ab27-cfe3b9b3e5c8", "comment": "Malware payload (AgentTesla)", "value": "e9227550787f74d0a68d42c8feecea78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912438, "uuid": "9cb5ad18-3ce8-406e-a073-0db7d2192814", "comment": "Malware payload (AgentTesla)", "value": "4c6b982a3fdccf3ae5dca3ac8595a81f615754510454b9a11f88f38e3eb5ad87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912438, "uuid": "6cc4fc70-f9ff-451b-97b4-757310b8a233", "comment": "Malware payload (AgentTesla)", "value": "64d5147dee5b5b22ba3d51fe14c799438d45145c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912438, "uuid": "4fd15835-3477-4e05-b347-d42ed632cff5", "comment": "Malware payload (AgentTesla)", "value": "f3540e60c736da71b129de25f65e7d5abb0a27e554831896a653dc8e896d7d1bf58a42471518b3f995a4fa7f54234382", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912438, "uuid": "6dbd89ad-1454-4c7a-80ca-1805f75bf45d", "value": "T14A2512A52698D702C8B60B771D25E3304BB81D1DA831D36ACFEDBCCF7959B909C19392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912438, "uuid": "1d9971d1-f326-41de-ae1a-0d6674d7448d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912438, "uuid": "da4d3c4e-7040-4782-b322-66d8103a7daf", "value": "24576:ATjhzKilaFMB0doJcXhh03woRLTEFVpLGhPs9r:kh5lRjGgTEFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912438, "uuid": "5ad62761-f09b-4040-b876-33e3eed03990", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912438, "uuid": "473b577e-903d-42ae-b787-25a3ea85fac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912438, "uuid": "cc3db806-6584-4122-b775-f46dd164060d", "value": "4c6b982a3fdccf3ae5dca3ac8595a81f615754510454b9a11f88f38e3eb5ad87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b730441d-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941535, "uuid": "575c4bb9-bdc0-4bc9-aef6-b58339d28510", "comment": "Malware payload (Snojan)", "value": "77e3d9d45dc58de7881d76f411c88b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941535, "uuid": "1a1675a3-56e6-4874-b86e-6ca465e84cad", "comment": "Malware payload (Snojan)", "value": "4c7ee9c53eb420079db3c09b689c76ef778ca12d6f6569cdf344298dd33ab070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941535, "uuid": "977037a6-7db1-4240-9f4a-960801c0739c", "comment": "Malware payload (Snojan)", "value": "19cb3d7b3ecf17ee54b8cd08887919c6724fefd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941535, "uuid": "b3f3bd66-e5e7-4180-a1fb-6976a01f62ea", "comment": "Malware payload (Snojan)", "value": "2b96c238ad7049cde9e5932564566644a2fe771a01f82ed681f09862c34d92b76ddce0721485ac748c5e9b51b31f9541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941535, "uuid": "3cb0d637-e0c4-4738-8d93-23976edc6230", "value": "T12535222471C0C4B7E46B403544C9CA76AA76707247BE89DBBBDD63E9AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941535, "uuid": "1759ce91-bda2-4b76-87e6-c8cf0603a0d8", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941535, "uuid": "24f89806-3d91-4210-87a8-b45764efc3ea", "value": "24576:/Y+Nk70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyT:zkQTAKYS/v6h3+1uhZcT2NnvOyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941535, "uuid": "4410d117-3ff3-4e28-95ce-905caee1d19f", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941535, "uuid": "72548f8c-5ed3-48db-9e06-94cafa9a6686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941535, "uuid": "b6e452a0-0c10-47e8-bfce-ea0595835c31", "value": "BM10GslcRzB1OPan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b4ed67-6373-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780948213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948213, "uuid": "b2fb886c-8fb7-4571-9322-3a310b63644d", "comment": "Malware payload", "value": "baae4fe346690ca69d61dea5d84e51f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948213, "uuid": "98410542-2f56-49f0-b5ee-dd3c6b04b243", "comment": "Malware payload", "value": "4c852c1da460c6e7f3b39fc21287ac1fac22c90e196e8d15a2b6ae1f2d5884f2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948213, "uuid": "32ecbc62-1ca8-4a39-9a83-794eacc70f0d", "comment": "Malware payload", "value": "36da63ce6a31c8108c2cac5e751a5d887b7b0615", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948213, "uuid": "64f319cf-23eb-498e-9989-65f4cb77f112", "comment": "Malware payload", "value": "eecddd5cc8a1479c34d15f88d3620ef91664e7c8a83f135866b67fe8b1175909663096defe07aabcd4ff689c43335927", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948213, "uuid": "5d82b17d-2e27-4d9a-a0d4-69a3150bfd79", "value": "T17A01EFCEC006EF1040DAD49D22D71494F421C3CB22428FA5BF6C683D8BB564C701AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948213, "uuid": "ac082718-ea40-4aeb-9c4e-2b383c3715ff", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaDI3BVkI7tq5FIWP6AIaFDI0eIA0X:kXCKysE2hi0ziQvZohaD/okFDBReOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780948213, "uuid": "db030b14-eb26-46d5-a2bc-7db0926d42ae", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780948213, "uuid": "6b4f3d0c-c50f-41d5-bfb3-70b2f0963723", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948213, "uuid": "9d8eb6e3-1309-492d-b470-791d3eff5290", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ea3cac-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780912513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912513, "uuid": "37db1bdf-0d3c-461a-8e84-a395268ab46b", "comment": "Malware payload (QuasarRAT)", "value": "a6bfce202f8bd51b4cc69294b8650794", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912513, "uuid": "314857de-49cb-443f-b79f-10cc996b47ca", "comment": "Malware payload (QuasarRAT)", "value": "4cf1a43a06108184d1ce4fd1c2dac70cdb98fdfb168e0949f84ce88a1e437a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912513, "uuid": "aa172954-7d28-4de1-9f5a-b97283d03b48", "comment": "Malware payload (QuasarRAT)", "value": "d90e10c849a2434c2af7c3c97f885dcd7172d518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912513, "uuid": "6a25d025-6618-4f2b-b37a-ae2539f182a0", "comment": "Malware payload (QuasarRAT)", "value": "91c53bede5ddf54884262b4d0895c4187ae79c02f7392a05fe7f29ba6deb646011a62d498771b5d5b0ef0374d79b4a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912513, "uuid": "565e213f-5417-4887-9ffe-851049817d48", "value": "T1002623F2F7D215C3D979943CC853A53195377AB62AB699A710CE282FCD0F8824C39E25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912513, "uuid": "8d0f94f4-f919-4b3f-acf0-7b07e2ba7776", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912513, "uuid": "e6d5c4a1-fee6-4909-a281-a976fb9a5d07", "value": "98304:3MT0jfSrC/NHjLBxv814ESp8z3w3Humq6PYax1mUAkWCeNnzpMk3dguZr:cprC/JjLBxvS4ESyw3hl1mGetpMktJZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912513, "uuid": "cc9900fd-99c1-4975-bffa-053a755c59c5", "value": 4603904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912513, "uuid": "71bc9339-5c95-4c54-9238-055d3762be9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912513, "uuid": "aebcf48f-a5f1-4ef7-803c-8645d169a4f5", "value": "4cf1a43a06108184d1ce4fd1c2dac70cdb98fdfb168e0949f84ce88a1e437a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f794e4aa-6313-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907283, "uuid": "dc6af089-405b-4e91-9112-c60e386b0861", "comment": "Malware payload (Formbook)", "value": "dc3e05323fa2ae1c4f9b2bf179e189f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907283, "uuid": "179d0b5e-c5ea-4000-9e49-ff26f0acf2df", "comment": "Malware payload (Formbook)", "value": "4cf48958339691a0c2a645cd077f3847a7ca33754805baf1815cbc31361d1cea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907283, "uuid": "8bcd013e-d00b-4368-9500-97bc125b4a51", "comment": "Malware payload (Formbook)", "value": "79230e4665d021ee82a39909084159ccda062f67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907283, "uuid": "24400046-8fc1-4f70-b404-2bf62e8b961e", "comment": "Malware payload (Formbook)", "value": "c45bb7ac28dea0de6880ee09db79bd3e4972c9b209f809d84a9f7691c12493d62a3412353a834ae3f232ecc5005f0d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907283, "uuid": "32e6bb9d-3028-4e86-8675-9eb400b94f34", "value": "T1D3251219A61CE816C0934E794D72D6F866B0AF99ED26C3074FED3FAFBD7A2610401385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907283, "uuid": "0fa61a1a-0f25-4699-a95c-c7043cafebdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907283, "uuid": "baee5764-cd25-4083-8053-c16a07632b56", "value": "24576:7ShwZtsKW69A51Z/nh/GLggUkJRk9vyrIembMHTqIlp:7OwvWUA5znh/GLg7pdbgqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907283, "uuid": "b512b495-fece-438d-94c8-284ee8f21357", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907283, "uuid": "f319f97a-c966-4aa0-af9a-bb3caeb02497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907283, "uuid": "9a6bc8d2-35f9-46c4-bb71-332da1512353", "value": "4cf48958339691a0c2a645cd077f3847a7ca33754805baf1815cbc31361d1cea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff232d0-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911968, "uuid": "06151b27-416d-4fdf-99ff-4342fd1de4f7", "comment": "Malware payload (Formbook)", "value": "47912354b325ff25c2d30010fe23e502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911968, "uuid": "6da2a6d4-e174-49dd-a18b-9a988cff333c", "comment": "Malware payload (Formbook)", "value": "4d137b0f85e967fa77cdc2b07bd869db5b0180d3639aae384bc0eb6f2d740243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911968, "uuid": "81dbfba9-60db-4bce-a0cf-19f6aec23073", "comment": "Malware payload (Formbook)", "value": "3f2d9e93b973e517b9d76678b94dd36b93d6dcc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911968, "uuid": "3d61d7fe-45e0-433f-856d-8e6a582d93f7", "comment": "Malware payload (Formbook)", "value": "a0d88406f5d47da4b17b310a7c4e3902c00842e16c941bce86f9d8f20123d305065c0f242fa20a93555bd1d5b2a22fe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911968, "uuid": "66c03db1-66e9-4590-bece-c888e9828d6d", "value": "T1312512045A1AE607C5D01B794EA1F2B403AD6DEDA500DB07DFEEBEDFB93AA151D04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911968, "uuid": "69001400-ff24-45fe-96fc-ce1a851af1f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911968, "uuid": "40d07298-f941-45e0-a9f1-17701fbc323c", "value": "12288:Jm7GMxlFvqNFfsTnRvWfk3u5lH1jiDG4u93f4mfcNo/p11xg1lR7Y0XCHVky6zpT:talFG0ekAaJYZfcM1xwlFJVzpiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911968, "uuid": "9c2269e4-1ff3-4457-b211-39aae456ccf2", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911968, "uuid": "8fca4345-b14b-4aae-816b-4b80762da576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911968, "uuid": "edebf0c5-a59c-40e5-81e8-6bb9a71d5bdb", "value": "4d137b0f85e967fa77cdc2b07bd869db5b0180d3639aae384bc0eb6f2d740243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd0c255-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780910411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910411, "uuid": "b85d897b-03c1-47b1-922f-f5461b0b42d7", "comment": "Malware payload (GuLoader)", "value": "edb0ab2d9b2ab905e32a0eecc2c279b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910411, "uuid": "cc0a87cb-05b1-42b8-bdb3-1bd7b145a19f", "comment": "Malware payload (GuLoader)", "value": "4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910411, "uuid": "e484836a-1317-420a-a7e1-ea07439acf99", "comment": "Malware payload (GuLoader)", "value": "b98fb072a62ba04f18bca7578912bf191ba170c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910411, "uuid": "e018e8df-ee84-4f1f-a032-b7b8a2422ad3", "comment": "Malware payload (GuLoader)", "value": "59c1a778a3a08ed6d4b20b82de98861b3d19df363189b50b483a03aa38d243a1105060027ddb27da09e842f187a48796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910411, "uuid": "9004c515-9e98-441e-833b-c081c82556e6", "value": "T116F423387180542BC07047B99D377FBA929FDB25A660551743407E3EBCF1EEA882B1E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910411, "uuid": "4de14fd5-682e-44fb-aab3-55c0dc10db6b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910411, "uuid": "ee7de909-170a-4876-aa21-02d89ac791e9", "value": "12288:j+RnUnoE12lM1yk7s4uKkxiaC8o03g32u2HNYQTUJ9Ag0RavExvwDY7ANuGFQBC5:j+IoE16Mj7s9oqg3aHNHmAlljEAGuBC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910411, "uuid": "c1a64326-9c3c-4129-8372-7b9b064d1b31", "value": 782962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910411, "uuid": "8a30010a-f1f6-49a2-81ca-4d586247bdbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910411, "uuid": "a72bb422-4f91-4b84-8205-a6dfb5f7b3d7", "value": "4d1b8646c493d3fed46745143f84d655331efb35a908297c86efcdc90fe7cecd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7b2211-62ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780889392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889392, "uuid": "9637c7f1-2d52-4e0c-a54f-5464b6464eba", "comment": "Malware payload", "value": "04141a22446112873b07c8d21b2bba0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889392, "uuid": "89f58832-97eb-47eb-9f6b-f79602376e2e", "comment": "Malware payload", "value": "4d216955f43760886a26312ea10af1fced5f22aa4307cc5b2080c04feb158b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889392, "uuid": "c2f43bed-0a45-431f-89ad-f99ed75d6a65", "comment": "Malware payload", "value": "254e22eb5d61b5422c9bd96754abdef136b011f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889392, "uuid": "f330da8a-6dd3-4105-b570-b21e20bc88d6", "comment": "Malware payload", "value": "2c3341a1b77b45073b29241697ce7710fb3aab90fed959dee712b27d9547e03e339269b0a2e7c533c91f027088857784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889392, "uuid": "369b1c89-f167-4aee-ba6e-d891b2950ea2", "value": "T1A3B63907EDA545E8C0AED5348A629253BE717C889B3523D72F50F6243F36BD0AEB9710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889392, "uuid": "83977ed4-d0d0-47bd-bd87-7d0a9862441e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889392, "uuid": "eb290b5a-9206-410b-a17e-b51f0b2cf4b3", "value": "98304:SoqeD19hSQl4BauC/QP+9lgIbtRPb9xVH2GbEe:SoqSSQlW3qdVse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780889392, "uuid": "cf3b298e-4b42-4d79-ad38-95a3e26b88f5", "value": 11418112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780889392, "uuid": "32960ab8-a0c0-410c-9f60-39271d22cb27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889392, "uuid": "984f6dd6-8782-4944-8ef6-d5c56cadb213", "value": "04141a22446112873b07c8d21b2bba0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2124110c-635e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780939135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939135, "uuid": "79a6c0b6-5446-4ebf-b45a-5b2fb6ebc0dd", "comment": "Malware payload", "value": "0bb743fadb5b3f0a8094e51c736a8667", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939135, "uuid": "b9867812-7752-4f73-a1d5-7ec97951a39f", "comment": "Malware payload", "value": "4d23299c42ea2dfe54d8105b06c9519320c3c085c55f86c0c197e6709b7527b7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939135, "uuid": "de209e8f-e323-410a-821f-97ca2a01fd90", "comment": "Malware payload", "value": "75bac9efc961df2466f4330d0ca965eba59ec954", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939135, "uuid": "b4d7e157-4380-4f39-a951-dd819a9fd9dc", "comment": "Malware payload", "value": "3067bc884ba0436afbeadc4521270cd20a91695417bece37db6cd391509d6f1d33c2c0dda800b7b4ad61336e10e71b07", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939135, "uuid": "76be19a9-359f-4cc2-8006-a6a0ae0d2423", "value": "T11A410F2913940328D3F3DA3E6C56F3038635BC42D921AF3D0590568A5964500EDB1F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939135, "uuid": "38a87ce4-f5e2-48bd-9f1f-91dea3e96390", "value": "48:80ljdB0c9aJtwUpiSO+plR2UnpKULMMIW5ZT:801dqc9kaUm+92y0Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939135, "uuid": "9607932c-8ab5-4f06-91b1-399a1b95e820", "value": 2083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939135, "uuid": "0811c2ec-8a0c-429e-9a14-b4687fd6a800", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939135, "uuid": "96c045d0-07b0-4c9f-9008-c19360083e3d", "value": "PDF MANGO's Global Project, including Salary and Benefits for Successful Candidates.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7da0ee-6328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780916119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916119, "uuid": "787d076b-9e79-472b-a8c7-2759f53cacbf", "comment": "Malware payload (Mirai)", "value": "f15add08572177a8db17c84ffe8ff86a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916119, "uuid": "a56d0bd6-db44-4f13-b88a-3909a8781e48", "comment": "Malware payload (Mirai)", "value": "4d8238b2155221cbf744d078ba2d484f8e82736e4c73442c40037e79cc397de2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916119, "uuid": "f5a2436a-33ee-4af2-b9a8-ae96a6949d5c", "comment": "Malware payload (Mirai)", "value": "13460cd07f1231e2ec4aaf0681f8ab99e6519521", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916119, "uuid": "05d6cf10-c890-4246-b898-ecf6860872fb", "comment": "Malware payload (Mirai)", "value": "7e2a085e566f231a3ad6f204430e518bb723291b29438c27368ac6668904362e7b176ac37aac68f55cc0aa99feed5a9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916119, "uuid": "08e5d6c5-74e6-42db-b63d-06474d3de344", "value": "T132433A51F8818623C6D1127BF66E468D3B3123E8E2DBB3079D216F207BD686B0D67E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916119, "uuid": "198ca862-b683-4d48-97d8-398dda556575", "value": "1536:6nkG5GhLGv3TCzFhHu0+oFVTefFOiZdTI5nj:6nh2xpuforTgQ2d4nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780916119, "uuid": "265a0bf6-4437-4d65-a0f3-23b90709867e", "value": 56564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780916119, "uuid": "f8cdf446-cca4-4c93-b3e1-85ac72cee609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916119, "uuid": "e0af9a2f-c634-4a15-b14b-9acfadb169e8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1b7f54-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780912361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912361, "uuid": "8015dd7e-5384-426d-9e51-8546f2b490a7", "comment": "Malware payload (DarkTortilla)", "value": "49ce2ff2b51e3e75288ac4b05b897a80", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912361, "uuid": "b29f5518-c868-4429-807f-e36859ed093b", "comment": "Malware payload (DarkTortilla)", "value": "4dfb2741c3eb4589df8ac85965892f1c3edbce626ca3b7972d76a5a625722387", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912361, "uuid": "12c53dda-0f39-4356-aa76-8e5fa285ee72", "comment": "Malware payload (DarkTortilla)", "value": "efac233833ced1593bf0a0e0543949a5c389cb5a", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912361, "uuid": "23aed1fb-6ed7-4b4e-be16-73dc521b5608", "comment": "Malware payload (DarkTortilla)", "value": "a620b7987a4eebfb402bc9afc7de0485495a68dd065252f182d3db9e69da6fe1f0b9cbdedbbadde56cfd3564deff9e60", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912361, "uuid": "970eee57-b7ca-4b3e-98cd-662edea85bb9", "value": "T18415E0152DC65668E5EE0F78C072089C77F4C54752A7EB2B2EFC80F89EB3A89CD1A451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912361, "uuid": "45a1b9c0-9a81-4518-aae3-122cd399ac0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912361, "uuid": "588f20ea-5031-4fb8-a8f0-d5be64778228", "value": "12288:5fOK/hVb5wp+2m9Ow1xqVVWn4Wwu+IcbPmJ8t1RGUc8DyqF/NgyUlK7IuYw:5f7pUVwcbm8t1RGUb5F/etwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912361, "uuid": "ac2de4af-a1b2-4181-8e35-b2fc5baa47e5", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912361, "uuid": "dcaca5c0-1aa9-40bb-a8ac-f7f3f1417401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912361, "uuid": "4c762794-1a0d-4ad1-a71e-5e718ef9c64c", "value": "4dfb2741c3eb4589df8ac85965892f1c3edbce626ca3b7972d76a5a625722387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecaca5d-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908369, "uuid": "4de8c3db-ffe3-4559-9784-b480a9e67e81", "comment": "Malware payload", "value": "e0825201ae5ded202a5753c36660a7c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908369, "uuid": "e707883b-ec8e-4c46-b884-73ffb40e2b11", "comment": "Malware payload", "value": "4e0b1a2220ddffa809dfa88f4f8906d022099c220c3475e300c4c5386fd203ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908369, "uuid": "96856241-14e3-4d38-aab6-d72cbeea588c", "comment": "Malware payload", "value": "ca0e145bb4d905be87368a6dea4c3d3fd3a5d1db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908369, "uuid": "bfeb6615-5f24-4a13-b4a0-fa98f1b41339", "comment": "Malware payload", "value": "1460878fae5eca54592f13ab6398f8237fe25d018d67c3bd5977bc3c8bab430db9354808a5c43d4200da2a66b53cafe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908369, "uuid": "13dd86ef-c405-40e3-b531-9e399fb5b359", "value": "T11E2512652743D000CA5667315F7F1FEAD333DA280639864B8BA31AADDE37769E1D0D81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908369, "uuid": "7370adc4-5003-4474-bbce-e4b9e2cfe199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908369, "uuid": "3c071217-deb2-4480-b29b-6066d30c9c65", "value": "24576:6FJz7c5a8uGrxU66LghoGFq4H/+0a7K3:EvL8ne6thv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908369, "uuid": "6e5af277-ff46-4285-9efb-802648e48108", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908369, "uuid": "94cd99da-7a89-46a4-bc2f-69d87d2d65f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908369, "uuid": "65e89feb-78b1-43e0-bb16-d503604650c1", "value": "4e0b1a2220ddffa809dfa88f4f8906d022099c220c3475e300c4c5386fd203ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50434e0-62e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780885347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885347, "uuid": "0d1231e6-c38c-4842-8a3e-1a3a5e520d5a", "comment": "Malware payload (Gafgyt)", "value": "fcd241f89e98b4a1be6e8c22db4fa0f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885347, "uuid": "67996854-e4a4-4175-85fc-6b45d8810dc8", "comment": "Malware payload (Gafgyt)", "value": "4e68ae4f8926fbebed0302b8ee825bf0e792777fe58eadd48b82cd3a781a75d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885347, "uuid": "6a1e7e83-cf19-4a11-964e-42614a0d9260", "comment": "Malware payload (Gafgyt)", "value": "f8d25697fb765230d1376f64164e515f0a80963e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885347, "uuid": "657f30da-10c1-4262-af08-5b54b607c143", "comment": "Malware payload (Gafgyt)", "value": "02f0fe71bc7db83715e4a9c86ecc8855498adfc793e6b4fbe0384a57c9daf742bff764bcc67bc5f27205c5a3b809dc87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885347, "uuid": "5ce28060-8974-4787-ac42-2f135e04ab00", "value": "T155833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885347, "uuid": "7ce3201f-da92-4cbb-8994-f6b99ae9e5cb", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LsWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0YY2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885347, "uuid": "82809b6b-71c8-455c-a6e3-738e72b8519d", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885347, "uuid": "7269caa4-c223-428e-bdaf-31609b992753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885347, "uuid": "19600a1a-98d1-4e30-8ebb-ad511e91fee6", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8984fc7f-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941458, "uuid": "01a7fc85-8787-40d5-9c5b-a8b5086135d2", "comment": "Malware payload (Snojan)", "value": "058ce33d469090351063c0cd90107080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941458, "uuid": "aac35855-c831-4953-b26c-41aee57a9969", "comment": "Malware payload (Snojan)", "value": "4ea4fb9f9d5a9c0449444055028ee21779a2d8133e28c76df6c8d6e6bdc6f3a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941458, "uuid": "e209add5-f12e-4298-810f-848c331770cb", "comment": "Malware payload (Snojan)", "value": "44e9cdf5aa22763253e47314de5d79d2a6745e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941458, "uuid": "026bc71a-8c29-455d-acd9-712eda063cab", "comment": "Malware payload (Snojan)", "value": "209d8ef133d63409e9ca3d817e68e2c2f443d6fddb836e19b875230520a35d1b4887a74cf25f58639d7c6f9f0a2eab0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941458, "uuid": "c00f98c7-b8ad-4f38-8581-f0fbe40a322c", "value": "T1B6B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941458, "uuid": "dfc23806-f70a-4b74-96f4-a76373054f1b", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941458, "uuid": "df416501-a9f5-442c-951b-7adfff90bcc9", "value": "12288:/bE+uBh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+6k70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941458, "uuid": "85cd8ade-4136-484a-ad25-b6c33d7d0b72", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941458, "uuid": "bb327ddc-58f8-415f-9336-9908b78918b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941458, "uuid": "ef3cb670-c2cb-4359-ae04-7384b9686375", "value": "GZea3Mczjn5IC8jt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6fb16e-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780910621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910621, "uuid": "4acc5f09-e702-45ac-9cee-07cdab3ab394", "comment": "Malware payload (Expiro)", "value": "f0145465f801d40a41f8ffeddab2f9f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910621, "uuid": "37f37d9a-ecb5-471a-b1cd-4afe8e54e47e", "comment": "Malware payload (Expiro)", "value": "4ef9cce749ca88cfde098c9048dc9e0f914b1ddebad21336477584a1ae7ce24c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910621, "uuid": "38742c9c-b900-449c-88a9-a5dc0be4a1da", "comment": "Malware payload (Expiro)", "value": "439dd1ea008b7c6ee797f31d7cb20ccf2af483cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910621, "uuid": "b35879b2-ec46-41f0-ac81-592cac9236d1", "comment": "Malware payload (Expiro)", "value": "72f1eaae4bd5abf9d0301db852e03504a7217c067010941e427a932f801c594f6631c93979a242fec6934e4b0556336d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910621, "uuid": "4fd451d2-7531-48d9-a0e5-0d63e4735698", "value": "T17B852309241EDA1BE5DA0FF40AA2E27137740D89E611CB5BEFC57EEB74BD7242481346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910621, "uuid": "5194b4ee-d4ca-4e50-96a8-28311495ac68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910621, "uuid": "bc6cfd81-6c13-4c5c-af55-c80597c74ac7", "value": "49152:Ue21B4W8WYGculICRLu/4oofJXGgG8/Ck4jS+0yBTxZZfMy7:M8nGczC55GgkkSqyFSy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910621, "uuid": "ad71ec0c-7803-463b-8c51-b97209ddad43", "value": 1793024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910621, "uuid": "acfbbc2b-d840-44f2-b6e5-84d5977bf39d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910621, "uuid": "fc02de29-bdc6-49a9-803f-18f08c3aebf3", "value": "4ef9cce749ca88cfde098c9048dc9e0f914b1ddebad21336477584a1ae7ce24c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5573919b-636c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780945236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945236, "uuid": "0e2bd4e7-46cf-47d7-940d-6e4eee0535a5", "comment": "Malware payload", "value": "e7b80a942ae7a63a07c52ca024ae9f44", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945236, "uuid": "3ff3bdc3-6eb1-4e8a-aa08-d0e10327b4ef", "comment": "Malware payload", "value": "4f00887356d0e94abe6d45d173c17f871ac240429d7bd0a97150a47443a8685d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945236, "uuid": "7dcc6339-28da-41b4-a835-22055019b596", "comment": "Malware payload", "value": "4c33b0fcd0e2d7d73c9826830aa603008826eaf7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945236, "uuid": "dd7a6b5f-6eb4-4e65-8b13-2aab25079391", "comment": "Malware payload", "value": "9522422a33b9c33d5f25ae4e3f71cc2703760d7c910bc1e7b0f683cabe6cf3aab04570ac3638f22dca26f034ee9d27ad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945236, "uuid": "02b94c6d-d10d-49e5-98de-ad33849e1d5e", "value": "T1521412E188FC4F72E946F83517844BF09D3B9C876C947A487FE0E0159DAA5F90F46A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945236, "uuid": "d29d4592-b916-489c-a589-996e6459f665", "value": "3072:pSwKYKBL9jgc6CjmmmOSYB2Eel65CccabdXcI7ENe8A6BOT/blQa8TO+U8Ok06Kn:PnKBSc6MmQB2lYCKRoe8ATZQa8TZU8OF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780945236, "uuid": "c06bb7b2-b965-4168-b481-157b648123aa", "value": 195453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780945236, "uuid": "61d9fd40-0215-46e8-a6f1-e8ec89e10735", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945236, "uuid": "28181130-a112-49a2-9142-e0396aff2126", "value": "Onbuy-orderdetails35.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5345171c-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907437, "uuid": "d1fe65ff-06cf-4022-98eb-10df360fb46f", "comment": "Malware payload", "value": "f3e821716f9855630f8e9a317cd6903b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907437, "uuid": "b25ef304-0b7f-4217-be6d-bb428a8583a2", "comment": "Malware payload", "value": "4f1c48a0c1b4b078bd20f1edf31d2dc91be1366be16d63d29b7563c25fcf6d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907437, "uuid": "c0e3e74f-919d-4075-b8f4-cb5f49494696", "comment": "Malware payload", "value": "5f5feaad4fe0b0782a59d317d179c2699a8c9417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907437, "uuid": "3cebe25b-29f2-4f09-8fe9-ef8ab52e8f45", "comment": "Malware payload", "value": "bd8a662db60affbf5e0505b46efa928b9d492cad00e0cd917f5bd8aa007f1766c5aa93ecc1002f4a7f7fe5dfa04a2114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907437, "uuid": "abe52748-f890-449a-9b69-4b178de0057e", "value": "T137551212B7C48076D1B22A324AB69710067D7D611F268ACF13E07DBE6B759C2D631FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907437, "uuid": "0ac0ae9e-520b-47a2-a8d8-697931d21a6b", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907437, "uuid": "0881d868-9f2b-47c8-80e1-d348308ab8d8", "value": "24576:hN/BUBb+tYjBFHL68WsTIl0jC8UzEo50ES+zZ2eZniXiM0hD6di/AT:jpUlRhTWOo2dU4Y07+12bXiM0hDTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907437, "uuid": "657ed323-562f-41e2-9c4d-2ae2f8b56a02", "value": 1318634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907437, "uuid": "d9d095f5-c643-428d-8ac8-5d0cdb32cccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907437, "uuid": "584174dc-3a11-4e0c-90ad-bff83700dd3b", "value": "4f1c48a0c1b4b078bd20f1edf31d2dc91be1366be16d63d29b7563c25fcf6d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d67f22-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908194, "uuid": "301a21a5-4bcc-42e3-8c34-1d1b2be60a29", "comment": "Malware payload", "value": "28d99a51e1a0e2d94c8d6dc51ebdcd16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908194, "uuid": "03342756-adb3-40be-af4d-4261cd7104a9", "comment": "Malware payload", "value": "4f2fa77096b9fa09de244ae07440d75f2a2ce9d0225d0b14c53de41f445e9115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908194, "uuid": "48d58730-9e2a-4390-8d28-88072bf04146", "comment": "Malware payload", "value": "94a915ca02c7bf915ae20902ca3979fc92cfef23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908194, "uuid": "86877695-6ca7-4bbc-beb2-c93db819a70f", "comment": "Malware payload", "value": "00cd11bbe0cfa71bca7237b52fd5c0709f8c99dd9fc84ae06de2bc9df8676b5f1143c63fb1938c79ee9d9dcf7d4ef997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908194, "uuid": "0c93dec6-f020-4a33-a1a2-9e3eec7781b0", "value": "T1F25512C2D369D861ED180771804FC53102377C27EA592F9E3A94B73B7A333E5A66582B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908194, "uuid": "10d047c1-92c0-40cb-861b-57bbb6d9cb2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908194, "uuid": "fed04fbe-b190-4f01-a7dc-af498d18dedd", "value": "24576:DVv6qPGQ6FXPnnFzjiKU6EIr5NcuwlnX7BXqFxWxoW893w9uYNiNplA:x6VQ6lnFvFU325uLtrBXyxJf9g9uQidA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908194, "uuid": "79b305f4-bcf7-444a-81c6-62f4392c5f43", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908194, "uuid": "e4f7fa94-386d-4222-a395-1ebf5bf5f9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908194, "uuid": "3e454e5c-f299-4d99-86d3-05d682367f68", "value": "4f2fa77096b9fa09de244ae07440d75f2a2ce9d0225d0b14c53de41f445e9115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e430820-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907938, "uuid": "ec71310a-aac9-4dba-ac79-59ce7d7513a2", "comment": "Malware payload (Formbook)", "value": "542520e02fb4b5bc034e98349d689a27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907938, "uuid": "c7908787-3116-4e70-ac60-00c5b87ea899", "comment": "Malware payload (Formbook)", "value": "4f4445008586514573acaaf03c43c1d80fed98ff3cf1d22b00e2e28704eff2b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907938, "uuid": "b508cb45-a8dd-4225-b872-182df5421ec8", "comment": "Malware payload (Formbook)", "value": "6775ffa6784862a5a33a1a84f6022148f021910f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907938, "uuid": "e83243b3-9b12-40e2-914a-283e8dfa5a3e", "comment": "Malware payload (Formbook)", "value": "a763cf21ff0b977fd23feb638f2c15ef19c1c009288cd1324a0351e423d1503d34b69bd97003cd0e8d9f40cbb639ad4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907938, "uuid": "ad6e6a78-8f8b-482c-ac59-2be36780305e", "value": "T193350144235ADC06D4B78BB81860E3B507745E88F931D3139EEABEEB793A78158193D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907938, "uuid": "96de5f86-0403-44fe-91d4-435ca701a18f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907938, "uuid": "29565622-4c56-4be4-b221-33998f34369d", "value": "24576:uRYW8mrQ/ThJ05rSnvsuGnXBlm0X/SyVhpo07pd:u6W8cQnU9nxhPSYU0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907938, "uuid": "40cf02d2-617d-477c-abf4-ca86df044d7b", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907938, "uuid": "f181ad37-3c28-4160-a64c-74e78a020951", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907938, "uuid": "d9fd92f8-f22e-4924-9a7a-05f22ab87516", "value": "4f4445008586514573acaaf03c43c1d80fed98ff3cf1d22b00e2e28704eff2b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389509f5-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780911687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911687, "uuid": "bc975751-673f-4897-b491-b00d650e8c28", "comment": "Malware payload (njrat)", "value": "cd51986c94afa6684ad8e7ba81712869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911687, "uuid": "8d6dcb37-2f86-4358-a740-d48cd1623072", "comment": "Malware payload (njrat)", "value": "4fae5a36b111535ffb0b3d0ceda61556b6bafec8e20c742c8c5902dd54620f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911687, "uuid": "3bbbbd4d-0255-4ef7-a325-3218d98b9982", "comment": "Malware payload (njrat)", "value": "06b316c3d29025a782923169e8650891c4deaa1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911687, "uuid": "768092b0-61e8-4eda-a48f-c5eacbc799c2", "comment": "Malware payload (njrat)", "value": "ca35a3eaabdd199600e98030bb4b188fcdee64d4baefbf7225e0f79c3f57d0a85d32dcbaf5c9aa0705202b0b98a36ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911687, "uuid": "8daa386f-b25a-453d-942c-a25d9e9e7dac", "value": "T1130512A86A05E413CA812B745E71F2B512AD1EEDF810E217DFDDFEEBB8B6D101D40285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911687, "uuid": "cccaecb5-6d09-4598-981f-f89babd9f673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911687, "uuid": "f31060a0-5519-420b-84c0-9b93fdb18a9c", "value": "12288:ZgtzDlDcUoML7zamd/3QCWsvZImHMcjre4O3ziOoGAY8dkmR0J:ZgZdcS3amdv3viwe1ziHkrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911687, "uuid": "a199ffe0-79a2-454c-bc52-a1a87d04fb2d", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911687, "uuid": "6f86fa78-8b7b-4835-974f-e77b7393f4c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911687, "uuid": "02eb5686-ad95-4692-8676-d2dcb4a379c6", "value": "4fae5a36b111535ffb0b3d0ceda61556b6bafec8e20c742c8c5902dd54620f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514c710d-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941364, "uuid": "8f2f1caf-2d6d-4116-b7de-123888673447", "comment": "Malware payload (Snojan)", "value": "18c39fbcb290bde41bce0971812f3d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941364, "uuid": "b6ab2262-59b8-4e11-9ca0-4b22d9ee17d6", "comment": "Malware payload (Snojan)", "value": "4fbec9ece68deb2e4133440408ab051858b78b45ae5500315a68f1d5a0d73c32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941364, "uuid": "3d34864d-c95e-4fd2-a7cc-f37aeab2c6ed", "comment": "Malware payload (Snojan)", "value": "d8cfe973b8ef7ca5442e973a9b1bb6e047153b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941364, "uuid": "82df3e58-1ba1-4d47-887d-42739d8bea83", "comment": "Malware payload (Snojan)", "value": "ecf5bd93fb23df0e1257681641858237c1835653c716dd674f5dc2e3e80942954a110731ebd73a10f0e4776219f495e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941364, "uuid": "dc130e0e-8bf5-41db-9a38-beb633c8a7c5", "value": "T17735222471C0C4B7E46B403544C9CA76AA767072477A89DBBBED63F5AF203E1A3352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941364, "uuid": "46136d64-92c8-4138-a353-7edcac0a4401", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941364, "uuid": "ce02a047-eecc-487b-8d0a-82e61187a500", "value": "24576:/Y+Bk70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyLBw:/kQTAKYS/v6h3+1uhZcT2NnvOyLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941364, "uuid": "a75668a0-d336-4313-ae11-8fc1d804c94b", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941364, "uuid": "9aabd318-77f8-468d-915f-09bdd7171716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941364, "uuid": "6944062b-de14-447e-9731-e6050982555a", "value": "AouXh1CgTjyEr8Aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c645a1-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908238, "uuid": "5d7bd71e-6ae1-4c48-9bdc-7570d80bd88a", "comment": "Malware payload", "value": "3c7c631ab1ac9530b7e07bd0d94ed2a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908238, "uuid": "9f7693ad-05f3-4d09-8e09-5cc49f8a2ec3", "comment": "Malware payload", "value": "4fdb50782ec56176bbf856ce71daabf6a46d5ba1d84259a838e66be7366bab21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908238, "uuid": "15ae3388-ed16-4fbc-b678-2a84ebf5455c", "comment": "Malware payload", "value": "c3fb8d15566badee45c34eb0d7b397cd2840677c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908238, "uuid": "2975f444-60ec-4b08-a113-5671e536f6b2", "comment": "Malware payload", "value": "d67f67fd2563ded70d3b384a1a0b9c0c7cd20ccda164fc5cb32cbd768a145dc64cf24cf5d2665faea60af198a7345552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908238, "uuid": "9ff948a3-b076-4191-b388-500ebae41f76", "value": "T15D2512252B039015CA1667311F7F2BD9D373DE280639824B8BA31AEDDE37769E1E0D85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908238, "uuid": "11a5c725-4c1e-43e5-bf35-fa4219814bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908238, "uuid": "826443d3-015b-4120-b6d7-59f87b92ac8a", "value": "12288:l0FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wnvVgpk8IAoG6IGHrv:6FJz7c5a8uGrxUEk8IAoG6IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908238, "uuid": "edf29f10-e808-4403-8cad-3558ea85abaa", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908238, "uuid": "2af024ec-a885-4234-88c6-9366a8d219df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908238, "uuid": "ae9b6cee-2c8b-49db-96d4-2a1248099c15", "value": "4fdb50782ec56176bbf856ce71daabf6a46d5ba1d84259a838e66be7366bab21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9276014f-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780910120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910120, "uuid": "082798c1-e55a-4409-a508-c1b9af922482", "comment": "Malware payload (WannaCry)", "value": "445c961def899fe67eebb4fb5695ea6e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910120, "uuid": "f0e0da8f-f628-4153-a710-cf54b8824ad6", "comment": "Malware payload (WannaCry)", "value": "4fe2a41cf563fcf8f78c03e9c23cd3adb4d04e628aabc781b6bcaced0dbb9556", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910120, "uuid": "a2367bee-2c6f-4ea8-8865-12705e825856", "comment": "Malware payload (WannaCry)", "value": "3576a836e21959dbaeee1f61600420cb3d57e3b4", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910120, "uuid": "756d980a-2361-4184-8ad3-5b5ac95fca76", "comment": "Malware payload (WannaCry)", "value": "cc6791cb6fe0205aed639946cd000c46acea039cdf49c392d938e469edb362676744768c06449e122190f3f72ae94803", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910120, "uuid": "b002cdc8-e431-4ed8-b340-51ddfbc3742b", "value": "T1DC363398726CD1BCE10609B484738D26E7737C6657BF5B0F8750866B0E13BABBB90712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910120, "uuid": "f937b8f2-cb88-4165-b9fa-8ba6750e7634", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910120, "uuid": "fbc8e9eb-f634-4c05-b1a6-0fb36cad3394", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8y:DXDqPe1Cxcxk3ZAEUadzR8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910120, "uuid": "97f8d179-9746-4868-a493-c53db46d2fd9", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910120, "uuid": "3498086f-c3cd-4d4c-b972-3682d3d2e481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910120, "uuid": "f99b6f19-0140-4424-89c6-448512d63220", "value": "4fe2a41cf563fcf8f78c03e9c23cd3adb4d04e628aabc781b6bcaced0dbb9556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c53ea8-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780939593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "4deb154c-74a3-4512-a392-8c34d1fd5ff9", "comment": "Malware payload (ConnectWise)", "value": "fbe6dbb1e9f321592488e09f79d88c35", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "22c20d3e-3f94-4a28-a3d3-b0ee78b72ae1", "comment": "Malware payload (ConnectWise)", "value": "50a7b8388219e007b94d0973ce55c8633d282a5403f3acfef39760cd2fef86d8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "6372c3b1-f2bc-4585-9d64-527c012878c9", "comment": "Malware payload (ConnectWise)", "value": "95ee84e30c7db7809eddaf84700a89e0f2ea115f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "56fd5302-9beb-480c-b2de-69eb4611519d", "comment": "Malware payload (ConnectWise)", "value": "0b543fadfdf0a57ee636e988916b2d2cb2845870ae82ade35571cd99feedbeb3e95bbfe56ad6bc7e254d57f91f2e9b77", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "d5273ad0-99ef-413b-ae58-b23ef6f42b3f", "value": "T19446E001B3D5D7B5D07B06B8D87B4E655636BE048311C6AB5394B92F2E32BC04EB236E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "40532510-537a-4e7d-bfac-665db5a39411", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "7a3367da-1e1d-4395-aaa8-555fd3ab7370", "value": "98304:2zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:2hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939593, "uuid": "4fc5b91e-1780-4797-9da9-5e1d7cea0da3", "value": 5677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939593, "uuid": "ad573acc-0e1c-4259-830c-83854f0af408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "f6f80fa7-ae2f-4856-b314-e4b6cf1567ec", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94380447-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910123, "uuid": "772424e9-9006-4fcc-ab4f-3147f426a17a", "comment": "Malware payload (Formbook)", "value": "470bbf26ff7c8891376c910df8015ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910123, "uuid": "25a5aca0-adda-4360-aad6-3fd5fa7f9860", "comment": "Malware payload (Formbook)", "value": "511abcad3305adb02bb25c6595b07608ecd8d75532775ee18ed14daf646ac7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910123, "uuid": "dfe093da-c831-4101-9206-2e8508c42992", "comment": "Malware payload (Formbook)", "value": "c3cf21701572d20277f12d6c42cbabbb1b27bcb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910123, "uuid": "db0cd1fa-edf1-4bf7-8973-6d6085b1f480", "comment": "Malware payload (Formbook)", "value": "64aeb26f485267ddb1b793afa31cdc83803f5a1b9fe52a3e7b4faa0c22ff28dea4e271cb4117630ea319e2b486f9452c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910123, "uuid": "3c7639de-3528-40a8-80be-75ea4c045f9c", "value": "T11435E1D43A26E70ACD524A319935EEF116B40EACB501BAE38FDD7F5B74AC150AD0CB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910123, "uuid": "dbef1e9b-a8df-47af-80bb-73071adf02c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910123, "uuid": "e527a19d-b7bb-4833-b2b1-761e590d27bb", "value": "24576:Qxabt/r0phcJXOHCsdw0/heRmkqeliGDAQ4p1BaKKRzZ5:OaJzTJ+Fd1/heDliG14p1BtaV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910123, "uuid": "b4065bb5-7e73-40b3-a17f-2273000eaeb9", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910123, "uuid": "36ba7515-2a44-47cc-bea0-d5f260f2071e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910123, "uuid": "5532d938-c1d6-49b1-8d3c-c77e13aaa048", "value": "511abcad3305adb02bb25c6595b07608ecd8d75532775ee18ed14daf646ac7eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d6fdfe-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780911308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911308, "uuid": "56a4a082-86cc-42b7-8aa1-43d01e26e274", "comment": "Malware payload (AsyncRAT)", "value": "33fd53ddb91587c8cb365ae671e58d69", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911308, "uuid": "1fa8c4ba-203c-41c3-b5d7-555b21886af0", "comment": "Malware payload (AsyncRAT)", "value": "51935015f140db78911cab15b0d4aad0f64bbfe742ed3ca5e037cad03a1978b7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911308, "uuid": "bd8e07b9-4e4e-4d14-96f4-7d7c1a1b2a1f", "comment": "Malware payload (AsyncRAT)", "value": "9ed156b8694b16214b21fe3dc87f05860ce91a44", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911308, "uuid": "c5fdf542-8764-4c9a-b3e5-452cdadaba7e", "comment": "Malware payload (AsyncRAT)", "value": "9927078370cbd5698075c1b6739fddb7970b2418b1a972f0f775c6e2cf8aec6e949e779aad911fa705b90d19a9de8bc8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911308, "uuid": "57e44dc4-53f0-4aca-b04e-5a2451f4d18b", "value": "T115050268766AC407C59947B498B0F27843B86EAEB411C6D34FD9ACEFB9BAF054D10343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911308, "uuid": "bba6aed7-3542-4126-ba04-86af374966bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911308, "uuid": "afd4168b-e37f-4430-8baf-d8feb4b65f7b", "value": "12288:qAGp1ZIrKyVV2Oxofyz78EZaIYUXXd/TUjhV5GmKq+zlsHjO6trkYS21vU0kTfpV:3G1IafhEZXFU9VnKq+oyKrhSgUXfgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911308, "uuid": "e887b840-8d0a-4d87-bf13-e484c6e55c0d", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911308, "uuid": "8b065277-e51c-4673-ae1d-9d83e0af9abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911308, "uuid": "d81a53fe-79e6-42da-913f-c50263f76bd1", "value": "51935015f140db78911cab15b0d4aad0f64bbfe742ed3ca5e037cad03a1978b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ceb00e-6320-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912519, "uuid": "6f11eb06-ae19-44f5-a9d1-4c1cba5fe720", "comment": "Malware payload", "value": "908ee0237659597115804c4fdd24203a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912519, "uuid": "b2560c69-a8f3-467a-90c9-a80f8fc9c7af", "comment": "Malware payload", "value": "5199a56f2af495a2d90bdff07afb1982e79da1e4fa66b8943f288fdb4e4a7e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912519, "uuid": "710d8ec2-d715-414a-a6ed-928a1110e93c", "comment": "Malware payload", "value": "96e45ba2c955ce76540be657d3d6e197f75de2e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912519, "uuid": "e1135df5-d186-4e38-b62a-5435f0eda6a9", "comment": "Malware payload", "value": "a77f189302e17e53364e4dcda6e766f9032505a4bb3a3c689a6dbd845ce435bf6623785b561568eee6503002eff650d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912519, "uuid": "42043571-18bb-40a9-a8cd-ea02c5728d06", "value": "T14E25CF232D4AAFD4C97F0B76C0AB015463F3CC426DA3D78A3EED19B82963B958E11517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912519, "uuid": "571e80ba-3abc-4d6c-9f11-47ff37993372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912519, "uuid": "33576d08-b973-4e4c-8c12-42f71c30ce59", "value": "12288:f63+pQ/KCX+rNf1OV45vKgxPs3hHaUxe2Hg2EUgkrCdl8Z923PnEzHlkn0c5fbH2:fFTbKd3Nxe6Z9gnEzHi0wHy0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912519, "uuid": "4b434ec6-b42d-4ba6-b73a-1558eb7e5738", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912519, "uuid": "3e8375df-af6e-4aca-b74e-10b0cf971f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912519, "uuid": "a8730b6d-74b0-422f-aea8-7294daae3499", "value": "5199a56f2af495a2d90bdff07afb1982e79da1e4fa66b8943f288fdb4e4a7e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f476278-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912557, "uuid": "ee5d8d42-5ecf-475c-95df-94237b0451e9", "comment": "Malware payload (GuLoader)", "value": "c0c0dedfb87d4c312363a9cd0259a128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912557, "uuid": "1ac8ebd3-bb6a-4d5d-a6da-64798331c3ff", "comment": "Malware payload (GuLoader)", "value": "51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912557, "uuid": "be4dade4-19a4-4720-a2a7-a044179acd0c", "comment": "Malware payload (GuLoader)", "value": "d83c9b52e96203f4f976ab2762a023d3b0bf141c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912557, "uuid": "fa52e3b2-8e60-4191-a59f-a3ec20fb696b", "comment": "Malware payload (GuLoader)", "value": "e4b01122533223c30fd8c0ac41863104b364902f612b6b0a5a6b2f463d7cec08e7d9662a5d01b630476046d1f818090b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912557, "uuid": "72a13b01-df0f-4717-a305-ad094b001c28", "value": "T16854120437D8E0B3C92352715A3BCB5F1FA2A9006A98534FA7504F9BBD73541CE6E6B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912557, "uuid": "91dbbd2c-72ce-480d-af6b-414dbf7d6bc0", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912557, "uuid": "14b7efee-ffc2-402b-92eb-6ccd55dc05e5", "value": "6144:I5OhgOWGGYoXGEJE17bKiGJotXLeH14Xk1IAMRER43QtYm26Ndj:fhgOc92AE17HtEAQtYm2Odj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912557, "uuid": "5894068a-1f8d-48fb-a23a-4b560db07358", "value": 305624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912557, "uuid": "89e72d1e-4e90-42fc-be26-f0ff91532e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912557, "uuid": "46192b0b-e17a-436f-84b9-14411d3fc7df", "value": "51e21ba467683d83fa2d9856dba5c40375b05d6b5627c7c37f8024af959e235f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa55c08-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780911288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911288, "uuid": "c08f1f05-c4a3-456d-b37f-f05c509fee5f", "comment": "Malware payload (Stealc)", "value": "956e4294d1b17899079a9817060dec4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911288, "uuid": "3788cc8c-7ea0-410e-945f-6486acc6ec50", "comment": "Malware payload (Stealc)", "value": "51e9b1e1eccdc862908895897e6aa329b433645fdc5d2c644509958547ce3dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911288, "uuid": "f7e6db80-bf9c-4b6e-b2dd-9c4d75108044", "comment": "Malware payload (Stealc)", "value": "19a9cc6d74f1f652c3669f013f69d4a744b6bd88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911288, "uuid": "68e6df35-e057-489d-9c18-93eeff895b6d", "comment": "Malware payload (Stealc)", "value": "b30221c5d257c7dd20b7365a5f43dc17e61d947f9e014975fafd9a70c6233942633e149827146d19aafb9c56d5521ab9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911288, "uuid": "6a41ac23-e33a-4f14-b1a4-da3ea1eca782", "value": "T1B8032A1BA5EBC385D9E282B0F6668327FEF0B081B034075F5670CA3D6F27513AC2A955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911288, "uuid": "8184dbab-8cf9-440e-87fa-b67a06271175", "value": "9d6b7a90e30c979aada0c2c88281d1b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911288, "uuid": "0a43b54f-97ea-4648-82bd-4a2c80eb2c62", "value": "768:UlvBc4FsYxddOnewnDyD5+tRkXpLYm772iuhnJ00/x8Q/8k1hC:UluesY3CnDy1mRoL2bh9RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911288, "uuid": "fb6bb190-2df4-4a8c-a7b1-982a4ca0799f", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911288, "uuid": "10a4975c-1a80-4cae-975a-8aef19084b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911288, "uuid": "ffeed9e9-2709-439d-913a-77a64a11681f", "value": "51e9b1e1eccdc862908895897e6aa329b433645fdc5d2c644509958547ce3dac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104807d4-6328-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780915914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915914, "uuid": "dbccff4b-1303-4ad4-8ef8-21b6f225f73a", "comment": "Malware payload", "value": "098564a47893e9648628cd25eea76830", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915914, "uuid": "25f5e233-c8f4-4d97-ac5c-c98f5c5e1e2e", "comment": "Malware payload", "value": "523388567630e4fbdc359f75232bf2ad82671a680d4bfdce0237fc30dfec4c80", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915914, "uuid": "e8a0cdec-8552-4267-981d-20cacf2f7550", "comment": "Malware payload", "value": "a9b8de1a032ff209616300e38d2da49ead85d73a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915914, "uuid": "4c1d263e-981e-4cb2-a03a-481dca9a9609", "comment": "Malware payload", "value": "38cc7983ea38e98148af057a624328960079e10dead0dc5f8a0df1099fbc1b993aaa6d01430920fbcc138c3b4152a160", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915914, "uuid": "277d5869-fb8b-49ce-ab24-87328d571347", "value": "T146273343C21B0356DA8FBF3532D7113BA55CE62C7666948B3F5063D02CE16E69E23E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915914, "uuid": "f7a62981-72af-429f-a42e-ff9320c9aff2", "value": "393216:mHJbQlHe/h8xBuXm6u+vV9r1BPWCpFD8uXd8G0wim6Cm2lKqEI575UKV5EgPu:mHJbQE/h8Pcm6XV95BFZ8Md8zwC2wqEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780915914, "uuid": "12049d46-6c63-4936-879b-77e8872b1514", "value": 21954327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780915914, "uuid": "33a1fd09-2ec4-42b3-84d8-c8c02b315b8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915914, "uuid": "b402d022-615e-4379-b27c-3d947ee60cf2", "value": "523388567630e4fbdc359f75232bf2ad82671a680d4bfdce0237fc30dfec4c80.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbffb47-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780911853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911853, "uuid": "84b856b2-c744-4b48-875f-04a794d9f525", "comment": "Malware payload (GuLoader)", "value": "a82794090cabba00fe39ece0606a616d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911853, "uuid": "703c9a58-2e03-4e0d-af87-5d63111998e3", "comment": "Malware payload (GuLoader)", "value": "52bf5c03705954e49fc0d7e7c37c507868c223f4a54180cad932fb942eebd4f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911853, "uuid": "b2886303-9098-4758-922d-3fefd6c55c1a", "comment": "Malware payload (GuLoader)", "value": "1a069946a5cddb81776c73546b4b46f2feed0958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911853, "uuid": "2106b4ea-ab2c-4dbc-b11a-4cbc11fded84", "comment": "Malware payload (GuLoader)", "value": "3b89b9627b08911131ea1c4d95e5df5b8530604217b119b4e5940235d5eb7e35ec21c83151bde6af15154d73255a91b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911853, "uuid": "8092814b-9f6b-4a2e-9a08-4be40a3ac5e3", "value": "T1BD441201B270CDE7D9651671153ADBFFAEABD80A0194A7539F80B71E3DB32425C2F222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911853, "uuid": "89c9fdb6-b26d-40be-b153-d5f0aea4fad5", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911853, "uuid": "60754220-6900-4058-bff6-e87a62389480", "value": "6144:Y1ssjCzMu5rUBdMDUxfYeAA4cpaLyed34WqoeVTThhTuWm16:1sezy+D5APaX341NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911853, "uuid": "aae73f46-a5ee-4d01-826b-b561f1ba126d", "value": 271912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911853, "uuid": "562ff8bc-291e-4a4e-a8a9-96d5b903d6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911853, "uuid": "8965e801-5961-49a5-9a3a-fb913096a423", "value": "52bf5c03705954e49fc0d7e7c37c507868c223f4a54180cad932fb942eebd4f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9861e851-630a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780903258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903258, "uuid": "db1ac164-7b39-42b6-884c-bd90cef761c3", "comment": "Malware payload (AgentTesla)", "value": "316742092665bb76b521bd8263ed1516", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903258, "uuid": "f417bdb6-0e53-45d3-9c8a-436be421615c", "comment": "Malware payload (AgentTesla)", "value": "52cd593a85d84da0c764e303c5f9c7811ba4ce5a759f625ce1117c5d707c2958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903258, "uuid": "eb0c7949-0e96-4554-bbeb-1a57256077d5", "comment": "Malware payload (AgentTesla)", "value": "9faf5165a220c720fc318cc9c777b8fc29337097", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903258, "uuid": "02e41a05-c77d-4e70-99b0-aff03644eaf4", "comment": "Malware payload (AgentTesla)", "value": "24a51f21a6c4d3a8e7911d44d4300b15b8130f1c78c39de05f76b062125f108267c218058b24d1c16ca157c0d6e59606", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903258, "uuid": "46ef2410-a3ff-43f6-bc03-0f6da5c86e8d", "value": "T1302523093A79D9C7DAC689B83E0AEFBA94725E5836404D473B507F8F3D7A4D22C2B144", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903258, "uuid": "fef8a7ae-9d58-4452-bc6e-ca33465dd306", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903258, "uuid": "df49247c-8e25-4e4a-81fd-55ba1d21017d", "value": "24576:oy3TD6HLKcNWLwmMmPu0XMlauDfADojpBMH8mmibje3z:oyCXNWLwm9PDEkD028mmAje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780903258, "uuid": "1894c5d9-f238-485b-8a7d-9f1cdacf6e9c", "value": 982104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780903258, "uuid": "eec39a64-8c19-486d-928a-34c7c4dfe133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903258, "uuid": "5919a7ea-f7cb-45c2-9df8-8db53d09288c", "value": "ORDER10004639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720d568a-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780912213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912213, "uuid": "e85e74bb-eef3-4317-b22c-7a67ce13147b", "comment": "Malware payload (MassLogger)", "value": "03445bf74d9ed6bb145462468a7d8a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912213, "uuid": "85218538-1462-44d2-979d-d609f94728d7", "comment": "Malware payload (MassLogger)", "value": "52e21b7dff216804700a9aa925271a4149d379dd47e933524b7dd6f5eee9ec7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912213, "uuid": "9d93374f-72cb-414c-83be-fff55cde9ff2", "comment": "Malware payload (MassLogger)", "value": "b846579335e0bce5b9d35ee2868119bb718d1bf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912213, "uuid": "71c72b5d-e6b3-4c9e-99b8-2dd7d9aee919", "comment": "Malware payload (MassLogger)", "value": "a9119e02bdb1bc485ceb292906d88e0886c4a208b28782b06af3b7419ec0ad3a3de4689edf755cbe45bf53579f529d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912213, "uuid": "1d684aa0-9257-4df9-8330-44bc969c2f8d", "value": "T1570512A432ADE766C9A24BB51C61D27147762EAAE431C359CFDCBCDF7C2A3505808393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912213, "uuid": "bab5e353-acda-4142-bad7-b546e4e4d635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912213, "uuid": "1d6b940b-370f-44f4-a7c0-1789ab63a2a3", "value": "24576:GAWfFsP0erqDqqTG1Q7LNnWyJ31XDR0ECXWQ:wberqDq11Q3AyJlzWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912213, "uuid": "e17c3675-88aa-4042-9b06-57895e4b2a4f", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912213, "uuid": "92f689a9-3c1c-4d2f-b994-b3a2c4f32814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912213, "uuid": "c50a2c99-2ec5-4c29-afc8-45ba57b6644f", "value": "52e21b7dff216804700a9aa925271a4149d379dd47e933524b7dd6f5eee9ec7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f1c1e5b-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780928931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928931, "uuid": "1c65328c-d1ea-440e-aab5-e73a86304318", "comment": "Malware payload (RemcosRAT)", "value": "e17d9c408b860cee531721f3969447d9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928931, "uuid": "989c0380-2615-4c5e-88a2-846375da600a", "comment": "Malware payload (RemcosRAT)", "value": "535a851b631bfb8a5705bf6f191e28cbba0b188485ca0ff1347e423463b4d9db", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928931, "uuid": "769f6f72-2ec1-42f7-8657-23f235c4a389", "comment": "Malware payload (RemcosRAT)", "value": "fe79fcbe3cb6b1c9d1e6973b90547a35690a56a5", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928931, "uuid": "ac5a9a51-54ce-421d-bf30-6b06447c0987", "comment": "Malware payload (RemcosRAT)", "value": "3fbec61b315e39ac19481ac01bcb66c6187f8738a8d3a6315ba560fd7aa3ce0caf6bfb4c7e22fd93185dfd7eff36ab96", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928931, "uuid": "b4acc048-eda3-4b56-8b80-04a7a4bf0169", "value": "T12F230A90CEE10B746D9317BD6C84362DA678CBA6273540ECF7C8634CA10D17CBBB995A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928931, "uuid": "ff3b1e9d-ba97-463f-9455-15d0c2fbc220", "value": "768:Fb0I9+wWL5yxR5sOfyKxXUfqF1w5O5ijzBfVWNTNmU/OqkkX5LnqBSS6Pu136bJe:qNrojjumBx5USS6Pu1KNDdHbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928931, "uuid": "e933fc4d-97d4-4efc-a353-46a3d85c0945", "value": 48545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928931, "uuid": "b85eac9e-eef1-44e6-b58c-f2382f8d4f0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928931, "uuid": "0bf742ab-9cd1-45df-be24-a6250f87674d", "value": "Beautihood.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0260cc0b-6368-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780943379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943379, "uuid": "d9bc29f7-ade4-45b9-a862-4ab43287d88d", "comment": "Malware payload", "value": "271594f044122d5a17f3ba6ff2b630db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943379, "uuid": "19cc3d4d-7ad8-4543-a72e-11984fe27b49", "comment": "Malware payload", "value": "536e4058811fb0f426ad5eec77d73aa44752484d840d3f9f42880f32a141553a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943379, "uuid": "fce735a1-0a95-4215-a6f7-4962eaa40a57", "comment": "Malware payload", "value": "bcd2b2ecbfb89fa40c19ed748fc3c3d5285c6ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780943379, "uuid": "a0c4efd8-9226-45a6-be23-79a943ca2266", "comment": "Malware payload", "value": "f10dcc4c245343320832e1b335f9607fe1bc19b7fbd1d1f9a1107b5f4fea540a7ad21f0fa62615ef25d75bde5cc7be95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943379, "uuid": "3151f9f8-cea8-47fc-b889-e1bbdb1b726a", "value": "T1D3F37C0773E521F9E1778338C9614A46E773B83247609B9F07A48676AF23780AD3EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943379, "uuid": "b9d589f3-dfa5-4395-8b88-5142760f85c6", "value": "5997a1cc8b7da07801a72d0fc23941cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943379, "uuid": "832c123d-2892-4714-b1e9-785f16dca669", "value": "3072:TgySyLaXVh1XLbUdlLM+O5JULmMMuos6nAqzPu6RtGxN:TeyLaFhlbUrLvRHMu/6n9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780943379, "uuid": "d187f043-1ca0-4b74-a74e-e9c9613c33b5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780943379, "uuid": "db88037d-ed5b-4fc4-96b7-1d4b7c3ffb06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780943379, "uuid": "d887e195-6a86-4c37-a1c7-e5a73814d353", "value": "AFT xStream 4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ab2122-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911246, "uuid": "178e2505-81b4-42da-94b0-458ca9b3e8e0", "comment": "Malware payload (a310Logger)", "value": "693a00bc9348b801a27d4a28620c0c86", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911246, "uuid": "edb30c97-4f0d-40cd-a32d-f1ad47ab392d", "comment": "Malware payload (a310Logger)", "value": "537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911246, "uuid": "f02c98bb-f445-45b6-9c4b-948e9b0943e9", "comment": "Malware payload (a310Logger)", "value": "1c22ae36eed229adfc72ea82e07978f5530440f5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911246, "uuid": "3ce8f90f-57d3-4779-81ef-29712ecfd2e5", "comment": "Malware payload (a310Logger)", "value": "ca386eb929bb15c70dc48dad8ade35eedd0867d06b4e40c022309b28b9482d9d4652867e8eb8c40b7c5dfb0e178d13fd", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911246, "uuid": "ae69b68c-5a07-4202-9637-bcb62d26e1fd", "value": "T11045226C6A6AC117C59147301A71F2B8637E5EFDF905C3539FE8ACDFBA7AE444808242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911246, "uuid": "898587b4-c66f-4828-8ba3-a0747f72035e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911246, "uuid": "77b619a9-c7d0-4672-9c3e-f9be2fea7d23", "value": "24576:WPC9/wZPFw08599KdVPkk1+hiBj4ng67crLWTYuyjlX2O/XF7BI:WAePFw08rsnP1+6ENQfWTvyV2aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911246, "uuid": "6429310d-42ed-41ca-bf53-7f9859235d1c", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911246, "uuid": "4bb98063-a7a8-4af7-a4a6-889be0a28336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911246, "uuid": "128abfad-2b78-4f71-8df1-2fa47df20aa6", "value": "537f7ca8cc643307a13d911526becfb67328b9dfcfe3b3fd370f7e59b2f40a79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3acc8b-633b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780924122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924122, "uuid": "0566f1ec-b623-469e-9813-2287cad3440a", "comment": "Malware payload (Formbook)", "value": "2615e1fe93b28db838e8537c309cb139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924122, "uuid": "e0eae049-6cc2-4efb-bebd-eb4bfd856755", "comment": "Malware payload (Formbook)", "value": "5398021213a4e2d98a3eec3b19d4e14458ed62400eaeb3e329c9d287c0ca8b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924122, "uuid": "779c4a2e-259f-4c09-a65c-41e0fb6a677d", "comment": "Malware payload (Formbook)", "value": "44f557fc30b1e2bf72d75e71e0ffc82e092727dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924122, "uuid": "c103fd71-2513-425b-be67-a676456c6856", "comment": "Malware payload (Formbook)", "value": "1c2e613d12cefa7d1206a4a6d05644b46cc84b7ee2795e9336866d5c62944c72d5c77592e98f8576980cf19424b60ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924122, "uuid": "b4804903-4428-4e79-a097-58cf5f3076f3", "value": "T17C440278D720DA5BDFA84B31D953DA182AA53C4EE6743C6E068B724F1CB130374166BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924122, "uuid": "bd89d5c4-94e6-4d32-8eb4-d405c2160f47", "value": "2b5b37775389edc1abc7a75f91ca6d8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924122, "uuid": "aa1ac7c9-b251-434a-ac05-8437bf40d877", "value": "3072:NWiOpS4lNRLhIoTkceC5M16tYdQo5k5/5R+QZdGmNq/sjQavABliK:cimS4lSoTkcefoAQo2/5R/DOri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780924122, "uuid": "762ccb5c-1c7b-4af7-8989-86b50fe2a1b8", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780924122, "uuid": "09e38efa-b76d-4c0b-8d4c-bd59213c2cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924122, "uuid": "864cc956-8469-48e4-86ab-93ae6b39f522", "value": "5398021213a4e2d98a3eec3b19d4e14458ed62400eaeb3e329c9d287c0ca8b02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17f57ca-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910252, "uuid": "a3ab49b8-f9d8-4e33-8b94-05abaf4947f0", "comment": "Malware payload (Formbook)", "value": "dfcf540a35389f1abbcfd696f13aa51b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910252, "uuid": "585def1d-d9cf-4e4b-a51c-c7f67ce3c0bd", "comment": "Malware payload (Formbook)", "value": "53e00780c5d57af25fb691aa5934b4f9573f6c351dc10463ef31235355447a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910252, "uuid": "fcd267bc-f1ef-449c-8054-275f4710eccf", "comment": "Malware payload (Formbook)", "value": "44e4b603af984314116113e2f8a24ca50ea6fe9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910252, "uuid": "a1f403aa-3a62-4cb6-a2ab-18afd652b825", "comment": "Malware payload (Formbook)", "value": "8499f455934246e1fe55e4c6b95433e46b243a093300eee339bf2609f79b7b9f3f00cc2422ef39543ea41422c89e3123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910252, "uuid": "3daebc60-60a7-4adc-8d82-57ab11303459", "value": "T1D9350208161AEA02C8919FF44972E2B40F746E9DE911D207CFDA7EEFF8767942945383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910252, "uuid": "8e057b63-49c5-4f7d-a991-5b9b3d1bb132", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910252, "uuid": "8b125f80-6596-4120-af42-f837d3c87b49", "value": "24576:nzZ5rsXupJuplMoI7x42vxKmOEqYRJ49pcK6sUId8D3Clflje8P6M:nV5rsXiupl6DOEqYRJgcKnGD3CFp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910252, "uuid": "7455e006-4721-4ae2-ba58-b462da3ed962", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910252, "uuid": "9a1b78b8-16de-4c2d-be68-8c972332713d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910252, "uuid": "64b02a94-03a7-40e1-b3ac-6b56d8ccee4f", "value": "53e00780c5d57af25fb691aa5934b4f9573f6c351dc10463ef31235355447a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a177c4-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780939593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "634efa21-7c28-4603-9f2d-0bf12abf568f", "comment": "Malware payload (ConnectWise)", "value": "df5a770c01d36dc0f6151f7bdc258eb9", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "f5ead335-e8d2-4d09-8f28-8b6ca58e2f64", "comment": "Malware payload (ConnectWise)", "value": "53e766096d9652625577beab2549a7ab2d58867da9bdf8a2d01ed819f4b3703f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "c2f44c5b-ddb9-41f3-bb9f-dc7d457f4c5d", "comment": "Malware payload (ConnectWise)", "value": "503852e513fe8f8d076454aa6c7b14db7d293140", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "d33a7de0-4533-44ba-a901-463f1fc65460", "comment": "Malware payload (ConnectWise)", "value": "1da29212929f0218898b1aacb8ea70f4e9d6dfc6db62b32802d5b510f221f8d329e33b249f2c3faaf8be19d5070a9979", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "2167fbb6-4a3f-44e1-a7a4-fb55c4607e7f", "value": "T176646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "f9d7729b-d1dc-43cf-9046-9693ea0a6219", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "af13cf2e-a2ce-4a56-9349-535c4312764a", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9J:B1iw7gryNkSV1hy1Z1u2JLu9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939593, "uuid": "930c1a5b-b8c4-4adc-8186-5e0d7aa3a4c5", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939593, "uuid": "ddae7a14-d549-45d3-9bbd-58cbab2e1955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "bed154e6-24ea-48fc-ab20-745e71776a17", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fcb821-631a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910265, "uuid": "f9f13b4c-6c2a-4b38-8d31-3eaaaa195589", "comment": "Malware payload", "value": "2ce20d1c492e2317b38a74609331bbf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910265, "uuid": "2a64c444-c292-4c2e-b130-ea9f3731167e", "comment": "Malware payload", "value": "541e415e131870c3ae82e2386114b882585892e2bcc152810117a4992b969539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910265, "uuid": "23647590-2a95-4342-b6b2-5e3922c11c05", "comment": "Malware payload", "value": "67183432ce09f8f5c482e696fe8241f92df06514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910265, "uuid": "59201a38-773c-4f2c-b642-6f02e62709c1", "comment": "Malware payload", "value": "1bdae893f793fd45bbd5d33fcdbbf3e309c6965a5a4c46d4ab0568d9dd8847121f9881c9ff3eaa5f037d53797f971f7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910265, "uuid": "90fd65f9-03e7-485e-9f7b-891314179cb3", "value": "T183258C1923E81A08F2BF5FB4ADB901204BF2FA66AA25C65D7D5404DD0D22FC0DB96773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910265, "uuid": "0db9b99b-9d4e-4b02-83fd-330d6489835d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910265, "uuid": "b14ea874-2746-47c0-b786-db33a95a2fa9", "value": "12288:1J/bAcH5ugthDBiwEt36oKhmqfQzgETH9+GUGLUy04iMyRb83cY/jUVjOKf:g8hDBiWoyfJuz0ey+3csjEjOKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910265, "uuid": "fda90957-b191-4395-8469-3e2adf4066aa", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910265, "uuid": "38719041-3730-4805-8b1f-ca490fd790ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910265, "uuid": "362decd9-c6be-465d-8748-14990eeafbbc", "value": "541e415e131870c3ae82e2386114b882585892e2bcc152810117a4992b969539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc213a7-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912420, "uuid": "5a42ab3c-82ca-4b85-86e7-d1c01691a26b", "comment": "Malware payload (Formbook)", "value": "e5d0965469741f7ee3503956f8015179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912420, "uuid": "4377a61f-7224-4ab8-ba98-9e6525240876", "comment": "Malware payload (Formbook)", "value": "5432286c7bbd67650ce161c9b15554ab8b886cb59c5c4ec12cdb92baf5e4c80f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912420, "uuid": "f9dd370f-ce7d-45ef-b464-03d5f178f9f2", "comment": "Malware payload (Formbook)", "value": "14fc49d135e9340d8b07718a34e7394d777c7c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912420, "uuid": "1bf9be40-1aa1-48be-bd6a-100390fb016a", "comment": "Malware payload (Formbook)", "value": "19061fe76b03db3575639c60aa0e4a278847a546be49a8ab698d54c7f72d17eb579a8c555db6540e50b7318c1a147dbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912420, "uuid": "450b083c-117d-4022-8e18-b7a19cd54221", "value": "T14F2523A8BB96E823C6965B7719A1D3341B308F2CE617C3576BEE9DEB785E3304C48141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912420, "uuid": "31ec41c0-cf1d-4113-97be-7344b4eaff67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912420, "uuid": "f8a6371a-e6ab-48c3-b2e8-53e5186fca67", "value": "12288:sthWbSzBvDWGw1OHr2NggZCmHAF7wbCvd8w7fyaKkErDrTEZsefiiIyPhyK1:sKbS1KgnODgtnvGw7+pr7sseJyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912420, "uuid": "59be41c5-be3a-4ce2-90a9-4b824dafd945", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912420, "uuid": "1d19c6bb-fd3f-474a-aaf6-e75031e8449b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912420, "uuid": "a89d28e3-53ed-4df4-8802-c9822eb338c0", "value": "5432286c7bbd67650ce161c9b15554ab8b886cb59c5c4ec12cdb92baf5e4c80f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ad17fd-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941510, "uuid": "b2160506-ca03-47d0-a3ac-190ebae37206", "comment": "Malware payload (Snojan)", "value": "0356b94c8f1da74b6ddadab63402c0de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941510, "uuid": "e73d5c28-7567-4e0e-ba15-c84c320ce148", "comment": "Malware payload (Snojan)", "value": "546ef26d0e6ea586e6e10c341dfc8b888ebefeacd909393331fd0ecf4eb7961a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941510, "uuid": "9868e460-aa17-4bf0-bd3e-b9125d29b78d", "comment": "Malware payload (Snojan)", "value": "c0fb5895c17aa384640b18ebc34aaf42c9292b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941510, "uuid": "50458241-b7e1-4d39-a0b3-5dc3e1278fa7", "comment": "Malware payload (Snojan)", "value": "b5936ad013ff79e4aa8813c61a1a38f3502ba4ff677662ece5e9f8d48210471c233808e098d300a4ec378b39d6e5ea59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941510, "uuid": "12d5b15b-cc51-4d80-98ec-f083a02451e3", "value": "T169B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941510, "uuid": "687b4d31-9bbd-4a30-8b83-b1966406cd9f", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941510, "uuid": "a4fd706d-6eac-465c-b4ca-8a7c5e8c80f7", "value": "12288:/bE+uhh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+6k70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941510, "uuid": "7fb186ea-7e4d-4d73-910e-cc3ef914a1b1", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941510, "uuid": "29f9df99-9fd4-4729-bd24-2984fdd59305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941510, "uuid": "37d1b09f-b284-46d9-99d0-11d608ac1202", "value": "SreMxVL83Zfrn1b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4ae144-6319-11f1-a769-42010a9c0008", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1780909760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909760, "uuid": "bcb782dd-847b-4199-b466-4a007f1211cf", "comment": "Malware payload (PhoenixStealer)", "value": "e1c509bb8843553cf09c2af31446a0f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909760, "uuid": "187069e6-6cf1-4e9e-8ac2-ec75060590a2", "comment": "Malware payload (PhoenixStealer)", "value": "54887612a8a297607916955b89d19e2d50dbbdcec96352804d005166e63d8be8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909760, "uuid": "a27e390f-da7a-4b0d-bdbe-9d8f809262e3", "comment": "Malware payload (PhoenixStealer)", "value": "9633e4bdd852c00c2d692a7b36fe5f27f313a01d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909760, "uuid": "fdecd733-5ccb-4513-b245-9fbb5abab4fb", "comment": "Malware payload (PhoenixStealer)", "value": "dd8ac0f00cee716bbf1b51bf53279034c512eca0de39e7ecb7f8b02cac77656bf775ba5cf7972bce9790f4e12b7c6112", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909760, "uuid": "01ac4c6f-047f-451b-917d-bd68b3985004", "value": "T19315F72EDC64423EF032C51CC596481FF896698B532CEE5721C2278F5EA384677D27AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909760, "uuid": "549c85e5-145a-458b-8bad-e5275fd5dd57", "value": "3072:X4tUvlBuJrm9vVW0Ae84SuzxqD+1ynO+LmB2lAa2fXcOdgGinxdq6Sd99NqUXEkI:hHvVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780909760, "uuid": "6a9cbea4-47e1-4e4f-81c3-0c396df20b5b", "value": 882816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780909760, "uuid": "ce57c3c4-4af1-4a9d-995b-6c4ec6eff2d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909760, "uuid": "2e815fc8-a8c8-4193-bcaf-23f6eb2ebb25", "value": "Purchase Order Number 4500013967.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704cb04e-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908344, "uuid": "3a78f6c0-2e59-4b98-88ad-95b232c5df39", "comment": "Malware payload (Formbook)", "value": "e92b08b7411fec25126c970efb816fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908344, "uuid": "d206c7d3-ddcc-4b83-a2e6-96c75f150938", "comment": "Malware payload (Formbook)", "value": "5488fa3d252865cabacb9c18b16e03c5778cf351d6697540eaa482c6c00091b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908344, "uuid": "981f1708-e262-4316-a89f-a772f56fcdb8", "comment": "Malware payload (Formbook)", "value": "0f5f7e93b8edc1fbd25fb163e2dc2cbc624273db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908344, "uuid": "91259142-60ce-4f1e-8ea1-88778f57cd7c", "comment": "Malware payload (Formbook)", "value": "7b2e54148fc0f846e834fe971541c2d053440a9a50cec11b1b94a67fad6e41696b37849e0b78f11269b5fb9c7ad872f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908344, "uuid": "c2db025d-9992-4a1e-9ca9-c42c7691feff", "value": "T13E251268230ADD07C8D24FF50970EBB456684E94DD16D603DFEBBEEFB87A6446805382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908344, "uuid": "b5c8d5b4-53bb-4058-b7a4-716c9e035fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908344, "uuid": "179c65a9-6e8c-47d5-9535-d58fefc3f7e4", "value": "24576:ZKAEFT0DFjMPKame4euauHW+yTnYHkkReXrCp8tWf:M3FQ1MPK1xLzHb+6kfO0Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908344, "uuid": "ba57311e-b6b7-4b5f-808c-297622e98c30", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908344, "uuid": "111b359b-b1b6-4c1e-85f7-22589de90b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908344, "uuid": "9538adfb-043f-444d-b1dd-e33f3d193e1e", "value": "5488fa3d252865cabacb9c18b16e03c5778cf351d6697540eaa482c6c00091b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67e59b5-62dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780884088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884088, "uuid": "b60a2001-8975-4151-806a-799378874a0c", "comment": "Malware payload", "value": "8efcca8839ff55dc9c4a0e714fd81202", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884088, "uuid": "76454ad1-e54c-4ba3-ad1c-10c578edd677", "comment": "Malware payload", "value": "54e40a2188f968b725915ccabe35f5f77a44ed9ce0f6bd79084e196973af7018", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884088, "uuid": "09d1c73a-c4b1-4654-a5a9-ad9b684db8fa", "comment": "Malware payload", "value": "e3b365ada32dfcefc88ae308dce3405a39d642c5", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884088, "uuid": "73fe820a-94bf-430f-8cce-1e905f2c6cab", "comment": "Malware payload", "value": "abc0432b7203692c3c30f2574f85a2de37677033719bf76f782c796e74755f4198ea0fa137baf72ba221557431a69d8b", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884088, "uuid": "3df9e536-ae30-4226-9955-acc3235cc263", "value": "T1BBC529201BF7FA08E43EB774AD79500C5776B86AA9B9CD7ED803007DC8A5B445B1B362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884088, "uuid": "6a83224b-2aeb-4d9d-bf02-c788e284ac87", "value": "49152:G2MM7UMyzZnNkIzVT4DcjAF3GttfttfttfttfttfttfttfttfttfttfttfttfttD:dMM7UVzZnNkIPAxGttfttfttfttfttf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780884088, "uuid": "a06989b3-91fe-481d-80f5-e214a5250bb7", "value": 2650457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780884088, "uuid": "7332df94-b9a5-4e32-8bff-c91f1d205dbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884088, "uuid": "2ddac8ba-8141-4313-8724-770e60778b22", "value": "54e40a2188f968b725915ccabe35f5f77a44ed9ce0f6bd79084e196973af7018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e247ac-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911738, "uuid": "68d15224-b7c2-426c-96ce-f29134d0a0b9", "comment": "Malware payload (Formbook)", "value": "ef9fb660d3e520c606cc31e09e3d969b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911738, "uuid": "bf574df0-3a79-4232-94aa-f58c1765dfd7", "comment": "Malware payload (Formbook)", "value": "54fcdd0391f350af46910df67db7d18bd314c17cea5cb8e6e38e58de6c470b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911738, "uuid": "a2d0134f-6552-4939-b376-07b4d00ed9e3", "comment": "Malware payload (Formbook)", "value": "bc28455bbcbfda1099a8e3b14569b4e851d94147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911738, "uuid": "dfe44935-dc67-4c2d-a486-30ae67a722e7", "comment": "Malware payload (Formbook)", "value": "db04fae5605465582008b847eb51e3f6dc557b03471eb0ec76a805cb769e8414dee8d390a4b2398cad38f45565253de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911738, "uuid": "f23e2915-a9bc-4e4f-8d82-5ef85875e8f3", "value": "T1D025226C1A4AE007C6405B389E71F6F962AD0ECDEC00D2568FDEBEEFB963E119D04255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911738, "uuid": "4c8975b2-4cf8-48cd-bdd6-d33ae763b712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911738, "uuid": "df36afd0-8567-4bb8-9264-be2f840ece37", "value": "24576:WEidfL/p0U8LPX01+oceoDZnTfKoAxSV7XVijw8qeA5F:Pixjp0XLX0zcrpTioAwV7Fijw8qeA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911738, "uuid": "9b38cedd-b3a4-486d-bbf3-16fddf1915e6", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911738, "uuid": "2bd7a131-7dee-446e-89fa-2294249f4a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911738, "uuid": "67da6202-5b9d-4912-838f-3ca0a8466b96", "value": "54fcdd0391f350af46910df67db7d18bd314c17cea5cb8e6e38e58de6c470b83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61063e52-6394-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780962435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962435, "uuid": "56456699-5519-4545-878c-6306cbba8a33", "comment": "Malware payload (PureLogsStealer)", "value": "23c6863584934819cafcc7c2dd72c964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962435, "uuid": "ebccfa59-96b1-4b60-952b-8e21560ecb8b", "comment": "Malware payload (PureLogsStealer)", "value": "55357c1468ac99c2b2a8ecf55151c3e80fe023712ab40b1a6bcb990ec1a85e18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962435, "uuid": "5e00fd4f-51ec-4ba4-af50-52cc23b4a7bb", "comment": "Malware payload (PureLogsStealer)", "value": "4cc9ef239e9465fe8bd07e9874c42e5189ed71dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962435, "uuid": "56995406-39cc-461b-b5ac-9e6a9ee072c2", "comment": "Malware payload (PureLogsStealer)", "value": "ee99467bb7d936a5f12dc2b902e64a979fae56dbb9a01efef9d5b534df475eb49f385359e2711bfd4c35b4b2ace99d16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962435, "uuid": "148f8db4-f8d8-415b-8255-08d48c767743", "value": "T175C401433BD48F12C9445275C5E7896403E5E9C72AF3D30A3A49239B0E827E5DE96FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962435, "uuid": "0f2b7c5a-2ed7-4a3d-b30b-65b7b5a02254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962435, "uuid": "5b47b1fa-9202-47de-b202-c9fdf15331c4", "value": "6144:YUL6+giWe6U20DyhzITCfrpLiTy2VFkzgGza6u1bUEE5i1SK+XPIedg1Id9FUqef:YQG5EDIlotGmv1bTE5jHg2rlTDfWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780962435, "uuid": "b2c6dd5e-6f61-4b8f-aea3-38b1a0b39346", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780962435, "uuid": "3c55e832-5cdc-461c-9065-50fb6180ff85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962435, "uuid": "7cf2d173-cc63-47c3-9e09-8f0d36dbfe9c", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.45485.8471.29912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7289201-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911094, "uuid": "64ab79f1-d883-416d-8493-7426903ea7ed", "comment": "Malware payload (a310Logger)", "value": "b1a61b129e9c35a0b4897fe49292f948", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911094, "uuid": "371045df-63f8-4dcf-ba34-704b20f2c8d4", "comment": "Malware payload (a310Logger)", "value": "554c62ab2e1a0e8ae03f41a25a89b1d1528e228d85ce3b3e7d8d8cacae6e86e0", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911094, "uuid": "652ca3fb-d8b1-497a-86f9-b612a05b0df7", "comment": "Malware payload (a310Logger)", "value": "a98c53a4fb7399bf0122d2def658fc3112175bfb", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911094, "uuid": "a681c349-faaf-4eca-8af4-1e060ad3015a", "comment": "Malware payload (a310Logger)", "value": "aadee26c58edfb6436310b4bf48522a480942c6e7b1c29453c6e8b48c579bf64aaa010677961e7443b72ed5629bcde29", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911094, "uuid": "1b19a0ea-c64f-4776-9e18-0ae3da1589db", "value": "T1C54512581989C90FC1674BB20D35F7F40769AE9BA419C613BEF77EEB767AA04C804342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911094, "uuid": "47fa5802-7438-499d-b7a3-4d2a5a8fa466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911094, "uuid": "267ec843-4a4d-428f-adc7-909b6641ec81", "value": "24576:pbI5vqyI1cU7BealE9W2f9Lb9kt3O+rWiGukdFMMrXODK3FNrd:FI9qyQcSEX9132t1WJosOGjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911094, "uuid": "c04c0048-75dd-4fe7-b0be-4b010b69701e", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911094, "uuid": "8850d9a4-344d-46f0-b72a-54d4fe507b7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911094, "uuid": "267b2d86-aa18-4451-8114-263b0ec31a49", "value": "554c62ab2e1a0e8ae03f41a25a89b1d1528e228d85ce3b3e7d8d8cacae6e86e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ec0257-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908619, "uuid": "767bfcb3-a570-43bb-810f-24449f9064bb", "comment": "Malware payload (PhantomStealer)", "value": "33334a3f12a95a80c25c8a8d33e06291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908619, "uuid": "cb04d949-97f5-4939-8c77-6d65c39a816a", "comment": "Malware payload (PhantomStealer)", "value": "555222573dc9e1e4aa84ec13f0f1ce27cd61d87b3cbc23bfb1d83860d3fb5c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908619, "uuid": "600252a0-0b90-41de-9810-3ca7864e656d", "comment": "Malware payload (PhantomStealer)", "value": "e83772caef95ea78fdd4b427626dc7fd78407fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908619, "uuid": "4802dff4-fd7b-42c6-ac73-7bd83a1f061f", "comment": "Malware payload (PhantomStealer)", "value": "6e1540956547131acf6b22fbde72cbab68068a5f08445129fe92d24b6eaf03aa1dd3cc6d70040928ddcffd7e1dd62676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908619, "uuid": "a8a2ba1c-b668-4586-82f4-3cbf11aba41a", "value": "T1927512191619DD02D8E65FF41920E2F027B84ED4BD22E313DFE9BEEFB87A3501945286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908619, "uuid": "342f80af-6e7b-4e0e-8ae1-40259ee6f34d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908619, "uuid": "b6eb764c-b13e-4044-900b-c1fe9fce4180", "value": "49152:TZLR3FQWGGzm7E45wx89Jici7EhMStJZmgNU:rFQPGaI4WxiBkEiSt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908619, "uuid": "bf19995e-5100-4e0a-911b-218fddafd229", "value": 1579008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908619, "uuid": "5e31b1e5-5078-4d61-93b3-aebab2d4eb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908619, "uuid": "3711c2b5-c13b-41ca-a712-3261b81172a4", "value": "555222573dc9e1e4aa84ec13f0f1ce27cd61d87b3cbc23bfb1d83860d3fb5c1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556361c2-6357-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780936217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936217, "uuid": "95abe5cd-0adb-4ad1-bbf7-c6c591c999e8", "comment": "Malware payload", "value": "53d1be7633676b9abf7f0c711d018940", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936217, "uuid": "6b5ed232-0145-4757-99e1-b996f4ef09d3", "comment": "Malware payload", "value": "558543ac14d2270f2a2c1618fcb4c15be1a3a1887df314818a8b381b21b3cecb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936217, "uuid": "5009e3b6-bc12-4957-a9d5-41b1e9376c41", "comment": "Malware payload", "value": "eb74d14fa05129d242cc95a7bfba01732f301761", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936217, "uuid": "4c970c83-df21-4078-b425-05c9cf1f49f2", "comment": "Malware payload", "value": "abb5c1cd774c76207fb928793480f3cbcb6a76674aa42a4fa2c67739f6ce2b172b1daf61014a14a08fe139397607b906", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936217, "uuid": "6db0f68e-6ee3-4446-95ad-a0713ab07abf", "value": "T1744623398A1F06DF450260FAFC556CC139A863CB44841775839CEAB438E94FC9A7EDB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936217, "uuid": "ee03550b-2888-489b-aca8-ed9690fdad70", "value": "49152:YF7M0THR7m4EtWykxyydvbLCE+ZMxTKjNOvCkW8RB3jOFUJV7pOmLEakRnV9jCZG:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780936217, "uuid": "3651b5ac-3e4b-410a-a032-51823b85d799", "value": 5741466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780936217, "uuid": "77204d8b-57f4-45d0-be59-391e702a1d82", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936217, "uuid": "13903a0b-f8de-4b57-ba83-02783e88c9a3", "value": "z1LABELS06-06.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f3be1d-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780912506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912506, "uuid": "7d323f5f-2b44-4f72-8f3e-00f2092ab551", "comment": "Malware payload (Stealc)", "value": "6a7840bb9028410be890fef37a74ccc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912506, "uuid": "1a6d0d6f-8c10-400d-82ce-a7b61f4da3f8", "comment": "Malware payload (Stealc)", "value": "559cf8f30405e8062a40cf277c9cd1f5ecd1f99b2da14a5983aea7bdd08073a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912506, "uuid": "875f9e47-5848-44d9-83a3-78f4cc4e122a", "comment": "Malware payload (Stealc)", "value": "ed9880da643563d2be8d73a3cc7662bb296de19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912506, "uuid": "d79d05ba-b79e-4f2c-9f51-ce446152bd4c", "comment": "Malware payload (Stealc)", "value": "3d336b0fe83d017536fc19bf2a7f7d43bf79e7daa167c894382e7a65ec3f58d86ba23ba1b3fb22950c341689741067c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912506, "uuid": "cd7c8c81-e911-4488-aea1-901ecdbd77d9", "value": "T16B745B45B6A40CFDE967827CC9A34A06D7B2B8560770EBCF03A046965F277D09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912506, "uuid": "2a94bf92-49cc-4be9-98c5-1cb29158ee81", "value": "d04feef9f2f0dd0a18187fe3826aaf2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912506, "uuid": "c6dfbcdf-6833-437e-a108-bdc022a08b2c", "value": "6144:H6YaTDvpL7IF/Kz8plA4omkla3VbwXDhAYSzf5U:HCIvplsvla3VENABzfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912506, "uuid": "44de2e8e-32e9-46e6-adc5-b56532f1c9d5", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912506, "uuid": "be72c6a5-7308-49f5-a00b-835c9ad66b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912506, "uuid": "2f2cfd5d-0252-46ff-afab-b9c34928e46c", "value": "559cf8f30405e8062a40cf277c9cd1f5ecd1f99b2da14a5983aea7bdd08073a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6a1215-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780928984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928984, "uuid": "e03405b4-e896-4141-b05d-7b44119a56f3", "comment": "Malware payload (RemcosRAT)", "value": "8780e218e69a857da3e4f5d0cb259857", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928984, "uuid": "880572a5-8298-4e71-ae9d-aabea3881195", "comment": "Malware payload (RemcosRAT)", "value": "55aa2602844698ac27dfee9880fb5955c1d92dc54ed77a29ba817bebed08e236", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928984, "uuid": "c56adaca-85b6-4e12-8f6c-a044bbfdf320", "comment": "Malware payload (RemcosRAT)", "value": "9ff041b404aa96195004b015cfb1bfdc1770ca38", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928984, "uuid": "9c6e22d1-82cf-4026-822f-cc9eb2e63e12", "comment": "Malware payload (RemcosRAT)", "value": "135fae022855aa255ff8a63187c80faf211e332e7409b43f830ed380348b542a55e215a84bfa705bb08fdc3f98a419da", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928984, "uuid": "ad75a69a-1d4e-4ab9-a624-143e297e4e80", "value": "T138A2D1FAF57AD2A42B37376B127085972410B738097383C5B695E19A4285FE2F7300E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928984, "uuid": "0ab2f7ea-a454-4ad8-b4f9-8ad2a3ccae6b", "value": "384:GKK7aeyWDqwvA2LkF4TQbap8N4P7jU5RpgHbzqrY+6o98oFSq5PHWFVH:GKK7aeBGX2L3supO4DI5jwOcsFT/W7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928984, "uuid": "c14edc7b-c6d3-4bba-99f8-6c58259699d0", "value": 21410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928984, "uuid": "dc904556-c738-414b-b128-d06231a20ff2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928984, "uuid": "b161f27a-9d51-4c4a-82a0-06dc91af07ae", "value": "WTR-01032026-145041-02439268.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc584063-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908069, "uuid": "411531c8-d931-4d86-8ca3-0c79a993849f", "comment": "Malware payload (PhantomStealer)", "value": "6be8ddcc17d262e9a648712cac7ff348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908069, "uuid": "27b1c410-2de4-4cb5-8935-a8777ab7c498", "comment": "Malware payload (PhantomStealer)", "value": "55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908069, "uuid": "469d0dbf-7490-45fb-9283-9a6525a5fdd3", "comment": "Malware payload (PhantomStealer)", "value": "41d50f868c0a14049c88df57c2c47c4dc859815e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908069, "uuid": "2c9be31d-78d9-4bfd-9e7b-579712a6bacb", "comment": "Malware payload (PhantomStealer)", "value": "0ffa49dc73d1999598e472a02f7d60261200e8491a8b5e6a9eef5421f078ec79415a2bf58ce66c26dd8f47e12607f429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908069, "uuid": "cc8990b0-1006-4219-9590-cbb690a390bb", "value": "T146751219021FDD06E9B7CBB80860E3B406B49E546A35D313CEF6BEEB783279169053D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908069, "uuid": "c9e468f8-5353-4327-b15b-d2bca1fa41f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908069, "uuid": "91a3c44a-0d2f-4a33-a806-a8f70dba4b64", "value": "24576:v14A+J/8aH2qB6jzSqECsw7PoNNnvQFWthRKgE+1qwRb9UQ8QWVUdRi2UhR:dV8fH4WhCswToNZc8PdE8fWVui9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908069, "uuid": "450c45ab-cb96-491d-8103-a182358616c6", "value": 1588224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908069, "uuid": "dcf4d4f9-974a-48fc-8774-93b6f1b13070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908069, "uuid": "6e946f66-639e-4c9c-bb71-885ff723fe82", "value": "55f9fc2bd17efb8528446ebc07d541d294cd2ea4aa3989a4acf60ad9f13146a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2a27ac-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904927, "uuid": "edba2591-9855-4abe-b682-d81966b37aae", "comment": "Malware payload (Mirai)", "value": "a0b480ab422dc36d0d4c3574e6847948", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904927, "uuid": "625a3d70-c159-4e9b-955e-7db117f2297e", "comment": "Malware payload (Mirai)", "value": "560277b12f6c7786f490eba4210b9fd4e4352fb9321c82e729e579dfd0871df4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904927, "uuid": "370a97b1-8d61-4e5a-b5cc-4be2fc354c45", "comment": "Malware payload (Mirai)", "value": "7e392a7c2aed5b83a0c745cdfbe0c76982628347", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904927, "uuid": "b5761cb0-81df-4b5e-a043-9ae690adb73e", "comment": "Malware payload (Mirai)", "value": "fc842d3b14187144ea35ade31cb8a1ed95f6842deddd78b5bf3be993d8aa0902b31f64fe5db7fb851a13b81dffadf320", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904927, "uuid": "e745a1b0-2c7f-495e-add3-aeb2401437cf", "value": "T15EC33A45FA43CAF7D40719F021F7AA3A9A30FD3A48B6D485EB507EE1C6569C76206338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904927, "uuid": "5d21e0ce-9b6b-425c-bd66-d31ea74631bb", "value": "1536:VkOGCswLV/jqRyoHFO/YqTmVzWwQnQiWe0ibhp9w3lpAwLg9ydgy:Vhpt+GYO9ZNWe0UhpapAwckK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904927, "uuid": "41a6f602-c5c5-442a-8de9-bf634b330cb3", "value": 129764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904927, "uuid": "dc8dd46e-ca44-42ad-bbf3-f0d4ee191262", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904927, "uuid": "ed645020-d1ed-4ac9-85b6-dc22b6ad39b3", "value": "nova.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d3617d-62f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780894902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780894902, "uuid": "4461f576-c928-4961-bf28-57ebdd6acf5a", "comment": "Malware payload", "value": "bc41d9461ba7c437db74b419f5c572fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780894902, "uuid": "afa34656-d689-4ead-bff1-f64d377f640c", "comment": "Malware payload", "value": "564cedeb2e15dd24729f096adee910cdb2c9328755e8491bb3a9d99d914975f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780894902, "uuid": "fec17b7d-54d8-40a3-aaf9-e76559088d04", "comment": "Malware payload", "value": "bb26a4278e97fa191c141cc3f1c8f51be185a06c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780894902, "uuid": "871aabbe-2078-40f6-a670-5a12e9357346", "comment": "Malware payload", "value": "ee229aadac1ee97e8bc560160a81ad385921b7a70b77167649d95146f3723495a34b92a2dd60378a1307c2f68b62f31f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780894902, "uuid": "46709f97-e37d-48e0-82c0-277ffa697929", "value": "T178D2D5F676942403ED1A4F33A06883417DA0D137D9B2D2A1164E52A4B67F2EE7F223F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780894902, "uuid": "50699ccf-f419-4e22-b450-45ad7cd050b1", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780894902, "uuid": "784f7897-2006-4ff2-9acf-b9922a9d34be", "value": "768:w5ku9hSACQN8JuNyhjMJEFsQFt6hrNhd7c71SYiO5ALQ:JACQN8JthjMJEFsQFt6hrNh5Q1S7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780894902, "uuid": "df51315b-c8d0-4246-b0c3-c93a1591af65", "value": 28592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780894902, "uuid": "afbea987-61e9-40f9-b540-ea5bac0d451f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780894902, "uuid": "67486fbd-fa4a-4d21-b961-252b0f7b7023", "value": "564cedeb2e15dd24729f096adee910cdb2c9328755e8491bb3a9d99d914975f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310c4e14-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780911674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911674, "uuid": "d5a1c90e-b06d-4f56-a673-c957980af514", "comment": "Malware payload (DarkTortilla)", "value": "16dc05aefce2c1291465cf913c405ef5", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911674, "uuid": "2a18d936-a86a-4f2b-a017-dd6f4948183c", "comment": "Malware payload (DarkTortilla)", "value": "56665c03479de2e701b5de153ebf4b20548497eb34262a40d616ef323e8691dc", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911674, "uuid": "50e13756-6dda-4de7-8307-82f9f2c14c2b", "comment": "Malware payload (DarkTortilla)", "value": "1f4171b112696570bf8b1609c46b4895e257d7a0", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911674, "uuid": "67bad48d-344a-43bf-966e-ad5e4a5a92fb", "comment": "Malware payload (DarkTortilla)", "value": "b3128994bb60ae86dd4f99fe1399c194748e1cc69d4c697096391d6bb28f9729025bd8975bfb7fdeea9cf0390dd564a3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911674, "uuid": "d164ddb5-e110-406b-b731-704bec42f7db", "value": "T19375D02E3ACF445CD0D1DB789B323BD817B0853B44F2D3577B8C5378EA1A6A56A8C252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911674, "uuid": "951b0f6c-ef7b-4330-b577-cde88d5eb5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911674, "uuid": "854325be-b24a-46ce-8593-d340d31c9088", "value": "24576:3zQPCmQui1rBgc+9SKFlAfoR3awyBsbR3:kYusy32BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911674, "uuid": "35749d9a-9e46-487a-a130-e908425fbc09", "value": 1646080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911674, "uuid": "fc02657f-2012-4092-bee8-0b6871fb1725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911674, "uuid": "53868eb0-860a-48ca-bbea-0121efd2e773", "value": "56665c03479de2e701b5de153ebf4b20548497eb34262a40d616ef323e8691dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38564c26-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908251, "uuid": "fe0f050f-01b4-4f0b-bf4f-394e3209b69e", "comment": "Malware payload (AgentTesla)", "value": "1a7007b92d8e69f8a2a725b28c8dad9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908251, "uuid": "fe3704c9-4a48-48d3-9062-34b56afba6e3", "comment": "Malware payload (AgentTesla)", "value": "566d42f59906f245ebb59d4560fe1116f0e89f6ba8256cb3a5a9feaf9c4937d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908251, "uuid": "5df55e73-a06e-47e8-9490-2749b5d526c4", "comment": "Malware payload (AgentTesla)", "value": "a78bf1fe36a6aed8bcab643030fa58414a240994", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908251, "uuid": "14b886c0-93d0-4b43-aa71-54e985150461", "comment": "Malware payload (AgentTesla)", "value": "2c284800f515308f596b0b81ca0bdd5f71de5046a6755c91eecf1bce32a2f6c7579aa4ac36e2ccae68ba063e18da14fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908251, "uuid": "c126f2d7-036f-4644-84cf-81add1c878f5", "value": "T1EC25126927439001CA1667315FBF1FD9D333DE280636824B8BA31AADDE37B69E1D0D85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908251, "uuid": "db650001-7791-41f5-b41e-13d7dd2c4e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908251, "uuid": "c54b6d2d-99f6-42e7-8df5-6d14dd2d4275", "value": "12288:N0FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wzZvQkynwHProGFdRJN:iFJz7c5a8uGrxaZEwHProGFdR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908251, "uuid": "58b777e5-c623-4d01-bc5f-c8ed534aaa79", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908251, "uuid": "744bf123-17df-47cd-ac99-98d75c2f3494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908251, "uuid": "824dbe17-d23c-4a16-bf91-25973715bc7b", "value": "566d42f59906f245ebb59d4560fe1116f0e89f6ba8256cb3a5a9feaf9c4937d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a1e215-62e0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780885182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885182, "uuid": "587dcbc9-36e5-4fe1-936e-d76ce5485b3e", "comment": "Malware payload (Mirai)", "value": "d300b6632128a487eb81cfcf0ec8df8a", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885182, "uuid": "796b4c94-0583-4afd-92b5-91c5dd7a72ac", "comment": "Malware payload (Mirai)", "value": "56782d3959080b428d54f22504b3783ec03f9fc98ec54bbde408eab1094ee277", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885182, "uuid": "bc8e8622-396c-43c3-a316-85b3ccc0274b", "comment": "Malware payload (Mirai)", "value": "3671b36929d1cb743f8566415f44e2ce96e7645b", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885182, "uuid": "9946db2b-2641-452d-aff8-a13cdf377b79", "comment": "Malware payload (Mirai)", "value": "ecc7c23fb33a6f7576837e1880796d074a82fdc721fe7c55e725f47c7ed2fd05c3a49cc3bf9ff6e92ae46958398c4406", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885182, "uuid": "3d303c88-1759-4aa6-b05e-51adda735c50", "value": "T1EF762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885182, "uuid": "425884d8-76b8-495b-ad33-1869148633b4", "value": "49152:CNBjP2hUIgFmCn7phTo9SDW1pBD4PvOCz2ADADtxKRg3cTD8LJmAU6AE4mCLpU5E:wghjcpBo9SnXOA7DixKmNHxlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885182, "uuid": "52b9519b-8c7c-4622-bd01-264bd2400735", "value": 7267612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885182, "uuid": "06043311-d874-4aad-8329-4f9a4c0397b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885182, "uuid": "159e459e-dd19-470a-b5e4-913e4bdaff53", "value": "zero.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf706e7-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780911775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911775, "uuid": "3b1d4e60-2d0a-4878-b015-e0e758ecd9ee", "comment": "Malware payload (MassLogger)", "value": "a5fdc0e4f4004a5b8c20191c7c3ebcad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911775, "uuid": "efbd372c-10f2-49b2-a1ca-1da65ba5fbfc", "comment": "Malware payload (MassLogger)", "value": "574a4e7a5f2cc7b755da86c4233e08c05f244c722deba53df766bcd96cfd1311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911775, "uuid": "bba5e265-7419-433c-8152-fc3aebd0f381", "comment": "Malware payload (MassLogger)", "value": "3f4e444b587d7f9c2a7a36d550412e751af62443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911775, "uuid": "16157515-0427-44d4-85c0-ad27964ad189", "comment": "Malware payload (MassLogger)", "value": "ba4d75338eda6f22bf36d777499ea31829d4e85831058e668a8ca3329b6eb542f21c1471feddda21d822f623736eefd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911775, "uuid": "01613f24-2e3b-438e-8762-35b5ae175a35", "value": "T1FE25122C650AE607C9912B395FB2F2B4126E0EDDE911D226CFD9BDEFF9B7A041C04152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911775, "uuid": "822c0a7c-6952-4eeb-a0a2-7d7a52f87512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911775, "uuid": "24d7b857-c948-4449-b47d-7e18131d35c6", "value": "24576:H66lR0caEJwNftgHNwMv0KUI8HmefwiAfi26CG3AwP:HF0tNfANhsK+7JkMQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911775, "uuid": "f90d57b8-0395-4fa9-b454-9f7b75fa7f08", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911775, "uuid": "af89146e-5e03-4929-8b2c-d8cfa5ef4186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911775, "uuid": "e92c3921-2216-4a52-bbea-19c0bce476b3", "value": "574a4e7a5f2cc7b755da86c4233e08c05f244c722deba53df766bcd96cfd1311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b39b7d-6348-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1780929906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929906, "uuid": "16f9a336-23d2-450d-9dcd-bba882745a71", "comment": "Malware payload (NanoCore)", "value": "0ca688d28cd15f0a5756bf3894156029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929906, "uuid": "3456150f-a6d4-4ad5-9bfa-55632ec1a957", "comment": "Malware payload (NanoCore)", "value": "574b156255a61da989d89c6f4c6ccbaf33921c4aba9a92fbcff5de054b437e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929906, "uuid": "20596565-3808-49b5-8a0c-47b45d664e68", "comment": "Malware payload (NanoCore)", "value": "9d5c022d3e4cc6bc2ce1f9d4898b88fd936c1982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929906, "uuid": "ce04b76c-f54c-4037-83ff-9edb08814cf4", "comment": "Malware payload (NanoCore)", "value": "5a8506daf45429692a7d7bf96599e57eb2be35ad9228992ffeaf1aa80a69fd16d1cfd5a07606dc861894f820cc93afd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929906, "uuid": "9b9edcde-50c0-4c68-a8d4-355c866f6e32", "value": "T12014CF1A77A84A2FE2DE85B9611211538378C2E3DCC3F3EE18D855B39B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929906, "uuid": "58ae7522-4c29-41f0-acd6-9d2ee439385a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929906, "uuid": "4dc257a2-e486-4300-9a71-7e229b61f033", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIx8svu1SEImfAF8V7m8CJvflRv:MLV6Bta6dtJmakIM52uvImfVqflRj0vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780929906, "uuid": "fd5d4041-b64b-447a-b1ff-eb7edfa9ed68", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780929906, "uuid": "0b3faf84-f43f-416f-a550-4d55b410163c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929906, "uuid": "c2bf6dec-46ef-46c7-8809-c955ad82a2ee", "value": "souljaboynft.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdeecb8d-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908475, "uuid": "87253b35-3ee9-4282-8654-059766fa39ba", "comment": "Malware payload (AgentTesla)", "value": "fb0f4dc478ab1aef9bcfbddf79f1644b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908475, "uuid": "d6e903b7-c309-4b92-a0fc-4c26de147ecb", "comment": "Malware payload (AgentTesla)", "value": "57d4c1525bc46d8df0acc327a131bc149c396e6200bb082fd4b0f1a443b0f8a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908475, "uuid": "d4e585b7-1491-4288-a595-c15438fa2928", "comment": "Malware payload (AgentTesla)", "value": "081472e471e630a5a0b2d5a12e8a965dfc8e01f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908475, "uuid": "e0c392f2-ac49-4903-947f-06b608ed6f3d", "comment": "Malware payload (AgentTesla)", "value": "1f7569630479d64e7b5c6ca78dc781a16a0ea8c243860e991b263e2a0899ad646c129b1642d12bfa6818d145f22eecaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908475, "uuid": "1ea73021-8bf5-4257-afc9-985495f65be2", "value": "T15F2502482319CD06C4961FF06A61E2B45BB49ED8A921D303AFDBFDBBB87F64119013D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908475, "uuid": "2395541d-53c1-46bd-acdc-bf46fa87aef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908475, "uuid": "ad9d9ddd-ca68-4450-8522-05e035e732c6", "value": "24576:uPoTVcUyANRvXHktS/aAHpcwswEBuKNviAEFT0D:RTV7ycdamxoBuKN63FQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908475, "uuid": "36ebf2f8-0cfa-468e-a31e-0aceea192e26", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908475, "uuid": "aa25e390-55ac-46cf-8f5b-e1d61e3a412e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908475, "uuid": "32bd381a-295e-4941-97df-6d62e04e2bfd", "value": "57d4c1525bc46d8df0acc327a131bc149c396e6200bb082fd4b0f1a443b0f8a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daeb4c5d-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780907664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907664, "uuid": "ca96d5d2-0353-4acb-8331-eb5ce0c9797f", "comment": "Malware payload (PhantomStealer)", "value": "46c28a9057ea7a42ca1e175fb6ec829b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907664, "uuid": "b52f483c-8b3e-4145-9bab-90e246083d69", "comment": "Malware payload (PhantomStealer)", "value": "57d568f515174c990672d96511a9d1da72212c030e7daa5971c2306ab73224a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907664, "uuid": "68f77e1c-9d30-4d1c-bc8b-728b247e8318", "comment": "Malware payload (PhantomStealer)", "value": "a8b1f202e64d66ac98e2b407055c0171194be97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907664, "uuid": "f0e45f55-518a-43cc-9cf7-4d6cd4720318", "comment": "Malware payload (PhantomStealer)", "value": "b6eb97b04869ca89d80cf242ab0ff91202a3101d3b5ba8a4158438e248b4bd3e9ea458b45b881857e84e1eb0f82ec835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907664, "uuid": "118ef829-96b1-4b09-8d1b-d9c31f5ff35a", "value": "T1B6751210231ADD17C8D6ABF46824D3B823748D99E911D3238FF6BEEBB47E38525452D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907664, "uuid": "c8c0b3ea-ae6b-4a93-9aaa-44bceffbfe56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907664, "uuid": "d8728f01-1d6c-43b3-9d8e-7f59b5c096d1", "value": "24576:L6VYmSr9hoCbVqfrlqXjsdtLyLWsshwlPM9XirJ5yb9saYSd0VGC+kfwTKo4TS1:UOqfBqXjXLWsshwlP2y1ob9PkoTr44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907664, "uuid": "1a0f708c-742c-4f81-b700-1401bc771016", "value": 1564160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907664, "uuid": "9fad7954-11f1-4ede-9fea-0f45369be774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907664, "uuid": "b1ffee81-57af-42fe-b545-41841d47ad66", "value": "57d568f515174c990672d96511a9d1da72212c030e7daa5971c2306ab73224a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94491cf1-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911841, "uuid": "8718393c-2583-4fe4-aee0-01ddebe028c2", "comment": "Malware payload (Formbook)", "value": "268507accff36a6f704560d6921c951e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911841, "uuid": "cc644272-9969-4632-9a26-884a5742bef3", "comment": "Malware payload (Formbook)", "value": "57e753a6d49e97decfdfd33977c017da0c19955d69b6aeb150a7f9c80bca1134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911841, "uuid": "eeebecaa-411b-43e4-90ba-dcb016914278", "comment": "Malware payload (Formbook)", "value": "bedb4c32c7fba7add04a51ee93c63c8abc11278b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911841, "uuid": "ebfe4860-9b36-41a8-bfed-4db96970f62e", "comment": "Malware payload (Formbook)", "value": "b50224fcf3a2b07dc7a11dcdb2401383f21f5ab0f5553229283e527d11adc414a93a80b6150050b2dfa58812a03a3dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911841, "uuid": "0529f155-6a1d-440f-88ff-539e0a4742cb", "value": "T1A625125C5A16E206CB81677A1DB1F7B5067D2EDDB810C2139FE8BEEBB977E441C00292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911841, "uuid": "6650b6ac-4890-40c6-8067-8165929e3d2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911841, "uuid": "707adfde-e755-4509-a0ca-8ca268424649", "value": "12288:xtI40IhcvB1NUuX7lpcO0RvOn6yWJsls3MFK85b7a0iASug10wasGnKy/1Sobynw:446BvxoRmGs+kbm0fs0w4Ik2nEWPFs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911841, "uuid": "6ec72ed4-3546-444c-949b-4d420f107f3f", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911841, "uuid": "c82eab5b-e776-408b-b94c-90f482aec468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911841, "uuid": "66593d5f-6477-4018-bae1-90556df6e793", "value": "57e753a6d49e97decfdfd33977c017da0c19955d69b6aeb150a7f9c80bca1134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7365b94f-632f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780919087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780919087, "uuid": "56d66df7-454b-49d5-b260-c69e1ae0733a", "comment": "Malware payload", "value": "fe18af8be6a9d1208fa6edf813f80c32", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780919087, "uuid": "36a60ba3-ca42-4c14-9cd6-4133cc16a1b1", "comment": "Malware payload", "value": "583754e5e682ea83d58fbf76ea5c82ea0f2ab5db06e9e52343c4d52f35f0a4a6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780919087, "uuid": "4dda3531-7ca4-4a5d-873f-e012169de8d3", "comment": "Malware payload", "value": "0589d2079fbef814dc7bb95c4b3b555c8b933af6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780919087, "uuid": "583a0b79-311e-4550-b118-f4c3e7f6a808", "comment": "Malware payload", "value": "c77057ad9c1ea7fe54adec0ac46886b3027fbbb0cc293886ac9675aecbe743055322855156a403cfb8fba5ee1c5b269f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780919087, "uuid": "9aa158ae-a0f4-4828-bb49-2611295fda43", "value": "T11D0533FB45AC33D5F21E0D3A7EAADC75EAE9604A9DC16A90471424779C00793FCD38A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780919087, "uuid": "5405f00b-9936-46d6-a462-5eca892244d5", "value": "24576:GFyCNSZGZ9ozAqDfLRp5BP8IDO+CkU/X14527Y:0wGZ9wRLLrP8IDO+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780919087, "uuid": "fabe830c-c885-41fd-84de-e8dcd5895d75", "value": 838864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780919087, "uuid": "7abd8c48-1288-4dea-9d1d-a31bb8f765da", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780919087, "uuid": "84733565-6b71-45c7-9c5c-c447c7f06dbe", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e \u0441\u0430\u043c\u043e\u0432\u0456\u043b\u044c\u043d\u0435 \u0437\u0430\u043b\u0438\u0448\u0435\u043d\u043d\u044f \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0457 \u0447\u0430\u0441\u0442\u0438\u043d\u0438 3018-4726.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14668617-62e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780887145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887145, "uuid": "755096b3-d53d-45d6-9e34-a94808d8313d", "comment": "Malware payload", "value": "7f7d405ae97ac135781e2d8a21d979d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887145, "uuid": "0105cd91-79b1-45cd-bdab-94f513ad40e2", "comment": "Malware payload", "value": "584b44ee2738cb65b9227a6537f95b6624f5b024a65db5c820653511684213e2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887145, "uuid": "307f7069-48b2-4a53-908e-c60df7ce1178", "comment": "Malware payload", "value": "f57f9e9c281817a17d8324159c93a5b9cbcb17fd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887145, "uuid": "322786cb-bf4c-4a92-a46a-eb002df8afc3", "comment": "Malware payload", "value": "586a1393ef10975684bbbd1b72ce4e231b5422ce56b53cfc91220a02f03a81d4b0fc1c16e90781f5d68fde4d6a8be4fb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887145, "uuid": "a980a69e-0190-43a6-a806-57670022df09", "value": "T133018CCAC1019B6051C6F86D26D7A1D0742183CF16864BF8BEDD043D9BB9248B019F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887145, "uuid": "9fb427cc-c022-4122-8f73-bd18c97060a4", "value": "24:kXCKysE2hi0ziQvZoha38hMF2MkS819FlIN7:e9Qp+Ms38hMF2MkS819oN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780887145, "uuid": "f584d8c2-999b-44d6-adc2-e533dc3423d2", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780887145, "uuid": "fb5f6e8d-c1cc-4b26-bf9d-77f8572fc18f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887145, "uuid": "82f64f19-ba95-4cc1-bf52-41b73c5e0965", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e10565-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780907391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907391, "uuid": "95c6a602-dc8c-45e4-995a-ce052276e739", "comment": "Malware payload (MassLogger)", "value": "f99cce82a22a18532535ef2a9c7b3f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907391, "uuid": "f7a3cacf-7321-4425-b19e-d430677558a8", "comment": "Malware payload (MassLogger)", "value": "5911c8f9e9a4e2189c7f1a2048444c316b83eaaa1a16bffe9492e4f94d595f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907391, "uuid": "f6e80cc2-7bb0-41aa-a735-c66867264257", "comment": "Malware payload (MassLogger)", "value": "ae1da07ec6c4e1ffafe9a6d1623fa58789d3e19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907391, "uuid": "a52b5802-aa85-4590-869c-3c111e756bf2", "comment": "Malware payload (MassLogger)", "value": "1f6f0e5283c774f5297273fbacd473ff685a757c46caaa1ba874308842c605eca02157959940a73387a6761852b8e83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907391, "uuid": "7c84faea-c481-4fe5-aaa0-d2ace578ac06", "value": "T1DB050154621ED807D4965F704C31E2F427B44ED9E931D603AFEA3EEFF53A6A4484A2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907391, "uuid": "31a56b84-9cce-46e1-81dd-09ebaafaed29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907391, "uuid": "2fe721ee-7eb0-4290-bd26-eb36530aff84", "value": "24576:4ahFhwZtV5Hk12EHsFF/7JS76nHAkekoO/1z+m0:4CwFVk1BMFBcOHAkekoOtzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907391, "uuid": "d363dd46-9cc6-4bb2-8b83-50fb213f272b", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907391, "uuid": "70fb8886-a2ca-495e-9bf2-f673e17ec31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907391, "uuid": "c9ca90a6-512d-4278-a1bf-02caa95a56c7", "value": "5911c8f9e9a4e2189c7f1a2048444c316b83eaaa1a16bffe9492e4f94d595f5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e8abac-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780908139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908139, "uuid": "86cbe1aa-9723-4704-8159-cd440959cbfd", "comment": "Malware payload (QuasarRAT)", "value": "98487809e5b4ab1da97fcb4ba3d0c5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908139, "uuid": "f254805f-f9af-471a-8ba5-2bec91b21090", "comment": "Malware payload (QuasarRAT)", "value": "591724c3ba6313d16d21196d60230ed5ff414a50cfc6392c8a0afac25c64947d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908139, "uuid": "5340b55c-e5be-4565-9f4b-59dcddda88fe", "comment": "Malware payload (QuasarRAT)", "value": "3136619246a1a17bd681f30c8178c0754f055a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908139, "uuid": "ac834b2e-b499-4321-8c12-1b81be03b60d", "comment": "Malware payload (QuasarRAT)", "value": "4db4e6b285f79185cdac5fd3845686ae09e14d34fb27697acd56cfc8ed65fae0ced53abfed41082d17d6ea71be1a48c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908139, "uuid": "32895211-3adf-45c4-bbe9-416e1d3f1398", "value": "T15C05F19AAAC08D30C9565E34C0341DA842776F5E3EA5F245EE38BC7333B76D628961C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908139, "uuid": "66edc358-9548-4a5f-ba85-0d00c5bd7c7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908139, "uuid": "91f6cecd-75d6-400d-9be3-fc71342cfecb", "value": "12288:e+VqdWbKmEbl2CfDSvfbM7ioz6E572VvrmQnJfkvivatkm7kL+tsLc/uPNQmSHC9:ekqdSEbFGjMZ6+7613CtXkL+tsBlQUJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908139, "uuid": "82f05d29-7af8-4b86-8e27-c9606c495a8d", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908139, "uuid": "aa885dee-46f0-4d61-8735-4cfeb64c9d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908139, "uuid": "7163e593-bf7f-49a3-8d1e-eafcfefe5eee", "value": "591724c3ba6313d16d21196d60230ed5ff414a50cfc6392c8a0afac25c64947d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c448fe00-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780911062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911062, "uuid": "b283e816-15d9-473d-9068-51c2228ae67b", "comment": "Malware payload (AsyncRAT)", "value": "8eb90c36955bc281f2f1c007cc6c387e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911062, "uuid": "a58cbbaf-d2c5-4d16-809d-40ef562a036a", "comment": "Malware payload (AsyncRAT)", "value": "59616120b2be5d3c2f79d8379c9f3fb004adaf01a81742ebd2443e28b7d5e665", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911062, "uuid": "e6036241-713e-48c8-97c1-407e5815692a", "comment": "Malware payload (AsyncRAT)", "value": "0e4f140acca5dfd1076604146f772db1f1640f45", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911062, "uuid": "1f5d6bac-7e34-48ff-b4cd-291cd48ad1ee", "comment": "Malware payload (AsyncRAT)", "value": "9a92057093bb0d0fe050d1b73f340f9c792be6629e65cf1e4286319ca88fc698a183eb66f986ab8dd376adcc366708c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911062, "uuid": "3168e137-710f-40b6-9b33-16e843385a67", "value": "T14AE24C4877E44312D9FEAFF02DF3710A1675E11B9823EB5E0CD8C9962B63AC146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911062, "uuid": "524a424b-37ce-4e3c-b7ea-9b7a87290b52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911062, "uuid": "29dc76cd-4505-4e8f-8b8c-a195e8755088", "value": "384:RYaJWq4Ava7Rm32oDuuw3+q5XwYeLBEzvh0FbOKTCOQSCRApkFTBLTAOZwpGd2vV:bxC3fOJ5yzvGFbO75SCVFo9jhOjh0bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911062, "uuid": "679a4ff6-98f7-4bf8-b727-cc20f39bc52b", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911062, "uuid": "126f8dfc-49cb-468a-8f78-bf54ce8fd1a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911062, "uuid": "ef026d65-d9d1-470a-8cb2-2c2c32c2e68e", "value": "59616120b2be5d3c2f79d8379c9f3fb004adaf01a81742ebd2443e28b7d5e665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7934ded7-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780928975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928975, "uuid": "794a6722-0838-492f-80f4-d4822ca43453", "comment": "Malware payload (AgentTesla)", "value": "5517bd2d2976eadb212795e9396da904", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928975, "uuid": "9ed05935-723b-4e94-9b31-70c14308a0f9", "comment": "Malware payload (AgentTesla)", "value": "5a21036cc04bb57acc9e9186e09c7da2fb066b5446d94a3afc768ac373ea096d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928975, "uuid": "2f7a85ec-b118-46da-8299-64348ad3f474", "comment": "Malware payload (AgentTesla)", "value": "8b6edc6a307754359c8bd17af98a7bca1f2ab594", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928975, "uuid": "d46e669d-8a33-434f-a2b8-b40169335444", "comment": "Malware payload (AgentTesla)", "value": "c700f17f078998cf2e2acefd6a6a9a0a115a2066fe9d1a74caa4b99822882525bfde5d95a29fe32d91dec290f3a87fbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928975, "uuid": "68510f4b-40e6-4693-8802-33f6ec5e860a", "value": "T1CA760E3103948671E3549F9A26B9B128540E5DCE94F9EB013A5FC7B4127E832E3BB7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928975, "uuid": "b5fda5f9-dcfb-4f0b-9298-7bf3b7453a19", "value": "196608:jHal1yt2x+lAq3YYYYLlgYIDH8+WmRT/lvgfZYyntPJC2:j6mt2x+uq3YbYL2/pWYEC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928975, "uuid": "e514de79-1723-4b97-990d-ea49daff424a", "value": 7277935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928975, "uuid": "ecb49afe-a850-488e-ba5f-ccd59ae7edc9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928975, "uuid": "6c722634-eecf-422c-8a81-c60207523bd6", "value": "TT_APPLICATION_FORM.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5d6cd5-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780911591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911591, "uuid": "ede6a1a5-97aa-4710-a4a1-84ab278de1bf", "comment": "Malware payload (GuLoader)", "value": "cc4fb917fe90ef34c9dcf83a2cde79b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911591, "uuid": "d6bda9c2-2082-4153-ac3c-43dd8cfdf1dc", "comment": "Malware payload (GuLoader)", "value": "5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911591, "uuid": "f8a52991-ee1a-47e8-974a-9398efd4ebeb", "comment": "Malware payload (GuLoader)", "value": "246040d62d917037865d3576fa71081d44448d89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911591, "uuid": "f331710f-77ea-4d6c-bafb-a5528119000c", "comment": "Malware payload (GuLoader)", "value": "0b9d3ae12b9c37876e8c6b80a476c865cbf5decc77a5a064422a4b272b789615f1bd0dff073800bb59beb2135c759580", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911591, "uuid": "a9922f21-1307-4f60-9713-cedf1909461a", "value": "T14F152369F334431FD866D371C87A4750CBBCAD58754AA20F7349B2A53CA32DA46203EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911591, "uuid": "9793fdf2-afc7-4e4f-bcde-31bfa1576f70", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911591, "uuid": "267d457f-66c9-45b4-9a0d-17e44e941b7f", "value": "24576:zA7FRBJNy4YDnYYlMeBEFmNZpJGSqQc3DKtbPik+k:zKwNnYYrDHVSKtTik+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911591, "uuid": "93bb4705-6542-40df-a085-abd3e52687f1", "value": 891856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911591, "uuid": "5b0e60d0-17a0-4ba0-ae39-aad0bd743c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911591, "uuid": "a581f3df-b460-47f4-99f2-80b5c45c9ea8", "value": "5a891a660cb8f45d18db11af1a25a332d615443781ad7915ebf92c6919a88ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f92555-62e9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780889213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889213, "uuid": "b3b34a67-46b2-4be0-b79c-fdc1479d23d9", "comment": "Malware payload", "value": "073a076a154df390e2de76fddb25d958", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889213, "uuid": "809c005f-87ce-47dd-9894-963211123e3e", "comment": "Malware payload", "value": "5ab6f877f26b8a42909bd750a14d00d807c5565712dd51f1917b580eace55b3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889213, "uuid": "58205087-94eb-4139-b6eb-f330a27b6724", "comment": "Malware payload", "value": "f8bbe9e82f10bade3fa9194150dc67e86d032b5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780889213, "uuid": "4c0eb1df-c2e4-464a-aba1-347654debeb4", "comment": "Malware payload", "value": "9a04f1ab06bd7a4f978707078e9711d551ea1c2f977c88ef8926e52a37e99c65e44c6ccca6e06aa65b3b5b76abc88fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889213, "uuid": "7657598c-a5d9-44aa-8432-3c33f360d7f5", "value": "T1E4362907EC9545A8C0AED231CA6692537B71BC585B3023D72F90F7782F76BD0AAB9344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889213, "uuid": "511f7f0d-495c-4fb6-83f8-140c73d44e69", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889213, "uuid": "3c9bb20b-4c9a-40df-b3e6-1fb7c5c30fed", "value": "49152:TZu+gm3q5giXmcL30c0M6+/U0kJv22b0UuL/iq75E+Iqd0srj7oJ7MT:um6m20Mkv2pEKus3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780889213, "uuid": "961a1ea7-eed5-4ec3-99d4-0cca7a20243e", "value": 5274112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780889213, "uuid": "74a062bf-18e1-482c-b714-a20a20dfd738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780889213, "uuid": "67856d1b-e89b-4ba1-8efc-2f22ba8b931e", "value": "073a076a154df390e2de76fddb25d958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c17040-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780928830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928830, "uuid": "8f048d2f-fd99-4c0a-baee-59738477cf04", "comment": "Malware payload (Mirai)", "value": "019fe6b7fb92ab4721c299e0cc769156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928830, "uuid": "bf72fb32-c7f7-4828-8f08-cd52443d96e8", "comment": "Malware payload (Mirai)", "value": "5b37a309e921e021f42e94004724652858dad01af86d64c9dcdc1ea7d9130527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928830, "uuid": "6a146089-4b36-41fe-b45d-269ec5445fbc", "comment": "Malware payload (Mirai)", "value": "651e2580d3715cacec8b5a6bf55c5e311d560e4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928830, "uuid": "634a87a5-1e1e-43a2-b0e2-ce92910591a2", "comment": "Malware payload (Mirai)", "value": "0564fbe8f6f98ac837b4cb440d437a075d8e54336c169f9777d1ccd277831fa9a70613262ce153a8a016e3a54340ed9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928830, "uuid": "3a3c5b1a-3653-493d-8744-083148f9608b", "value": "T1F1261B97B8918643C0E4367AACBDC1C433636EB99B9712676D00FE3D3ABE5990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928830, "uuid": "1ca4ca87-fa63-4655-b1a6-4525bec65d43", "value": "49152:mqfxV5ERF0QfJgbVJsfxQhmxlPztiMKU1F1:/fxrER+QfJgxqiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928830, "uuid": "64c03910-c52a-4ac4-a9dd-5fc621e3b3de", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928830, "uuid": "460a7926-0216-4584-98de-40219cb7a25f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928830, "uuid": "54d09a71-5161-42ab-88bc-327a55ef1b06", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4fd1ae-6357-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780936361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936361, "uuid": "0a087b21-386c-4b9c-98d8-31f4b81ac07b", "comment": "Malware payload (Phorpiex)", "value": "99d98dfa15a8f0182dabc4efe7fa53f5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936361, "uuid": "ddaa6688-68aa-495b-b03d-ad8b4d015f63", "comment": "Malware payload (Phorpiex)", "value": "5bad3ccc54c80b0a7b31494515b117ae0c714c54157a4d53dff09cfa07954008", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936361, "uuid": "d5551b1d-c269-4dea-852a-eb2775af4205", "comment": "Malware payload (Phorpiex)", "value": "c7fe1b0db4723c9771b6bca94bdd817ad23a0408", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780936361, "uuid": "5639472a-7a1c-4d77-b1aa-b688ef08352a", "comment": "Malware payload (Phorpiex)", "value": "451c4efd34b627adc41f1b820ae257462c8c2654a70087e2081f87dab632c6633d9dc3d6074a84a010c88fe3072b6b7c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936361, "uuid": "6553cb41-99fd-40ac-8476-b4086fca7904", "value": "T1D6824A0FB8464726C1E100B49736877BDAB9A871378404DBF7E48ADE1AA86D5FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936361, "uuid": "08ed6409-abe3-4bf6-a575-012abed808ab", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936361, "uuid": "d1b05d3d-888d-448f-9b73-f7a07aa19016", "value": "192:8KaqCngTtXWAwjryNjtEyDCoDjlvlgZKP2vKUSvu9zw+ghSSCgbO5qmEd/F92GJP:G0WPyNQoNvSZmu9JgwOc4av8U9cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780936361, "uuid": "b0ca8a8b-6788-49e4-806f-eb62f509f21b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780936361, "uuid": "46ee92fb-808f-4662-ac0f-3bafc52a3539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780936361, "uuid": "beafff50-04df-4f9b-a9ec-f92681879d41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4062dff0-631e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911700, "uuid": "d51d1f60-5bf8-4409-8bd1-c7378c51f5c8", "comment": "Malware payload", "value": "7f7dc3d432cfedb251638f3469a8b381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911700, "uuid": "04ab8d02-6a66-4202-8a7c-09a2a4c5080e", "comment": "Malware payload", "value": "5bd7e3b18ad16738bb474067fa68c81897f9d598c0bad0ba704d40a20946c91d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911700, "uuid": "4512dd67-181d-4af1-b9bf-c3adefde035b", "comment": "Malware payload", "value": "ce1e73293b5bc6b8fab037eb86cd93b34acb5df8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911700, "uuid": "f07f46da-006b-4694-b9bb-d9956ee7656e", "comment": "Malware payload", "value": "e616e952ab84b14cd1c83df2282fd109bd60f90089cbc1a46075739e48f14b8f8f140edf649bc93935f4004b685766be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911700, "uuid": "65f41f52-bfa1-4ab6-a086-79d3dc5d92d3", "value": "T136E4C32162E9CFD0C19F2575EC96B1F81617EE10CD209FDB7D88BE1A34B22A5A97014F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911700, "uuid": "b7e465ce-6a17-48f2-a050-fd574aa91c23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911700, "uuid": "22b0ad2b-8d81-401a-82b9-d22df927e289", "value": "768:Az57Ngy0RKqQbFgzgCZawgWcqJF4+QtqdM8sScR9ApqcArS+jbN6K:DQbC/ZjgnMqSjpPEjbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911700, "uuid": "11b288d3-a400-4904-8487-3999c3296455", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911700, "uuid": "ddc73fb4-7423-43bc-bec6-68eeba92a511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911700, "uuid": "0c28c408-4adf-4cff-8154-8d0bf7a02dad", "value": "5bd7e3b18ad16738bb474067fa68c81897f9d598c0bad0ba704d40a20946c91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcdac19-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907780, "uuid": "175243fe-6d1e-4de1-82fa-f2384910262b", "comment": "Malware payload (Formbook)", "value": "118156be4e1554c0b0078e1f83e88957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907780, "uuid": "35ee3c6e-c372-479e-b5c1-d5f9884fb171", "comment": "Malware payload (Formbook)", "value": "5bfbfe0617dc083819a756a1b934cf7d7b1534334ebe9d1147789afb854d0bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907780, "uuid": "41e3e277-079e-4395-bfcc-c69d485420eb", "comment": "Malware payload (Formbook)", "value": "068478fd0064bb6e6fa9f4e1d548cec2dc30e2d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907780, "uuid": "6c80180b-cb0a-487a-b956-33607aa504dd", "comment": "Malware payload (Formbook)", "value": "88dac9d03fbcc6c86bf25e4956fd057eeb93500bb0751fc6297ad33f5f8b6741c428fc564f9cd28b2662e3f837c35d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907780, "uuid": "52d115e2-79ac-41e2-adf8-92f0a6a4b19e", "value": "T18D350254760ACC02C5C25EB52CA0E3B862358E88A905E3139FFBBDBBF47E55939463D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907780, "uuid": "b2670797-addb-407e-890f-924e72ccc76d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907780, "uuid": "084daf02-376a-4826-8d0e-6614bf5c8aa7", "value": "24576:hVrRQYRbmpSo1tazHuWbfIkh6FoDS+W5sMn943Z4TS1:7rRQYRbySoHOuWbhh6FF+Wv94p44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907780, "uuid": "bbc669b4-2fd8-484b-a3a4-a12616047250", "value": 1059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907780, "uuid": "78d0f27c-d29b-4fae-a00d-304e88c38f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907780, "uuid": "191603ba-77d1-4541-9582-ca974d437d87", "value": "5bfbfe0617dc083819a756a1b934cf7d7b1534334ebe9d1147789afb854d0bca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6804eac-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912784, "uuid": "b91c6cbe-ddae-40a3-8e5e-2b35a3dac078", "comment": "Malware payload (AgentTesla)", "value": "0850f4a592ad6c02cb3a8fb8dd0e979d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912784, "uuid": "300f5fa2-cd3e-46c2-8311-7876661e653e", "comment": "Malware payload (AgentTesla)", "value": "5c079b4b5b752c8738bd4b590448b19bbdbea83290695f7c44651cfd25aa5299", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912784, "uuid": "e1c461f4-49ad-4473-8a60-0df726a866b3", "comment": "Malware payload (AgentTesla)", "value": "cb4a5690cbf632a5a94688e5ac49a88aed5e582c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912784, "uuid": "e47e5e78-f71a-40e1-84ab-c9c6f027445d", "comment": "Malware payload (AgentTesla)", "value": "a325eca109e0841d3739be4cde9d9578d833f8903a9182aec55afe1cfca2970d10858dec7e42e284bf2c72fe868ca585", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912784, "uuid": "4020b962-539e-428a-b666-aa23e475243f", "value": "T1FDC45312EA21A42FF45389F079799546BC282D365680EC5BF7802F693474AABF4F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912784, "uuid": "4556cd4c-eedb-468a-86f7-ec09da242053", "value": "b14bd2ee9796c8cde3a75495055fd7a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912784, "uuid": "6015584d-e157-430d-a51f-b36f5836466e", "value": "12288:2gwVv9VR4Kk91jJWWDrtIbLs06gj9oFzj:g/R4KkFDK2F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912784, "uuid": "bda5507f-b794-4d21-b984-83b5806e4d8d", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912784, "uuid": "d5194d20-1877-49db-a751-fb738eb575b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912784, "uuid": "0ee3c16c-7fce-481f-88e2-5cd1d285958e", "value": "5c079b4b5b752c8738bd4b590448b19bbdbea83290695f7c44651cfd25aa5299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66a716f-635b-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780938097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938097, "uuid": "26e95543-c8f9-4ab3-8d41-08eb390e2c32", "comment": "Malware payload (Expiro)", "value": "89b25ee7b5a787285a4aabba84232741", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938097, "uuid": "0b5724ab-cf72-400b-adbf-09f982e25a67", "comment": "Malware payload (Expiro)", "value": "5c0aa9f4ade6b7b79a52c9f23c5474f3baaf22062d826a5b5055632876a8aeee", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938097, "uuid": "51823a08-6cff-4fa0-a81f-f0b54072dcb3", "comment": "Malware payload (Expiro)", "value": "2b3aedf2299c8190ef3b2714b6575938e2d57c34", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938097, "uuid": "b473a693-b48f-42eb-8b2d-90d4ff6718fa", "comment": "Malware payload (Expiro)", "value": "225f00c47e36c40f89ad46dd38bd56608f2081aa7c780d1e5fc988a46c5ca3833319fcf104469aae31e0474816604d70", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780938097, "uuid": "0232610d-fe5f-4773-bc2b-67eab8a0dce1", "value": "T13945238855D9448ED3770DBA0192DD22852A34A0238FD9D3230C36DB48FEEC6687D7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780938097, "uuid": "0a4df183-6ec0-4600-be08-19f6123c94b8", "value": "68e651f131674892ae7e46556eb24726", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780938097, "uuid": "55ea7692-38a0-49ba-a832-480f5757bb7a", "value": "12288:GX844+l+x1IWosME6tU3CalGRv8W/AbAIwUmogfTYlBcznqtw:GX94+USWosMBmjoVBCm/+yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780938097, "uuid": "001601b3-6216-4bd4-a960-1eceb4608108", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780938097, "uuid": "057aa3bc-fec1-4404-85b2-65c1a1faac62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780938097, "uuid": "37f046f9-0d33-4bb2-ba69-94d5d83836e7", "value": "5c0aa9f4ade6b7b79a52c9f23c5474f3baaf22062d826a5b5055632876a8aeee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7565db9d-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780910930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910930, "uuid": "8446e5e7-7c9e-4736-8dc3-1b9e99a220c6", "comment": "Malware payload (SnakeKeylogger)", "value": "530aa741afab4aae3b45aa36ae677cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910930, "uuid": "8654cdf5-6777-4b1f-a8b3-3289b3bcb7e0", "comment": "Malware payload (SnakeKeylogger)", "value": "5c1525ef7994d3a68c5dfa2a0bc5f0fe1ea42d0b7c939a4ec08992062c1f98f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910930, "uuid": "6cd469a0-b64e-4065-959e-820c27c172ad", "comment": "Malware payload (SnakeKeylogger)", "value": "06ca6a556f8229f71de6b27bbcf0768a90dc3c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910930, "uuid": "987d4c73-47ee-402c-833f-6987b7cec80f", "comment": "Malware payload (SnakeKeylogger)", "value": "46928ca2d3d931b5eac1d7ecb514d3d74715564fd053c2f977d2e07bea3ba1c8b931a3ff5d31b9aeebbc34e249ae519d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910930, "uuid": "b487ca7d-a81d-45e9-b345-29e9b858aba1", "value": "T1581501682725D52AC890A7B85970FB74127D5DEEF140E2468FED7EEFBD25F098C08242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910930, "uuid": "c15420fc-5a71-4e0d-af1f-3b3df3bda43c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910930, "uuid": "5d443e1a-2764-4f30-bef5-0547c97cbf92", "value": "24576:wBdn5R/66q6FuOC3oda9N3HwY1/gzCCvQw9o7W:ydn9qEuOCpzQfna7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910930, "uuid": "e7a30df2-89b5-41f1-b56e-d1f6e4f430ec", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910930, "uuid": "39f0a88e-1985-4fdd-a237-d66a56464554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910930, "uuid": "895c4926-392f-4535-8219-3dda87e33fea", "value": "5c1525ef7994d3a68c5dfa2a0bc5f0fe1ea42d0b7c939a4ec08992062c1f98f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c349fe2d-6390-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780960882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960882, "uuid": "7c26daf7-dde0-4b5a-8f9a-698379bd6d43", "comment": "Malware payload (AgentTesla)", "value": "0e85bbde823f88b98e200400c926accc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960882, "uuid": "a613daec-82ab-42f2-a4bd-afec44ed3525", "comment": "Malware payload (AgentTesla)", "value": "5cf74c60c773a776c2291395b7b57627b156119560e0939b381de56788a2420d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960882, "uuid": "95058688-e5c7-4642-b7d6-b7677759200e", "comment": "Malware payload (AgentTesla)", "value": "1923b33c6afb55d6ee5726ef94f9fa89b527bf30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780960882, "uuid": "a4c9ce4b-0f1f-43da-98d5-165cd8d89098", "comment": "Malware payload (AgentTesla)", "value": "af3d1a7008f83c06e532926c29ac21842832d2c53bdd794744f24c9f94aa71132a9d63e64ca928afbe8c87ae1ebbd481", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960882, "uuid": "f45a56d3-6819-4930-8806-cdcabe2e12ea", "value": "T11C94BA3CECEA402AF173EE598AD47997E95FB663371E980910D213864713942FDD223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960882, "uuid": "f76a719c-febf-4144-b52d-15559881ae34", "value": "6144:wZiqKyK7FuVABxf92GtxOIS26FPQLWuiiOTy2uhhMmzK:wZHXKhhBJ92GyIS26FPMiiOTy2uhhM6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780960882, "uuid": "d428d90c-2679-43ca-a4c1-99e56e86439f", "value": 425324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780960882, "uuid": "d6bdc694-5364-4f4b-ba47-0799bf52a986", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780960882, "uuid": "bac0825f-bc99-43c3-91fb-a629d7229860", "value": "REF_7RFQ001751_SDB904-99843.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec634a2-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780907671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907671, "uuid": "f7065194-cc74-4080-bfb7-6ee0ee306de5", "comment": "Malware payload (PhantomStealer)", "value": "7600b6cd3b0e817f96b9ca792bf1fecf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907671, "uuid": "cc2dd220-384a-4f5f-9fc7-e471338b8a25", "comment": "Malware payload (PhantomStealer)", "value": "5d23a0e4656f41bcb064307a614565b32cf6d04d6b38a910f24570907f29b436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907671, "uuid": "752ec66f-bbed-4d75-8401-6eceddd2ec86", "comment": "Malware payload (PhantomStealer)", "value": "11bb6984129b5e230523f9a726f6f798e147451c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907671, "uuid": "8f2b901c-5329-49db-b533-0cfd4658eba1", "comment": "Malware payload (PhantomStealer)", "value": "8445193fb131e6d1e4f97557277ff964eca7a207cc84f06d9c1df2800284dcf53c52d777ff5cd80370f4527bacbc0e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907671, "uuid": "d32b3776-cbd1-41d3-8e4e-b3fe3783fddd", "value": "T18D751250131ADD16D8A74BF12570E3B467B88E189811D343DEFBBEEFB0AA35639442D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907671, "uuid": "f3ce6991-6d20-4211-8cfa-d175aa614eea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907671, "uuid": "380e27a6-94a5-4334-ae9d-d958994f5a6a", "value": "24576:ippmAftiwO9bBQLvSPI7yNY3L8t4rLNi043BbtyzSYz8loWl+2kD3s1PF4TS1:UlfAwVvrycLC4vNi0K1tyzwnwTIT44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907671, "uuid": "72dc2f18-a49d-429b-b77a-ab677cda851b", "value": 1570304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907671, "uuid": "8390ad30-9ebd-428c-b484-c25845313989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907671, "uuid": "fc2f2fb4-f7c4-4628-a3a3-d480db4e0f75", "value": "5d23a0e4656f41bcb064307a614565b32cf6d04d6b38a910f24570907f29b436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c63ff2-632a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780917100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917100, "uuid": "fc5611dc-280a-4cf1-b2d3-372d7101d6e5", "comment": "Malware payload (ValleyRAT)", "value": "0f15369d8554333f1eaf32c2b7f53802", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917100, "uuid": "de92680a-863d-44f2-96f2-547de8c173db", "comment": "Malware payload (ValleyRAT)", "value": "5d599b00fddd82df4381e386e7e5b8bd9178262869554e8a01685241c25d21cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917100, "uuid": "df47b4e5-7670-4bbf-8502-4bc2b4b47349", "comment": "Malware payload (ValleyRAT)", "value": "1a734df43595dff09fd18c014cf6e4972661fe60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917100, "uuid": "4f9fe78c-266e-4dde-a376-453d333d79c2", "comment": "Malware payload (ValleyRAT)", "value": "d066e9daa2e859fbeeb5bbc8c552343ef6dfe648ce29a7f3152d114a519c6854912f249e940260a52d9077f0dd2c668c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917100, "uuid": "34246e38-1f35-4c2d-9814-f2823f773faa", "value": "T17D0861667601CCE6E04682B19893FBE123BABD7689E4C30731C57B2D6FBE14D8DA3550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917100, "uuid": "4deea355-fd3d-4a2f-b1fc-16ef4e301c4f", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917100, "uuid": "5f2b301c-4235-4a52-b724-9e68213bb363", "value": "196608:pxIdETpCjPxXOIdxBN8C9WCkhq+SiRVR/l8jpvUFgAg:zpOxXOId7N8bRVR/EvUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780917100, "uuid": "228f185a-5f69-4903-988c-12c549896890", "value": 79227904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780917100, "uuid": "40974bf9-e9f2-48cb-acda-2facdc854eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917100, "uuid": "9efb638c-2764-4239-911e-04ad3a642fce", "value": "ainsapp6565203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16863a4-6313-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907246, "uuid": "41b19389-914a-40fd-b463-3bae38385ddc", "comment": "Malware payload", "value": "6aaefbc3a49a092dc1c001793b7974a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907246, "uuid": "1f25d0ad-069d-42c9-9600-173cdbb1eba4", "comment": "Malware payload", "value": "5d9ee988420ac2c8977e96938f7bdbda137f629c6a4cb2dd9c3ccba1ba02edd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907246, "uuid": "30e456dc-c52b-45c4-a7d0-1c36c87e0984", "comment": "Malware payload", "value": "084fbb0eceb7d28127d48d2e17d691f63d7dc14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907246, "uuid": "a6c3f580-3010-4d96-80ad-1ab28f47ef5a", "comment": "Malware payload", "value": "537985559a9a542cddb84a1bab82339f72581f5e70eba06e99e119b70eee3a5bafe4f4d938d5f1b25f0d9f1b84d0ec5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907246, "uuid": "3022aac2-6b83-415f-b304-9f11fc3da4a3", "value": "T13225E1150D872B94D9AB4B7CC0531498B3F0D48793A6EB6B7FECA0F89EA7F41CA49441", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907246, "uuid": "94e9fec3-876c-4e2a-b384-88c427d8c966", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907246, "uuid": "80425142-a72e-4dc7-8184-34a48eea5270", "value": "24576:NKLChEhFMxO+Nm5olKEKUp73O/WoGYdTfr:ohFMXNSooTk7uWvYdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907246, "uuid": "8f652807-22e7-480b-be0f-917453e3d926", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907246, "uuid": "de1bfa22-331b-4674-9357-8f49d8327811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907246, "uuid": "748472a2-b84d-4ad2-9797-b6356024bd02", "value": "5d9ee988420ac2c8977e96938f7bdbda137f629c6a4cb2dd9c3ccba1ba02edd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d544fe4e-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912809, "uuid": "b0d8d6c7-16a2-45c4-92e8-bbfc123038cd", "comment": "Malware payload (a310Logger)", "value": "9702438d042a0d8b9faf54fdefb7ef03", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912809, "uuid": "8d99fd9e-1c54-4a20-853c-c61d39b86f7e", "comment": "Malware payload (a310Logger)", "value": "5dc5d4c3497c4e57f59fe9e68ab820a2013d3fb1b48d914876000184e398c812", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912809, "uuid": "f37cf9a3-4eb3-49cd-adb9-563ba35037a0", "comment": "Malware payload (a310Logger)", "value": "572ee9822f8de338b1d9bef08fca7cd1cc5adf92", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912809, "uuid": "503e22e0-c5b7-4da1-8b14-afd6bb41bb59", "comment": "Malware payload (a310Logger)", "value": "e88e61e3809ca71540b74c2c15428e45529629f32ae52ac542b4189867f6df60f8bcf1c4df1ca6b07c39efda131b8c67", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912809, "uuid": "e4d2c4b2-097f-4625-833a-75fafa36d3f2", "value": "T147944A13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F5A35715D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912809, "uuid": "feb1b2d9-8bb2-43cc-864b-041d01ec6026", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912809, "uuid": "5d568058-ae64-435b-98ce-e9fd7afd7d80", "value": "6144:P168d1/w5KA81IJ8GpF6nuTmOOUiBUrjM1DnvJ2JU6NumWFX0cgGlyLOnVut:TjYKkJj6GmZUiqrCkuIOlyLOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912809, "uuid": "15978a68-43db-4d02-bfd9-8ffc5697b141", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912809, "uuid": "0d77eb07-f7a4-4f17-8794-6899277d6954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912809, "uuid": "c0a224ce-e065-4210-96ac-567cd0ec2c71", "value": "5dc5d4c3497c4e57f59fe9e68ab820a2013d3fb1b48d914876000184e398c812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200a9773-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910787, "uuid": "1a8a7792-4f68-4e69-98df-8eb11246915e", "comment": "Malware payload (AgentTesla)", "value": "bcf8c307577dc7d502edfa849f41b788", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910787, "uuid": "eef7ccde-f22b-4b7b-a6c0-e4c048472b94", "comment": "Malware payload (AgentTesla)", "value": "5e067cd3fc2a7ea947c8b346c74b2ac62f69add3a8b990c4923ea58eb192ad29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910787, "uuid": "69ab5e46-d22a-46f3-bb20-acb6d60d4fe6", "comment": "Malware payload (AgentTesla)", "value": "d4de3218d1920230e6e3e379c54451611cd37985", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910787, "uuid": "7e984c06-ae8d-43ef-bce9-3b45709412a9", "comment": "Malware payload (AgentTesla)", "value": "5ee14d10b75172325b19653a1666a12399a45875153e1bde7f1021ff46395d3f0bbaf63b21176517f9e4d06b83f4ec1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910787, "uuid": "79be3150-ff17-4b3c-9979-8b4f25df0420", "value": "T12445BF396A87568DE954A7B8C5333BD20B70D429D97EC306BFF84274993B7A19C30B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910787, "uuid": "861b7f50-5976-4333-a93a-1af478af790d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910787, "uuid": "34a23bee-1303-4587-a09b-18ce92eed60c", "value": "24576:J7BL/9GUN5AidLVkzQU/Q3RvIvWM66LghoGFq4H/+Qa7KzQ:J7J1G0bhmzI3Rw6thv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910787, "uuid": "b528d753-84a5-4fb9-8bf6-4bff1a99780a", "value": 1223680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910787, "uuid": "292cc2c1-aef0-479c-97b3-68eec2f56f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910787, "uuid": "10f1a977-5a03-4e37-9af6-d184e24a4b28", "value": "5e067cd3fc2a7ea947c8b346c74b2ac62f69add3a8b990c4923ea58eb192ad29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf46876-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912605, "uuid": "06d8f8a9-b201-41eb-9ab1-0b123bc18308", "comment": "Malware payload (AgentTesla)", "value": "63916a93d7f977e9b13323645d640c31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912605, "uuid": "7a2065d2-100e-432c-9800-4c23bb8b2de7", "comment": "Malware payload (AgentTesla)", "value": "5e09f995703c957e5b3c7d569264566f17b4ebf83db6606e18eae09e52109f2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912605, "uuid": "0469ee7f-9f84-4791-9fc3-77ff579d494e", "comment": "Malware payload (AgentTesla)", "value": "66cd9b35c868b8472f491f0bf6f7e90ba67e9300", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912605, "uuid": "b5f13682-304e-4d30-82ad-54d436804f7e", "comment": "Malware payload (AgentTesla)", "value": "2dc6013e88fec61c5c204346ae14ebe553d40c25c97cd4a9ee9976933c607cb482d40abfb94f9aeabb2a2a3062c3bda0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912605, "uuid": "251d38f9-adc7-4cf8-b11c-b2dde5488ae5", "value": "T1D73512296B9CCA03C89623B45E74F17623B56ECDFA41C21A8FD9ACEF7C62B401419753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912605, "uuid": "4c1fd125-3e51-4202-b8a0-fb3868bfc9a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912605, "uuid": "1b5de0a4-0b9b-429b-b65c-dfe2d2eb388c", "value": "24576:/DValyJNUhReVafoFrjrs5LYyj8Oc0Qt+/WhMmsBSt8rkuRsSy:/ESNUfbohvsqyj5c0lKsQ8rkMsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912605, "uuid": "ce6538b6-214a-4be6-8335-4f069856c5a5", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912605, "uuid": "e3105307-aa31-45eb-892e-546aa8db2192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912605, "uuid": "a2dbb1ba-f7a1-4c12-ae00-a3601174d40f", "value": "5e09f995703c957e5b3c7d569264566f17b4ebf83db6606e18eae09e52109f2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4404b2-6341-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780926838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926838, "uuid": "c4517beb-3ce0-4942-8194-2c4c8afd1859", "comment": "Malware payload", "value": "6faf371da49795e7d6a6a0a220498ebe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926838, "uuid": "8d4d4372-0267-4b47-9858-00b721d62949", "comment": "Malware payload", "value": "5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926838, "uuid": "957141a0-e0bc-45fb-be94-e2854914babe", "comment": "Malware payload", "value": "74ffecc698a4454b9d90a123c3b3a5f5a852cbb0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926838, "uuid": "a5b86542-478f-4947-8b83-b6dcb051ea35", "comment": "Malware payload", "value": "ac93d5d42c5f01e95a2f89199d37b6bf6f22493313886bb85dceb322fe61e2182d0ac7a5343726de00f5c8632324a430", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926838, "uuid": "4472bc0a-57af-4a6e-990e-d0c884600403", "value": "T15A01AFCEC102DB108185F89D72D75680B410C3CB59894FF87F9C483DABA97887165F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926838, "uuid": "eeec4ccf-761b-489f-9f4e-aa4a33a869f9", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaqDjIIEsvIsu4yjTLICpEajID0mLs7IaYQ:kXCKysE2hi0ziQvZohaqYk0PLPNteTU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780926838, "uuid": "e96dbab3-3094-474d-8f6c-af044c670b6f", "value": 830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780926838, "uuid": "ea2ac180-0b40-4c34-8037-94aa76ee2ce5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926838, "uuid": "eaf2920b-6970-48ed-a44c-4eacdd4f410b", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4d010c-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780907856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907856, "uuid": "4df4b20a-d99f-4725-80da-0d485ad5d265", "comment": "Malware payload (a310Logger)", "value": "9b6ae677e8b6f8d042380ec78786246e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907856, "uuid": "99244bef-ca79-4312-b189-74e5d9a034ca", "comment": "Malware payload (a310Logger)", "value": "5e8140bc340f72cade2f464b6f9742c8236f544e0213e17cb74ca05a4d222b31", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907856, "uuid": "cc4ddabc-41ee-4537-8090-28ff7e8fb683", "comment": "Malware payload (a310Logger)", "value": "e6b68f5830fbd216a9d7004351e94913291b8836", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907856, "uuid": "7407bef7-900f-47bd-9661-cc8cb5f9d355", "comment": "Malware payload (a310Logger)", "value": "f75ea16c99a7e41a41843af1a46d37518cc666d1cdedf7eaaa0e9116dbd78eb158b2158dc9d1d25372bc6c0f1cfd2afd", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907856, "uuid": "58d97570-e386-49a6-bee7-9d8447aba814", "value": "T1D1551254325ACD06C1E60BF158A0D2F857B48E899521E303DFFABDEFB87A34169493D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907856, "uuid": "39faa41f-0f68-40b0-9de2-6e56625cd718", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907856, "uuid": "82226f50-1403-49e0-84ee-558b2c9c99c3", "value": "24576:RFnFtYM921//u+f1F9SpCtkYAehXDZHk38NYvtwGfr4TS1:RFnr21H3HOCtPAElE3IYhD44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907856, "uuid": "b54e1bc1-f27c-4e23-b5f6-eb3f70bbc14a", "value": 1289216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907856, "uuid": "ada0f9f3-055a-49b1-a3df-276130da06e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907856, "uuid": "673b7a82-e646-4e7b-a083-d8f4515cc498", "value": "5e8140bc340f72cade2f464b6f9742c8236f544e0213e17cb74ca05a4d222b31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efe3052-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780913067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913067, "uuid": "192ef50a-d11b-43c9-a4c8-899c35d567d2", "comment": "Malware payload (GuLoader)", "value": "16c21aebc8636ddc78e537c58d183c8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913067, "uuid": "9c20b3a4-18f8-4fb5-8047-1fe257281ec8", "comment": "Malware payload (GuLoader)", "value": "5e8e303f85b17263f85044d1e8dd593477755c753d13664bac9ba8f53241ec26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913067, "uuid": "3680cca1-c40e-464e-8973-4c8fa9632a4d", "comment": "Malware payload (GuLoader)", "value": "6d73993725af703f9725c20e3a8f313bbb1a464f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913067, "uuid": "5723bdb8-fbc5-4e50-aee0-4e1dc80bbefb", "comment": "Malware payload (GuLoader)", "value": "aa6dd0e4c0d5df3ff62ce1558ba079a08ae10d00897c69a73621c866bed356943e067a07b6d3fdb9022b2a57ab8f27bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913067, "uuid": "9343c4b1-eb5f-4100-8ea6-cac20e462d22", "value": "T191452314B143E067C4E7513F68FF54AD92EBBE297C526A0F2314BB0E1CB526C538B64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913067, "uuid": "fe4fafb6-ebb4-4c97-954f-3ff272d824a1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913067, "uuid": "290af220-faa4-484d-a591-b9fa43bbed06", "value": "24576:MYXDDHkQGt0xUh2xx5h2nwOhUXKkp1jCLbiBBnLQvHF1bnHmvIxG/Cq7huPY:lX8dtn8xPUnwOhGXjFh8l4vI0CbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913067, "uuid": "ddb47854-bbd6-4c24-a51d-05f5dc01676d", "value": 1275936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913067, "uuid": "9ddc9e7a-708d-4b57-9ddb-6a7052ae3b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913067, "uuid": "96cd2d79-1c1b-4528-8c52-4f3cc2507922", "value": "5e8e303f85b17263f85044d1e8dd593477755c753d13664bac9ba8f53241ec26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76851a68-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941426, "uuid": "4bbd9012-54ee-4728-868a-cb525075d9b5", "comment": "Malware payload (Snojan)", "value": "ba3941fc350164be1a0b5d2700958c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941426, "uuid": "b785c0a4-b0ba-405f-a5e1-8bcde5346259", "comment": "Malware payload (Snojan)", "value": "5e9a41701e79ee2d35b0b0d3aa4fde39e589dfb764ad8836c78a8299ef9aab83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941426, "uuid": "989b868c-b157-4c18-a1cb-6e0f84beff71", "comment": "Malware payload (Snojan)", "value": "199f57bc3799f3c35c96c2a7ea338963e7ef2b66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941426, "uuid": "69a95b22-a9d0-44cc-bcd5-4969542468fe", "comment": "Malware payload (Snojan)", "value": "51e2a695ce61cccf9755ede361e65a668f87055081217344fae60ebb10c94eae1ec9f9be9df0ab3bfded4978699ffced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941426, "uuid": "22de229d-0845-4c22-ac0c-9b95f46f167c", "value": "T19CB4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941426, "uuid": "c46cafc5-0b93-4282-b4eb-71c0ecf289c3", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941426, "uuid": "2f28249f-5b9d-4558-b243-09c44bb83c54", "value": "12288:/bE+unh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+wk70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941426, "uuid": "ebb9326c-6040-4f51-a6e7-b319962c38f7", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941426, "uuid": "719d7ce2-b1a5-4786-bf15-6183002aef41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941426, "uuid": "734beb6c-56e0-4615-a7fb-9f7714464ac5", "value": "BLrYGSqRr273Wria.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d263f60f-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910227, "uuid": "fc8bd3a0-a84f-4573-90a4-bda23e3d78e4", "comment": "Malware payload (a310Logger)", "value": "550b2851eca9582aac0e59f2b5f600e5", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910227, "uuid": "e62d350f-9f0e-49ed-986e-9edc8e0f9f06", "comment": "Malware payload (a310Logger)", "value": "5ecc27f56722fc21c5634f86c6b3918b51ec9dca2034b7705ca2c2aef07a4d33", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910227, "uuid": "f97b3d16-fb4e-4ff3-b8ee-ca31a981c18c", "comment": "Malware payload (a310Logger)", "value": "6ee1100aa80c02f5ed9ddf5c869a7d9418d2a77b", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910227, "uuid": "487cee3a-51a6-4693-ae0d-1349cfdf97f4", "comment": "Malware payload (a310Logger)", "value": "605b646e2ddaeedb3dcaf35609588939873fef8fe2f33ffcd19ce7ec2f1785cdc1ec37bedfb05d7c6ec6aad0ba4427da", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910227, "uuid": "15cce94f-bb87-4b6d-836d-d2bc97cbb880", "value": "T16D65BEC47517E70EC8D10672FD27C9BAB5B40DBAB410E9AAEADC7F07397C2519D0AA40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910227, "uuid": "b05ec8a8-02a8-4cb6-9b00-9c7a4dee7d10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910227, "uuid": "1633bb78-281b-4920-91d8-57efdf11c937", "value": "24576:u+aCzZ53MTEM2QqZV0MeebM4n7UD7K3rqB5x26neTVwCj0S++z:XaCV53iPb4HyDarMxe5w3S++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910227, "uuid": "524568fc-8512-4052-b22c-f5840a63e956", "value": 1529856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910227, "uuid": "17de4eb1-3733-45b8-8219-10b33bc507ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910227, "uuid": "f161351c-b688-44be-b71a-512677f8ff85", "value": "5ecc27f56722fc21c5634f86c6b3918b51ec9dca2034b7705ca2c2aef07a4d33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb737862-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911584, "uuid": "6d6206e8-f0ce-4388-ad40-4c721c3eef1b", "comment": "Malware payload (RemcosRAT)", "value": "a873558cdea0b87dc4acda7a137e9a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911584, "uuid": "bed0c7d0-c8a8-465d-a14c-ba2932c4cff9", "comment": "Malware payload (RemcosRAT)", "value": "5ee5f76509fa8ae756b44bbd0be34d035af01277c87f14d2c890495f6e98f1fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911584, "uuid": "36d51556-a1e5-47cb-839b-87a9d1ecfe2e", "comment": "Malware payload (RemcosRAT)", "value": "fb89b67f2f6013fd813060144f5ca0f5d6231159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911584, "uuid": "55d15cc0-b675-425b-9c97-24f31ad3f133", "comment": "Malware payload (RemcosRAT)", "value": "2e42ed0f147a33c362495a2f086e200dca057e84312a39ff0a801fe26f2727f351cb858aed29ee995e2d0c56bc56592a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911584, "uuid": "931a9aff-ed4f-411b-ae48-2fa4835e0fec", "value": "T190436D27D78B79C3D4E572F0189386C21FA2BC0F0F2B45566248B9DAB773208D693B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911584, "uuid": "03baf0b9-b3de-426e-9ce3-345cb313b3ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911584, "uuid": "8cff73ec-d857-4eef-8c3c-7e2db82dc868", "value": "768:6z57Ngy0RKoubFWHUfdywMbiF9AV+jH/yAVsDhF87bs3MYNZfXrYHBBis2p+cQei:HubMHUfdwbiQ+m0sr8XstNJXrMqbni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911584, "uuid": "eca2ac20-17ef-401d-b4fe-55e84bfb9015", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911584, "uuid": "aa27d88a-06a4-4f2e-bfb7-2c91d4439ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911584, "uuid": "e417bba4-8c9d-47c5-9fc5-0f1a63abaeb9", "value": "5ee5f76509fa8ae756b44bbd0be34d035af01277c87f14d2c890495f6e98f1fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b069287e-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912747, "uuid": "5130112e-f6ba-4681-9462-1519d5edb188", "comment": "Malware payload (Formbook)", "value": "abc61e883d8a0b50062b02756f5cd46e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912747, "uuid": "f31544eb-6c85-4898-971b-4982d0e57d2f", "comment": "Malware payload (Formbook)", "value": "5f2376321572d45c6249aef1cee957634010feceb4feb8a40ab1f8de1841904a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912747, "uuid": "dd7f2c9c-5790-42ae-aab6-16a68abc0569", "comment": "Malware payload (Formbook)", "value": "c56c58e0dbb9af60a1c4fb0cdaa89fc3121160a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912747, "uuid": "3b8cf180-a492-4a21-b322-77f41177c408", "comment": "Malware payload (Formbook)", "value": "9be6d74dfc99ea2e1509b6402ab640bbb22864fae8bcafee146d83a15b50a8a6b9dae9d55af205d7c69d609395b41d24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912747, "uuid": "c33526d4-f881-4bb5-8817-9fec21377c96", "value": "T1AD5423C65887721ADD512A3CB25350578F5172B909B163CFBBC09EFAAC92AD8DC2434B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912747, "uuid": "69e062dc-0bef-4429-9332-31673ec04c00", "value": "6144:ksJcYqwM2HKx0npo7tfjnYHrNLMoyVEQmRdeyDj:fJcYqfxYoRfjYHVJZQideyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912747, "uuid": "a5d04080-06cf-4711-9539-4f7203466d59", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912747, "uuid": "d5851bda-636f-4c91-811d-74b7fbf17377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912747, "uuid": "ab8858a4-ff09-45d6-80d1-486a8af888e2", "value": "5f2376321572d45c6249aef1cee957634010feceb4feb8a40ab1f8de1841904a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99265b63-6356-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780935901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935901, "uuid": "c7022a54-f478-4719-b6bb-d1141cd1585b", "comment": "Malware payload (PureHVNC)", "value": "2de0031388566aa23e568aa76b12c352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935901, "uuid": "adffb350-ec20-47ff-bd73-59b173f19764", "comment": "Malware payload (PureHVNC)", "value": "5f242a99c4e56f8a9897708027f30fef39319c621766a45c6443e83a8bedf058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935901, "uuid": "a0e41116-eb30-4a39-8570-59fa2b147ee0", "comment": "Malware payload (PureHVNC)", "value": "28510d8bf4f28444efb4a19c687bcd82fc0231fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935901, "uuid": "a3699e33-5325-48e3-bddd-9a5f458fb109", "comment": "Malware payload (PureHVNC)", "value": "8647b2776c5b68fda52756b8b6726901cf8a72061b400b17b4f717d8ffc5791d3f2bc89330c08dca11701bf3df8ad7e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935901, "uuid": "daeffdaa-c03f-45ad-acc0-cd2711d5a2f1", "value": "T1DCC4F1833BD44751D689A275C8D39E2203F2E6CB2B73E7563B05238A8D513F4CE85B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935901, "uuid": "661857e6-9854-4084-b3be-7f625485815d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935901, "uuid": "84f030f3-fd0b-4aeb-998f-6d4a16479d46", "value": "12288:v1dfVAxN2Ttv4kjKO+fJ3F3beLYYlQWvM+E3rvSLH4ap4qc/:9dfENutv1votF3bulXv+OHWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935901, "uuid": "bfc08f47-eab2-4e70-b08b-3067870b5985", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935901, "uuid": "03027a19-f06c-4b10-b8fe-e605d23e4a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935901, "uuid": "e4b3a761-5b62-4def-95fd-7bf71f3c0cf3", "value": "SecuriteInfo.com.Trojan.Siggen32.43908.12531.2986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb882c4-638d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780959668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780959668, "uuid": "25cf302a-08dd-47f1-b157-4d67847681a7", "comment": "Malware payload", "value": "bd3d5204f5c813fbaface6fc27cee2de", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780959668, "uuid": "ee37001e-1db2-47c9-9250-5d0430fa6a15", "comment": "Malware payload", "value": "5f34e1af5ffacee0810fa07121f09769d796e619e868aa20b317dbc9d72578b4", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780959668, "uuid": "abc6a25f-1462-4089-a565-059a731322c2", "comment": "Malware payload", "value": "122d136236e7e38b9606a3813ddec75cf6663182", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780959668, "uuid": "36332935-72b0-4ddb-875d-f15af8231d4b", "comment": "Malware payload", "value": "34efdb0ca0e0565a2c4fd5a1926e277f71406c8cb8786226a68a4ab4bf656d4a03f667ae69d5e2ed028d7f28ba02ba3d", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780959668, "uuid": "ec1f8492-451e-44c3-8f2b-d681ecd63c9f", "value": "T16BB308BA4AB64AF3FD491FBF1D311CD2E98BC0E1F37607A9EE2CC168462D1589071642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780959668, "uuid": "a6304a5e-e6d0-4712-8888-819b2bb49289", "value": "c2a87fabf96470db507b2e6b43bd92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780959668, "uuid": "606218b5-fe54-411a-bfe5-fa8f73660b2a", "value": "3072:HBUfkFqxjdzsz0r1GwonluCL0QSvSXcNrP9f5:hUaqxj6PlL0QSvSXctVf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780959668, "uuid": "a33e5143-a9f5-4fd3-b7a7-2d393cce3a19", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780959668, "uuid": "5e8da07f-b42d-4442-82ac-17aa60934632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780959668, "uuid": "a64c9880-df93-4ffc-b1c0-c919a36daf4e", "value": "5f34e1af5ffacee0810fa07121f09769d796e619e868aa20b317dbc9d72578b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd7a972-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912176, "uuid": "726d3fd3-a447-4009-af2c-61843e936daf", "comment": "Malware payload (AgentTesla)", "value": "9699b4f2e8e9a505a5b83cc5c6d5c7df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912176, "uuid": "b7d8a888-3871-4e6e-b2f1-1ac9a89fa00b", "comment": "Malware payload (AgentTesla)", "value": "5fd2c0e8b98fc702ad8dba845be46e246dd015ef3f8507671f8ed29be597b609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912176, "uuid": "a3ff788d-9d6a-47c2-825c-fd7e7544c66a", "comment": "Malware payload (AgentTesla)", "value": "a4144df5c37de0ef786ac8e9bb1dcd8af5deecb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912176, "uuid": "9a249d90-47e8-4df2-8ca7-42b44cfe9ea0", "comment": "Malware payload (AgentTesla)", "value": "697eac5f9e98eb18fd7d125bc671cdc279fe3bdb24a9b31fdbf0047c3f6b0978d8bae6bb826402cb793a14a74f0e1c06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912176, "uuid": "2da2df34-d37c-43ed-8846-a3db2d9c25d4", "value": "T1C95423237388E0E6E9650731887AC7774BEBD7E603954A8787792E437CE00D2D80F996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912176, "uuid": "68e13c25-7888-4593-a53f-e25913f0afd2", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912176, "uuid": "4848a374-66a4-4802-afaf-5aa5ff923ed0", "value": "6144:J9X0G7HGo89AqeAxccgjbEGjZXpO706Ti9wz4H5wSZ8kXV+RUHnaM32L:v0IHGoK5eiccibZCfv4HiAp+RUHaM3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912176, "uuid": "da6fc6b4-9b91-48d9-bff6-1cc439eaaf3e", "value": 305376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912176, "uuid": "a6a48c30-f1c1-4602-b97b-988a42464316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912176, "uuid": "ff16e0ff-b129-44e6-8e16-36dd83fd269d", "value": "5fd2c0e8b98fc702ad8dba845be46e246dd015ef3f8507671f8ed29be597b609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e65d639-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780913012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913012, "uuid": "e3df54c5-b8dd-45fc-b2bd-ce498c58f30e", "comment": "Malware payload (PhantomStealer)", "value": "06b9051735eeb9abe4b3bf62b74ab7c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913012, "uuid": "63d7b114-17a8-4e6e-b8e9-997833c24602", "comment": "Malware payload (PhantomStealer)", "value": "601a3b4652a3ee14717c169259230d0b3e4fd4bc2e128e26b7f3102d1b375822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913012, "uuid": "6e87e825-bd32-41fd-a382-ca8a6b19d157", "comment": "Malware payload (PhantomStealer)", "value": "cd7852761f141c92851dfccf5dded375f39adb78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913012, "uuid": "fe4643f9-c362-4d04-ae89-ce912ed2de44", "comment": "Malware payload (PhantomStealer)", "value": "0abf89c32e4cc0a3403503b420d2cc6076c11cb68413a0aab835700c758287105598e3df48485d0dc3379403dfe009f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913012, "uuid": "78fe1a75-821f-42ea-a3ef-c04544375f10", "value": "T1946512446619DA06C5E69FF44832E1F427F45EE4F812D3039EEA3EDFB53A3651826283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913012, "uuid": "3658b149-7485-4154-870b-fa664a9f603b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913012, "uuid": "5b2cb556-abe7-4746-8036-091c2c77b00a", "value": "24576:6hwZtG2/Ohzl46lUdeUDkpkbCUE4+9O5gfyain1dXZiM/8g1o5PVwCLcvgNk1kCZ:Gw2aOb46Odeuk8+ffyNJn/4VwP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913012, "uuid": "c7ea8f69-e616-4138-908a-234d470bff7e", "value": 1531904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913012, "uuid": "a40b7219-2fa8-4435-ad41-e5a4e934b325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913012, "uuid": "f76ce1f0-1d4e-4787-b21d-1e632c149665", "value": "601a3b4652a3ee14717c169259230d0b3e4fd4bc2e128e26b7f3102d1b375822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0fadf5-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780907806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907806, "uuid": "61eaf9f4-83ce-410a-9247-d6f2c8c5edd8", "comment": "Malware payload (DarkCloud)", "value": "35528e67a838476b37f79e9507fe8710", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907806, "uuid": "d110187e-d287-40be-a345-d11724fa1321", "comment": "Malware payload (DarkCloud)", "value": "60e5f367fe8de6fff97832c64de3a78d5e55fb0ef03378ed5a318e1c3747945a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907806, "uuid": "3d5a2236-a26c-47d2-bf29-73063f678399", "comment": "Malware payload (DarkCloud)", "value": "b132fb9e334eb371f8c4fdc603c4b8be5f5cff6e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907806, "uuid": "135e9897-dbe5-49e1-b862-9fbea0413893", "comment": "Malware payload (DarkCloud)", "value": "bec466e991eb36a5bb45db55553fdabcbe43dc974eb11291b92d70defe47476c0cb8087535f3a7cb8bf3862869248132", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907806, "uuid": "cd87b69c-8170-4067-8dc7-d1295cd8d0fa", "value": "T11C451254620ACF06C49F5AB058B0D3F9226B8D84AD11D3C78FFABEBBF57A5413944293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907806, "uuid": "39131afc-90f7-4ec8-86d5-acbda127dfdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907806, "uuid": "7243bc57-e3c6-4da6-8f58-b616126b1920", "value": "24576:P4TS1lwFoGDzLK0wvcCOepsidsJvKjywSyCPm6P4XJngpVjMES6O:P44lwFZLJwv3OuJdGvI9OoXJgpVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907806, "uuid": "36afd49b-97dc-433f-a999-7e74aff5ff57", "value": 1268736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907806, "uuid": "b7368b2c-d085-44bd-ab2f-3f237a9e988b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907806, "uuid": "437e0ae1-0559-4d2c-8838-92e80b1acb5a", "value": "60e5f367fe8de6fff97832c64de3a78d5e55fb0ef03378ed5a318e1c3747945a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d511882-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780907346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907346, "uuid": "fcdc5d3c-e254-4795-acd7-bd2631c3ad73", "comment": "Malware payload (AsyncRAT)", "value": "519c9bd3fb94fd69b223afefbc70ab48", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907346, "uuid": "fee5783a-3f59-493a-8312-ffe0b13c9e1e", "comment": "Malware payload (AsyncRAT)", "value": "60e6c277f91ecda36bf0892ad26c6f6ec4aa40f41c99c0b0eea8ab7b16770b1e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907346, "uuid": "13a46c84-42c6-4570-9f28-592bf905d2e9", "comment": "Malware payload (AsyncRAT)", "value": "3019715649cbeb34a6a7e0dfb239ae8dcba9bfee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907346, "uuid": "e134e55d-3099-4da4-acad-a0d178127727", "comment": "Malware payload (AsyncRAT)", "value": "51c9211d20bbbf4a67f71844e46500f243b0bb9b21a0f2f8a3a2ed3f3a9649dab3478576b06ef5bac4292ef2e0859565", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907346, "uuid": "4760f100-c5f6-4e2b-9236-edc362736c6e", "value": "T1BDF4F104631ADE1AE4A69FF14D21E1F10BF48F98A915D2079FEA3FEFB5363214855283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907346, "uuid": "58fd5e91-d80f-4ef1-97ec-7c471c98854c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907346, "uuid": "0bb3ea10-9cc8-45d7-b3e1-b9c9ebdc826e", "value": "12288:Ohz0ZtemCSHhwLZj48I29tJFcvA+Ku5GTqLHK20WMADMIsUqYl4Z5I/V:OhwZtqSHhSzf+Ku55pYYl4DI/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907346, "uuid": "9bd341ab-9265-467f-acde-47fee49acffc", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907346, "uuid": "133eb604-497e-4fb5-8aa4-a0de05006f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907346, "uuid": "21e34a0a-9b25-457e-9a7f-54c4fecee5fb", "value": "60e6c277f91ecda36bf0892ad26c6f6ec4aa40f41c99c0b0eea8ab7b16770b1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e32dc9-6322-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780913342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913342, "uuid": "6df22b90-2202-451d-b437-df2974814173", "comment": "Malware payload (ConnectWise)", "value": "ddb60a95e4087daea80b0640772e0563", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913342, "uuid": "4c196647-f83f-4adb-980b-d464b1e1cff4", "comment": "Malware payload (ConnectWise)", "value": "60f104030a7e6fc47d5ce7c286c5172e9f835a09b5a560350ac71d0c25f8c187", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913342, "uuid": "2cbd9515-f45b-4a5d-921b-995b5bd58d83", "comment": "Malware payload (ConnectWise)", "value": "9bdab1b64c3831f991611f25a4b0fd36e2e3b0dc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913342, "uuid": "b430eb38-c9a1-45a1-a395-1d177882637e", "comment": "Malware payload (ConnectWise)", "value": "9fd9ee8ca1101cafec9a90bbc76c27515c3ad986644c95885356ed5868b2801f2f3797e02056dd36363a724c71967cec", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913342, "uuid": "871f7e3f-0beb-4e65-9ce7-7f95d42303fa", "value": "T1C6971230B64ACD36CD9605B08D3DEB6E602DBA750B2590CBB3D82D2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913342, "uuid": "43102939-b351-409b-b0a3-699912c556a9", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913342, "uuid": "7ae69172-d698-4c5e-b92b-0bfa881b93b0", "value": "786432:0DuwWcvMBee8Lnj1jON8lZamshpwxyUJNfUh4+YEKqIklrdtJqraWrGbcj9:0DuwteEhjO2ZpshpCNc4xkHt4vrGm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913342, "uuid": "28767c24-b9d4-4da7-bfa7-9a3b573f5eb4", "value": 42323688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913342, "uuid": "747ef05f-c377-4076-b5d4-7a4bf8605675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913342, "uuid": "7128f8e0-083a-4875-b2bc-a4571fe8a0c8", "value": "docusignsetup.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a73848-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780908145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908145, "uuid": "94dc47d5-d3b3-4f08-a828-93c83f043932", "comment": "Malware payload (SnakeKeylogger)", "value": "991077570e0fab54507614ccd8ec039a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908145, "uuid": "891166c7-3b26-4606-a83e-755e9703b863", "comment": "Malware payload (SnakeKeylogger)", "value": "6126e0a9c96495c3e4694cd82545a5aca1f4d7bfe9fed14251638a2a66740199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908145, "uuid": "a3e4bc22-4950-41c8-824a-ebc758a85907", "comment": "Malware payload (SnakeKeylogger)", "value": "2fa961edb059b3e3a3f9d53f6f7d023c2ac2352a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908145, "uuid": "080d0506-753b-49e1-96f4-2e2713a52b5f", "comment": "Malware payload (SnakeKeylogger)", "value": "b4a389fa1df12ef1238fa607a2d8b64c9f8deb1a03a3e4a2e464e1fecbdec17cfa2c6b5592591f93ed1b32c88efa1cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908145, "uuid": "1629e6a0-e4c2-42b9-a40d-a33f0a316111", "value": "T1A34502542207CD05E5928BB9DC70E7F41B301E84F974E333AEE97EEB783669658106E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908145, "uuid": "85c80bc2-41f4-41d1-879e-eef5c27e221a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908145, "uuid": "898ef30f-20a0-4dd4-b8c7-0e4f8fd7b38c", "value": "24576:EslRqe9kHfZHH1LdfSwPiBV4srReDEj2gzIx70ZSSS/:zpkfZHH1Ldnm4st8I27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908145, "uuid": "755890bd-a486-439c-abdb-6784c3e376d3", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908145, "uuid": "40eb2454-f665-43fb-af64-583205d2d18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908145, "uuid": "b8c909c1-a2f1-4d5f-bd14-0b2c04aa598b", "value": "6126e0a9c96495c3e4694cd82545a5aca1f4d7bfe9fed14251638a2a66740199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be382a0-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904928, "uuid": "e1667398-f097-4c99-b902-b8c50d0a2bd9", "comment": "Malware payload (Mirai)", "value": "f63ac0eb3923bd0c5b0b619024070277", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904928, "uuid": "0dccee59-d9f4-446c-946c-729667c4642a", "comment": "Malware payload (Mirai)", "value": "615ee48b82d37604b146ff9417785fee1a218d0620b857dcfc3a2e32d09a5ac1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904928, "uuid": "c67aba8d-fb4e-46db-842a-a30827b87414", "comment": "Malware payload (Mirai)", "value": "1ad4c4faa4d6b8418a55579fa6a0fa12ece13da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904928, "uuid": "fc38e281-849d-42f1-b807-e9aacd52cda6", "comment": "Malware payload (Mirai)", "value": "9d4e9702fba300463aa35709000283caace2d6b535d7af2ff6cc5859a7b98283d1442dbb895f79c3bcbcb10a8787c9ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904928, "uuid": "665d3a52-0997-4f6e-b466-7e44517b7423", "value": "T1A7F32A45BD418F13C5D721F7FB9E428C371A6B7DD6EB3102E9257FA0278A8D60A3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904928, "uuid": "76abb1b2-a093-42c9-b1e6-4c9551b51454", "value": "3072:cOj1h5xllCTvuXUb4Z4z4sUqoK5l/h8cIfBr0D:xj1hCuo4Z4zBUqoIZ8cIJr0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904928, "uuid": "9c2080d3-19db-4f0e-a1fb-d57fbc74aaca", "value": 158816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904928, "uuid": "0984f6d8-8262-4f79-b304-5b7c450fc98b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904928, "uuid": "57cd8e73-37b0-43fb-8957-a5867657128f", "value": "nova.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076a0867-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911604, "uuid": "552cc4a8-955c-4108-9843-1f1f89ae4ca6", "comment": "Malware payload (a310Logger)", "value": "ced292c4cd7276b1708c051ef42cbd91", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911604, "uuid": "9361641a-177d-4c43-a06f-332babc8236f", "comment": "Malware payload (a310Logger)", "value": "61d2f5327573cc93e405467c245c6b74fe7ddd33a4a8d4e2b80cd533b061f63f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911604, "uuid": "8ce13d82-81d6-418c-bab2-dfe33e564db7", "comment": "Malware payload (a310Logger)", "value": "3278f14147e062ec1dbcfcfbcc66fe04105067f4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911604, "uuid": "e3503ebd-8ab7-4ae7-a7e3-445768c24217", "comment": "Malware payload (a310Logger)", "value": "b231d29a3f4c9e034afaa7783e2ff8b575d3c5fcd0b61b96fb620630825d24d0c622ffc629d1f0ee4a1905db7a1c66d6", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911604, "uuid": "8c18aecc-89e8-4aa6-ba32-b5570e765af7", "value": "T115A43A03AA50A12EF1A3C9F1A8B5A29668267D3917DCE89BF3404F5935315D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911604, "uuid": "a779faed-d5c7-4c6b-8859-0f0f75bd7a1c", "value": "63188fba16188090cd2f35054eb46278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911604, "uuid": "d1c1d810-0f33-470b-87ed-5f90b390cf71", "value": "6144:+28d1/w5KA81IJ8GpF6nuTmOOUiBUrj7Ey0FTl5CT7qh7Ee6OvHyw+qifdrCWJxR:+ljYKkJj6GmZUiqrH/eC7rcHyw+9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911604, "uuid": "13e4bfaa-508f-49f6-b1fc-29d3bb45267d", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911604, "uuid": "436a40f6-ea51-40b1-8d0f-24707b44b0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911604, "uuid": "22ea8680-5eb6-4550-a505-f5e1fd40eec8", "value": "61d2f5327573cc93e405467c245c6b74fe7ddd33a4a8d4e2b80cd533b061f63f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e697c8-633d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780925046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925046, "uuid": "2a61071f-bc30-4354-a52a-85c389fc35be", "comment": "Malware payload", "value": "fc6b89269288c864cc6ce54079c4e712", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925046, "uuid": "eddbeb65-0abc-40f3-bf4c-89f01f8db3bb", "comment": "Malware payload", "value": "620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925046, "uuid": "18aa047b-ab69-422c-8ba2-b2c7f51e1e49", "comment": "Malware payload", "value": "c6b64454f58af9c5ab324a9561c42f63bfcedd52", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780925046, "uuid": "626b7127-9ec0-44d3-82ae-dc4e4ddaea5a", "comment": "Malware payload", "value": "550b3e697bf09fc1ee55eb2b72992886f31276eb5bdc90b0e6a50010fb7fda7907550ccb0d0d9f5eca35d7b8d2d76b76", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925046, "uuid": "592ac13b-d583-4129-9d1d-e991e6d355f2", "value": "T110F301248C65ACDDC2A5D3F14B6E7D8D7A1EB2A272C485913C2DC3A20365EE86067DD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925046, "uuid": "6dbb25ce-a4e7-45fb-ad34-1a131035d707", "value": "3072:lzz3tF7WNb1J8FHs/394B/tzmmkdB0OPJskI1qsZM2pPcQU9djQaOY:1z3vHM1YFKmkfxskmvS2cQU91J/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780925046, "uuid": "565ead5b-4055-46d5-a10c-7d8adfc7f639", "value": 166631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780925046, "uuid": "2b2b0092-f7a3-4f9a-b28c-25376d7bcba1", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780925046, "uuid": "fd2471ed-c786-466b-bd9c-8bbb3e0c9ce6", "value": "620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74736f21-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911787, "uuid": "1c16775c-a30b-45f6-a5c8-0db29f9fc1c1", "comment": "Malware payload (a310Logger)", "value": "27641738e94ccfac6957a42ced48ec60", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911787, "uuid": "a8064105-c9bc-4c0d-988e-c22d14bbfd70", "comment": "Malware payload (a310Logger)", "value": "625e379fac73e1c7e778ffddb2c9011ab5db951a0d51af0171dacae17b8ef635", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911787, "uuid": "ecb735d7-9184-4c63-a0bf-f89b83d97f22", "comment": "Malware payload (a310Logger)", "value": "ff5cf8f746bb325e7dff43a3b40386dd27b799dc", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911787, "uuid": "7ad0bf5d-dc66-427f-ba98-3e678a4f9d0e", "comment": "Malware payload (a310Logger)", "value": "e283eaa492c30dd93df50d05c0efb7af11515422365e3731cb68761df9a7de844f57e886a12e5f399c2c40fb22c9af27", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911787, "uuid": "6861e490-0617-4bfd-8f39-b353aa0af146", "value": "T18EA44A03AA50A12EF1A3C9F1A8B5A29628267D3917DCE89BF3404F5935715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911787, "uuid": "2d174e9e-e2c4-4aa6-a016-5cdee94c8233", "value": "63188fba16188090cd2f35054eb46278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911787, "uuid": "3d37425e-dd57-4310-ba07-f3f6e0d2e6d7", "value": "6144:Kehc8d1/w5KA81IJ8GpF6nuTmOOUiBUrjU8ykEhgg3m7qh9VwntvHyZsNp0PuCW+:KehvjYKkJj6GmZUiqrQ3j3zchHyZs74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911787, "uuid": "4bcbbe2d-d782-431b-ac13-e4d0f7a75844", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911787, "uuid": "8810726b-f7cc-42d9-8d57-0249a60f4db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911787, "uuid": "88fd8bd6-3b8e-4b4f-aae8-8d9df0c76c09", "value": "625e379fac73e1c7e778ffddb2c9011ab5db951a0d51af0171dacae17b8ef635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9440821-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908494, "uuid": "7034c1ae-5017-4949-b802-f5c558e6f206", "comment": "Malware payload (Formbook)", "value": "a40ae4f5f2d0fa94871e169eadff6a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908494, "uuid": "16009cd3-b9d5-48e5-8268-83f9b2d069cd", "comment": "Malware payload (Formbook)", "value": "6262f535935bbff801642c7b4a3f074c59907ec83752d41bf75d6d15f132037e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908494, "uuid": "b66bf1f3-ede8-4e3a-8602-d055ea7b3109", "comment": "Malware payload (Formbook)", "value": "d66cf8e28a068e8267a367583bbaef2f17fa8b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908494, "uuid": "abf290ba-e03f-413d-af6b-40da49dd676e", "comment": "Malware payload (Formbook)", "value": "00d8efec3abe09376be7b8c80175b8dced47b996f34e2f729b7d160d34d53cdadeaa1711f40f7b09e8243dda1861c11e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908494, "uuid": "a3bcdf66-94f4-493a-8c53-9da53d693d61", "value": "T118350240220ADD17D4E64FF41971E2B417748E99E822D313DFEABDEFB87A3642841396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908494, "uuid": "4354fff2-15fc-464f-b681-37718464a27a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908494, "uuid": "12d32d22-e7b0-4571-a039-eabc4a8deebc", "value": "24576:FAEFT0DztLx+tlJNG5K65vTV0ZitVzA6E:F3FQdLCE59bVzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908494, "uuid": "b48ec689-c0ac-4111-8b63-85f457bedd46", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908494, "uuid": "2d215600-b163-4182-8a2e-13401800dbb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908494, "uuid": "db8f4533-56ec-4ce1-821c-b2078f4de5ae", "value": "6262f535935bbff801642c7b4a3f074c59907ec83752d41bf75d6d15f132037e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2955f3-6324-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780914243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780914243, "uuid": "87ad6ea1-83ad-48d2-8e0b-7512fb3c338b", "comment": "Malware payload", "value": "7abeaf1d829f6802fbc1773156fa04a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780914243, "uuid": "56f85d79-7768-466b-8a32-1a1997bca350", "comment": "Malware payload", "value": "6284773d0baf62fc7d404816cb95654962872de655de32288516022400ef6dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780914243, "uuid": "b17b28b2-1c0b-4789-8380-ddccd267fa15", "comment": "Malware payload", "value": "7d95c8e8dc5d734bf3e4552bb97081d139c274e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780914243, "uuid": "c89f7368-b136-4df4-9634-730bf10aa87f", "comment": "Malware payload", "value": "e4f57fac995a9e3fa28af1756dcdc2887d173b58e1574f18150c5812bed26811ab91af5354e45bab5b6c55a10542c033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780914243, "uuid": "54d09e8e-cf0c-4c1b-98ea-d0391286e869", "value": "T15FF4BF2B72568E12D2885237C0C75904A3F4E6867633DB0E768523E61E473FBDE4A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780914243, "uuid": "292dc9ff-c279-4f02-8c2d-e7caf7882567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780914243, "uuid": "99a5401f-57d9-4705-b956-dd512c411361", "value": "12288:Y91rOH1XeiI3qkd0pVlGD9kA/fKUv49zHHAJRPBVjDuuKo9fh01nIPDyXZ6nxnu/:MMkddkQfKUv49nSZlSuKSh0nIesnuUjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780914243, "uuid": "1765fac9-42f6-4a54-910d-e6e09ac55c05", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780914243, "uuid": "3ed26406-10bf-4577-a699-7a1d7b3fede7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780914243, "uuid": "7400f9dc-40fc-4f87-9e14-8a385500f1fd", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.24836278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817d900e-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780913098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913098, "uuid": "06a41657-d914-429c-bfa6-800c136792e7", "comment": "Malware payload (Formbook)", "value": "ea005c034bf9821cd8188ecd536058be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913098, "uuid": "34422d9c-cc40-4f37-a70c-1f99973b732a", "comment": "Malware payload (Formbook)", "value": "628a9edf53eccd17a23ab89aaebdf7d859e60b20442757f3b3782fc33f6d1bec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913098, "uuid": "055f715b-191e-447b-a030-9bf6222fc69e", "comment": "Malware payload (Formbook)", "value": "8c75032a3971165edc8bafc79be12b71f0e032c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913098, "uuid": "7542dbfc-e1f4-4895-a7c0-fa5f94f5aac9", "comment": "Malware payload (Formbook)", "value": "ad37e8e3ce7a13c44fbee51d756510a0a61b9f04bad41609ac83d0dc1653ae696313473fb0d19f76b424e153cab5558d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913098, "uuid": "140becc8-8bb0-4297-8c9e-ec747f740514", "value": "T160251204621DD907C0974F740C72D2B827B4AE99EE62D203EFD57FEFB47A7A5144A282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913098, "uuid": "6db6cb93-5e45-4b7b-ab38-34f9370eea58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913098, "uuid": "fce4a493-595f-4f4c-83d8-8047a77345ae", "value": "24576:LQXhwZtZWyzFGT4cJBHQbHRZT27GDMBJ52wRZh2W+ER:LiwpWvHQVZToGDMB2wRZh2WH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913098, "uuid": "ea09f9ee-a4f5-4fe7-b993-18320756686e", "value": 1032704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913098, "uuid": "d99b9ff7-b2cd-4d86-8f6b-7044b9ee1a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913098, "uuid": "ca580b95-687d-4cbf-a3ac-213cc8588236", "value": "628a9edf53eccd17a23ab89aaebdf7d859e60b20442757f3b3782fc33f6d1bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5e981a-6328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780916124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916124, "uuid": "3052a28c-a8ca-4d54-b83c-cac4dd80ea87", "comment": "Malware payload (Mirai)", "value": "5d5776a81cf618aad9a6cc0c80e67983", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916124, "uuid": "ecfe3c5f-0807-49d6-8049-b0b601667901", "comment": "Malware payload (Mirai)", "value": "62bd44c8a4551914d2cebbaf3a74c84213bc9fa51347c429c2daaea1ae7ed0d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916124, "uuid": "34d1d559-4584-4193-8583-968065c57ee0", "comment": "Malware payload (Mirai)", "value": "c8cb8480bc4976535d54de8a10a1cab5cfb466c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916124, "uuid": "f0535881-ccbc-42ca-8e5c-90c1bb5e1e36", "comment": "Malware payload (Mirai)", "value": "6012654bc8e8109a39f9b3a62b111ff8f882bc0d7205e1bb7128b2932bbddc0b0aca67fbd277ee4669c3b9ca0537f22a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916124, "uuid": "ae59af37-9c20-4a40-beb0-ec683fc3079e", "value": "T154336B77E45A5E94C086417075249F351F23B2C893932EBB16EAC2755483EACF509FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916124, "uuid": "baa606a5-e248-4dcb-a9ad-1f798732492a", "value": "1536:8aWjW/cXGETFWaZqKAlSW4UBOCVQV5nj:8pjWuGEZZtAuUBOV5nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780916124, "uuid": "21a3c068-3c92-4439-a22e-783327d49d2c", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780916124, "uuid": "db04f458-a79f-4e40-96e0-63d5d1e61453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916124, "uuid": "f7910997-f08a-4bda-94b1-a4c293852774", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef2d30b-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904933, "uuid": "3cf70ef5-0ebd-4a7f-b15a-5db0ddd8119b", "comment": "Malware payload (Mirai)", "value": "ca09acf481eac36d9cea3afa1641c86a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904933, "uuid": "d09f484e-50f0-471c-a691-8f5052934877", "comment": "Malware payload (Mirai)", "value": "63b62f14433a609121e097623c5cd4de720e3ff2169296222f9fcf6f17b4900d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904933, "uuid": "f82ac549-a3e7-4a72-84f9-3cda4604becb", "comment": "Malware payload (Mirai)", "value": "26a8c540c7d1dd09ba109e395477a6ca0f72941b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904933, "uuid": "327d4eb4-c4c2-4bc5-91a9-884e551e14a0", "comment": "Malware payload (Mirai)", "value": "c0da51e603a5dea474e9ea4ab4b831b007689e0fed14f11bf55b354c8fdf2cb65b8306944de72d9c05664e3fecf9a84c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904933, "uuid": "cf383a95-09bf-4a16-b65d-f60a73805298", "value": "T15C356D5AF2F370FCC167C030439BDB62A839F46511226E7B25C4DA352D66EB01B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904933, "uuid": "2c693170-2ec3-40c8-9339-045ffb4cced6", "value": "12288:FDf0/Q5nHf5SpsYSA2sUNxXtxKRa+pwySZozmylZTIgA875k:FD4QZ/5SpKkUNxXtxKpxjZBg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904933, "uuid": "770245ec-4fc0-44d1-82e6-46e995ffe92e", "value": 1102944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904933, "uuid": "ddba9166-6d29-4e5a-b632-221a3a50548e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904933, "uuid": "a13ab77d-1232-47be-a85c-5c558624b2bf", "value": "nova.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1625fd-62f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780892097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892097, "uuid": "51c6b734-13fa-46c8-8294-52e80f3b511f", "comment": "Malware payload", "value": "1a789fa1daa8e27b59174b0e9d0cac07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892097, "uuid": "0eb1600c-6a42-4d9d-94cd-cd340502c5a5", "comment": "Malware payload", "value": "63d14926fd77a3c44626728d60d1679d7f9f92f680c88f86ccc0e13870195210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892097, "uuid": "62125f31-1038-4c87-834a-e9a220b95e90", "comment": "Malware payload", "value": "6dbe9d92e170108cf35b64e6dd9edf46d1d8112a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892097, "uuid": "90914e5e-f43a-4b06-a445-d4e292e09e42", "comment": "Malware payload", "value": "e3ded1128a12c7ed205911b76c5292b8d79ed8dbe7053e3c2f8d253395abd5400dd70dafb30153daaec3c9f2f6d6aa28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780892097, "uuid": "e793ebab-90d0-492c-a43f-bc45491d64a5", "value": "T133A55B17FCA504E5C0AEA232896295927B75BC880F3163D72F90B6782F73BD09DB9744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780892097, "uuid": "6e9bb9c0-f584-483e-9f74-0032f86a49e9", "value": "24576:+79Pi0M7+IbvQ8rE0eVupHXYaIXZzwWjenR+5/FONLvZ4UiS/hmddMZeg/n3rJOU:+79aL7+IzQQeQdySnU5/FOnmSZWd6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780892097, "uuid": "c722faff-e588-427d-b157-10c689fcba64", "value": 2113698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780892097, "uuid": "127b5b21-9d2b-4344-b38c-90254101b287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780892097, "uuid": "bae237ea-f5ec-4e8b-acbe-d2437221917f", "value": "cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "effe98be-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912854, "uuid": "8313346b-bf8c-4acd-a60b-3e4df7076e3d", "comment": "Malware payload (Formbook)", "value": "6f4229ecd61b7ec353278261c97d6e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912854, "uuid": "d979e050-e7d1-4a8b-a93f-a750a01a4550", "comment": "Malware payload (Formbook)", "value": "63dc260a747b9043efb746b691bfc5a9237d1b152321a901bfe156b33e723c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912854, "uuid": "67765589-d9e0-4aff-b8be-cee4fcd4e960", "comment": "Malware payload (Formbook)", "value": "44b8fc3589f34092eea17ba77336e392b985e6bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912854, "uuid": "48ae842a-25a1-41fe-8e09-72d31e30c95b", "comment": "Malware payload (Formbook)", "value": "3cbd3da4d397f3b611ee0747880d2b48f2deb433fc93587da28806cfeef8d117124835007e5a477a282a5b90619a16de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912854, "uuid": "91b850b5-6649-48df-b12b-c9e919680989", "value": "T1841512789E99C403C88713B406B1F27522798ECDF905D6538FECBEAB346B7891D89391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912854, "uuid": "1e329095-d8b7-4f8a-a623-7f7a4bc1a5fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912854, "uuid": "b1f9a442-6ca0-4775-86e1-c1ea7cb6fcb9", "value": "24576:pXh4eRCo1ZSiyRmoZ2G4LCCDMZ41lajH59Hlz1/l13:DHLyR52LLCCAZ4za753pt13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912854, "uuid": "6039c08a-5d93-4d7e-a3b9-a3a5bc56cb5c", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912854, "uuid": "036705a8-3b0c-4c74-8b8d-b1a82fa1eefa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912854, "uuid": "be1ea0ed-e24b-49e5-99c1-9dec4fce6088", "value": "63dc260a747b9043efb746b691bfc5a9237d1b152321a901bfe156b33e723c9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c3feb4-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907334, "uuid": "8b56c8b1-011b-41a3-ad4e-9c497bbad641", "comment": "Malware payload (RemcosRAT)", "value": "1a723db4db67ca9fee99bcaafe7290ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907334, "uuid": "36d3d0b7-a32d-4bfe-83db-a985a6d258b2", "comment": "Malware payload (RemcosRAT)", "value": "644622eae00f07eb21343e138fa870edf8ca5f961f69bb8c49dfcf651764f30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907334, "uuid": "dfa58693-eb22-478d-a7e3-1056e73912b0", "comment": "Malware payload (RemcosRAT)", "value": "eefde6e65d20114a138d9436527346b2fd228172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907334, "uuid": "716ef509-81ba-435c-89b8-fe20afaa777e", "comment": "Malware payload (RemcosRAT)", "value": "1704fe9edee02c9d7d189d58696ca1ccfb9bb9cc9747b6e24208c26ee4f70470bf9b22dd50120e6695cdf93c71f72a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907334, "uuid": "b2503e6a-92f5-4633-9360-a2ac78f642de", "value": "T184052382B7B0C407D581AEB24CB2F2194BD3DD21E594835BF790F949F83899E8A4D673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907334, "uuid": "d9beaf78-9efd-4de1-ad8c-c6635847d7e3", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907334, "uuid": "232b6ce2-afd6-4e01-a4b5-79dc99e0feee", "value": "12288:hdPIffzISjkVCyk1ID6fKthaMlMYYApwF67pA6qTJXjJoHe5qM8fNVqgBn:jQnzI01NQhaM6gpmaITJXe+56LqgBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907334, "uuid": "510ca9a9-5d77-4c3a-a5c6-26bebe817fff", "value": 840368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907334, "uuid": "87a8845f-fcc0-4a7b-bca1-cb4926409bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907334, "uuid": "19990d65-0088-42d2-a97b-37dcf1383250", "value": "644622eae00f07eb21343e138fa870edf8ca5f961f69bb8c49dfcf651764f30f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b17fd77-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907530, "uuid": "fc72a95e-6012-4183-a015-f8a184c9db69", "comment": "Malware payload (AgentTesla)", "value": "78c8798af4744a28d8e47372fde0f2dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907530, "uuid": "5df2d71a-1d40-49fd-a55a-241af3fec0bc", "comment": "Malware payload (AgentTesla)", "value": "64a4841d45667fa254a4498cc60c7ebcb14e5078b7e33538735f7d93171de5a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907530, "uuid": "deb27eb5-f183-473e-a3fe-5017209db9e0", "comment": "Malware payload (AgentTesla)", "value": "2a2d55231c225e165e09ada02b42fd4e8e7625e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907530, "uuid": "dfd58bd4-f09c-4856-a69f-18d740e0e13a", "comment": "Malware payload (AgentTesla)", "value": "df16eb8fea7678b8715fd5571d7592a540ced9834eb6e047fad47ca4ac99be352238d495c0f3796210d861a3db2a84a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907530, "uuid": "f040eb23-2233-4a8a-861d-1376fcde9ef9", "value": "T1B8A42211B3A0E049C8635F315DA24BBB16ABEF60259E55071334BE5FFC61AC2CE2D5B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907530, "uuid": "144d263b-8c8a-424b-be07-4cb41f734589", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907530, "uuid": "d0a6551e-c24e-4c33-8720-bcef7d0e5dac", "value": "12288:gwG9WFug7Q59XWVgNfz235w3F1PL3RHjnPj:gwGPl9ig9z235I3zBD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907530, "uuid": "b6648ace-107a-4b2c-841d-8fd7d9a3eea6", "value": 489576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907530, "uuid": "1a5b3939-e94b-49c5-adfa-6e72c736ba7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907530, "uuid": "8cabb304-b99c-402f-ae6c-a5bc98068c75", "value": "64a4841d45667fa254a4498cc60c7ebcb14e5078b7e33538735f7d93171de5a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c221f6-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941452, "uuid": "4dce77f4-55ca-46e7-ae66-c433199ea939", "comment": "Malware payload (Snojan)", "value": "3f618306784c2256eb3d93293a8edffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941452, "uuid": "ffee1d71-ab72-4bf1-9365-0127e46d180d", "comment": "Malware payload (Snojan)", "value": "6500c796c9925a821c0ad2b6715f876e9ed15153543970e57d0d6455acaec719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941452, "uuid": "111927ba-8858-4d5a-9853-7f54e0dc3a28", "comment": "Malware payload (Snojan)", "value": "86d6531358ebbbcfd98d6e4740582d88d82d74bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941452, "uuid": "0c11a86a-aff1-4159-a049-7b692e787c82", "comment": "Malware payload (Snojan)", "value": "2fb581e70761d69c96547b5b729a61c88d2736b00b21ff28b6bd5f8c3770240e3129c55d2c007f0adfff2d739edbbbe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941452, "uuid": "59034823-c742-4f75-8936-1a108f15be42", "value": "T19EB4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAEC67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941452, "uuid": "a4c71535-37e6-4338-a8ea-f29bb6895d13", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941452, "uuid": "e45a6abc-1d68-4ff4-bf9a-e935db3793d5", "value": "12288:/bE+urh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+Ik70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941452, "uuid": "e0ada365-7983-45ff-ad7f-8eb93956036a", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941452, "uuid": "f5e1abcb-859e-4993-8a14-a616b434d892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941452, "uuid": "9e65b337-9389-48c0-a7be-c8afafa9c7ed", "value": "U0eSWbTIdMnLQ43u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f07c09f-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780912100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912100, "uuid": "dcf42b54-788a-4d97-8dc4-d57a301e1776", "comment": "Malware payload (RemcosRAT)", "value": "9e76f6d0c44a87595d9a04d286c09d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912100, "uuid": "cac27648-85be-47eb-98b2-abe2ea6735e3", "comment": "Malware payload (RemcosRAT)", "value": "6525f806b4c8405e1e3d0f275e06b12b2710ea562966fe3b8092913d4d3340eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912100, "uuid": "b5e6fdb7-8e47-4cfb-b2de-5eafbaf1ab58", "comment": "Malware payload (RemcosRAT)", "value": "91d002cf9c96551320c22f0e4eb5858e811613d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912100, "uuid": "74abcd9a-b0bd-4115-9d4c-46ce3e8feaee", "comment": "Malware payload (RemcosRAT)", "value": "7cc138cd5447e5afab94316330348995b3a33df3cc05154a5c1789bb6e7529e4e5d6b31cba7764a4954fbdb751f8a87f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912100, "uuid": "6a78c57d-7186-45fd-a27c-8d0711ad6805", "value": "T1305523003684E477D9E3813E6AEEE45E86EB1C28BD756D0F26443B4C3872E6D169E347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912100, "uuid": "0cf5381f-6970-4379-932b-ead0d2f3bf82", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912100, "uuid": "ba6432db-f7a4-4a5e-8a68-12583f693af5", "value": "24576:fYXDDHMwiSjxyGYUOQXEcU63rWNkTyV17SdSGWr/E9bWxokTqvAzHWLFNW2Yz:gX0i3OQxU63rWKTO17Sc/Nxcv8m1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912100, "uuid": "3f0ee170-e9bb-4f37-8f8b-7aa3a6483295", "value": 1372368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912100, "uuid": "5ec5c009-61aa-4235-b6dd-38903fe7fc05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912100, "uuid": "19e5ebf3-1eb0-4838-9a7e-bb62286307fe", "value": "6525f806b4c8405e1e3d0f275e06b12b2710ea562966fe3b8092913d4d3340eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21ec6be-630e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780904992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904992, "uuid": "12192a53-a8d6-45ec-b9bd-3030f1e75b6d", "comment": "Malware payload", "value": "de3a84b31b98680c2c20e226c4bdf26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904992, "uuid": "dfa0dafd-53f4-4286-ad86-fef4d92ec78d", "comment": "Malware payload", "value": "663d46815b10add13446508a10541efbb553f331c661869cfbc52587668ab73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904992, "uuid": "a5c55ed3-ed77-40da-8777-d15320c79900", "comment": "Malware payload", "value": "7cddc74566be8091227380a2c392dfa516b811c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904992, "uuid": "d9252b6d-cae5-4ae3-a76e-18cf4b0fb3ab", "comment": "Malware payload", "value": "abebd97570f021898d15353c98580819575dae3669e47e724272860f59899c9405556e31273df12b9bd9370c020d1d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904992, "uuid": "54187ecf-d448-4f52-8b6d-d90f3fe283bf", "value": "T132046B64F3A910F9E0678234CD560D06E77278061720AFDF47A04BB9AF67AD05D3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904992, "uuid": "7d60e3d2-f78f-4fe7-b1ec-f9618bc24d9c", "value": "df492663aa45773aefb414ba9816c9ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904992, "uuid": "461dad7f-c679-4bde-883d-f4a50359e4c6", "value": "3072:G+9Xnp6GYXqju2L7AJCdL0zkV24TDMpVxG4VqGl:hAt2nAFkVnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904992, "uuid": "2c5744d8-d610-489d-a3cd-139c70f4e0dd", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904992, "uuid": "83a77ea1-46b4-448b-9a83-af63310ce6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904992, "uuid": "dce1b6ab-3a88-4e8d-9b79-d75335fa3f83", "value": "SEA_FMT20260506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7280dc39-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941419, "uuid": "50eb4aff-c753-4c7f-84fa-04b0aa707f61", "comment": "Malware payload (Snojan)", "value": "9ffa0e9cca3b99986efa90b703d4e9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941419, "uuid": "b76c27e5-3939-41fa-b0ba-fb4cace8e66b", "comment": "Malware payload (Snojan)", "value": "677ec7a34c65b8669812365e9f2795664b68297c76106828a6a1c64ffb4a150d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941419, "uuid": "f3846dd4-0a0a-43e1-adbe-7236dbb3e5ac", "comment": "Malware payload (Snojan)", "value": "e9738fa9c4ff7fdbde379cb6950e901ede3241de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941419, "uuid": "afa8cf87-bff2-4b68-8290-8ec2439338d5", "comment": "Malware payload (Snojan)", "value": "fcf63e6984d4c519033bec36eaf54a7ec3e5b70b22e12e9329e8d865ab60b5aafcee531ed1b951a85a11e5466e6e015c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941419, "uuid": "34df35eb-4bae-4df8-8d67-3957c4951dd9", "value": "T113B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941419, "uuid": "2d907241-0620-4f16-8a80-1eb342c26466", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941419, "uuid": "11cdca3f-528c-43fe-b236-076b8088b2be", "value": "12288:/bE+uZh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+yk70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941419, "uuid": "82f6be40-8479-45e4-a94a-5e7740246e13", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941419, "uuid": "ef838c2b-05f7-43ce-a3a2-0342ef90c183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941419, "uuid": "59a31d49-0896-4877-8d7f-f4d5216cedbd", "value": "qpXXo9GmG4yTWiK1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43590b6b-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780908269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908269, "uuid": "9f564a47-4700-432c-9630-52708ef476b8", "comment": "Malware payload (AsyncRAT)", "value": "d1cec83bd71edf40016368934535790c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908269, "uuid": "78c56022-3922-4570-8697-0c67ea6bfae0", "comment": "Malware payload (AsyncRAT)", "value": "67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908269, "uuid": "3b32e879-8eb4-4df7-8996-957a7e51cc89", "comment": "Malware payload (AsyncRAT)", "value": "288afa6cc4db713f707aca887c25d820318b35c8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908269, "uuid": "078cbd53-154d-479b-b2ca-1ae5d5613c26", "comment": "Malware payload (AsyncRAT)", "value": "12a2e81fe5464bf5ebe0d25108916fb2e686620fe39023cb21c7758496a75b95e237a09cce8edf5b3b5fa8f7c5fb7018", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908269, "uuid": "4bb73a3c-ee99-4239-91b9-17863c18d897", "value": "T18F15F1142219CD46D4AE0BB86A61E37417B88E9DE822D3139FD1BFDBBC767B06D00257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908269, "uuid": "e6227c94-dc63-4f12-b4e6-c29bb7e46fab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908269, "uuid": "e150b80f-1d6e-4c6e-869c-89b40d0b8d30", "value": "24576:rG3kAEFT0DXQWa5GRPnyMH+C9NH6sz6kpi7TYKHK4H3Y:sk3FQD/ayny6x9zUTYKHDH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908269, "uuid": "73f31eab-c2b5-440a-a9f4-8367750ebfed", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908269, "uuid": "76fb1228-3fad-40c5-8613-35d5964c6a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908269, "uuid": "e62e9db0-68f1-41ac-adf9-c5ab45d81437", "value": "67851f424ccbe66c1d79bdb2c7dac0bcb2f833d6225014ddbf143974d5d96766", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77636d7e-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904920, "uuid": "373d2e11-7d75-4303-b861-517eda76c358", "comment": "Malware payload (Mirai)", "value": "bfa2e700e7f86b2daf342e33c8173522", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904920, "uuid": "97f2f3a1-80ef-463a-ab1c-30af5558923c", "comment": "Malware payload (Mirai)", "value": "6792548a137a584da63c419ce97095366074728731b1255474a88bbc71ed3406", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904920, "uuid": "8d5da2ab-a4c0-4ed3-9703-992550e710c3", "comment": "Malware payload (Mirai)", "value": "3279f52afb547066e9a1bf99d12b070a3b87b4f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904920, "uuid": "8285aeea-b44d-4d31-9996-e1ab2ca9dcbd", "comment": "Malware payload (Mirai)", "value": "9c49931153ff8b1b748cac18d40e776132f76314dfa14c203f7e18f5f5a633fb431b1b3325c6c0c547ec24edaa1324ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904920, "uuid": "8a89ea6c-7259-40bd-831e-9ff578e70527", "value": "T109140906AF510FFBD86BDD7302EA0A0134CCA81726A53B757674D924F64A98B09E3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904920, "uuid": "42ed8e49-c016-4c1c-b005-7f5bddf40bb9", "value": "3072:gqDHvsiIFV4TKfrYBieO0Z3J9IEGQElC47j0:gqjvduVsVlZ3JYZlC47I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904920, "uuid": "5bb57c05-51c3-42a2-a591-0a765e42871e", "value": 202928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904920, "uuid": "b3e2fe28-20b8-401f-bab2-4e61f1101da0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904920, "uuid": "ac7b04c4-f106-4f76-8359-e6bdfbd0fd86", "value": "nova.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3aaac6-637f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780953462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780953462, "uuid": "cf0f1599-77fa-4538-b61a-ff47402b6d8f", "comment": "Malware payload (Mirai)", "value": "924c2ab4167856402da508931a77adde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780953462, "uuid": "4b8b0d02-0a10-4e64-ad36-35506991d831", "comment": "Malware payload (Mirai)", "value": "685a5a6809839106bc2798e8350ca837f70d4c832c030be8a1b5d514770624c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780953462, "uuid": "41dcd2f9-7913-49a1-9092-8635c3160152", "comment": "Malware payload (Mirai)", "value": "75ce21f2e9a06b99f48fd4cd9c07a647417ba464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780953462, "uuid": "6b5fa327-7ee6-4a80-b5f7-6f2d180872d2", "comment": "Malware payload (Mirai)", "value": "07a2099e33d3b345306e8f39ea1bc7ea81c25a214cf9f0e03525382e8eafd9e126c6e61defb6c388699878e18bee4a0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780953462, "uuid": "604ead46-b129-475b-9e36-afc5fb47958b", "value": "T117C3198AFC818B11D5D525BAFE1F518D33134BB8E3FA7112CD145B2A638A85B0E7B605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780953462, "uuid": "2ccd51b8-8aa7-4c9b-a79b-1e0e3f424259", "value": "3072:frgRAlPvuXDoxUE8ddP4AZQOjdjE65zang3zFkfp7Z6xeofWmz:77xMTP4BSNzang3zFkB7gecWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780953462, "uuid": "87dadd1e-8361-4e83-894e-6ac58f6a1248", "value": 128804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780953462, "uuid": "cb60d018-ea81-4dd6-8142-722a79a44281", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780953462, "uuid": "9dcd7220-e892-4ed3-ab4f-d2c41f6dc039", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7926e67b-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910936, "uuid": "074f3d4f-d9d7-44af-9e9b-9ff79891ec74", "comment": "Malware payload (a310Logger)", "value": "791c9cbb5c026893b5aa4c41c028228c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910936, "uuid": "31937bd9-bc31-421e-8250-14bf127e3d1e", "comment": "Malware payload (a310Logger)", "value": "689ff648f7f658e87f9592426aa911157e5347d4816947bd18b8b952f0668490", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910936, "uuid": "44a0a621-7228-421d-b1ce-436f10d01aab", "comment": "Malware payload (a310Logger)", "value": "7b7785b4efbdbbe7c3e4e8e6f22720c6ea796ba0", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910936, "uuid": "88ea803d-c5f9-4fbb-86ee-ec57052777f1", "comment": "Malware payload (a310Logger)", "value": "ae155a9ac45c84a88fa8447c4dd593c81204e4b9c0977601f40320d0df43806bdda7ea46fd92a6772dc4a7a954f5e980", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910936, "uuid": "31ab5caf-f6aa-4bc0-ab77-95395f1eef8c", "value": "T14345125C2B15D51AC8E44FBB6A31E2B4F2397DADF441D2529FD9BFCBBA32B004900952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910936, "uuid": "f8951b97-ff41-478d-bd86-017107b7756b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910936, "uuid": "4fa8a45b-4bfb-430d-b3c2-6977047944dc", "value": "24576:cod5aq/hf65wnRvmKsg/KSsJs+7ROFNM5408g9/V:ndnVUK9C4+sFNXXc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910936, "uuid": "e1bd2a59-e66b-40d8-a17f-580cd0095326", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910936, "uuid": "d96ece60-8dcc-463f-84fe-42ace5f2afb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910936, "uuid": "bd6149c7-cbf1-4c31-b256-c670318f3c5e", "value": "689ff648f7f658e87f9592426aa911157e5347d4816947bd18b8b952f0668490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6809ff70-6385-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780956005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956005, "uuid": "ce0c67aa-9d60-45f4-963b-e4d895b00234", "comment": "Malware payload", "value": "2d07458e00ae3d3b1bb90463d5695a4d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956005, "uuid": "1dc10de3-f16a-43b9-a032-3299439ec1c3", "comment": "Malware payload", "value": "68a4eeaf7fc3454c8774274cfaecedbcbfcb4fbfb8e3168d6e6c28738e46a0ed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956005, "uuid": "a3c7ed2d-f85b-4caa-9412-8b5607388eb8", "comment": "Malware payload", "value": "ece70e1517a7fe4e272052af5c822b23fd42471a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956005, "uuid": "c5932650-3eff-4186-9719-ecc936a27158", "comment": "Malware payload", "value": "8a5ed68eb469432b663995293e4e1d6e239be6315c7ff880bc9dad62a75e5e14d2eb0d6454c181b6de5b51d4e95703a0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956005, "uuid": "240c0185-11f9-4e88-9eee-2978fb12a83f", "value": "T1DE91EAF843DA36A50F5F817D2E738092186C024F17EF659D21C51E261A240DE9AEE1EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956005, "uuid": "b4e8efca-bcc2-451e-b98d-94342ee9460a", "value": "96:2U8CIqMVWbbZk70mFut3aDiSLmTew79fKyEpi1mNLRQ2x:2uUkRmF8mJPIMBVRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780956005, "uuid": "661f6a65-fbaa-484e-b954-a1ff5388e1d9", "value": 4495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780956005, "uuid": "ee60812d-5d5a-49d0-ab70-06c2029dcc18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956005, "uuid": "15bd47df-fb0b-404f-b1d8-7332829c72d8", "value": "rPedidoCota____o_617_014260608_GrupoMinuano_PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6073465b-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780913042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913042, "uuid": "a8336ed0-4c58-4b77-897b-8c8674126bbc", "comment": "Malware payload (RemcosRAT)", "value": "db500c8d296dfd988a57558ec462d918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913042, "uuid": "5f2d4814-6cc0-4871-b608-8165db48ed6a", "comment": "Malware payload (RemcosRAT)", "value": "6908c3194b043853c96cbbf9117044d43eb7a18c3fffa212071945007e2074d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913042, "uuid": "0f722714-d311-4a86-bac4-f9f81e0642e2", "comment": "Malware payload (RemcosRAT)", "value": "33386f70011807e49d05bc86f3a29e2d85cba476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913042, "uuid": "5018e45b-e0ee-422d-9e86-62c9d42dd11a", "comment": "Malware payload (RemcosRAT)", "value": "ef8be3eca6296be1ace26f54b8d1b3eb05044d4224aa41ab30a221b45c5ff9fd40532b60d9f668c96d2584eab66bbc30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913042, "uuid": "5d3d89db-f235-4c5d-99b5-4bae0447eee7", "value": "T13E0523D6BBB0E80BC881AE7248B5F12857E7D95074904716BB50B64EFC3C98ACD9C763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913042, "uuid": "5eb816d5-8437-4fe1-af3e-9ee73fc223ab", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913042, "uuid": "c2359dbb-2ed4-404d-8203-61f4bdecb5ff", "value": "24576:9K/3SA6s/PtlS1NQhaM6gpmaITJXe+56LqgBU:EB6sXS1ir6gM1f8BU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913042, "uuid": "9b7aee84-ce24-470c-8bd0-fb517d70bced", "value": 861432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913042, "uuid": "11b11e6d-8ae6-4c94-8e8f-802ec1ed4b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913042, "uuid": "56b3db6f-8e03-435f-bd1e-72184b460f07", "value": "6908c3194b043853c96cbbf9117044d43eb7a18c3fffa212071945007e2074d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e80863e-62e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780886786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886786, "uuid": "4d7ae61b-04e0-4dc4-8b3c-2cac8a6c888f", "comment": "Malware payload", "value": "ebcca9ad522e4ddbbc5490f85e814db8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886786, "uuid": "18febe41-3cd7-449e-8ed0-cd03bb20f0c4", "comment": "Malware payload", "value": "6919e2d3f51fa9020f0c5669f42c21c99eafbc621067e29cabc945848b20ddc6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886786, "uuid": "05f0ed2c-5aab-4136-81ec-a994c8510673", "comment": "Malware payload", "value": "34c0b0fdee1e631d530e34412161a4b836a6ae17", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886786, "uuid": "c46b89a9-4aae-43b2-ae4f-546c63347bc3", "comment": "Malware payload", "value": "fa6c921b11fad48f70d0ecd5cf3f67824e3961509d873f0d5695677eb858a06f0bc782ed03a00d797b915f9f2946fd4e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886786, "uuid": "d0150a65-e42e-4fe1-97c3-0bfaf4bdee61", "value": "T1EA136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886786, "uuid": "8647d8e5-c311-401c-a254-e61c419d2493", "value": "768:cyXRWNGxVi9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:DlxRco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780886786, "uuid": "7d464422-0b4c-4ae2-afa7-309f28a87e2f", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780886786, "uuid": "a87c6dca-5887-4a0d-bc6f-446a45afa525", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886786, "uuid": "99dda4ff-d770-4db6-8269-a285e3e12e85", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7b0651-62dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780883719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883719, "uuid": "6fda3b9b-45bf-42c8-8b7a-53755b70997f", "comment": "Malware payload (Mirai)", "value": "b1b2dd7c78ac6780a037fb224afa7223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883719, "uuid": "b63e2e6a-8059-496f-ae49-82b32bf3ad52", "comment": "Malware payload (Mirai)", "value": "69585f03fe008fdaabc9c6e58e4f02665a1dafa9c77b683a30afe5e86e78549f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883719, "uuid": "162fa9f3-93c2-4cd3-9136-44ce9bfb4b4f", "comment": "Malware payload (Mirai)", "value": "25f21c48840de331f05ad14c821888bedd1e650e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780883719, "uuid": "7827f4ad-2620-441a-91cb-81a2b7489f6e", "comment": "Malware payload (Mirai)", "value": "6b8a52de64216849598e78e00e35c9145fdb0f0b044b2351ac279c9e47884ee7dee0f39ab302947e9f34c2abaedd0cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883719, "uuid": "6c63668e-78b8-4add-9eb2-63a5295f9897", "value": "T172B32CD6BC818B11D6C115BAFE1F118D33134BB8E3EA72138E185B2D678AC6B0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883719, "uuid": "64836f52-e849-4253-8ca3-9267971bbad3", "value": "3072:a6mRAzgU97LwolnEqMmy/LaKrgIMjdHazXPDJd8eNuj0UMsJ:Nblb9y/98BHarPDFNkosJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780883719, "uuid": "0584ae88-a1bd-494f-96c6-30ee2b38882e", "value": 112252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780883719, "uuid": "acf6a75e-fe49-4aea-ae8a-a643017d555e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780883719, "uuid": "68b1de82-7a75-4d5c-b656-6ce68525fe6b", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7527871b-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910500, "uuid": "c1d2ad6e-7652-480b-8f29-2da9f7b3f248", "comment": "Malware payload (Formbook)", "value": "5edfb5969af17aae590e5aba0c0cfbbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910500, "uuid": "6674d97d-7a04-42c0-a509-b8c10599840e", "comment": "Malware payload (Formbook)", "value": "6965b488f760885316594ef34f93fda1fc09a6cf8100e52f4990c725990542b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910500, "uuid": "25ed778e-3944-4068-8221-f537f808ac5a", "comment": "Malware payload (Formbook)", "value": "ddb8d109c3562abd936662114c3040425ddddb69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910500, "uuid": "2d216926-9669-4db8-a7b7-50944b1daf8d", "comment": "Malware payload (Formbook)", "value": "55b3cdf0f9f3a9ad6e65defb205975a1b0f18d879e3293dfff86bff4f9c362fcbaa0bc8372dd707e448676bffa614ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910500, "uuid": "ac0529a5-a6d5-4de4-9f71-cf9d74a25a1e", "value": "T1712522686209F643C86B5FF41DA0D170273C4C8DE920D607EFCD7DAFB2B9AA5454239A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910500, "uuid": "960b04c9-a565-4b65-869a-de4af5c18fd8", "value": "24576:T5nNrrXVjd5NZ+RwasJVyoqhF6P7HOFfwkWhPres9PSxcTWizK:TvPVzNZ+e1fyoqI7WfYP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910500, "uuid": "d9555776-c6b8-49f9-a0ae-b7e4f9885615", "value": 1002496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910500, "uuid": "6bd31f6b-18af-4b47-b1ec-03434e30259d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910500, "uuid": "0c2a7547-c795-4b57-b238-86b8e06e8d81", "value": "6965b488f760885316594ef34f93fda1fc09a6cf8100e52f4990c725990542b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63d4ffa-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780911522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911522, "uuid": "4c00c670-97c4-4064-92c1-6d48f6b69117", "comment": "Malware payload (GuLoader)", "value": "029446cec84ba081a4e9dce40936f3ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911522, "uuid": "39162adf-691a-405a-b330-927f09fd2296", "comment": "Malware payload (GuLoader)", "value": "696bafd93ca02c40be66c2a20b41f332a122df4fc0215f8fb0c6d3560f1602a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911522, "uuid": "7254ba41-da10-4ac4-acb2-6e463a40cf1e", "comment": "Malware payload (GuLoader)", "value": "40d039b7a85c88e6502e20b610ea8c3f2e376322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911522, "uuid": "2c957cdb-5163-4560-9bbf-d6c83b22938f", "comment": "Malware payload (GuLoader)", "value": "9d1bbb3f06981418d3386b7694a3e46c64c9bb16418a6c5fd062123369841abe5c5a59e3b854cb24be670c1c5a5ae13f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911522, "uuid": "eab24ffd-db68-4ab9-bf95-3582966c619b", "value": "T17C152399F335831EE866D37184BE8764CA7C6D68704A930F738A72913CA32DA45153FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911522, "uuid": "25bdd7ed-1911-4497-90e4-d39029d2de4e", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911522, "uuid": "8a2cf4d5-6e56-4267-bff0-2af71f2e3d62", "value": "24576:jA7F8tSnMXcpwm7BllMeBEFmNZpJGSqQc3DKtbPik+e:jz1CwmBlrDHVSKtTik+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911522, "uuid": "55a5a0a8-6390-4663-b1dc-b29162522c8f", "value": 943640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911522, "uuid": "757bac44-ef6f-4f29-8385-c7a0bf39f1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911522, "uuid": "4cb68420-5b50-45ae-b547-1998e4693c97", "value": "696bafd93ca02c40be66c2a20b41f332a122df4fc0215f8fb0c6d3560f1602a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1200f0-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908045, "uuid": "f139d695-978d-4b7b-88f5-ee95a5db3b71", "comment": "Malware payload (AgentTesla)", "value": "61ad00879835cd123b6b36ff4f05744e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908045, "uuid": "117da8d8-09ae-43c5-a69d-76d3bf06bd53", "comment": "Malware payload (AgentTesla)", "value": "698e1b8cdcf63ffd2c9d4d9a246eef3a3f60b41cd1689fbf55412b78239f7e44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908045, "uuid": "3f77148e-7ba6-44b4-b460-b6181f0e01cf", "comment": "Malware payload (AgentTesla)", "value": "8ce4b4828560504d1d4015dc4e77409a7f84be65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908045, "uuid": "ec279aed-9856-4461-86ee-6e6700b7d385", "comment": "Malware payload (AgentTesla)", "value": "b9dec0fdf82f89b7e0dcf4059d5d93c2c06fb6b7c2b0d0d44a0d6abb5940a8f395dadd11b02c4def4b7b65144dc22d7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908045, "uuid": "23e6a020-df05-445c-9211-a4f2abd4a965", "value": "T1C54512443206CD05E5569BB98C70E3B417344E80F871D327AEFA7EEF787665668283E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908045, "uuid": "c13c9a47-7c58-4c64-8c55-b0d8c1e9e515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908045, "uuid": "fc9c83d8-0334-4fc4-b9ca-5bf6dd20c6cc", "value": "24576:SlRhhrPtibbVOk56mYZ9z9lXIZlY0z5IchtJ25Sh47g5wFSSSI/:utli0iJQz2lYqIAqSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908045, "uuid": "952294ca-3ae8-44dd-b240-4c602bf04624", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908045, "uuid": "8a932fe8-c6af-48b8-ab7b-093697a40783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908045, "uuid": "145c680f-0d64-44ed-af80-3c94b9729e2d", "value": "698e1b8cdcf63ffd2c9d4d9a246eef3a3f60b41cd1689fbf55412b78239f7e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9622c5ec-630e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780904972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904972, "uuid": "0a0a4d03-9e3f-4b15-9fc2-f9b23d117eb4", "comment": "Malware payload", "value": "37c5d45707e0ee8f25dc38f6f4b843ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904972, "uuid": "55c14807-a3b0-46ab-a93c-14f367c6c639", "comment": "Malware payload", "value": "69ba0022bf34c285c4697df4ccdc98cfc1c2443d425bba6580157de8c0ffe21d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904972, "uuid": "8eccdd25-40b1-4f2a-9b4a-47f6dcfd0208", "comment": "Malware payload", "value": "3b3014a6dae722657e1264a22c98bd06b46e65d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904972, "uuid": "e34ac8cd-e274-408b-8c8c-8551b8a9cec4", "comment": "Malware payload", "value": "a4256416eb2b2afbf9eba5a8de7bb1a17839bc5b63d06773b73ae1b7813267bd862137edf005fa7f8a8beae9be234858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904972, "uuid": "bad39338-3d5a-4ad7-a850-57aab6bbf355", "value": "T1EA6533A5B48242B6CCBF093354DD4635A97F776A0638206BF7DBEC3681B0B8A54241FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904972, "uuid": "79e60723-b1e2-4446-a86b-ee4864fd5d2e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904972, "uuid": "9b107105-67f5-4755-8574-f39a4c11d80d", "value": "24576:/ciw6i0y7oegNZiuHqKcX8nHya78EqULN0i0gQufXF7Sb60OLGcz5nWQ:/ciw6byC7PnHr8fULWbcXQbv/sWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904972, "uuid": "a587ceef-19fd-4765-82aa-1ea4bf22feda", "value": 1478592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904972, "uuid": "25ead06f-81bb-4ba0-8d24-a502284bac8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904972, "uuid": "12e9f0cc-b16b-4abf-9dad-9a8ba464df80", "value": "37c5d45707e0ee8f25dc38f6f4b843ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57c9a8e-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780908487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908487, "uuid": "e24c9926-c7c1-41aa-a2bd-864ed8794da8", "comment": "Malware payload (AsyncRAT)", "value": "e703ddbc183e54ede390f1ff832d1fab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908487, "uuid": "592b41a1-923e-41eb-a244-cfec68f6b221", "comment": "Malware payload (AsyncRAT)", "value": "6a28979e4873a92ab14b8e3e7ee1b14b65458a9c60ed51b87cda24c03383429a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908487, "uuid": "d9e02a34-6304-4198-a696-e6555db25275", "comment": "Malware payload (AsyncRAT)", "value": "0da540cd506e2a1454e86dd9b8ef9b7db6936faf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908487, "uuid": "d3a6f5e7-7120-4b1e-8d29-3903679c0e40", "comment": "Malware payload (AsyncRAT)", "value": "9213bfed287cc75c108647d0d68e5300c54299fd72d7d6d76c86b92b1f7015f6fabb3c87a0a9c6cdecb4d04823ed9d62", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908487, "uuid": "82d620d3-d372-4c9c-9641-240cd52527ec", "value": "T1F905F114274ADD03D4DA4BF44AA0E2B417704E99E922E253DFE7BEEFB87E25419053C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908487, "uuid": "b7f1488c-e502-43c4-a3dd-442ad6ea172f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908487, "uuid": "8c4f50c9-0c4a-4da0-a806-fc80deadb1a2", "value": "12288:DUwfTj8fAJRkVj8GirD1Sp+L1HOjVdy5l7looJkjiNo2ZN/3EGxbDUlqo2bxzsNW:AAEFT0DQpm1HQEiiNRfDUIXdINR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908487, "uuid": "51bc802c-359a-4e35-aaf7-47837b8fd57a", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908487, "uuid": "74faca5c-36f5-469b-8ef1-460c457a1148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908487, "uuid": "387ad32e-9b3e-4d21-a266-9e34e7c6bd37", "value": "6a28979e4873a92ab14b8e3e7ee1b14b65458a9c60ed51b87cda24c03383429a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb7641c-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910355, "uuid": "fbf16278-afa2-49fe-8095-6171011e2ab1", "comment": "Malware payload (AgentTesla)", "value": "8c9c8e430e1eef28ed30c860b0d5458b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910355, "uuid": "93bc5b8d-e2c2-4554-9064-f4b440a9a9d3", "comment": "Malware payload (AgentTesla)", "value": "6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910355, "uuid": "330ca5fa-f04f-4115-a747-4b04cc666003", "comment": "Malware payload (AgentTesla)", "value": "e54344846679c4eb74c0edece3061ed73baf4575", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910355, "uuid": "f484cedd-9216-498c-899c-301219ad7c54", "comment": "Malware payload (AgentTesla)", "value": "d9151a57c8df1764323992b15a3623b3dfcf0e2ccaef75db2a2ec0b25f2952391569e56e82d4342345328ca9e6d0aee8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910355, "uuid": "d16dfc8d-5499-4bc3-952f-0666ade391a9", "value": "T179251294269ED306D0B64BF02871D1B813746EAAE430C70B9FC93CDFB9B57A05845B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910355, "uuid": "6095ac48-1591-4c10-8893-911b3aa0fc72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910355, "uuid": "b4d968e0-e876-4d11-b622-6951197138bc", "value": "24576:VE30nNrmH5uL3rSqGKukPx/TvRUlfbVbVzIIkr1:VJSHgL3OqGgRJUljVbVzMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910355, "uuid": "ad7c39fa-7a09-43b8-86f2-b5fda07783f1", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910355, "uuid": "ef3a8f8e-9ffe-49e5-bcbb-51da2cd55e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910355, "uuid": "42e49027-bc57-4e94-8dda-fb7933943197", "value": "6a2dff579e9e1d9c274c0cfb88e34b815389ff242cd7e05db08badfd9d0699c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2377d11f-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912081, "uuid": "9b3d7720-a14d-4002-9af4-0ecebc479c03", "comment": "Malware payload (Formbook)", "value": "71eb977f893274a82a19a74f05deab60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912081, "uuid": "dc69378e-0e0f-4b1b-aeef-fa5fd7fe41e9", "comment": "Malware payload (Formbook)", "value": "6ac6126e8f242b42ac71a251bf9f4c8e45d7eaa8fc1fd6ea5bff661498848a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912081, "uuid": "2a57cdda-c41d-46c1-9bb3-98cf00779737", "comment": "Malware payload (Formbook)", "value": "1c9cde6cfe6fa1c73ff2fedbe2d10baabafa0d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912081, "uuid": "c0b2d797-4957-48a9-93e0-e7e6f03b8f6a", "comment": "Malware payload (Formbook)", "value": "d2391803cf04546d01d8b5f89370ea69e3321e23551b1722e4143814caa2e847905f914155e434fc7ec8712fee2a4005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912081, "uuid": "231ff49b-30b4-4c47-8f2d-9a07f947a872", "value": "T16E252378474AE217CED71B391971C33147286DAAD520C3A78FFDACEF382A7B55828191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912081, "uuid": "1870fd77-0eef-47ab-a5e4-6dff531ed6f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912081, "uuid": "369240d1-7dff-4134-ad51-234e5d9ac5a2", "value": "12288:vgycXAJLTOsbx3YhqUft0y7/II+lGmSlRbfER+KWkh2MV8WQ82ZJ+/frDDe/+hMv:vgybOioh3jIzlGmwRX5U/fCmGsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912081, "uuid": "ebbf65d2-99cc-4a1f-9ed0-06c176c62b1b", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912081, "uuid": "b7548bcc-c2a9-4e7c-ae55-cb184f7bab42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912081, "uuid": "bd06dbfc-53bf-4660-a715-31979433f01a", "value": "6ac6126e8f242b42ac71a251bf9f4c8e45d7eaa8fc1fd6ea5bff661498848a0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10325d0b-630a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780903029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903029, "uuid": "d8a688a6-b6b1-44f7-86c0-b4bd29399074", "comment": "Malware payload", "value": "8e1389360f391447405f779dfd4f4d18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903029, "uuid": "9af5830c-d26e-4f41-8bf6-e8ea2882f7bd", "comment": "Malware payload", "value": "6af6d8fe02670f84138d3b0e4863f548fa9c47a19e51094225ede3650492456d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903029, "uuid": "655156eb-9819-454d-8453-fe2269a2f18a", "comment": "Malware payload", "value": "21f4ca35c0ef592997c79f593e4656ccda1ccf74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903029, "uuid": "fdf392ca-9cb9-4dde-a489-1102dfbc66ae", "comment": "Malware payload", "value": "7294e5220d183c20a9316c844ce19c8c5281189d2fcdeffbfd64ad5ad200c154120f2dcaf93628c90aa4bb722cd648cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903029, "uuid": "88147b03-906c-4aa3-9dc3-396f814655ca", "value": "T1EB936C0BB7F8CF92D99D063C487AD7604B70FC266A82D75B1AC130AE5D723D09507AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903029, "uuid": "09a0718c-038b-43c7-a207-578eec6c5a1a", "value": "1536:r3tlqX/JUddmE01HOJiWUDZUS/Tg636b/Iz5VbPqqKHyXkAlb6WaqkSZZZ3g5TpE:r3tlqXEo8jINVbCpHyXkAl6WEUcbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780903029, "uuid": "334b2b3d-ffae-4419-84f1-ca1a5a573903", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780903029, "uuid": "efaaa51b-e6b0-4f3f-83d6-34adeafc791a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903029, "uuid": "65b3547b-cd6a-4d6d-a009-01e845fb7a54", "value": "6af6d8fe02670f84138d3b0e4863f548fa9c47a19e51094225ede3650492456d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34debb2-631e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911866, "uuid": "27e20a8f-bc78-44c9-8d2c-c8a79c8e6966", "comment": "Malware payload", "value": "64f08e0730c5ac3c3bf53dcb72a05f32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911866, "uuid": "445920d9-e498-4d2e-a60e-1b2e42c24ae4", "comment": "Malware payload", "value": "6b0889b845c2bb53a7f2e9b2da5266b0201a680baa2d8d5f15d9062992b858ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911866, "uuid": "8ab40e49-e3ea-45cf-bc2b-135c4a51c7ed", "comment": "Malware payload", "value": "bf61d24a4a73b87acb5c6ad929e6b219f0ccf176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911866, "uuid": "4b59be42-8313-47dd-a37b-19e1e3d168ed", "comment": "Malware payload", "value": "0a75ebdcf778096e1717b57f49023b611606ad9cfba05d942fd06e76b39b15ce5a6fbdc3ccb566de2f97178d3ab808fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911866, "uuid": "9b1498d6-2329-4911-8d52-679b700211fd", "value": "T10555E11A5CC31AA4C1F98F78D27604AC23F0991B9752E7B76EEC02F4DE5278AD913472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911866, "uuid": "5e4aa005-3b57-493d-afc2-956500bf4110", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911866, "uuid": "9a3285ba-1bb0-4e24-8ce1-60f2e2106001", "value": "24576:SWedX545fOBWGt8CXdCdU1eAsePYpVTAOPmUo:SWedpCfOkGe20A9CMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911866, "uuid": "6152d729-7b81-4bf9-8267-5589bb349c5f", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911866, "uuid": "29791640-e6a4-4533-a3a5-a238787ba57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911866, "uuid": "5c19de76-87d4-4d8b-8590-8eefdc13ba64", "value": "6b0889b845c2bb53a7f2e9b2da5266b0201a680baa2d8d5f15d9062992b858ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710ee292-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780928962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928962, "uuid": "cbad56e0-03cc-4c76-acfd-902959ead29c", "comment": "Malware payload (PhantomStealer)", "value": "27c68c32ab4e8568c09c56039bd20c09", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928962, "uuid": "cb3c30b4-d81e-41c5-827d-561b1535310f", "comment": "Malware payload (PhantomStealer)", "value": "6b204cc6b62f5ee01bdead32ec2d94464b5c3afb9bfea0de505342d0fd2132dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928962, "uuid": "db9be000-6e23-4b33-a339-b0b6a01a92af", "comment": "Malware payload (PhantomStealer)", "value": "796881e8f3795fde69fcbaa4c9ef58b9edc05133", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928962, "uuid": "9595e823-6840-4218-a1f7-c6fc698be92b", "comment": "Malware payload (PhantomStealer)", "value": "0ee737e550aa6f864039c4d0e23237b42b69726a146334f6c94ee5ce953920bf767c47536df2c1e9512f9077b38ea9fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928962, "uuid": "1f6db0c9-8700-4da8-8ad4-2c0142a17a2c", "value": "T1DC665B17C66F9B4E18097B61006A5D9AFE89CAFCEF727BC4E0CF90B610EA1110B455B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928962, "uuid": "1c6cf077-1078-420e-9332-7ca348dfea4e", "value": "49152:4642P5b7u4ePINEv0E2hyUOjXHvlutvDqAiEJUyEQBrQwIRfoOyv14p0/QyKUHku:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928962, "uuid": "a4903084-de78-42b8-a27c-8baa70a158ed", "value": 7044387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928962, "uuid": "ae7c407e-c14a-4abb-abbe-d46cc9a3fb9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928962, "uuid": "820da7a0-5032-4067-a45d-c1974bd401f6", "value": "Quote_Q080626.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54783a2-62d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780880543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780880543, "uuid": "3984b256-38ce-4f75-9274-987197ccce4c", "comment": "Malware payload", "value": "585e2c54cc687c1e6f9e374952283933", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780880543, "uuid": "79340f56-a42d-4bab-b668-db676857259a", "comment": "Malware payload", "value": "6b427c86481a642324a9776d6c2bbc2eedc00a5a0606c9a5a107833f42831534", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780880543, "uuid": "37cf0504-a1a2-422e-869d-8a21b2bcc553", "comment": "Malware payload", "value": "dbdded7a2e3bd6839168c018c9344d4ddb65fe75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780880543, "uuid": "acc45d85-6850-4b8f-ace7-dff927176e76", "comment": "Malware payload", "value": "247cd3dce8adf1228aff3f6cf487f6c80b23daee2dbc6931c304c0f774794a2e365d19ba354759e5cb1a180dcef09502", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780880543, "uuid": "14b8c5ed-936d-4cec-b764-d8c78fbbb2b1", "value": "T1FC75339315460FB4AFD3FE384018798AE661DEB44B7EB3B8B274967019537E6B230835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780880543, "uuid": "444d9e3a-b3f1-4b49-9f80-d1a3c7adf119", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/gWhHhbVlGttgKAmx/8:EpCKabVQ+9qlNlpjN8H8JZGtuc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780880543, "uuid": "e6759590-0ab8-4939-8eb8-7bc92bfed24c", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780880543, "uuid": "15a0bc02-ba92-49e6-803b-49ba6a13cb97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780880543, "uuid": "adf6221d-a39e-49a3-9140-8edac80b2b7d", "value": "6b427c86481a642324a9776d6c2bbc2eedc00a5a0606c9a5a107833f42831534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1c8021-631e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911961, "uuid": "e0c134af-1b1a-442a-8c99-95b6be37702e", "comment": "Malware payload", "value": "89ab77f46185fd16bc141ac4e7f53a01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911961, "uuid": "8d98a82c-535d-4546-9377-8b7c9dd65bb5", "comment": "Malware payload", "value": "6b510733b058e39308bf61e0239bbdf282e0bb074dea2938e0a9468b039c4f32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911961, "uuid": "80a2442f-97ff-4f46-aa59-1876cb883929", "comment": "Malware payload", "value": "9e7e6a45154cc69c7c8b8eb1952929e1e5ada8e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911961, "uuid": "c07faf89-83ae-45e2-933b-f788901790dc", "comment": "Malware payload", "value": "635fc0149039463928edc94be71351dc68b4aea54d960c7d96e7356b6d9cd300c2486256d8508348efa535821d69480c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911961, "uuid": "4db8a8ec-6ad0-4dfe-aa3f-78eb5846607a", "value": "T140E4CE216D822B59C6BE4B78C022481C77F0D853A797E3677FFD51B46EA3B84CA23461", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911961, "uuid": "996fda6f-df25-41b9-aad4-4c8e36b69fd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911961, "uuid": "0f588135-edd3-4bdb-a645-8be9ce21a25d", "value": "12288:72MDDTw6xIUBkGQs1/vIwQapKVBgZdQt8a9zubii8y:72MDL5fOBWGt8cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911961, "uuid": "2682d991-bb18-4dd5-b992-c1d8c927885b", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911961, "uuid": "142914ff-c45e-4f2f-8651-afaff65ba61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911961, "uuid": "f8b474e7-42a8-4e5a-b368-b3216604d44e", "value": "6b510733b058e39308bf61e0239bbdf282e0bb074dea2938e0a9468b039c4f32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268de208-631d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911227, "uuid": "e5775377-18a8-4147-bff0-52795b9e0169", "comment": "Malware payload", "value": "16fdaec51468997effd7c10f9f308c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911227, "uuid": "206b615b-6ec3-4185-aa72-af79278102fe", "comment": "Malware payload", "value": "6b6f7ff06a6c0386758f2ca0b50ee0b748a63eb0f2dc9fd2ad1dec0d7c352d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911227, "uuid": "737249f6-3012-47c9-9822-b2f236646082", "comment": "Malware payload", "value": "411c49342f2c57aaffefd07539d4d03ba6d736ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911227, "uuid": "a0c77ed4-e1c1-4c90-8054-0636f93a0b03", "comment": "Malware payload", "value": "b4f2c77cf5cda3633887585763d48b6ccf08e985eabffca924828c43148f5194365db69c1ecc35d9158a45af916e2ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911227, "uuid": "01df0886-bb04-4320-bbc1-387bac55c4b8", "value": "T12275D02E268F494CD49ADB788B3237D40271CC774CF2D3977B885774F6266A5AA8C243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911227, "uuid": "b4459ead-4742-4042-80e7-148627e8cf0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911227, "uuid": "3d58652d-f991-4dcd-9a9b-062e47b95188", "value": "24576:6vOcnPCmQui1rBgc+9tHYV8mj/CB7mtCfF:6vhnYus2YwVeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911227, "uuid": "ef996f26-9ddb-4598-b257-ffcca72d659c", "value": 1637376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911227, "uuid": "625f27d9-f3f4-4f2c-a27b-764693ab2803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911227, "uuid": "87906be2-1b75-4a7a-9f42-58c97e4a7216", "value": "6b6f7ff06a6c0386758f2ca0b50ee0b748a63eb0f2dc9fd2ad1dec0d7c352d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c291b7-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911572, "uuid": "f5ba7d7a-3b65-4940-ab36-a56db0321f6a", "comment": "Malware payload (Formbook)", "value": "268a494bde89a4f429dc5a28cf7b389e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911572, "uuid": "f4397c37-2ffe-4cc2-ab9a-1827505f33d4", "comment": "Malware payload (Formbook)", "value": "6b735b814780014e146aecb368af21b430cff011487ada5f211102c5859a7eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911572, "uuid": "441374e0-bb2c-43d7-979e-264162ba9de6", "comment": "Malware payload (Formbook)", "value": "a189ae07f8d13d3cd16d52455a28634a6739c324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911572, "uuid": "6da9cc8e-8757-4d79-b006-6d4fdeafb5f9", "comment": "Malware payload (Formbook)", "value": "35f72e4c7b35a9d0db937bce4ca84f8984f1e8ff14ccb75c78aaba3460a028175297d46acefabff1ab3e7a29728f42a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911572, "uuid": "b0d51188-eb37-4b1f-b79c-e7643f4e7dac", "value": "T1DE251229A659D617DA921B3C8EE6F279526E2DED7110E7078FEDBDEBFE215024C00013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911572, "uuid": "37c552b5-89c6-4aa6-84d9-42b2de1500d0", "value": "24576:Z0LtYiwVKYTh8TPqB8JAo1GSc8udKZyb78oUGrQaYRj95C:Zpgqh8LqiaosF4yb7ZUcQaY57C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911572, "uuid": "2f7bdf87-2a73-4e9a-b161-9bd19bfcdfad", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911572, "uuid": "01be3516-87c9-4fb1-87e2-1f0f6fa1ef38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911572, "uuid": "e3f21c31-da27-44c1-a6cc-fbf83b974962", "value": "6b735b814780014e146aecb368af21b430cff011487ada5f211102c5859a7eb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed2393c-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910892, "uuid": "576b4155-ff9d-49e1-83e6-a9ae2cfb3202", "comment": "Malware payload (a310Logger)", "value": "e1535bf358e000312f7252ec0c20282f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910892, "uuid": "863666b3-a311-4c0b-9cf7-960105d802a2", "comment": "Malware payload (a310Logger)", "value": "6bbabf72273302ee401d9601956447cb3a5f419f0b4dfe6947af469b28f69e0b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910892, "uuid": "c95f9a50-a22f-4c38-8b15-ffd6c9abe63e", "comment": "Malware payload (a310Logger)", "value": "cea7d6e307b4151aeabc7a47a0ff7e1f3f4f937f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910892, "uuid": "99dc80e6-9234-47d8-9bb4-3eb08f4e1ab5", "comment": "Malware payload (a310Logger)", "value": "7753092719908a18bae48d143945ed93aad05560a819cd13ca90081d3e36a4506fe52cb7817ea1c589fd2ead996cf5e9", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910892, "uuid": "e74c025c-8acb-4972-9389-b604acea2046", "value": "T15655D0859A808444CC2D6B74283AEE74561FBEEAE870E10E6FDD7D7777F31A31822149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910892, "uuid": "aa49c869-798a-438a-8521-e01a14721a44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910892, "uuid": "fa3701dc-bb22-4039-abae-9a49a9521457", "value": "24576:gdcgZrDktIl9CYdYwAswHi3+7XOpVrhVwU9bwtC5uxRQh:gdt+tbCws53COp9hKUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910892, "uuid": "8a3e6d29-4870-4700-b060-3778d7047ac2", "value": 1354240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910892, "uuid": "faa3cac3-ef76-43bd-9b09-8e6824cc68d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910892, "uuid": "8df649a5-bfd8-48b7-b74f-f2d7e3881da5", "value": "6bbabf72273302ee401d9601956447cb3a5f419f0b4dfe6947af469b28f69e0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b664d3-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780912318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912318, "uuid": "38c9b21b-ef26-4d7f-8773-bf20bfb92949", "comment": "Malware payload (DarkTortilla)", "value": "986209958fec7974232397a309068387", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912318, "uuid": "bd18d2ed-32a9-465c-9323-e17fde5e0f31", "comment": "Malware payload (DarkTortilla)", "value": "6c4f883f09a14d2edfbe9983c73ab025235d5cc10f2241c0109fee9306efd117", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912318, "uuid": "f59b7076-f31e-43ea-9d9c-c097403057c8", "comment": "Malware payload (DarkTortilla)", "value": "7816b417481b4640831490ca2ff728969cf6e3ce", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912318, "uuid": "04da0d6a-6cd7-4416-a6a1-8ad197f73ca6", "comment": "Malware payload (DarkTortilla)", "value": "5473940a0b4524d83b7587d830f8600bbcb1a3bd860a789357e63b650574ed68daf3889b0ce168aeab4892e66ef793cf", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912318, "uuid": "b09afc87-389e-4059-91f0-862f8b5a7916", "value": "T14715D0215D466F58E5AF0B74C062045833F2CD468F93EB9B2EEC9CB57AB3A84CD19913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912318, "uuid": "ce63d079-52e8-48e2-9a44-c9dcd2c0527f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912318, "uuid": "56f39ba7-6dbf-4387-81b2-3b5ebc42873a", "value": "12288:6H31s7gXU0PmEgqJY1xqVVWn4W2p8wB0DzaF0OjjBv+7HP7NTp35T1:6HQOVV6wB0He1Kzj3x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912318, "uuid": "fe492430-6f74-4936-adc1-88dcacb65206", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912318, "uuid": "7504e526-5b41-4bcc-8d25-d830756bf9f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912318, "uuid": "bae25f23-9362-4982-8510-271823f4c107", "value": "6c4f883f09a14d2edfbe9983c73ab025235d5cc10f2241c0109fee9306efd117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29126421-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908225, "uuid": "b1a32e92-7fcd-4e69-89fa-f84e5e3a88c3", "comment": "Malware payload (AgentTesla)", "value": "49f5aac7ded148fd97ee950cc6abdaab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908225, "uuid": "9be9d38c-be72-4a33-a300-6228bdefb0a0", "comment": "Malware payload (AgentTesla)", "value": "6d13de8277a75a559b0d5f3d07fbb3ea2cec01b1c089227c9f6a0e46fd35db2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908225, "uuid": "321657ad-1c26-4b0a-ba8e-8a549283605a", "comment": "Malware payload (AgentTesla)", "value": "b601f0190df472f95a3d53422e4dee89f37ac7c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908225, "uuid": "5bb625ed-c276-4d99-a5fc-ac4cd06d93cb", "comment": "Malware payload (AgentTesla)", "value": "26ca385c7624fdf997dca4e29c48e682b29eed03b233c43ea5257388190f38c51a7df5095e29a01264b710a90f8c8cbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908225, "uuid": "f75a7e2e-b782-45d6-96b2-48af6fed6634", "value": "T1D82501552602CF01CA0F67719FBF1B99D2279E140E7583C78B932DADBA37A1AE190D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908225, "uuid": "33acd0e9-c7c6-4e64-9fc9-9222f4211d7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908225, "uuid": "e8185e23-4a56-4221-81b1-b4d4a66b2ab8", "value": "12288:50FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wIsq98Ki5G05+bG3OcY4+YIJ4:mFJz7c5a8uGrxR9GR5L5+bG3OckJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908225, "uuid": "bddb0f5b-52e6-477d-8e8c-01b6ab69d1da", "value": 1040896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908225, "uuid": "2a69626f-093e-4d45-95d4-0c5c7037094c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908225, "uuid": "290c4379-636a-4c5a-b739-c179253182da", "value": "6d13de8277a75a559b0d5f3d07fbb3ea2cec01b1c089227c9f6a0e46fd35db2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741f5f6a-62da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780882581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882581, "uuid": "5b0497b9-b5cb-4f06-9ce4-6beeb6154116", "comment": "Malware payload", "value": "9e29d9446e07cfec8c1d7455d24be180", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882581, "uuid": "b43a179d-fe1c-40e4-b857-bbc6221e093e", "comment": "Malware payload", "value": "6e441e90af21238db30bb486cf9e9e7041bc79e93f149ba2035034c5433554cd", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882581, "uuid": "d856f945-b8a4-45ec-9945-6a4edc7d0f5c", "comment": "Malware payload", "value": "7681dc6df98728f349e1e0629043a8c986665bbf", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882581, "uuid": "228d3e32-cce2-4dc3-997f-c1c74559c893", "comment": "Malware payload", "value": "376578b451710c8233dc2c41a2b82e5d1e2c2822f6f2ca6145ad59854c9b06784e80b73deb24303bbc2a4dd225273ade", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882581, "uuid": "e13a3623-9a83-4131-af72-e7bd4b58f5cf", "value": "T168366D2439EA5029F173EFB95BE47AD69A6FF7633B07A85D1050034A4B13A81DDC213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882581, "uuid": "0a133757-cdf3-45e3-822d-926571227c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882581, "uuid": "e8eaddc1-1109-45a6-8cf5-955e3504b28c", "value": "49152:0kdQv1ZYP4kNdNnAE1zwmlz/Chl3GrEW:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780882581, "uuid": "9b5be3ed-a945-4349-b1ba-a0a6284a0c18", "value": 5006336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780882581, "uuid": "97957da5-95b0-42e1-8f3e-4e4dee95bd6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882581, "uuid": "bcfb1c36-b66f-4f37-bbb4-55ba74d0202d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305b632c-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912532, "uuid": "21230d45-5538-4e94-bff4-cdee1d42341f", "comment": "Malware payload (Formbook)", "value": "6966f2c07c5c2c824f7b8adb4a6c6a77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912532, "uuid": "c79c7ec2-9184-47d2-b266-c5efe72f550a", "comment": "Malware payload (Formbook)", "value": "6eae8440eb01ecb989722a4d32dd56832c40b0f3e554c375af276e07d6fc4138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912532, "uuid": "5e20f3bd-5742-4ee3-b3e1-fa70c2e5042e", "comment": "Malware payload (Formbook)", "value": "d4df72504d23a011dcf7daa8f5612aa4e3b60f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912532, "uuid": "d66092f6-5cb4-4c34-aece-31467e54d561", "comment": "Malware payload (Formbook)", "value": "aec56cec036a6fa2fdee223074eb96acc6208f69e64eeb866f384cfd98f6f69b2c12ddddaace32434c1f96ba205174f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912532, "uuid": "17e8b0f6-04bb-403d-a23a-55e38080f375", "value": "T11A2523B4AAEFE501C8124B3758E0E27503740E1EE523D22B5FEDADDB3C59B91990D6C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912532, "uuid": "d2fe50cd-f694-4ee0-aa32-6953b81c13b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912532, "uuid": "a77577c7-922d-4fee-895f-35eadecfb1b9", "value": "24576:IYYXziw7Zr6QrHPFh0PPRkrFmYziJgCwDIGEt47qLaIJ8Fb1z7BN4:VetZrHvFh0PP0FmYziJNwkGq47qO/bB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912532, "uuid": "1076d26c-2454-41b4-8963-a5cf753bf12c", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912532, "uuid": "adfe41b6-f627-46b5-9b68-09a70641dd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912532, "uuid": "e37fb88d-a4af-4cd9-aef6-d3f2dc3e3968", "value": "6eae8440eb01ecb989722a4d32dd56832c40b0f3e554c375af276e07d6fc4138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a885ad7c-62e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1780886964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886964, "uuid": "2beae0d6-49d9-4120-8752-3546eee2defb", "comment": "Malware payload (Gafgyt)", "value": "3ad76bf277012e69140ac8b57e4b615e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886964, "uuid": "ebe7eca5-7d86-4984-be29-5d62241f5ad3", "comment": "Malware payload (Gafgyt)", "value": "6ec0317810b3a63dd6739976bef4c1a2867e2aff5f2865381dc7736b64c6fbeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886964, "uuid": "370b9bdc-29e8-442b-8da0-4791bc1679ca", "comment": "Malware payload (Gafgyt)", "value": "cff4410ba374a8558c051f15e3b81af103a7eca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780886964, "uuid": "2b114e50-1b46-40d0-a10c-1088aa8563cf", "comment": "Malware payload (Gafgyt)", "value": "ef9c10374040805a95adca6f9dfeb28adc9b9bc5cd6bdd22076c97363ff064202970232eec7ff482561e540f0829f872", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886964, "uuid": "35b8b80c-3666-439d-b968-db27e7f6464f", "value": "T107935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886964, "uuid": "2b9e9aa5-d856-470f-b4ad-39a6d98f9348", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3zyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKDifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780886964, "uuid": "fe975747-0cfc-4d37-be43-54bb46c167be", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780886964, "uuid": "b89b6e6a-33da-40a7-8749-c2d1df971fcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780886964, "uuid": "3dc7f831-e0f9-4dec-aa0c-8876f6272465", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df813334-634a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780930865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930865, "uuid": "1a28bf26-aec8-446c-bf0c-f5fba0385b9d", "comment": "Malware payload (RemcosRAT)", "value": "cfde769bb05a71d9bce8d44f88e00069", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930865, "uuid": "fa4b5ec4-421b-4f52-89d1-9383ebb63a45", "comment": "Malware payload (RemcosRAT)", "value": "6ed0aea26248c38f2ae3e12e790a3aa9807d93b68e227c011388ecda2c85f3e8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930865, "uuid": "fc3a4b4f-2445-4fc9-bf27-e9628b38ae52", "comment": "Malware payload (RemcosRAT)", "value": "cef180a7b237db3f3e7b478645264c44367a9719", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930865, "uuid": "800f1c8a-3d24-4166-903a-6e5ca5414b5a", "comment": "Malware payload (RemcosRAT)", "value": "b33078fbab8ef3b316d279a08382ce32546644e61cc768a523e5f9edb542221b51023f614d83ee7a89f8bfae503c24b6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930865, "uuid": "1d3196cb-01d5-4913-baf4-bd79d0a476f0", "value": "T1265480F14C6AF391B2EAB1D4098D4862D53C389ADF1F5D0F24C51A240EB549660FFAAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930865, "uuid": "e7185e98-ce02-4270-afc2-177c7bdbf48d", "value": "768:oGaWQsak6+8HdDizaRQqxjn5cMZ+aRQqxjn5cMZhh+oZLueITs8bnraRQqxjn5c+:oHXWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780930865, "uuid": "a8f1a36e-abb4-4e09-9d61-63b15fbd4bf1", "value": 285365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780930865, "uuid": "27a8ad20-7ec3-4e7a-8421-408c8bdcbabd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930865, "uuid": "cd42e586-270b-4dd7-ba0b-d5b37ab73d54", "value": "107.173.9.85_807_greatnessideadsbeomcebestthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01b9538-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780908076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908076, "uuid": "c3ea0b4c-2590-4373-a3c8-d0bcf47921e5", "comment": "Malware payload (MassLogger)", "value": "44ed95b5f7fd8e9d870f6f1e091da118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908076, "uuid": "a6e6627a-f5e5-4f6e-9974-171c46298b2b", "comment": "Malware payload (MassLogger)", "value": "6eec837ef183484c588803026b979cb724909e5f62923786c771b6a38bda35e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908076, "uuid": "3e9886c4-22cb-4522-ab70-d1dd82f405c0", "comment": "Malware payload (MassLogger)", "value": "6b911c3192088319ebfff1c8b86747457b5df132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908076, "uuid": "5bc7c45e-b8f4-4b3f-9059-0cb57203ad29", "comment": "Malware payload (MassLogger)", "value": "19cf01eab1b4492be5406aa8f198e0d45e5423d00d2ffcb2359e687d114187ee032d871272f3b796b3ad860d2650d5e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908076, "uuid": "54eaf4db-8a19-4e16-81a9-df904672c28b", "value": "T19B350114221EDD06D1B79FB84871E7B006746E88B971D312DFF9BDDBB839B816908382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908076, "uuid": "3ffc51ad-c40f-4d51-94de-da5d71831773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908076, "uuid": "4ef354cf-e649-4511-a971-5f80fbc77fc2", "value": "24576:FVRptSkmUcDK0wBZOGHEF7jcQ6fyhrFoopNJu8M1P:nzyGBZDkljcvf4f8xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908076, "uuid": "ca1c213b-9223-4d28-bdb7-90be3a47a32e", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908076, "uuid": "03756754-cdf5-4954-b9d4-5c8ec082b493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908076, "uuid": "189a6247-fb93-4865-99ce-c74d3e4ac575", "value": "6eec837ef183484c588803026b979cb724909e5f62923786c771b6a38bda35e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd723b05-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780908152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908152, "uuid": "ef66f671-3695-4768-9d21-18a468c479cc", "comment": "Malware payload (a310Logger)", "value": "8d48ff0067c832e120642acd5474171a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908152, "uuid": "a9b7a4dd-61d3-4110-8f09-0ee5451bdfd8", "comment": "Malware payload (a310Logger)", "value": "6f03eb92fdf7df04859a0e7961264d8f8324df23593ba98bc7163f24a08e2fe5", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908152, "uuid": "adbb7e6a-54f6-4adf-8623-bcc1637cd9a1", "comment": "Malware payload (a310Logger)", "value": "6218e10327249687fbe1ee54f2e11dd6e175ec98", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908152, "uuid": "83be7406-49e9-4502-bd26-e7c7e4f68eb4", "comment": "Malware payload (a310Logger)", "value": "6d273eb6c2965dde5392242adbae84e83f2d65ed0b1ec32e4726ba77227442aaba17130260cbace874565ba0ac830e00", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908152, "uuid": "3e5cbe89-b705-4dff-b89c-96bcc60c121a", "value": "T11E944A13EB60A11EF1A389B0B8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908152, "uuid": "a48941d0-caf4-44a9-8fef-1e12572371d7", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908152, "uuid": "dbc84f98-0032-4c9a-ab2a-052acfb04fa5", "value": "6144:1c8d1/w5KA81IJ8GpF6nuTmOOUiBUrjg/NnQA+4DtU+tcaEXwtVylZiR1GW:1vjYKkJj6GmZUiqrKpRtHEsVylZin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908152, "uuid": "2c35d3a3-fe0d-4a8f-96d0-81853caf2937", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908152, "uuid": "a3d43c44-5103-4be2-b084-176196789477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908152, "uuid": "4bf06901-305f-4477-b180-7c737225b42a", "value": "6f03eb92fdf7df04859a0e7961264d8f8324df23593ba98bc7163f24a08e2fe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecc878d-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780911295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911295, "uuid": "da1e8fb9-81bd-4915-ac1f-c545dcdd040d", "comment": "Malware payload (AsyncRAT)", "value": "9eb53d84d13d6d83a963b77eb484b6be", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911295, "uuid": "6c9a58cb-101a-4127-a317-47e8243a18da", "comment": "Malware payload (AsyncRAT)", "value": "6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911295, "uuid": "5ab87630-8ad1-4fd5-97ff-9e4ee0bcc117", "comment": "Malware payload (AsyncRAT)", "value": "8145e319f133f9fa7f958903a93ad9495aec9272", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911295, "uuid": "d9da8c28-907f-4f36-8095-01797c4f2e52", "comment": "Malware payload (AsyncRAT)", "value": "5efb2d6f3aa2c094f3628209fc109f4428eb97c9ff234a573185dc022ac9c7f473d900072ac1c2de17cb0145cd7ba681", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911295, "uuid": "e05c8696-66cf-49b6-869b-c6e146f8b8bc", "value": "T1560501887665D40BC66993B44470F5B853B91EAEB811C7868FE9ADEFB5FAF048D00343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911295, "uuid": "a0f1dadd-621d-4c04-8689-efe4c0f3df82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911295, "uuid": "534fd29b-a6da-48c6-ba43-9b491b6fb3e1", "value": "12288:NABp1ZIrKyVVon0kLVaQBnrbWKtPQ2tl+6A0Sm2NaF7MnB/BNaj6XU:aB1IonxVasfJFu6eNCs3au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911295, "uuid": "38065705-39a7-4894-869f-e40dc36b1dd2", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911295, "uuid": "2fb7be20-8bf2-4c61-8c16-51e2b09d37ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911295, "uuid": "52bdf723-b074-44a3-94bb-4a443d0ee558", "value": "6f3f9135288d85b5f287047a91cab2bfed9b5b91c72595dbdd1437f58276dcd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12306bb-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911540, "uuid": "0616dc05-6ff7-42f9-80c7-5fc23274a907", "comment": "Malware payload (RemcosRAT)", "value": "354d4260dae3119b502855394257e29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911540, "uuid": "a7beca57-b99d-44bc-af32-e7c603f8f6ce", "comment": "Malware payload (RemcosRAT)", "value": "6f430ac51e67774e14b819c59c1654a58f3e23ca73c6a31b0c450ef0abcebbb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911540, "uuid": "c066f118-525d-4330-8628-facf7150ac9e", "comment": "Malware payload (RemcosRAT)", "value": "176d653c6699c8de81e64f15bba68b24b28cd79c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911540, "uuid": "25f7b410-c066-4768-ac7f-d6eab6f7f972", "comment": "Malware payload (RemcosRAT)", "value": "f4ddbb63ce839da152940d76ad6df7761d79c22395c17bd9a3c05382b0bc23f50c606615e1de7998645ec679452e35bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911540, "uuid": "8980d79b-6841-47f1-b6c8-11948cca9782", "value": "T1D7C402E17B94B58DC1500CB0A1269B50C967FD7381E10E6A23FA3F2F4B7B942941F6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911540, "uuid": "bcaa053e-3234-4ca1-bdbd-7298eed3b698", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911540, "uuid": "620426c3-982f-4f41-a066-3f49e35d5088", "value": "6144:vh0swf5ARjQAUTz3HLuVvk2NCXqnfKvtHEi68t1yr4T8r8QRjfDt+CaZTYVYg4jI:8f5ARxU3wjNCXtNC8TmLf5+CaZTYV12I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911540, "uuid": "7e1a9d71-6309-4074-9dc0-45a2714bd76a", "value": 590173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911540, "uuid": "f9360347-6aac-4584-9789-801f3a394bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911540, "uuid": "2681e32e-9f45-4b84-b67e-4608c55d514f", "value": "6f430ac51e67774e14b819c59c1654a58f3e23ca73c6a31b0c450ef0abcebbb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2865223-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780907677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907677, "uuid": "0aea3e79-5e66-4c7f-b346-2fd5ca6374b2", "comment": "Malware payload (SnakeKeylogger)", "value": "56850f45ca6db939a9d328e485eb32d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907677, "uuid": "1d7b1433-506e-41d9-9f3d-de20717b751b", "comment": "Malware payload (SnakeKeylogger)", "value": "6f69ec51896964375cea2778bfe7632c0086f8761a44b1afdc108c9be1732cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907677, "uuid": "239594cc-be12-4fa9-9ef0-cfb066d0c798", "comment": "Malware payload (SnakeKeylogger)", "value": "435c90459585d6162d18c1e2f1a28df26259a308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907677, "uuid": "844b6ebf-6f02-4996-b702-5a28da8c2a22", "comment": "Malware payload (SnakeKeylogger)", "value": "06288f4493cec369557f6fa7cd62292f566d50aad92f0b31a99f77091335d1925aed88119b4d7d8ad05ccfe92ac2c8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907677, "uuid": "f2fd773f-c0c4-42dc-9f76-446a87da7d7a", "value": "T14B150154621AC912D8C64FB12870E7F861388E88D902E393DFFBBEAFF47E5553905291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907677, "uuid": "52acb81e-0729-4728-9949-1a035d7dc284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907677, "uuid": "8ffafa73-260a-428b-9c75-29503ae6cf28", "value": "24576:/4TS1AWiRxXP6r6IfpTchyyhpk6858dBQAmiLWw:/44biRxE+k68uBQAtLWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907677, "uuid": "f08132ab-38f8-4200-a46a-a7ced385365e", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907677, "uuid": "1e75a04d-12bb-4899-8b8a-072cfbc2c351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907677, "uuid": "d2e25832-0bb0-455b-b875-3cbb97c32827", "value": "6f69ec51896964375cea2778bfe7632c0086f8761a44b1afdc108c9be1732cd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341378be-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912538, "uuid": "2ee8ba55-d83f-46c9-9731-c10a3be99ba8", "comment": "Malware payload (AgentTesla)", "value": "6cba65aed1445e55ee8c64811e6d0fb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912538, "uuid": "15ac56db-1470-4e6e-9edd-c2eb9dfc4594", "comment": "Malware payload (AgentTesla)", "value": "70aa72621fe77f8b06cf7d2e4486eb35a3a2528e204217ff6677865f024ef540", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912538, "uuid": "92062aee-5e41-4cd4-aeaa-34ea5264e05d", "comment": "Malware payload (AgentTesla)", "value": "87401ed6c3e9bea3ba8461180abcd74c042a2822", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912538, "uuid": "3677abd4-4d51-4fb6-bba7-71ab533cc8b1", "comment": "Malware payload (AgentTesla)", "value": "1a3daa7435b38e982c154b1347fd17544b8ab79da53f2bab2d7e8ecf536e9325e6f6d6683ae91671059cabdbf63488d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912538, "uuid": "3dac801c-7266-41ec-bd19-40ce88fa12d8", "value": "T1D5D41D1AFD50A02BE4A789B129688D46BE183D3117A0EC6BB7412BD534745BBF1F0B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912538, "uuid": "a2701b8b-d8fa-452d-8ff4-6e3de6b4ff15", "value": "a4e30367f0ec17ec9fa457181e7b8058", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912538, "uuid": "3f35262f-80e7-4641-b805-9f53dab32a4d", "value": "12288:rHcZ+aGHRu7f8Kp/RpOzwdGom0i8o5HWP4NvOgmYvhdCf:rHk8IpvGom0q52P4lbhdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912538, "uuid": "c65d674f-2362-4e1c-a161-892d47508a50", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912538, "uuid": "459e8f08-2313-4f0c-af4b-ec8c98c85f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912538, "uuid": "c3cda577-fb2a-4dca-a3b5-c710191cec33", "value": "70aa72621fe77f8b06cf7d2e4486eb35a3a2528e204217ff6677865f024ef540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8011624-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780908008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908008, "uuid": "6624b617-86ac-4b71-93d2-06af87bb208e", "comment": "Malware payload (DarkCloud)", "value": "25495293d0da235723ca5f73ea5d57ed", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908008, "uuid": "fe6520a9-78eb-47ed-b8c6-8c4008909dc6", "comment": "Malware payload (DarkCloud)", "value": "70e95228936f5ed7c284e8cc9da8d1789c57880fb22ec3a6e1d8ba58a4a39fe5", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908008, "uuid": "971d1e02-f293-4c2f-a36e-b68860a710da", "comment": "Malware payload (DarkCloud)", "value": "9a1dea8b5b35302efaf896fab9802eb07837d1a0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908008, "uuid": "b90a0ed9-8885-42ee-8d6c-a8ce01f46d0e", "comment": "Malware payload (DarkCloud)", "value": "309c7370360fd7275999cf19cde372f7d9bc9ab2faf1b5fd42164c2662ec2baf5aaec3ca60374c6ff84d9b2e9c179f80", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908008, "uuid": "1784e97c-b6a0-4533-83ce-a94c48125c9a", "value": "T10A551254231EDD02E4BB87B55870D7700BB4AE88FA65D2038EE9BEDBB87938158153D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908008, "uuid": "e6a44144-71e2-4ed5-b43d-1afba4d179f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908008, "uuid": "00dace92-16bb-4487-b7a6-d9ef857b2964", "value": "24576:wSRS4gNf/IgQAuGw7G5JM+9e5XRYEvKluz2FTB1LYZ:Bc4gN/jdp5JMz5h/Ku2Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908008, "uuid": "8ab75970-3e96-45cc-85b6-120d508409bf", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908008, "uuid": "ebd5c6a4-53a5-4ea7-ba1c-c6fd979d6213", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908008, "uuid": "be8b83e8-d3aa-465f-95f8-46b1c13517d0", "value": "70e95228936f5ed7c284e8cc9da8d1789c57880fb22ec3a6e1d8ba58a4a39fe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581eb2de-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912169, "uuid": "63d0645d-5b2a-4ce3-99ae-c9c014b5b5b6", "comment": "Malware payload (Formbook)", "value": "fd095e2fff91161a1d47e91a648686e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912169, "uuid": "b5a2857b-165d-43fe-b1a3-3125f37ca807", "comment": "Malware payload (Formbook)", "value": "70edfcb964830c49cff06700f4fca9aa5eca2e4fcc93f428da4ee151b9fe216b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912169, "uuid": "fffd0a2b-ac74-4536-9067-b3eb013723b3", "comment": "Malware payload (Formbook)", "value": "c3d695cadca525bc897c5ef021b3a0187b8e205b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912169, "uuid": "5981d3dc-ced0-485c-8d3e-a9153eb0ad71", "comment": "Malware payload (Formbook)", "value": "ef7de95d2fdda08470650ef842f6d2d0d491ba5b44e769a94978b61d8221cff8fa51b827a65a7f388c008a1410198239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912169, "uuid": "4e4756ad-a8d4-44a2-8ea7-9e3fdf5c5cb3", "value": "T1722522B4EBA9E512C8D24B352CB1D33107394E5FD910D2EB8BFD2CEB353A6252D29641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912169, "uuid": "59fb7678-ba2e-4d07-8bf7-a018ef1e7cc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912169, "uuid": "fcc6acd8-0d4c-4426-b784-b48e4678f6bf", "value": "12288:v44K8yKp8kD7c139cxy/WQeH8UZk2giJzaG2/byvxQ8vUd/n6d0N3MKNEMBG0hUS:vJK8/a3GxzQEhJzJaGSAZ+ooG0hVG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912169, "uuid": "730df9e4-a49e-40e7-8df7-c8641babf71f", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912169, "uuid": "12d11344-e24e-4390-81a5-9523f89ae86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912169, "uuid": "de41e9f4-5cca-4a6f-bf41-6ae7a8f95b4d", "value": "70edfcb964830c49cff06700f4fca9aa5eca2e4fcc93f428da4ee151b9fe216b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274b5ce0-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912087, "uuid": "36a72d9c-597b-4684-bac0-60041fd76579", "comment": "Malware payload (GuLoader)", "value": "f8b1a6f2a7bab6ffdef1e78a48e7a7fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912087, "uuid": "cf781d9a-4b8f-4389-bfa4-a1fa7d419a6f", "comment": "Malware payload (GuLoader)", "value": "7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912087, "uuid": "2ef9d12f-79c2-4771-81f0-e53c6b5af716", "comment": "Malware payload (GuLoader)", "value": "baa1a354622fde5fa03e28bc3eb4f15433a96e5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912087, "uuid": "c32ff97c-77a4-4b68-a5fd-3d57daa031d2", "comment": "Malware payload (GuLoader)", "value": "7d70565f8c6e4bf52a62676d4f5da2bd2fadabac3ef66af6277f52ffdab0451fe9021095d6d8d10566038e898576c0e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912087, "uuid": "9dc270ea-0472-4490-a794-e19e72dfec18", "value": "T13E54131271A1CCF7C3A82372893A6B6C4EFACD492180730BBBD47F0AAD737515926657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912087, "uuid": "9a840a3a-f1fc-4943-a577-a812de8f16a4", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912087, "uuid": "3544ff7c-f959-40f6-bb9d-19586716325b", "value": "6144:+8dWR9kvIuX9RdmKeG7oguuK9kMu9nliHxcUG3ARyQfVKrFj1L1Or2YzKN3:nMRavIsoKpoFJu9g43ARy0VKrROrvo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912087, "uuid": "5fba980b-8bd1-4721-8ffb-3071d5c3a762", "value": 304912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912087, "uuid": "19b48ca3-353d-4046-b1c5-2657bcf65aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912087, "uuid": "89ee1d40-fbc6-4199-8a3f-b26424a6b163", "value": "7101c5945c026bef41d2cbf5bb5865976af92b56d326336b89523c385680f2aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4371713-62df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780884890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884890, "uuid": "b8428e9b-7ca0-4522-869f-3279ec6f9cd1", "comment": "Malware payload (Mirai)", "value": "b9116a726f27b125ca54dce1a83b6548", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884890, "uuid": "6e5e30c4-e0b2-4baa-84c6-331c563ede32", "comment": "Malware payload (Mirai)", "value": "7112f8eb2e2de44a0cc064f152866eb6a1ab072ce387df3e2207b24c527a0345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884890, "uuid": "e84956d4-24bb-45c8-9853-3bb1f66ac0bb", "comment": "Malware payload (Mirai)", "value": "cab19bf7eaca2af218c77fef52a36625f451503c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884890, "uuid": "aec7e505-d2bb-44d5-9a9e-0fdb85ab43e0", "comment": "Malware payload (Mirai)", "value": "82a8f0af3212b58c8bcf1ba0879462773ee2ae2c5e7bd2926a1b6a89b3e5487e1e8cd383af742dc070de892a2e63688c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884890, "uuid": "70e60941-1d6d-424b-9237-0d6127770d49", "value": "T1EDD32A56E7408B17C0D31779BADF42123333AB94A3DB73069528BBF43F8679A4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884890, "uuid": "d08adb59-9766-426f-ac45-3b776dcf6915", "value": "3072:gW+ic8vqaEEkfnONGaAqtB+ws78LoM/921yZ:gFcqaEEkfnaGaBps78sM/921yZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780884890, "uuid": "c271a11a-484a-4714-a0b8-bd3711cf22fb", "value": 132091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780884890, "uuid": "b6ffa3fa-6c4c-4d6a-8370-b47211b62d71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884890, "uuid": "e01f3128-d54e-4891-acf8-d42b02a6ad2e", "value": "CRY.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcaef87-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "d5dca3b8-210e-49ed-84b9-5c0743d0e076", "comment": "Malware payload (Mirai)", "value": "b0a228a251327379708970cb1e8c2a8a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "d3309dd2-78da-4960-8252-e86c5b8457c8", "comment": "Malware payload (Mirai)", "value": "718b13e943c387dee64c28faa958cdb9010f87e321a8d2ca5d94870f752cd2b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "facfb8a5-d79d-4a24-949d-f13e9ca7c99c", "comment": "Malware payload (Mirai)", "value": "0e0f915a5772cfc358079466c8f9938584d45043", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939583, "uuid": "6840106f-6203-455b-ab72-43bb3232d8f6", "comment": "Malware payload (Mirai)", "value": "1763c69ad153772a9a690b15eb3a168530c8a3773ec0ddfd815b55dd021943b792721cf8f3f8a87081e8a6e59fbb0c06", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939583, "uuid": "7445b70c-cd69-4484-8434-80efb7cfccdf", "value": "T1DD932A03B58090FCC5C6C1344B7FA636EA72F1ED1275B69A37E4EF222D4AE211E2D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939583, "uuid": "cd7a96f9-8132-45bc-bd2d-1678f03c07c3", "value": "1536:KPvjFFjrKGGg17rsyCcpUu1v/43WL4vwi252xPSUUN4J+LtR:KvjLrKGG4syfImLviNxpUN48Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939583, "uuid": "c8a730dc-7d6b-43f5-b3ee-3893d41fa480", "value": 89232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939583, "uuid": "b5a78bd8-aaaf-46e1-ad50-5f5bf73abe2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939583, "uuid": "a5317493-4b77-4e46-bc71-72250134f7e5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9913e60-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780911125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911125, "uuid": "e1635a2e-6839-481b-a5e4-9e9ba0ebec08", "comment": "Malware payload (PhantomStealer)", "value": "7f51ce02e779a26853855ab396d9935e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911125, "uuid": "cf92c7a1-1187-4db6-85ee-489c770fbbd2", "comment": "Malware payload (PhantomStealer)", "value": "7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911125, "uuid": "508d8a4e-70e5-457f-a9c3-69f22fd8fd76", "comment": "Malware payload (PhantomStealer)", "value": "b501410f784bb1607e590a34d6a8dc7bdec781ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911125, "uuid": "eceb350a-c811-4e0f-a2d2-50623f770509", "comment": "Malware payload (PhantomStealer)", "value": "8b0d2adbbadc2c7e2083cf136143258a51fc6f3789aa03b203e329e1f87def7c851a67443ee23285906ba1482f516cdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911125, "uuid": "f201904b-3177-46e5-9138-6c5298fb8a2f", "value": "T19D6523582A1AC207C5839B740AB0F3B417A98DDEF412D6475FDA6DEBF5BBB050D042E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911125, "uuid": "48a2fe2c-144b-42d7-b6ab-c54e663e5a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911125, "uuid": "cff86914-af4d-4a73-a429-d79a2dc2fb81", "value": "24576:SNIBM0dvhyQ79MRgZUEq428xoVxig+z9py+K4CBJNXm4mALyNfEsZP:kIiihr79yuUuoyg+5c+SXNXm4XyNMsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911125, "uuid": "5969e10c-4e0b-4345-a872-4b8ca0d4ee0f", "value": 1520640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911125, "uuid": "8dde7c81-1cbb-43a0-a3d4-0ece36943d76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911125, "uuid": "288e78e4-25cd-47f6-abc5-9cf62202d075", "value": "7196e1100732cd16d74ba8099bbccc87077a8ce3fe2c4862e2ec6bec76ed2992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3dfe1c1-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908082, "uuid": "dbefbdfb-680c-40c6-a910-77cee3f33637", "comment": "Malware payload (AgentTesla)", "value": "9606d90494e374544c65f7f768b36df9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908082, "uuid": "8a962ad9-1579-446b-b759-0554a0f051f8", "comment": "Malware payload (AgentTesla)", "value": "71d64c0ad1445535eb9d1925632ea8d82c0f18a21bebbb1641df643eb9d26b0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908082, "uuid": "45d496b6-2c10-4239-895d-e2e15e2d1683", "comment": "Malware payload (AgentTesla)", "value": "cc45392cda7d554e609fa30907f767d39bd14a27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908082, "uuid": "88043397-97eb-4a9c-a374-c2377213e847", "comment": "Malware payload (AgentTesla)", "value": "19e6acc28043e8e61df6333974caa404451c5bb93239c270d58aac2456f81306f44871993b39fc0d711a490a1b9dd557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908082, "uuid": "d933208f-3748-4264-98f2-deca03b382ec", "value": "T162250104231ADD02D4FB8BB94870D7B407B46E59B931E3129EEABDEB78367819C153D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908082, "uuid": "2d24f794-9820-4517-83ff-bf85286d5cf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908082, "uuid": "1f3253dc-7d54-4e4e-88c1-fc35aef92332", "value": "12288:CmNLL9MaurZgQ81wM5WsUiRG7mcrTLysailrSecpEEOio1CygDdgh8zXOS5Nv8Dm:7RSY1fkniHcjyPerS+qpDdHOmMRFaci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908082, "uuid": "c2410b95-7308-4ec8-abb3-45cae12640c0", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908082, "uuid": "696d25b1-11f1-4943-86c0-97178646d594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908082, "uuid": "4528e5f7-3b70-4251-aeac-313a45d0dde2", "value": "71d64c0ad1445535eb9d1925632ea8d82c0f18a21bebbb1641df643eb9d26b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb16551-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910729, "uuid": "e401e125-7490-4b84-bc91-86c920ba8b78", "comment": "Malware payload (Formbook)", "value": "2a9dc9fdf7063fbe500670a227b743a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910729, "uuid": "d49282e5-a40a-410f-a683-4c62c8eaa383", "comment": "Malware payload (Formbook)", "value": "71f20789c8b004bedb2c36af611d4543c5cccafd3b9e02953da9e008a9638c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910729, "uuid": "a0cc59cc-b02f-4d97-b4b0-e08b233c8318", "comment": "Malware payload (Formbook)", "value": "b029459d596e100f7c45e0169586630536461fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910729, "uuid": "3874558c-af1f-4ae9-b87b-71505b5d5228", "comment": "Malware payload (Formbook)", "value": "1d1ec05c8a4a3714d609eff4af1d14b0afc063ae50ce637c193894ac61c0556d38a3c6ce160a36eaa9703b1d948dd516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910729, "uuid": "ee66f991-b381-47a3-9ced-9358eca0ff9d", "value": "T12E252241161ED407D48D4FB129A0D6B527784DAEE620DF03EFCE7EABB9B87201A64317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910729, "uuid": "90159aac-fc2d-435e-b44b-fc558b5efdac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910729, "uuid": "fae93199-4338-4436-a384-f1f52ba1866d", "value": "24576:dCnNmSxvX/sR/PFe01b4tiywRd+uoQLpY9GOlbgUv9Bo+F+wNt6IvX/nNr:dCnNmSxvX/sR/PFe01b4tiXG9Qd6GRGZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910729, "uuid": "a101cfde-af08-4215-b146-be1617bf0564", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910729, "uuid": "f59fc222-cb14-4282-acf0-7dafa82a971e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910729, "uuid": "6d48fffc-d036-4357-82cb-af6f7cf6576b", "value": "71f20789c8b004bedb2c36af611d4543c5cccafd3b9e02953da9e008a9638c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f115a2d6-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (SVCStealer)", "timestamp": 1780911138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911138, "uuid": "7f6319c8-d01f-471f-b411-a92be7a74e29", "comment": "Malware payload (SVCStealer)", "value": "5645c1c3a6390aeec9b0ac9372517bb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911138, "uuid": "3f95702d-3a9b-4af1-b90c-edf7cf0c5d31", "comment": "Malware payload (SVCStealer)", "value": "722bd4df8cbfc74ec64bc8cb449856160251099bd416fd70e26161917034ae2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911138, "uuid": "747c95da-43ff-4e71-ac77-56fbc467b21b", "comment": "Malware payload (SVCStealer)", "value": "1732840ad569c056fa9aa8c4fa310e7dd8787df9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911138, "uuid": "9881d64d-dd8c-466e-8678-a7f070c133d8", "comment": "Malware payload (SVCStealer)", "value": "f944e32034e3e2401552e4fabce09f4c4cd4e6b52c9d00c52779d3f4171432accc56b48fc16d8a9c2333b1d298afbb6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911138, "uuid": "0de1692d-8e60-4407-85db-ea26296a2fc1", "value": "T18F559E4AB2B400FCD557C178C5165A0FEBB278061374ABDF5298CA5A6F13FE11A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911138, "uuid": "d1bf9ba4-0433-4f4b-8f08-3598a0666961", "value": "5f6a43a1159e2e41207b962a097e6db2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911138, "uuid": "2c4b65c5-d581-4d5e-96a8-94ff9ab2e367", "value": "24576:qF2+fPeS080OrBjWACMs9qpL5KImt0y+S5G0GgDy:ZSKO9KACMsjhtIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911138, "uuid": "1b78de72-7b53-430a-8490-3d5c9dba1aff", "value": 1338368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911138, "uuid": "adbb792a-f2d1-48a1-822a-a05a940cd74e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911138, "uuid": "754531e9-1c0c-409f-a0d2-08183e53670c", "value": "722bd4df8cbfc74ec64bc8cb449856160251099bd416fd70e26161917034ae2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd4683c-631f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912367, "uuid": "a3abd442-f6c4-496b-a8e4-5bf2d11d6183", "comment": "Malware payload", "value": "69d2a6b56c0cca9838c9d2302640c2ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912367, "uuid": "1f01d335-63dd-4937-b8cc-856f2397a6d2", "comment": "Malware payload", "value": "723429c5f94221e490d0eda8adb0273441f11b5414cff21614b8aa23663a817a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912367, "uuid": "c8eabd27-40b2-4477-90ab-9b7d47020d2c", "comment": "Malware payload", "value": "ddf68c3b810d6492d8bd6de0cec53bfeb3e46aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912367, "uuid": "9701d255-0717-45a4-956e-f8f687fb26af", "comment": "Malware payload", "value": "f21c01792249c3ae0ab04455c3e90f0f904c3580c79d70a7bf7a2dbf7f33fd70af74b7fc38c55ba3a2d562b8a928fdc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912367, "uuid": "a1b9d697-c288-418e-a9ac-1911f763cf56", "value": "T1EAE43116ED21A02BF497CAB029789142BC197D3217E4AC4BB7402BD970759ABF5F0B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912367, "uuid": "b87ce060-7ef1-492a-9495-3e6bfab43b7a", "value": "ab659a3466774c7a87c134b06ed272bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912367, "uuid": "94110b94-cbbf-4222-92c4-8bc57ca99516", "value": "12288:8039gLLYowlq+qoYCOIE0OntuV0kVVBnxTpG8rm9Ei1s3oDs:v0Yow4/kBrm9E53oDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912367, "uuid": "8352bbc9-ea37-424e-bbe6-faa9b01da16b", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912367, "uuid": "3849a390-1357-4a90-997f-2ac9477d7655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912367, "uuid": "d5e78a65-f959-4aea-9147-1d3e829325df", "value": "723429c5f94221e490d0eda8adb0273441f11b5414cff21614b8aa23663a817a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e334657-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912126, "uuid": "2e838935-8564-4731-a9eb-626f3de44cac", "comment": "Malware payload (Formbook)", "value": "cb1ab525ee54541ab8438784690f9a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912126, "uuid": "9be504e9-c3c9-46a1-9825-a5db47eb0969", "comment": "Malware payload (Formbook)", "value": "72626a13946d1ec71bd3a688d45cdc5563d092da4d1d933d1639565618e7cf0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912126, "uuid": "b528124b-b11e-44c3-9539-e2d482634065", "comment": "Malware payload (Formbook)", "value": "83f5e0dc095720bf2d642e30292eef2d27904cab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912126, "uuid": "578c2957-7fef-4ebe-99db-037bc7ba6477", "comment": "Malware payload (Formbook)", "value": "c359b04a72c55e24086ea4c1f4138b8a99b548a3e13e82250d0b68d71c5e4d7d87ab78ad4fcc37761545336eb8810610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912126, "uuid": "50ba7b05-5840-449e-b284-3ebbc76fed33", "value": "T1542523794B89F1A2C9E60B394E71E33A5B249D4DC521C3A78FECECEF3855121691A3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912126, "uuid": "4835389e-5e0b-441d-9ea7-6aad035b6b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912126, "uuid": "d71f4e5a-fd89-4ca0-9d98-635c3f598e5c", "value": "24576:JLbpeEvfw2FxmbzkOsP58RXuF2IAVp64JLpCOM31n:feIP60HFxx4Jy3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912126, "uuid": "e0e2ff8e-0217-491b-a175-dfdfdda1e03d", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912126, "uuid": "82c078eb-243d-4c36-aad6-48d9d32b2364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912126, "uuid": "55cb3b54-3504-455d-bbc1-f3aea6371849", "value": "72626a13946d1ec71bd3a688d45cdc5563d092da4d1d933d1639565618e7cf0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a242bf68-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912294, "uuid": "357e4d78-4efa-4bcc-ae0b-2a7ec3197b10", "comment": "Malware payload (a310Logger)", "value": "9c027762b482038b050e5cba5a7af5be", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912294, "uuid": "43cb1885-011c-487c-90b9-6543df3b81d1", "comment": "Malware payload (a310Logger)", "value": "728ac47291c7eb020ce10ed5ec53f28ca03d6c7600db9ca18f702bbe6185a5c9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912294, "uuid": "b1993e48-dc8f-4bff-a200-e4e2a3b46651", "comment": "Malware payload (a310Logger)", "value": "74d281cb8ea7f6eba5761e236ccf5b772910fd29", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912294, "uuid": "781cd6d3-fe66-484f-bfd1-82f3ccecf3b3", "comment": "Malware payload (a310Logger)", "value": "67a202760b8210069e339d9e40eeae1a692f5d06d7a7c1f4da48e1d09433251d5bfd055975a182781e95c2c4f37745cf", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912294, "uuid": "391cee78-2679-4213-8c27-9eafb804f44a", "value": "T18E4523F8EB14D627C89A47782E31F3384B780D89D511C39BCFED6CE73858261962D296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912294, "uuid": "0c905fec-dfdc-4524-956c-6376616fd54f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912294, "uuid": "0cf3c9a3-5d8f-4dff-9004-50081bd8aec9", "value": "24576:+wKQqpas6rMXdZIF+SpMopDpozOxGIF2cRWXRUmOebmgeEacZw2:KZxrdZt6vl1oBJbmgeOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912294, "uuid": "63289588-40e5-4bc1-b099-dda46cb8069f", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912294, "uuid": "ab2beb98-78ca-4bb8-9bc0-fb6232ca9c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912294, "uuid": "4955b1ca-3579-4482-8216-d526ba5f118d", "value": "728ac47291c7eb020ce10ed5ec53f28ca03d6c7600db9ca18f702bbe6185a5c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708ba1d0-6360-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780940128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940128, "uuid": "8d692030-b180-4aec-b39a-edc02305d2af", "comment": "Malware payload", "value": "29e27c723ca6775ce15307538cd35769", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940128, "uuid": "01607a9e-a7b5-409d-9ba7-9455e1c156f5", "comment": "Malware payload", "value": "729a43b9ee96bee519dcc0c1aa65ee7a04cc5f979de44f665af77f731fc08897", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940128, "uuid": "ec674fc0-3ed5-499b-8b58-d083ba85bf24", "comment": "Malware payload", "value": "ccea76903e63f00fe028da19c09ed063bdbc5778", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940128, "uuid": "f0063010-ca36-40b3-9e89-a9c89785d890", "comment": "Malware payload", "value": "c5a4a45927e57d74cbf3673866b634fd1f3851015ee89fac07dcae1819e36f357d5c983b7540f54f31378ccaf0a2d623", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780940128, "uuid": "e67f0e23-ae8e-44fa-9d39-12c17199fc82", "value": "T146B413AE450E441FEC70D1F857CDDA17B9283AF0F16A893051C8A55826FCAD9FAD133A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780940128, "uuid": "2d76d40c-8231-4a75-bb98-9d0125abe9b8", "value": "12288:aLXCJO9KfxzmswYahR5E36PlFZfTI+0buls9DPQN5nA4SU:DCKxmblR8onk2MPQN5nTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780940128, "uuid": "6b4d1a5a-df20-437f-b3fd-540257ab15f6", "value": 527023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780940128, "uuid": "ff7bdefc-27b4-45ec-aec8-2c7fd4f11878", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780940128, "uuid": "c2356146-1591-4bd3-85b0-903967d0d192", "value": "my-dress-up-darling-my-dress-up-darling-s2.gif.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4727fab-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780904996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904996, "uuid": "7be6d64c-efd1-43f5-a7ef-908e2229ba2d", "comment": "Malware payload (PhantomStealer)", "value": "8456320b3ba0ddc36e3f0c6101b644a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904996, "uuid": "3d7c2006-87f6-42c7-9723-ebce03bb6b32", "comment": "Malware payload (PhantomStealer)", "value": "72c3ce7925693b6151f39fea70436ab32fee2fe50db39b09f1a3709f340907f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904996, "uuid": "0146f394-fa40-4c6e-9c44-7b0ce2eb59f4", "comment": "Malware payload (PhantomStealer)", "value": "40cf9ede3cb500391d1e7b81660567189de768a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904996, "uuid": "e1c3cd40-7b37-4e61-9cd2-0eebbd95f3f2", "comment": "Malware payload (PhantomStealer)", "value": "07806a800bcace3f54cc1be7ffbeff2ab92ada43dcc1712e5d3d0c371e9c4e61edf696587713cc36847adae6e5a19923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904996, "uuid": "c5ca19c2-ab18-459d-90bf-6139827897dc", "value": "T1F26523182D15E113D4AB1F7A1E60F676033C5EECD802EA4B6FF8AE7B79228E52C55341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904996, "uuid": "63d5ccc7-66e7-41dc-b162-783c06b91a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904996, "uuid": "7ec657a8-1240-4a04-b249-d6205686081a", "value": "24576:PjR93vv8nhbt7YNr47x5Yx0rITsb39MTWWVKCem835mDFMpBMCsWfvoU2:PDvshb1MrQeZC39MrVK0cMFoMpWfvo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904996, "uuid": "64981888-feb5-442c-8f05-95b0d0a4baab", "value": 1498112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904996, "uuid": "7daba453-7071-46cc-b0d1-bce223d35926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904996, "uuid": "2cf714a5-582e-44e9-a652-914a8efa6df0", "value": "Ust_Yaz\u0131 Yakias\u0131k Maliyet Fiyat istemi_ihtiyaclistesi_1062945_Teknik sartname.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c48a09-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780912623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912623, "uuid": "01365266-5dc0-4d48-a949-41ecaadc6cd9", "comment": "Malware payload (njrat)", "value": "69a0b737c1fd43912a9230a86dc05855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912623, "uuid": "e3e1c589-d3ab-4595-8db5-6206c3f116b0", "comment": "Malware payload (njrat)", "value": "7344ca2be06c797df34455ad4b35bb13278be54ee1ef969487bbd2ed79cdcdf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912623, "uuid": "e2d811ad-d296-41ac-ad53-23aad6487ab6", "comment": "Malware payload (njrat)", "value": "d96fb94173bb26d2a1f68cc0fbfca12dffac6dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912623, "uuid": "e3e1e878-e292-4aff-9ad0-c9768a7454ce", "comment": "Malware payload (njrat)", "value": "7d23c417c688f4312f0f5d508af1627f981784bd27053e37766188dc5f96dd239d9e6f18f310ca8aade5cd0e88cbe513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912623, "uuid": "03f70850-f021-430b-96b1-3147738151a2", "value": "T15405126AAE58C823E98917706BB2F2B663649FCDF614C1179FECFEEF34255109808341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912623, "uuid": "286c5380-b481-4a19-a776-10d39edf9e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912623, "uuid": "cc35a86e-c43b-44b1-ac05-3ab54246a42b", "value": "12288:LATAvbQsx6ANML4YF49u2zPc7XZU/0XLotRuNuJznXfVZDTaqAmZloQqjld4:E1ANML18NoXZA0XUtQNu/tTRAcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912623, "uuid": "3d761dcc-458c-47da-94f3-426ed36ab0b2", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912623, "uuid": "cbce1f01-e496-40c5-bd82-944c6871c2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912623, "uuid": "efb69b1c-4bc5-4e72-b96a-33d2a967e8d3", "value": "7344ca2be06c797df34455ad4b35bb13278be54ee1ef969487bbd2ed79cdcdf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e67b39-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908213, "uuid": "aec0598e-d859-4836-8beb-322373e00c33", "comment": "Malware payload", "value": "562c6e8b559f85acc7f4148dbb030708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908213, "uuid": "af8a5c4f-1c21-4243-86af-6ac929ec024b", "comment": "Malware payload", "value": "7388af1ef495f590692f648798b6f10f445f5075842655009355afb53a76f38c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908213, "uuid": "f90ff50f-b012-4307-b5b7-fcd0c2d3c024", "comment": "Malware payload", "value": "f473e83297371f5ba8fe0985e502bb87e5cfc9e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908213, "uuid": "641aa025-3d38-4a71-89ed-0a66d1f86815", "comment": "Malware payload", "value": "7e8ff717f9df83814ba00a4f16107249bd9e8a2c5b435946902393713573f20cc7b4e9bf63fd2723916ad06a4367f238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908213, "uuid": "8c994362-7432-4db0-9477-e94f67ad3ddd", "value": "T1A62512696643D411CA4563345FBF2BD5D3329E280635C20B8BA32AEDDE3B729F4E0E51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908213, "uuid": "360feb1f-5d78-45e4-823c-3f2dbfd335a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908213, "uuid": "ea72df15-bc2c-4c95-8b5b-21c2a6fd8c3c", "value": "12288:+az0FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wE93om7Y98d30qep1r+OB07:+jFJz7c5a8uGrxP95UGd3031FSTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908213, "uuid": "950681d4-f020-4c5c-bfd4-3943be2f4d4c", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908213, "uuid": "010177fe-4d38-4b72-a690-355e2f0fd3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908213, "uuid": "5edd6694-ba4c-4ae1-85ac-a54f84e3e070", "value": "7388af1ef495f590692f648798b6f10f445f5075842655009355afb53a76f38c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8a3022-62df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780884954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884954, "uuid": "b21cea4f-3ac3-47f4-bed3-42b57f5f578a", "comment": "Malware payload", "value": "b4fc89946e2f025c30961a62f5231b61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884954, "uuid": "f5117a72-1d18-40cb-bbd6-c61fa0292520", "comment": "Malware payload", "value": "73d5fffbc52ceb637118839c5afb9cb49e39b21767d39cf8cd9058f52f3614e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884954, "uuid": "1d73992e-ae03-4937-8aea-2e3b09620e06", "comment": "Malware payload", "value": "ea58f206691414852bd2796e2fdcabacf5b1b592", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780884954, "uuid": "36198c9e-ade7-4622-8e39-8f3cbbf43b55", "comment": "Malware payload", "value": "0356edbd8f615850f6949cfd13bee9c4a20d72615a48e176a026dc49bec9a79d812734e28c07a2deb3df8a35554f6a44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884954, "uuid": "3295bc78-cd64-46a5-a620-d1745a080141", "value": "T17B761957B8924942C4E43A37B8BE81C432634EBA8BC7125B6D15FE383EBE5D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884954, "uuid": "1422f59d-e27e-49d2-9618-09d3571860fa", "value": "49152:B/ILDNxtVg49bZ5GE6smgs47M/SN7WjBJtTpiB+Muk5E2:ByDdVg49bZ5GE6s10tJtdiB+QE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780884954, "uuid": "6db31c14-b599-40d2-a09c-e333c158c0bd", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780884954, "uuid": "27377241-8980-4261-b421-cd3482a4dd38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780884954, "uuid": "46ebf3c0-f282-4434-abb1-6fa1c1d3d177", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01631fc0-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907729, "uuid": "ece1befd-5f2a-405c-ba98-d521db502cc9", "comment": "Malware payload (Formbook)", "value": "5b6b4f7c36e2fb53406a5c88fa0e4d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907729, "uuid": "c6e982ba-d326-45df-a9a8-25c75d51cd55", "comment": "Malware payload (Formbook)", "value": "75034f17faf36dfa1b04dc6ee86a0f5b99efacdb94985814a4fc30ad2ebc48d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907729, "uuid": "13bc5dcf-32b8-4d44-acb6-fe3724b4cdc2", "comment": "Malware payload (Formbook)", "value": "d2fbeaee2feac8ece16aee704d47e3ff9ec819fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907729, "uuid": "f4770682-3e1f-4eb6-ab04-376a8bf5e0df", "comment": "Malware payload (Formbook)", "value": "69a243eef02bf6069513c3f95c1e0586767f3b706c207bde3d4c0821feb36ab8300fa3a4d965ae42354623582d31e0ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907729, "uuid": "cd3239be-ca21-4aa0-97cb-cd9e26298f51", "value": "T16D351254A31EC806C4C65FB029B0E3F956388E88E915E313CEFABDBFB47A61539452D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907729, "uuid": "0961e38a-ddad-4d99-84d9-85e5a605b902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907729, "uuid": "fa7c02d0-a977-4e22-acb1-eac5da447529", "value": "24576:44TS11Iy5l1r34FVvd7zzJxCBJqAdaKOp8FxJdKp:444Rr3WBlzNxCBscOeF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907729, "uuid": "a5a51500-cb77-4505-8b2f-a11d7ccd3630", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907729, "uuid": "296d9a98-2bfe-4a84-829c-560ff3e28a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907729, "uuid": "d88d39b5-2758-4cae-ae34-a0d5317d5b78", "value": "75034f17faf36dfa1b04dc6ee86a0f5b99efacdb94985814a4fc30ad2ebc48d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f18ce5-6313-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907258, "uuid": "6fac506e-f7c2-44ac-b025-02d2735af668", "comment": "Malware payload (AgentTesla)", "value": "1f00cdf99d72820be55904876fd12b1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907258, "uuid": "86db910c-f97d-45e7-afe4-4b81c7bceb3d", "comment": "Malware payload (AgentTesla)", "value": "754891192ecdc6907781eea6ad53ceab51fd6e2a7cc4c0143b431165d6f5ea05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907258, "uuid": "fbef6a9b-e44d-4ab5-b73f-8ad910348057", "comment": "Malware payload (AgentTesla)", "value": "e24d8494f82409816a7de4dfd73bbb7ee49fd832", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907258, "uuid": "fbcc7237-c86b-41ed-94c0-5341968e23fa", "comment": "Malware payload (AgentTesla)", "value": "b1c50f80da157e28dea4b68fa84b253e14700b9d127d2ed96ffe21c350d87695a03b8d0f21ec689ae35948bba2fc2b1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907258, "uuid": "381df0c0-2cb3-4c6d-b666-e52b08e74321", "value": "T1B31523077B809A56CD950AB5817E68478FF13D0F209BA64F739D7B4A3D660B7A00F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907258, "uuid": "7d81eaf6-97a4-4e8d-b8cb-e9ebff56f28d", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907258, "uuid": "aa6732b4-3657-42ce-ac13-2081555a1d4e", "value": "24576:7PMMMMMMMMMMMMMuKMMMMMMMMMMMhMMG8ajpQpMdkgO9VY6dVUkbiF1Y5Mm+yCaa:7PMMMMMMMMMMMMMuKMMMMMMMMMMMhMMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907258, "uuid": "c47f79f6-a3d9-4990-8f75-737eb639135b", "value": 959640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907258, "uuid": "dfbcd478-417b-4a83-bb12-acaf2e86df32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907258, "uuid": "5af09fad-c137-4b78-b59a-29eac40af7ea", "value": "754891192ecdc6907781eea6ad53ceab51fd6e2a7cc4c0143b431165d6f5ea05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6987a159-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780911340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911340, "uuid": "009b1871-017c-4cd5-a97c-bd7b6179d049", "comment": "Malware payload (MassLogger)", "value": "05c9e2047341fd81eb94e489acdc7bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911340, "uuid": "50cbcf0a-321b-4d6a-a2df-feb0a7148795", "comment": "Malware payload (MassLogger)", "value": "75912c3a8189e59f168c8bee08b1f7a157a6967ed185d610b5d154f4a61fe9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911340, "uuid": "6e7d9bed-0ed3-4187-8bb4-22d1b4c898e0", "comment": "Malware payload (MassLogger)", "value": "bdc5c9ad100be987caf9bac877a28b86b9b4e15f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911340, "uuid": "16f5910b-c326-4206-8e35-fdea7cb7e546", "comment": "Malware payload (MassLogger)", "value": "9b03b36e4d9b1909234662d6f5552cae2cc47e8abbdc44d37db9ee810e37fb31080679045434b03b9376f90e0bd54e7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911340, "uuid": "50cebacc-2ae8-46d9-b28f-ef28b3391cc5", "value": "T1BF3512583266E507C295A6F55971E5B843B91EAF7820D38A8EC97CEF78FAF048D00343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911340, "uuid": "45a97a4c-b0ed-4a96-a1b5-c31efbc2f26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911340, "uuid": "54ef6156-4600-4ceb-bf82-1ae582d83961", "value": "24576:qb1Isw7Mls6k+BCxRkMZjVsvw583c77TU:aI37Mpk9UGONc3TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911340, "uuid": "2995c347-4d8c-4341-8234-2dacb5786e3f", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911340, "uuid": "eae04d6c-e93a-4fb4-854b-68f25158d42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911340, "uuid": "d2be577a-31bd-45aa-b058-3d27f8b8b679", "value": "75912c3a8189e59f168c8bee08b1f7a157a6967ed185d610b5d154f4a61fe9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225296d2-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780912938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912938, "uuid": "dacfaac8-b409-4c24-907a-2bebf733e462", "comment": "Malware payload (DarkTortilla)", "value": "ba6af7023617673b53e5451ead573302", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912938, "uuid": "5cf83bd6-93b2-407b-9b96-2f5dcdd2b20d", "comment": "Malware payload (DarkTortilla)", "value": "75aff0d9466c3517f6cc6acba957228e1c25a915ed7c8b31e7e4a2871af0af7e", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912938, "uuid": "0716d1be-57be-4bca-b892-39c63a38c512", "comment": "Malware payload (DarkTortilla)", "value": "caa7b10700ae5a11681e306a8d7d512f4b31c76e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912938, "uuid": "4e765fc2-b1bb-43ba-aed7-0946ec5c9c65", "comment": "Malware payload (DarkTortilla)", "value": "fbd5708bc395c25f3fee96416f9aeba5585f1d7c00a5e317440f58b4ee36aef38401358b1c80e27b34b7e4633aea4238", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912938, "uuid": "b56f920e-d750-4920-9385-f9218ee82399", "value": "T11535F0115E872B95CAEA0F7DC052085863F4C49B93E6EBAB7FDC00F49EA3F85DA05416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912938, "uuid": "285d0a93-deed-4bc0-b108-93c8eb176aa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912938, "uuid": "eaa8fafd-64de-48ab-924a-951f8e464b83", "value": "24576:43PU3EhFMxO+Nm5olKEKUboyfJuz02y+3:qPbhFMXNSooTEoyczy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912938, "uuid": "75aa2953-e842-4619-88f9-0d891217a0d4", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912938, "uuid": "bafd8564-42fa-47e7-a7dc-00141869e3b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912938, "uuid": "ab2ebbd7-82d7-49b4-b949-9485ad84f815", "value": "75aff0d9466c3517f6cc6acba957228e1c25a915ed7c8b31e7e4a2871af0af7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbf51bb-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780912451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912451, "uuid": "22cb2c79-2752-4d4a-ac03-bb16003d6911", "comment": "Malware payload (Stealc)", "value": "767f8bd5fd52422ca74b39934ace3561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912451, "uuid": "5ded6aa1-b4bd-4018-8bc3-9139bae3e97e", "comment": "Malware payload (Stealc)", "value": "75e2f83ff0e51330236351a2d72030d9452a5c457a8eb38ee61ba69be230240e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912451, "uuid": "bcbcc676-e84a-425a-93dd-c81ccd9dd7df", "comment": "Malware payload (Stealc)", "value": "0b216fa7989d60a83f52a56e361f151d6178fe4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912451, "uuid": "1cefab44-320e-4463-a3cb-8b23f0676c06", "comment": "Malware payload (Stealc)", "value": "b04b095938d668636fdef7503aff7f30b80fca7418e683b0fbf0f287e43c12e0fa5dce989bf5730a4cfabdb0375f72ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912451, "uuid": "54a44452-0a0f-4052-b724-19cc80730f20", "value": "T147446C15B7A40CFDE97B813DC9524906EB727C560760EACF07A04A975F23AE09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912451, "uuid": "2e6c8e21-b619-4a8d-a130-95f238a41f63", "value": "a17f92348b4c8ca1121cd8073bebbf60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912451, "uuid": "aa382c3e-7093-48de-8e12-ed29602b7bc0", "value": "6144:qqloHD2cTDiKB/Ap819VlD+mvm2XnxNVZKoI:qql6nTDiKB/ApY5+m+2XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912451, "uuid": "f59ccde1-37fc-4841-b4ba-0b2a2b08f33f", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912451, "uuid": "6aced3d2-aef9-4afe-a4c5-470b3e55c0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912451, "uuid": "4ffac0b4-3794-411f-a7ae-0894c955c83b", "value": "75e2f83ff0e51330236351a2d72030d9452a5c457a8eb38ee61ba69be230240e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26122d1-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780911515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911515, "uuid": "04693366-a41b-4106-a58f-7e5987c68f50", "comment": "Malware payload (GuLoader)", "value": "7dbd18b2a990191dd8236f130f51ce02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911515, "uuid": "a41ecaf4-a7bf-4b25-85ed-57bd1d183d00", "comment": "Malware payload (GuLoader)", "value": "764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911515, "uuid": "8ca363de-9be8-40c3-8746-1c2ca3902ed6", "comment": "Malware payload (GuLoader)", "value": "74bda1fcc348468755f64a8d08d4ee101429d993", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911515, "uuid": "087c738e-af10-4c45-8b0b-be5e1e75a696", "comment": "Malware payload (GuLoader)", "value": "527e350613f092ae950b488bff190ece52c65873c1de883c0ed89cc058a88728a89dfc2b576b4aa4ad6f8840724fc22b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911515, "uuid": "1d4ae865-317c-400b-b435-b56ecc247c62", "value": "T104152398F335831FE866D7B088694660DB74EEAC358A630F334971563CA32DA85253FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911515, "uuid": "33bd0dc0-072c-4b8b-ba83-d05da8574470", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911515, "uuid": "5647a4a7-77b9-41bc-8332-104c1f04fbff", "value": "24576:zA7FU3luueOOLdPmlMeBEFmNZpJGSqQc3DKtbPik+G:zDJeOOLZmrDHVSKtTik+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911515, "uuid": "e23889f1-46be-4341-9ab1-465623a5b6f2", "value": 923824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911515, "uuid": "cad7aa02-a052-48bc-bc81-72212adfe55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911515, "uuid": "83e1b6ee-0152-4c32-b65c-6b1e303e8596", "value": "764ef8523d5ab4f0bccae53480bbb507748d95692da2823b42eb214c0dad82e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97ffc22-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1780910615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910615, "uuid": "38e0e496-31a7-4f9e-8964-d132c2a1c25b", "comment": "Malware payload (RemusStealer)", "value": "fbbc95b1a763e5805c0309eb37fccb81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910615, "uuid": "3ecf4cdc-0530-4ae1-9b67-9b22101e24d4", "comment": "Malware payload (RemusStealer)", "value": "76685551a4d027a356f3c9f0503c4d9989c31605bd1fa46f9a0d1528e2d37b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910615, "uuid": "ddbc1f81-8d2d-4728-85e1-e31696b0637c", "comment": "Malware payload (RemusStealer)", "value": "c6426d27232ab5c5dbaa57e78823c982a5f91083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910615, "uuid": "6a27c373-747d-4f96-b14c-41b54d12f81b", "comment": "Malware payload (RemusStealer)", "value": "287b83c2ef71a3ad72a3d8fa139eb25eb3ac3981caafb50b0a5c25592af132e641418cced3a8172a57febbc476acea7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910615, "uuid": "518cf006-0763-4ded-bb22-b2c2718bc14a", "value": "T1B80633B4AB94C696D0A293B41AF8C73347A02C88B501C3599FF5ECD778BF2244A955D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910615, "uuid": "1e490964-72e9-4bb6-944a-7c280825f5d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910615, "uuid": "24fe5cbe-621e-4bbf-9cac-bbdd424fdfd8", "value": "98304:XhJxqjjs9vnjls+btjRs0IXRjUoPKn8b0SHy4/VzN37yCOjg:RJxajstnjGoINXPK8bbvyC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910615, "uuid": "6fa01687-93db-444e-8dd3-bc2713103225", "value": 3770880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910615, "uuid": "10720529-5d26-4361-be7b-6de5df7d9579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910615, "uuid": "76597db2-0532-420c-ac70-c9cc594a0cda", "value": "76685551a4d027a356f3c9f0503c4d9989c31605bd1fa46f9a0d1528e2d37b9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a9fe3e-633a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780923956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923956, "uuid": "5c0ce9d8-b7e6-4a1e-bfb8-fea36498c233", "comment": "Malware payload", "value": "52fda5c1b9704544f32ee98d9060e689", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-50751", "colour": "#B1AFA7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923956, "uuid": "687f008c-b01d-4659-9877-74b49da88117", "comment": "Malware payload", "value": "76842bcd75b4429e2c92636274ab0395d91c441c6aea9b76fe8a051659b0c1fc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-50751", "colour": "#B1AFA7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923956, "uuid": "b234212d-1eb0-4efe-b1d2-634505afd6a9", "comment": "Malware payload", "value": "9d48d741d0a149aeadd6aef4b2c95c57833b1fef", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-50751", "colour": "#B1AFA7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923956, "uuid": "d65e44ff-c8ff-41d6-a0aa-b5a584cde3d1", "comment": "Malware payload", "value": "0e611afb078792dd58bddbab01a0558d358623327deeaaaf8920927458f4d069fc80559c4eafcce355afe07afc252c25", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-50751", "colour": "#B1AFA7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923956, "uuid": "667d7b4e-0070-4f83-aee7-1e8d81219228", "value": "T1A8F74B53E96240E4C5A9D535C5669A63BB717C499B3133DB2F60FA342F72BC0A6BA300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923956, "uuid": "ba869c01-9ab7-45ca-9837-8499531167a9", "value": "393216:/lfwSLIJ1MVKZXW5yE/LKEMmBpsgJXheWsJyhYiFXL:/lfwSLIJ1AI8/BCAhjXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923956, "uuid": "dbc12904-a88f-4b2e-94db-4d30be805e01", "value": 76251320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923956, "uuid": "2711ad13-58ef-46dd-af68-b11ceb2936f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923956, "uuid": "f0b704c1-f1a8-4f80-8ebc-79cc13024738", "value": "rclone", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ee1ea8-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910560, "uuid": "a4000058-0847-46f3-83ae-7ed2cb6d6b1e", "comment": "Malware payload (AgentTesla)", "value": "3c07979cd078b95702299ccb67eeab96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910560, "uuid": "9dc7b31a-defc-4b07-ba63-6c4859ddfab8", "comment": "Malware payload (AgentTesla)", "value": "7699d43254b0b56daeb8521213636efba81d3cf389a3dd602e54b8c5cb3cbf5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910560, "uuid": "3d17acb7-8905-4366-955c-9bded8b25efe", "comment": "Malware payload (AgentTesla)", "value": "c28c727b542327df87334ccd0c142f5b5d6dea8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910560, "uuid": "8eb4d1c7-c106-48cd-ae90-bc61ad352f58", "comment": "Malware payload (AgentTesla)", "value": "622d480ad25abbd8db0d96654c91d43c93d8b87a7ec4648943721393bb9bd0412470137e0d197cac35d485deb1c62b16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910560, "uuid": "9ff3deda-4c85-4147-8dcd-4c0d3f5aeb11", "value": "T1D0159D15D7422F05C32E4A78C16A6A9D53B1AA429676C31BBEE500DADFC27F0F6433C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910560, "uuid": "cc63e0a9-1d8d-483f-a7e4-a7e2d507be8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910560, "uuid": "494755f4-3a3c-4980-90ae-4132e589a98f", "value": "12288:fFMxOVr5GD786Su6RH5ugthDBiwEjvVgpk8IAoG6IqHrNHel:tMxYoufhDBixEk8IAoG6IGR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910560, "uuid": "cec3b279-11b9-4ef4-a819-b68882b4caac", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910560, "uuid": "d270ccc8-0603-4050-9ada-2762e96e1553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910560, "uuid": "9830032f-84dc-4610-a0ba-e19dd16770d1", "value": "7699d43254b0b56daeb8521213636efba81d3cf389a3dd602e54b8c5cb3cbf5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34907ed1-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908244, "uuid": "946d5371-deb4-46c2-af06-65eaf227a843", "comment": "Malware payload (Formbook)", "value": "3bffb7500ebf73af4fb5f19cdc716089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908244, "uuid": "90eb9c19-8c64-4fa2-b51b-63f1f99d3c1a", "comment": "Malware payload (Formbook)", "value": "76e696ea5a80e53e3f8954256b6ba67382d0f3fe148b4b4cde96555d778f1ce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908244, "uuid": "2b850eda-07f5-4168-8373-30e05a786191", "comment": "Malware payload (Formbook)", "value": "aeabb1c9a3bd759637a9cf0fda034aea82726c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908244, "uuid": "43c8b64a-3d3b-466b-9a62-b2e9f8be09e4", "comment": "Malware payload (Formbook)", "value": "8b878ad1f96dd09331296523523f5e46117873b1c3d3795269e40d898012035ce3b19054aacf53f34eac918ca0879ca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908244, "uuid": "5e8e1906-a0ed-4ba3-b357-d36da79d267a", "value": "T1C445F1642319CD03C0AA0BB81A65E2B057B85D5DB926D353AFD1BFEB783A7B12D00747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908244, "uuid": "29925359-9d81-4d91-a716-5dc5305c005a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908244, "uuid": "ba4e6cfe-7a9f-4760-a08c-acee6b29cb14", "value": "24576:dw3vAEFT0DbDuTZmYkdkgGrGpfitVcG+dN91s8xRu5CN:Uv3FQfaTZmYgkBaqtiGyP1/Du52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908244, "uuid": "bd68e2f5-8b1f-492d-9618-3c3f5595946f", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908244, "uuid": "cc8990a9-9a57-460f-8c02-b720e19a5c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908244, "uuid": "a93580c0-437c-44a1-b47b-304a72ce538c", "value": "76e696ea5a80e53e3f8954256b6ba67382d0f3fe148b4b4cde96555d778f1ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b85201-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910743, "uuid": "a715ecfa-0d55-4c04-a937-8da91c62938d", "comment": "Malware payload (Formbook)", "value": "d7d3928cc09684b5688a578c227789f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910743, "uuid": "693f93bb-3ed1-46b0-8451-42b8b5fdc9e5", "comment": "Malware payload (Formbook)", "value": "7752d40d31b2b689bb4eb30844a675b39b496edb6315af0b87c0b2b369e1c6f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910743, "uuid": "c27bd85b-904a-4b1f-94f7-dbd2eeccdc99", "comment": "Malware payload (Formbook)", "value": "79b8be977136f53180da173015a07c983e824c6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910743, "uuid": "b19f18d2-87df-46c6-9a44-50dce695a3c8", "comment": "Malware payload (Formbook)", "value": "77a90358b682cadd06aeb833772f6109c3c2022ab043217eda41158f4b1905b9c04defc9589ca01d8456be0946b6e12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910743, "uuid": "8d832e97-9164-48aa-8c2b-265d3431eb72", "value": "T1072523661A08DC06D1A50BF11EB2E274673C0FDCE955D7279FC4FEBBB8B926244122E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910743, "uuid": "4e22f8e2-2aad-44a1-82e7-d83de2bf473e", "value": "24576:OnNrpILUVpzacVsAe/dZsVnJ1WTfzfsuL64Gd34304aVF:+qopPEqVJ1Wrjst4GdqEVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910743, "uuid": "7625065c-51c0-4734-84af-76797da2d635", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910743, "uuid": "dfaa3736-673f-4d22-a615-760dd760121b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910743, "uuid": "c3aaf41f-0713-4634-a450-6f231ab0a714", "value": "7752d40d31b2b689bb4eb30844a675b39b496edb6315af0b87c0b2b369e1c6f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f29179e-631d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911269, "uuid": "ebf5d165-08e2-41ad-a6a0-75fe188e9f9f", "comment": "Malware payload", "value": "b9330ad7159273ca7c784c9ca3cc9d6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911269, "uuid": "381abbf2-5255-4fe0-a818-13dbf5b781a6", "comment": "Malware payload", "value": "77e3253cf2fb344e0fc397a36fa8f926c6678b1abdd9a12117a2a341aa60ff13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911269, "uuid": "8d42b245-1321-4d76-a0fc-93dcb9e85b90", "comment": "Malware payload", "value": "c0940288008b310b6ec52bbf91c428d5d4e06058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911269, "uuid": "13bd3382-c9d0-4b87-bc8e-41d04ca609a5", "comment": "Malware payload", "value": "7ad42abbac45e1713a6cccd675837dea46c4837ab60bf8086946683505ee5ed259b620be6f4d0133d05d486349ce7b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911269, "uuid": "c2641093-45e6-4730-b9b1-e0c45596f102", "value": "T1A5745B45B6A40CFDE967827CC9A34A06D7B2B8560770EBCF03A046965F277D09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911269, "uuid": "3da7b0bf-fda7-4bae-ba1b-872511a26ca5", "value": "d04feef9f2f0dd0a18187fe3826aaf2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911269, "uuid": "aebf134a-ba99-43b9-86f1-a19463667f32", "value": "6144:T6YaTDvpL7IF/Kz8plA4omkla3VbwXDhAYSzf5U:TCIvplsvla3VENABzfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911269, "uuid": "adb0651a-7d79-4f36-ad4b-b31b8bd5eb7f", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911269, "uuid": "01893dd5-280b-41f2-8fde-0212cf915c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911269, "uuid": "27cba5b3-e0a6-4907-b243-63a44ab859f1", "value": "77e3253cf2fb344e0fc397a36fa8f926c6678b1abdd9a12117a2a341aa60ff13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab34bbc-631d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911315, "uuid": "bb8c137c-7e06-4be4-bd42-2b5a4ebf962e", "comment": "Malware payload", "value": "b4bbb23324c5e4cd5f2b3bc6b0cb10cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911315, "uuid": "e5bfb2b1-4c92-493a-ae86-29fd01736098", "comment": "Malware payload", "value": "77e411ab949ee9256f76b3f4d7a5e2ac4c45de4e49469819061f0a9432cc8fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911315, "uuid": "db2c11fe-ab7c-4b0a-ab23-b4f04fc67852", "comment": "Malware payload", "value": "2e6eedec174a0870743aadd5cd12566acd58a5ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911315, "uuid": "1e5587f3-dd5b-4d63-8c64-9962cd2028c2", "comment": "Malware payload", "value": "9f4459502915b77de764f7070bdc52c691a02de54c3cd3d10886b629386d0e59ad0872d45e53a71b4fd864ffbcebd7cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911315, "uuid": "006086cb-4f04-4bc9-a808-6f49ec28575f", "value": "T1E645CF293A4F485CD591DB788F333BD41770D47698F6D30A7FDC6338A62A6E09A8C642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911315, "uuid": "3733c0e0-71aa-4194-8499-aeec9b0f611a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911315, "uuid": "f2d18c9a-19f3-4d45-98d6-789aa4ce3635", "value": "12288:O9OQIIrpwMYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72BOmv5odwAKoGXaY1LMG:grHPCmQui1rBgc+9pddwAKoGXaiM10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911315, "uuid": "a0d5c02e-fa0f-46f1-82f8-3ea639d065ae", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911315, "uuid": "740415ed-819d-4869-8ec9-08c658c58929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911315, "uuid": "bc8b52db-5c05-4bc1-b917-32093bd721d7", "value": "77e411ab949ee9256f76b3f4d7a5e2ac4c45de4e49469819061f0a9432cc8fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ef7e22-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780911302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911302, "uuid": "7adcd6ce-256e-42c7-bdbe-efcefb56df77", "comment": "Malware payload (MassLogger)", "value": "c5ef9dac0efcfae614b85865e449f71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911302, "uuid": "ec91c414-565b-4e17-a23e-aadb26d85c13", "comment": "Malware payload (MassLogger)", "value": "7816e31c07296613302f64479a20f8089f8d83e31330a476310e25f14228702e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911302, "uuid": "4fc4b868-0ea2-419e-a347-242b12b85692", "comment": "Malware payload (MassLogger)", "value": "d22846ccb150c53f7171390842ea664f8c27d081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911302, "uuid": "9c6a8f8c-fe05-453f-a507-fc9021fd8445", "comment": "Malware payload (MassLogger)", "value": "5f1ecf5450fdbbaa7123a4352a5924dee95ef90ff9f5419042925c46722adab2d658e2754eaba04b567efb3a02ff1954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911302, "uuid": "fbfc7a9a-b8c3-4af9-b9dd-881957e71181", "value": "T1063512287564D407CA2547B64970E2B883B91EEFA821C3825FDDADEF78BAF458D04353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911302, "uuid": "04e0c841-bd2b-4d36-b582-de3f0314a1df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911302, "uuid": "003714e2-cf2a-4f58-af5c-e69f2577f868", "value": "12288:oVSp1ZIrKyVVKuGnnHflPr7tsU7Nsx5HdnXqnhBtt487O9qsANYWHe6CX3OR7ONM:8S1IJGnHfHKxXXstpObvWH5ARNu66u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911302, "uuid": "7a360471-7a61-4f17-b6f0-c93e1469877a", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911302, "uuid": "db8eeb1b-acf1-4673-9e0a-bcb79abd10a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911302, "uuid": "72cbf248-4e65-439b-b3e3-eae0f269f413", "value": "7816e31c07296613302f64479a20f8089f8d83e31330a476310e25f14228702e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b8d56d-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911118, "uuid": "83482353-7f9d-41fa-878e-4814a2e4f35a", "comment": "Malware payload (a310Logger)", "value": "32f123142690747873c5fc7eb5be6e4d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911118, "uuid": "7b5f4163-3cda-4fbd-8d59-13c73faa15d6", "comment": "Malware payload (a310Logger)", "value": "785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911118, "uuid": "12044edf-3d2a-49b0-b6bd-5e08379aab87", "comment": "Malware payload (a310Logger)", "value": "3e02b1803a0972043475f0d42a0131ca76ea3486", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911118, "uuid": "c394b300-1265-4cc1-8cb9-4f2af8ea9187", "comment": "Malware payload (a310Logger)", "value": "6cc62322c45d5ee6a4b4cbd319361d5825aa30d0a0efd04a1b29ba5304672d5bc39137372b9690bd21162155c2302c80", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911118, "uuid": "e7c752db-043b-4f21-a1b2-989f32cd4f31", "value": "T1874523541A69E60BC59583394DB1F3B862BC0EDEB911D303CFECBEEFB669A544C04192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911118, "uuid": "d56fd0f7-0984-48e4-9ee3-9e6d0dbea172", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911118, "uuid": "ac3920af-3f3d-4f10-b93e-55008bab6a98", "value": "24576:1WyujK85+/SN357ArBdYMVBXORvOmoOUjJCh7jI:1WP4IaJXmotChI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911118, "uuid": "8af441c2-3637-4961-86b8-0aba07c6c32f", "value": 1198080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911118, "uuid": "81c3d66a-acae-4f85-ba44-41e8c032765c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911118, "uuid": "de2e5df7-3cc3-48b2-8e7b-d0fc0f951632", "value": "785675de0fc66a2a9b5bd05267f888b1ac3cbf447db720ee05c33f2fcbc43d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9af37e-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780910487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910487, "uuid": "f26d5bdd-2b6e-4cd5-ae87-9c2021317ee0", "comment": "Malware payload (SnakeKeylogger)", "value": "573a8833db017c53d099460b5a110017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910487, "uuid": "03590c82-f1d3-4462-8f95-f5266e0e8ac5", "comment": "Malware payload (SnakeKeylogger)", "value": "789bd9713b6affe8e4866359b782edd622ecb868a9444bfb4cac67e1296efe80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910487, "uuid": "c9106aef-fa04-40bf-b0f8-f01e51de2bac", "comment": "Malware payload (SnakeKeylogger)", "value": "60cc313bef1fcd666174bde4c046949fba8b361e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910487, "uuid": "cb3638c3-2203-4899-a3df-ccecc3e42fa0", "comment": "Malware payload (SnakeKeylogger)", "value": "6c17b1fda8300868d61c11c9d1cc5196372b07ba2ac8a2e0f002176cb70d6504e64dbad5c2767701effbdfef210623a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910487, "uuid": "6f37fb2d-0e60-4e2d-862a-be7928e6e4c2", "value": "T1C3051259621DD716C4A61BF01EB0E17023784D8EEA24CE13AFCABEDF797A7211195383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910487, "uuid": "3d7919bf-173f-4369-a097-bf1a3264a190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910487, "uuid": "1eca120e-386d-436a-bb4c-849a30e43741", "value": "24576:rAnNrhLlVyU0Rtq48lXx2nAsMrKnt4LWv:r4JyU4tq44BvVmnOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910487, "uuid": "bf0fbc9d-766b-4928-9099-f2fd1a9f9220", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910487, "uuid": "e54f951b-fb5b-45a8-bbb0-c98015e723b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910487, "uuid": "62235720-a1d2-40b8-a86f-e983fd755c91", "value": "789bd9713b6affe8e4866359b782edd622ecb868a9444bfb4cac67e1296efe80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf56cb3b-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912343, "uuid": "3c6de105-c883-4e73-a9c0-6d1329e4cd00", "comment": "Malware payload (a310Logger)", "value": "538294f730be1b411da768c9c36dff6d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912343, "uuid": "f81ca1d4-8d91-43b1-b587-32aacd9de902", "comment": "Malware payload (a310Logger)", "value": "793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912343, "uuid": "4dc0aadd-4d61-4351-a11f-f149840e008b", "comment": "Malware payload (a310Logger)", "value": "8942845b7d3eefddca9fdb2ffcd3355bfe8d34b4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912343, "uuid": "43441ffc-3eb0-4828-9cb5-30b4e1acfee2", "comment": "Malware payload (a310Logger)", "value": "fd745763291625ef779c22459f9bc5492c36793a835f4de0b08569de26b8c4db96c42a2b93ebbc6dd7ff30003e809fd4", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912343, "uuid": "903dbad9-dbc9-4145-ab62-3eb0150d0768", "value": "T1B63523F22ACDDA46C9B517BC1D60D13607605E98E961E32FCFF97CEBB02A3211915293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912343, "uuid": "a6c6277d-6b73-4d23-9f6a-977c8034dc6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912343, "uuid": "77101228-116b-4103-a2ba-6c4535917f17", "value": "24576:sUwAGdtOFrw8nvrnkLQiuua23DaK0ljsQkt:ExtOF08vr6Qgzah9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912343, "uuid": "e54bf41d-6d9f-49d4-bb90-ec91e41e5e8e", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912343, "uuid": "7373d1a0-2508-47fe-bb23-a725d82b9e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912343, "uuid": "b6a75414-40b9-4aa3-b16f-aa385802b212", "value": "793028ad3df8649b73dc3b7ed23d9d8fcfdfe84dfbd5787371eeb08037c0c94e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda962f9-62f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780895267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "91de012e-86e7-48dc-a867-4cd1a5bd8b5b", "comment": "Malware payload", "value": "ee730424ae61b79066238ca2c7ae3c23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "16a8817e-9ecf-46fc-814c-5dd7b11299de", "comment": "Malware payload", "value": "7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "10672376-9bc5-49fc-b16e-a2a0a937722a", "comment": "Malware payload", "value": "c5e675842dfe0f36241911abd245c8db69208162", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "acf11728-2210-4185-a456-d163c4f364b7", "comment": "Malware payload", "value": "34e5ac87e02d2b6bd37ddd9a78f943079afa9d769df4db6994b90e81f01be2b2b670d839f3dd1004fc396d13c113c194", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895267, "uuid": "345fd588-27b3-4824-811b-fd91bac5ccca", "value": "T1C601ABDAA2206D303D8981AE33E7845C5242015F08CB7FD0BCCD64A01F1C548B051B39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895267, "uuid": "11f23505-ffc8-4bab-a97d-60dc7dbeb84b", "value": "12:oEkDJFFHR1OuZU4CcxK9twF9Y4raEU6CRM1qvT4cDjhEgOk4Moq1bo2Q:oE+H1mBDMK9CF9YhEUXMM/hE4H1b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780895267, "uuid": "3c1a15bc-5d34-411f-8670-01043a0be1fb", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780895267, "uuid": "acea9cfc-9996-43e4-9e32-854cd279e545", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895267, "uuid": "179faa60-5040-4a44-80a6-7fd04791306c", "value": "check.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a0f73c-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907768, "uuid": "de287a32-0fcc-4952-a892-1517f4dd6222", "comment": "Malware payload (AgentTesla)", "value": "041c5cada8a17104a2b2a93c58510a11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907768, "uuid": "fbae0a16-af85-41e0-be16-9126ba3e96d3", "comment": "Malware payload (AgentTesla)", "value": "79b504735990c58ece2e01c3cf95573f2331b158908827f04a8be9d4556c01ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907768, "uuid": "4708a0ff-3ceb-4483-b95d-12599f3ecc1e", "comment": "Malware payload (AgentTesla)", "value": "718268283e36b9825c6f5ee5fe289654cee93df7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907768, "uuid": "15d27073-36df-47f7-b0e9-63a4375db2e6", "comment": "Malware payload (AgentTesla)", "value": "38d51977342692dbd508038af0147126e9d9841e74c4f23932ab1a28b88bcc292ec8abc35e661960e42254efb5fc8126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907768, "uuid": "0e9b605a-ca4b-4c78-8692-2e1518892c89", "value": "T106250254331ACA02D9E65FB45920D2B917788E849521E303CFF6BDFFFC3A35529492A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907768, "uuid": "befc470b-a16b-4183-9eb7-5f421b3917e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907768, "uuid": "3cca071c-0289-44ea-ad98-7df52d57b587", "value": "24576:q4TS1m6v5J36j/pkIMN7YD9gVP6ctLsaRc8NDIvjt:q44m6v7SyIMNC9q5LIIIvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907768, "uuid": "8de2b0c5-8b1e-48ce-abb9-b0f1ddb0ffad", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907768, "uuid": "53116077-6895-49e1-8655-bbd018772fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907768, "uuid": "adb21faa-c3fa-4dad-a94a-e4c6a7edb788", "value": "79b504735990c58ece2e01c3cf95573f2331b158908827f04a8be9d4556c01ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30e443b-631f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912349, "uuid": "32903ecd-92a9-4ba1-8b1e-4cd496a83161", "comment": "Malware payload", "value": "b764ddae19c8a4a069027a33eb9f75ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912349, "uuid": "a7ed7722-b9aa-48d7-9c81-088c185eedee", "comment": "Malware payload", "value": "7a1c0dc7a28947d3fb4303f823d9a324716d0c5c7410e4df50e78f4d40657bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912349, "uuid": "c3404d03-8687-4fe2-a6e7-1ed8c45a9178", "comment": "Malware payload", "value": "617d386573dba7c26b6495c394d7a61b73e0e592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912349, "uuid": "1f77a104-f431-4e23-a9d2-b65b3b38e82f", "comment": "Malware payload", "value": "40e0d6828a65f5e53863fc30acbdcad8f133f4761c7b4c13e8f764b5f1095f11e1cc10866255bb65fa9c20966cb69fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912349, "uuid": "9dff03ab-d731-4a05-aa4a-53ca044c374e", "value": "T1B005E0201D865658EABF0F78C062056C77F0D54793A7EB1B2EEC80B5AEF3B85CD1A851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912349, "uuid": "d09bc3f7-8fdf-4639-adb6-d1d0505763a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912349, "uuid": "7aa406c9-cdf7-431b-a457-c78b6b2285ad", "value": "12288:X9Zo+JzpwNc77qqyx1xqVVWn4WlKwscS6LghoGFq4H/VYQa7KHtGz+p:XtwCVC66LghoGFq4H/+Qa7Kc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912349, "uuid": "de25e44c-0024-4361-94b1-1630543cfa7e", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912349, "uuid": "c8ceaa29-e003-4e26-b0bb-9a686662acc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912349, "uuid": "0206bfbc-45e0-4cd3-abb6-2205d77a6781", "value": "7a1c0dc7a28947d3fb4303f823d9a324716d0c5c7410e4df50e78f4d40657bc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794e3293-62e1-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780885596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885596, "uuid": "e5308c21-c658-41c4-b9cd-5bb7d62c0d39", "comment": "Malware payload (MassLogger)", "value": "b4ae7650db4c6862a38a07cb5ec4cdc2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885596, "uuid": "fd241ef7-763d-4adc-b7c3-3d159e5eb865", "comment": "Malware payload (MassLogger)", "value": "7a22eb9f19792baad6002247762ff2d19199a36daa84da958da3f436f36b1371", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885596, "uuid": "013b2c93-a88c-47e3-a5e9-1b7ca66f2cc3", "comment": "Malware payload (MassLogger)", "value": "e26fa41bff0174e6e4066b6ed221bf4acd36061d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885596, "uuid": "93ecccd5-aa9d-4a37-a29a-b3186bbf9a17", "comment": "Malware payload (MassLogger)", "value": "7b85c79ef352ece8ccef7ef9402b11cbafbc46c792a8f2b9aad7b027fdfc682e8a8e3f15cf996ed79b15c6a5ae65e8f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885596, "uuid": "97c191db-c8f2-4c60-a449-ec45ef4f422b", "value": "T1DBB56C17D66F974E180A3B61106A5D9AFE89CAFCEF726BC4E0CF90B514EE1110B851B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885596, "uuid": "57a518cf-f0c7-498f-86f6-a8cb74a1d825", "value": "49152:QVBLWa/VrrYl8OzTV22Aj72d5kxzo/7XKqqicnXOxbd:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885596, "uuid": "ccc90d52-d3b9-4875-844d-fc1c673ba8b2", "value": 2453191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885596, "uuid": "9b41a23b-b3cf-44bf-9014-5b81d072a4b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885596, "uuid": "a92283d8-4a40-4e32-a66c-8b899f6f25ef", "value": "RFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965977b3-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907549, "uuid": "edeb4185-e6c6-4f59-95e5-bc378aad85d8", "comment": "Malware payload (AgentTesla)", "value": "591ee5436aab1ddb9ceca0ae292f96ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907549, "uuid": "6d2e6024-5ea5-4a58-8e7b-40722f04a0fb", "comment": "Malware payload (AgentTesla)", "value": "7accb57755825f4d98685f352a6a57e0535f804e99fda29e824de2376cddc47d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907549, "uuid": "32940b19-fc28-403b-932d-9de065ae071b", "comment": "Malware payload (AgentTesla)", "value": "5f8dd30562e9257359ada28c1ecb6eb558e2a743", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907549, "uuid": "40805e68-d25c-4633-92e4-176971972391", "comment": "Malware payload (AgentTesla)", "value": "1278da8c34f94d3174fedecc597e9dc98bb48b4d625d646c739ad81646571013d6803ce2416c43c0052380190dc5eec5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907549, "uuid": "2dd34434-4af5-4fc3-ab0a-1599d47a6630", "value": "T127F412077BA099A3C5606F785E7ABF136720D9282E52530B7600B72DFFB67C09E16385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907549, "uuid": "334f0982-abab-48d8-9e56-000ab309023a", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907549, "uuid": "239aed41-95af-4a64-bd28-5c0304c63692", "value": "12288:4lnbd/HClId9wadaYOhAoE1ZyuPIwRQITfri9EDEJj3gms5hUC/seItZybP1MOyM:cn3IFAoSyAIwRH72rmm0hU0s3tQP1EX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907549, "uuid": "b4c5e01a-a53e-48ea-b23b-6ba3169e4174", "value": 744664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907549, "uuid": "656eb844-cb4e-4bb7-ac08-14f1a3543444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907549, "uuid": "91daf1c4-8332-4c8c-b143-b699e28dedf5", "value": "7accb57755825f4d98685f352a6a57e0535f804e99fda29e824de2376cddc47d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ddd842-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780908506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908506, "uuid": "df28fcf6-5f5c-4a1d-a73d-619816ad7913", "comment": "Malware payload (MassLogger)", "value": "eae7a4d4f2d5e214fb4b3f62ca72c8fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908506, "uuid": "b50e80b9-ea50-4f1d-a198-c2739443ec2e", "comment": "Malware payload (MassLogger)", "value": "7acf9b7e0c881e207e7ae71860b35ec4fa6f909b1e193527774d8588efa51833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908506, "uuid": "0d105226-5747-49cc-b051-8f723812595c", "comment": "Malware payload (MassLogger)", "value": "5e7c88587d2c11d6f5d7e8dda5acd76f4ad6de73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908506, "uuid": "02aed25a-dc83-452e-b656-90af3878ad25", "comment": "Malware payload (MassLogger)", "value": "830272ac2bfdfc0c2a8028f79e0c2ad533529d770b2bc3952e0d6a54dd665e1e626bf9eac5176eb5ecb43455742ccd01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908506, "uuid": "66e1fbd2-6196-414c-b8a1-7de14528db30", "value": "T13D3502542749DD07D4E65FB01971E2B827B89E98A812E313DFC6BDEBF87A74568003C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908506, "uuid": "f7dce17f-2b05-4eb2-9943-619a90cedceb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908506, "uuid": "f2f3ce3a-b8ea-42f1-bd5d-e0f165c3538a", "value": "24576:JAEFT0Ddek/VEpNuDBGsC6YZL4r9IqiYJqw6sQme4:J3FQQ0VoNuDBGsC6YZUUBsQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908506, "uuid": "f3bc36a5-7895-4b54-901a-53fa75709372", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908506, "uuid": "ac5cad58-e451-4312-9b7e-dd8c3cebf4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908506, "uuid": "8ccf923a-014c-4cec-b531-dec192d8bcc8", "value": "7acf9b7e0c881e207e7ae71860b35ec4fa6f909b1e193527774d8588efa51833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623b2849-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780911757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911757, "uuid": "b022a8d2-001c-475a-829b-ddd72796f173", "comment": "Malware payload (PhantomStealer)", "value": "ae22efc1a186e0f6e114ae2e9255c36e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911757, "uuid": "516fb7dd-d39d-45b2-9c81-fd866488c275", "comment": "Malware payload (PhantomStealer)", "value": "7b174447649c77a0077b8a72b3efb18d58c23ba32461ddd47cdbae7dcbf19f29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911757, "uuid": "3bc99d25-749a-4892-9ca5-e18a7b1da8bf", "comment": "Malware payload (PhantomStealer)", "value": "022bf04922605c6a81a434034f5907189b4ed4ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911757, "uuid": "843c6a69-94b8-4f42-963c-c4682e8d5dcb", "comment": "Malware payload (PhantomStealer)", "value": "30a34b0f79c8d7efb3867251ac5ae8207c0173eef8023fc1cdc315966b44db3dfe3d8a2cb61122627bee831f67b40b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911757, "uuid": "d052fb66-8e9c-43bd-88a2-03926850da42", "value": "T1CD6523689E06D146CA8157787E31F2B9062C4DDCA905A7029FEFBEFBB537A940C801E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911757, "uuid": "829b9e47-fe97-4002-a3fb-95fa10525919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911757, "uuid": "aee357b2-217a-4759-b777-c242615213f7", "value": "24576:87pKj/dx3jpJikN7BL+T+Uh5b5h8p0YMtbV3zMbaa58:8lQdxfACUHbr8p0Z3gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911757, "uuid": "5e7fb66d-d0b2-469c-a8f0-c628a3d64fdc", "value": 1509888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911757, "uuid": "cf07338c-4a0e-4410-aa32-979660f4593c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911757, "uuid": "a783e2f1-a312-43cb-b10a-3f96315bbd61", "value": "7b174447649c77a0077b8a72b3efb18d58c23ba32461ddd47cdbae7dcbf19f29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cafb70-6313-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907277, "uuid": "68e26f57-ead3-434f-adcb-d30dd3696585", "comment": "Malware payload (RemcosRAT)", "value": "c1708fafc58d7197cd200c0550f08abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907277, "uuid": "cdc066c7-74c9-46ae-8d92-912d14e7651d", "comment": "Malware payload (RemcosRAT)", "value": "7bab45a7719ef9af4319e4091adc0c32ae5790347ac1c94a936fbbdc02feba87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907277, "uuid": "49fb65f4-591f-4e89-8680-74dc11a6c0a9", "comment": "Malware payload (RemcosRAT)", "value": "f0b7f37ba4173c01e4993dc95ed7ee8555c59e82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907277, "uuid": "64b2dcd4-2aaf-4ce8-99b9-c38aede9b886", "comment": "Malware payload (RemcosRAT)", "value": "c8546c5cf5531ded6d8160c7bcf5abac29acc886c0aea5ad16134a2c7b0c0c82b5b96a1cfc90a43b86bda1dd74f3d9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907277, "uuid": "872b30c7-15d0-47ee-a6be-ab6188de3e7a", "value": "T1431523C5B750CC2BD8C1EE7148E9F02587FAEC60B5A4431ABB11B64BF8399C18D9D267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907277, "uuid": "0842d3b4-e5d9-4a51-a59d-d3249cd6fdb6", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907277, "uuid": "4afac394-b158-42d0-bf12-58a3cec33337", "value": "24576:2jsOL1bO0HaJOZ1NQhaM6gpmaITJXe+56LqgB6:wLl7H7Z1ir6gM1f8B6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907277, "uuid": "540b6fb0-8adc-44dc-9f61-97a59e6ffeb6", "value": 904072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907277, "uuid": "d7f1f863-4d89-43bb-9ff9-ef4af206922c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907277, "uuid": "42f6c774-de92-4305-a586-93e63776dcf7", "value": "7bab45a7719ef9af4319e4091adc0c32ae5790347ac1c94a936fbbdc02feba87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c921fe-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911681, "uuid": "56151d89-de66-485b-842e-242a2587a887", "comment": "Malware payload (RemcosRAT)", "value": "89d7f8ff173a3b486b7f3c74abd5b8a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911681, "uuid": "138e3b2f-5e57-488d-839c-912730bf4b09", "comment": "Malware payload (RemcosRAT)", "value": "7bb9094ba122d7058e24c4a7856b4c865d8153267f051d1677f0f7f16e7cb112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911681, "uuid": "78778e29-6d57-4acf-9b67-409f5963aa6e", "comment": "Malware payload (RemcosRAT)", "value": "93074d83a2cb337b343a43e1890ebcb27fe0a74c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911681, "uuid": "3f8d0c41-0627-4979-bb28-05ccbfc4ca15", "comment": "Malware payload (RemcosRAT)", "value": "27d2f9dae504d231d08663db8c884f8bec81accfb780a84f2562809e48a77d7055d2a7fea5bd61c8758f5d5c38954628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911681, "uuid": "fa64cbed-ccdf-480c-b949-83550653ae1f", "value": "T1EA3412106B50D56FDBA30530A8331BBA0FB7542425753E874384FE2DBE72A64D83FA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911681, "uuid": "ab06ee1a-63ca-46e0-a3b6-c285841d264e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911681, "uuid": "95e80748-d3c7-4db0-a834-8aa9a2a438d1", "value": "6144:ymGIhxAPjMvIakrTr44WR+1Uqpah1RgQevQ:l1Abc9kP2qRpy1RR0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911681, "uuid": "7a191902-dad1-4565-850a-9d63a821a04a", "value": 240019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911681, "uuid": "ded17e0f-3b53-44c9-ad67-acf4239fcacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911681, "uuid": "3b7dce17-be87-433f-857a-8fd175c42a8c", "value": "7bb9094ba122d7058e24c4a7856b4c865d8153267f051d1677f0f7f16e7cb112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818db1a6-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780912668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912668, "uuid": "b36acecb-abd1-46ff-a2c1-2562d35f9e9c", "comment": "Malware payload (PhantomStealer)", "value": "824c027552a5e75e5d817978d9f073dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912668, "uuid": "1868c90b-5cfe-45aa-a285-f0e35c7cac16", "comment": "Malware payload (PhantomStealer)", "value": "7bc1a0941fd78ba96fdd56d7eec944b31ac5ff6d6548031142d8ef5235bb2037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912668, "uuid": "8be2c13b-ebc7-4a3c-86c7-2cf256dbc012", "comment": "Malware payload (PhantomStealer)", "value": "4f1b64ef02cbba70326c6c303eb13a3657448ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912668, "uuid": "5db4e1a7-e38f-476e-91e4-3b0a7ee57747", "comment": "Malware payload (PhantomStealer)", "value": "a5b54a539e804d84b0763bebab28b048990e50b6c0165fb7d38d8cb7f02d4b214d45d22d9b7676eb0e90c1aa1f6fb7ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912668, "uuid": "4a791df6-f20a-46a0-adca-4f37e83cdb19", "value": "T1C1652314BE65DD02C99927B41AB1F2B113B44EDAF916D21BCFE66CFB7865B002D08783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912668, "uuid": "30556726-cd84-4b3b-8902-f2647df9ca87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912668, "uuid": "4ea3e940-f36d-48dc-937d-9fd203c0fbea", "value": "24576:Ok3CLsl3dGGkOe8PcJzw0rxL3QVqyJIS61LpLoI2BynQNTRtFdZ4RCxeydoBmmyo:O6CGNGGkOpPcJzwaqiScsu43ZI9mJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912668, "uuid": "f25c703e-0766-43cb-8ef7-b62da60b201d", "value": 1525760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912668, "uuid": "4b74be73-c561-469a-aba4-62139fe895dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912668, "uuid": "aac2a0b6-6b28-4971-b794-6c813924427a", "value": "7bc1a0941fd78ba96fdd56d7eec944b31ac5ff6d6548031142d8ef5235bb2037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c58da8-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912951, "uuid": "17d1e098-ab4b-4622-8b8c-3cec1c86fe68", "comment": "Malware payload (AgentTesla)", "value": "49ff6376037b94e3988435bc6c4d3a6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912951, "uuid": "0285757d-85d9-4587-a25b-365b1cc1d4ea", "comment": "Malware payload (AgentTesla)", "value": "7c00cf5e15c2c840b03ade94f4544d08a55e51885e8d315593d9ff34284b8923", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912951, "uuid": "3c80632d-4abe-48da-b83d-2d87cf7a90ca", "comment": "Malware payload (AgentTesla)", "value": "1ca94ba07f3376af225d1a5ed68c5a78d604acaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912951, "uuid": "e6308b49-939e-4dcb-a229-686daa048782", "comment": "Malware payload (AgentTesla)", "value": "e0afe093092a3b9907413e48f21e2fc004e4b654e94a05c2e54e846306243561dced723e6565cb9cac45f579825e75f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912951, "uuid": "d6b2310e-0acb-48e3-b78f-f3cf84a46ef9", "value": "T193C45316EA61A42FE4538DB1793995467C292E721680EC4BF7805FA930709AFF0F4B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912951, "uuid": "7fdfdf71-764f-4995-afe9-d85869d9911f", "value": "5131eb2f38006fda23b3ba92f1e65ec1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912951, "uuid": "f68ae309-153a-4622-9a2b-116713fca6f1", "value": "12288:pQWb1yxgMCyFgMZd0w0zcXLBZoid2Aa/Ud8ma:FE/GDiha/U6ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912951, "uuid": "4fa006f0-86af-4590-bea4-997bad264cd3", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912951, "uuid": "88fceeac-6ecc-4b7c-920c-3847528bd47a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912951, "uuid": "d83bd97a-76a4-4d11-99bd-c7ce77018508", "value": "7c00cf5e15c2c840b03ade94f4544d08a55e51885e8d315593d9ff34284b8923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aee7672-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780928951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928951, "uuid": "5f84d47b-a6ab-4a59-a1ac-146689152c71", "comment": "Malware payload (PureLogsStealer)", "value": "df6ed495d4907f835df22ceb61d41cb2", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928951, "uuid": "e801c8d6-2411-4c70-bd07-18b38cf148c1", "comment": "Malware payload (PureLogsStealer)", "value": "7c18d8fd2df13229cd0bce8ae2483a0f8c29604bdbaef26beba28fa28483dad5", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928951, "uuid": "e83c3eb8-fa6e-402e-8ba3-081343859b20", "comment": "Malware payload (PureLogsStealer)", "value": "f5cdcc6365f0c8056d59db974a2b6fa9fa7d8cc4", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928951, "uuid": "a0d2314b-4b4a-4184-9510-aa520795b6db", "comment": "Malware payload (PureLogsStealer)", "value": "4d1e8f5b37fc9fc0c8a6e317977ff72de59ff88deb17d54faa4bdeff66f1e37170e134912d09fc5411dc4eb2e11d79bb", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928951, "uuid": "7164bdb1-92af-4660-bdf1-04b8f89747b0", "value": "T1ABB312739310D9528B19F7FC4808EC234FBA1EF9D173A6B115D5FB223C96694A16CE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928951, "uuid": "bc9046a6-daf0-42c5-99e3-f26eb9276d12", "value": "3072:GGcnm6gqbsqmWuyMD/io2qXc0S8UZ3eqwyfHl8:GGDWAqmyMTZ9K85898", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928951, "uuid": "c2f45b02-67b0-4126-b82a-5edee7c1e141", "value": 110246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928951, "uuid": "abcfee62-ac2e-489f-9a9e-3ca37f270584", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928951, "uuid": "7801beab-f234-4545-b285-02c61b82f664", "value": "Payment_Update_Profoma_Invoice_pdf.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506fd9cc-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780912156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912156, "uuid": "539f2d56-bdd7-49d8-9f3b-3e1df05acb50", "comment": "Malware payload (PhantomStealer)", "value": "772d9c532730072790e5682beefe9dc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912156, "uuid": "3c175ddf-918f-4015-8dea-f5f8a86d17d3", "comment": "Malware payload (PhantomStealer)", "value": "7c26003b25a03f34ac2ddd11324d2501506ef7fa694cac3ec9d63717d3071783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912156, "uuid": "64561d0b-aab5-46c0-810a-f4856130b2d1", "comment": "Malware payload (PhantomStealer)", "value": "c2f542bf891d5e6a78b1bcf3e4fcdf0989633f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912156, "uuid": "3c92566f-1d8f-46ff-ae82-58910b3b7f3e", "comment": "Malware payload (PhantomStealer)", "value": "ee8385001393b90239e1a17669fd1bcecf423693d36873a1680d6e3ea9b5d283bef2414f966f4b98dac8238c0e6880cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912156, "uuid": "0faddae2-9146-4e21-aeb3-00064e2b10a2", "value": "T15F6523A65669D62ACE6A4B7609B0F33643600D5EE520D3435FEDFDDF302A366180D2E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912156, "uuid": "7cad676c-bbfe-4f2f-98ff-5e52d53a221c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912156, "uuid": "0577f4ec-0fd9-425e-98ad-1c9ecb7b6c84", "value": "24576:ga8eqhmLrshGEhHZBkvSSUeQWz7cnyHIy9JDQIkzhCqhRAN45u2qn0NQCZnrP870:mXhn6vSSx/7cyowJDHkz3h9jqmZniE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912156, "uuid": "4e661c06-a91d-4a39-ba32-22805d79b95f", "value": 1498624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912156, "uuid": "a6051013-fd7e-44e2-a32f-d4f5a65d1cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912156, "uuid": "977e5653-ba7d-4981-9519-2330e6955c7a", "value": "7c26003b25a03f34ac2ddd11324d2501506ef7fa694cac3ec9d63717d3071783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9cbee5-631e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912012, "uuid": "3759c8e2-469a-436f-a281-d67c6b4a736e", "comment": "Malware payload", "value": "a4b680ab420fbac9bcdf7e24bd233ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912012, "uuid": "d98a7f7e-650c-4713-9e47-a477801390d4", "comment": "Malware payload", "value": "7c3fb3390ffc8b7b58bfd5301320cb3206e955ecce27a2176162d44d62834c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912012, "uuid": "1dff3dfb-1287-4be8-a5dc-2ab8085fa87b", "comment": "Malware payload", "value": "f7e9b445cdfb67a08fa8efb190a2ca533835383b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912012, "uuid": "19fa3b8d-0f16-438b-9bdd-5b5c9e5b7256", "comment": "Malware payload", "value": "821034cee9d74350abb6ee2810cbf375042ddf8158cb83962fafb7fae45889ef11410eb989e94d2c841663f24b8c23b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912012, "uuid": "a83d0eb4-3c39-458c-a728-e8c15df14586", "value": "T15F65CF1CE38D11E8D227D534CBE6A232E7B678590761BADF065AC2152F73AD02F7A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912012, "uuid": "98f6eef8-9bbf-4b11-8fe3-941a558e3aa9", "value": "3e3cc0d07e80f21ad4fda2de97dc2a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912012, "uuid": "d2eca1bb-515a-44e1-a94c-b14605a59bd4", "value": "24576:5h3k7harZP7322uzZcPeJ1YmUrZi4Jjz7m2i7+YJB92nKWG1XMgPXisnHjA3:5h3KUn+ZcPeJ1Ym4iK7YnJHJWsXnrnHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912012, "uuid": "396f9408-1bd7-4728-8997-cec3cca27fa8", "value": 1535488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912012, "uuid": "de0ed08c-bf3a-4bee-8199-f0893f5b634f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912012, "uuid": "d8783878-997e-45e5-b357-dc52ba219ba4", "value": "7c3fb3390ffc8b7b58bfd5301320cb3206e955ecce27a2176162d44d62834c01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58ca2a4-6339-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780923547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923547, "uuid": "1bdc16a6-e63b-47d5-978a-fb0f3cd7c934", "comment": "Malware payload", "value": "c9bb0eed1586262ab42ea5a61298b1fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923547, "uuid": "0c4a382c-8a4e-4f9d-8349-e8151b55862f", "comment": "Malware payload", "value": "7cc7c63542bfc39f82020d99cd5d84032ebcc85c3d941b1b9b2f74f52d529f20", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923547, "uuid": "9a9be2cf-11c4-49b7-9f2d-76c099414a25", "comment": "Malware payload", "value": "6e253d2bda265630d61302740bbb697bde81d2f8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923547, "uuid": "ebc4d8a9-3e75-4df8-8ba6-18d80828609f", "comment": "Malware payload", "value": "ec365c38d47a81178c78c5a0742cbd43434befe73af918091a87156788c6ee8bb5b5e661829cd507142b617ba89d672e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923547, "uuid": "c124fa50-0e99-4484-9c19-a711e8cbe145", "value": "T15E054A3DCCA4412FE0BBDA19C59A446FF8D11627212CE94710CB3B9FAE73A45B79221D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923547, "uuid": "e872ecd7-f504-4439-b953-930d4e323dd4", "value": "3072:ycMN4ifjqZR5D3AmwHhpMbTX+v0YGKBPuGuAuQaMRI7TkzVpJ4T3LlGaa6Ap/yck:TGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923547, "uuid": "4b994cc6-d9bf-447a-9c2d-7a656dbd4ba5", "value": 815114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923547, "uuid": "52012b02-ee75-4135-b08e-40cae3ed87d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923547, "uuid": "cd790a39-c8b3-475a-9fca-13dc2efbc3fc", "value": "New Order FOB \u2013 HongKong Kaisung Innovase Enterprise Co. Ltd_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ef2fd2-6310-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780905703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905703, "uuid": "44020c9d-aefc-41a9-9d0c-2aca84fda116", "comment": "Malware payload (Formbook)", "value": "e17a1505e01ef426c1cb29376abfeeb6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905703, "uuid": "7ce2106d-92e0-437b-a1e3-37b60e2ca221", "comment": "Malware payload (Formbook)", "value": "7d64641ad458b11b80551359bd4a39a91111150ee83c0f3ed43a79e05409db44", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905703, "uuid": "31648573-28ff-4c6d-acd7-b5c35c2a3816", "comment": "Malware payload (Formbook)", "value": "9493a3a7ef6ed42a5e9306cff82554bd23520d7f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905703, "uuid": "9fffaaf8-7037-442b-9867-c65e4beab835", "comment": "Malware payload (Formbook)", "value": "bcf25e4d4ee14533ab8d9bdbc42f14c2e4b4a2377dd99d9fa5985c6ac5cf86c82cbded6dd72374443bafceab1d1e5778", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905703, "uuid": "8624f44c-26b5-475e-8e1f-9ccc0871d35e", "value": "T100E55C17D66F574E180E3B61106A5D9AFE89CAFCEF72ABC4E0CF90B514EA1100B452B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905703, "uuid": "2f0b362d-dbfb-40b5-8209-cb26d37d64ca", "value": "49152:Elk/LCfKKEAm7KaRPICeRmFqbJbPT7eOdnahaMwW9K+Vr7G1VUP8Ql9tn:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780905703, "uuid": "b1e3fbe6-2c99-4657-94ea-3b6450bb4db1", "value": 3092467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780905703, "uuid": "265467f3-2129-464b-86d4-c80850b496ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905703, "uuid": "b7ff0cdd-f690-438e-8948-5dbda4804531", "value": "MT_Griya_Bugis_Appointment_LetterPdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a8608e-6374-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780948805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948805, "uuid": "5929d83a-c0f8-4a02-808d-427bb5172ad0", "comment": "Malware payload", "value": "d4196a9c72ed551172e24cc716bb5b69", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948805, "uuid": "2eac9d4d-dec0-4a47-8dc4-581591ae02b7", "comment": "Malware payload", "value": "7db5c8635d448b2f18c06d4b664f44731015db2fdec80367fcaef8f22fc2d3c8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948805, "uuid": "a16ffd49-c7e4-47a4-92c9-9295da6d7f9b", "comment": "Malware payload", "value": "f2d04d2e55ad44528eac959891525771741a3e34", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780948805, "uuid": "0c1b0824-224e-48dd-bcbe-c3337573f7ea", "comment": "Malware payload", "value": "adabfd1c695b97c0daa2fff030ce66e0b5b0521f4360213cf3912afe71c1ea23d739198c4f61e5725980d4f947600ae3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948805, "uuid": "24cf6e23-16fb-46fd-9c70-01c9c9a1c9c9", "value": "T1E991C7639E27C5F50EA25A353A0800532CA38BAAF852153ABD9882ED2C5405C52FCF79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948805, "uuid": "811f6e32-e9d2-4c79-bf49-ef59996a2f96", "value": "96:qQNWOGVtsN2owx7gHzmepIrbcmoJnL01cLXGMGM:VYZKIrqJnLraM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780948805, "uuid": "bc136c1d-3692-4d1c-a3f6-3de38a81f321", "value": 4496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780948805, "uuid": "a33a510f-b5b9-4e82-bf3d-76c9757c7403", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780948805, "uuid": "639af9f0-10ec-448c-8fb2-97dcba0a49b7", "value": "rPedidodeCota__.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038fe3a9-630f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780905156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905156, "uuid": "c81f430d-2396-48dd-a1ce-3e0efc93626a", "comment": "Malware payload", "value": "fd40d934e903a5698722e8d4ad3cd25a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905156, "uuid": "9268bff5-17bf-4ace-aa01-ac6ec555ec84", "comment": "Malware payload", "value": "7e2eca854b9b34b092df5c394caa19c8b4e9302167ae44edf50407c5fe59ecad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905156, "uuid": "58bf4d5d-af04-4f53-b0a6-74de5dfa6c73", "comment": "Malware payload", "value": "495cf2ae131bfeb233181e26765b5343b40ce611", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780905156, "uuid": "a14061f0-de25-4277-9c10-2e0dcd09562a", "comment": "Malware payload", "value": "46cf1d75f0a9fa0e48b6a385c438b6d19b69eaead5b23b03b37b81eb6e9961e48285f362545b83fd35a57539e92ddf3b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905156, "uuid": "2965e866-4992-4e98-adb3-ad9c3bccf9d8", "value": "T15D01AFCEC026D75011D9E49D22D75045B812C3CB25468FB6BEAC547DCBBDE08B015F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905156, "uuid": "04057c8c-090f-40be-9b38-4547a56a1393", "value": "24:kXCKysE2hi0ziQvZohaaxUuQi/2vsFF90X:e9Qp+MsaPQ42k/90X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780905156, "uuid": "c787a115-cbf3-4646-9f19-5d2364d9d13f", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780905156, "uuid": "d137d4f8-ecd4-4eb7-b37f-8623cd2fabf6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780905156, "uuid": "cefb5f11-0141-40f9-a11e-ac7f56b8b684", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4c7606-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911936, "uuid": "7d007737-6de8-4dd9-a0d4-1ee54821a216", "comment": "Malware payload (a310Logger)", "value": "9ee340a62fb58dadaaa98162648b998e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911936, "uuid": "bd8bb24c-2191-4d1b-b746-affe6d0cbc0b", "comment": "Malware payload (a310Logger)", "value": "7f09e7c4e8534b3a0cc80c2b88d310981c995132ece3ec78af84435457f4efd9", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911936, "uuid": "7b43cb47-623a-438e-bb32-5a325b8360e4", "comment": "Malware payload (a310Logger)", "value": "68a1183e7077d945a49c8dec2b82b43954c4800c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911936, "uuid": "35bf7bb0-cf57-4376-84d6-be4036f2e47e", "comment": "Malware payload (a310Logger)", "value": "4e3497dc1ec7e49d0000e758e20e9e6271d4f8698335c27deebcd43557974051c9ea296f8ce261849ea6208f9685af46", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911936, "uuid": "dcab9a09-0d4f-4c37-8dde-1aaf8465db9f", "value": "T1B2A44A03EA60612EF1A389F1A9B5629668267D3A17DCE88BF3404F5935315D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911936, "uuid": "d1060390-f8f4-4a94-8e4f-03fc0ad3a403", "value": "63188fba16188090cd2f35054eb46278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911936, "uuid": "530bedea-0157-4d66-af59-999e110582d7", "value": "6144:38d1/w5KA81IJ8GpF6nuTmOOUiBUrj1CNfmDlbXmH4jSpkOf4dZyzCTyxYb+qh0t:MjYKkJj6GmZUiqr85mkHyi0ZyzCei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911936, "uuid": "70936994-4924-4785-9515-d4a4c628ba8d", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911936, "uuid": "e412ab5c-9518-4bba-973b-f7eca7b862ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911936, "uuid": "a80dcfa1-5e21-4f07-8eae-f4095a952548", "value": "7f09e7c4e8534b3a0cc80c2b88d310981c995132ece3ec78af84435457f4efd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369785ce-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780912113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912113, "uuid": "e244cbf4-b78b-4c9b-8bbd-ec8694c3d8e0", "comment": "Malware payload (RemcosRAT)", "value": "569b1cbe5b66492960f1f7a4fd29ae2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912113, "uuid": "9f5cb5c5-0ef3-4a23-acc4-4234508ae31c", "comment": "Malware payload (RemcosRAT)", "value": "7f1f23d2e6de9fd7cbc234e92d5ab2ada529635e5560c86cadebd3f8ddee2848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912113, "uuid": "771a2f34-f684-48a2-bb02-439b531f5857", "comment": "Malware payload (RemcosRAT)", "value": "fdd446318126d82632af45534f6ea9bfb8308a0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912113, "uuid": "e0c9f144-8669-47c2-b070-0d384286b20a", "comment": "Malware payload (RemcosRAT)", "value": "51921e40aa182e7a658fdd1434fa181ba4cdd52415843500586c66d80eb8e41862ca776b13a330624cb418f4d72cbe1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912113, "uuid": "031185cf-779b-4680-ae24-5280778d99ba", "value": "T14E0512B89B99F63BC86347364870C77247288E6ED610D35B4FECECEF341A6647A18095", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912113, "uuid": "59cfcd65-7c0d-42ff-b2c5-ef49f9fc977f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912113, "uuid": "a0e0f593-33c6-4604-9a7a-814916fa2f5e", "value": "12288:/HuKgiuMO6fOwc0hcEIo88j7Xwi0iPjCqWq3HcmnSJGz0JWsfGNDZ+1WaQ1:/OKgiuMYwc0i5uwKbNWsIGacZ+1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912113, "uuid": "b83e4692-3ae8-4e3e-b156-ac00cac266f8", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912113, "uuid": "03d52cc5-b3f6-49a3-956f-6c8d473b39d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912113, "uuid": "d14a8dc7-0fd0-4511-9602-5e04421cbf33", "value": "7f1f23d2e6de9fd7cbc234e92d5ab2ada529635e5560c86cadebd3f8ddee2848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcfa965-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941381, "uuid": "affae511-1527-4d47-87ba-6c5f5917d5c5", "comment": "Malware payload (Snojan)", "value": "cf38052bab255693b2d51da9e441ad28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941381, "uuid": "3a3c077a-7b0d-49be-8e47-e146d58f3cd0", "comment": "Malware payload (Snojan)", "value": "7f241fc8960b92ac817104e40c38a06f750c033defb60f53f3e8cdb15791c22f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941381, "uuid": "3d20e51a-bb8c-45ee-8946-d60c8d36dc5d", "comment": "Malware payload (Snojan)", "value": "0b5a8fa36c1a193eeb68372915cda8b826c342be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941381, "uuid": "c61bdc82-2250-40e2-9676-6ff36c8e1ec6", "comment": "Malware payload (Snojan)", "value": "e948b07cbaf093ef5dd50302e4166a45139a39563529b84504e6e70c543cd4106cbdf99deb60904b4259b05744fa0713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941381, "uuid": "9ca7a572-c8a3-4668-9dca-d84731c7512d", "value": "T1D835232471C0C4B7D46B403544C9CA76AA76B07247BA89DBBBDD63F9AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941381, "uuid": "e46e7e93-12c2-439b-aac8-be21f4199482", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941381, "uuid": "bfa832c6-e47c-4036-96f6-4d39eacc6af0", "value": "24576:/Y+2k70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyLBP02:0kQTAKYS/v6h3+1uhZcT2NnvOyLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941381, "uuid": "6a4b065c-356e-4544-9832-8e1f80941a14", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941381, "uuid": "d4830ad2-d3ec-4fa4-957b-5294c105afe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941381, "uuid": "39b44d51-1839-4686-b8cb-0ed701ef094d", "value": "OhE8UjQ3kgMfTwma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41092051-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780910842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910842, "uuid": "03206328-c392-4932-8e17-04fa78afaae9", "comment": "Malware payload (SnakeKeylogger)", "value": "1ba2e5a40296feec512fe80ec1763b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910842, "uuid": "46cc9b28-4f61-40b4-98c7-0d6ff61ff750", "comment": "Malware payload (SnakeKeylogger)", "value": "7f576ee2dc16df02b2a13e078fcb34ae4bcd684ecf0cebb5d565558b857cd56c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910842, "uuid": "5e793334-629d-4eab-90a7-3662d8792e5f", "comment": "Malware payload (SnakeKeylogger)", "value": "46c4fea811bef1f5465c3b014cffb916e12274ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910842, "uuid": "54244285-1bc8-45cf-8c48-67b4bf5f2536", "comment": "Malware payload (SnakeKeylogger)", "value": "607154364f98eec7ebf8812f91a56f927c597f0b7e5177734bb40e26fc1621903d36114289ccd365b4a1c812245f3341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910842, "uuid": "15cbeb3e-8f0b-4803-a9bc-9859041ba4c8", "value": "T19505126C1B01D902C9949B745971F2F8277D4ECAE812D307EFDD6EEFBD62A204C45286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910842, "uuid": "fcdc51cc-1241-436f-8202-05efdfdf6401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910842, "uuid": "8b00245f-47e7-4359-b699-b139119b1530", "value": "12288:lYvFwlNIJzpOL0/l+UmXIm3TzZaH54oKfusVdWr8BYHEeOCfY72N9RBp9Yj+Z9bv:edHFpOLwPUzZiW/28vUI2N9RBpq+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910842, "uuid": "e91035dc-8318-4d81-a233-4d3c3ae6d65a", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910842, "uuid": "2188d2eb-1854-4003-831a-426418ea9ec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910842, "uuid": "762a6d1d-35de-448a-b2d5-c68a8a2d2ad8", "value": "7f576ee2dc16df02b2a13e078fcb34ae4bcd684ecf0cebb5d565558b857cd56c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e6b2e8-634a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780930902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930902, "uuid": "a070b3d8-9d32-4b71-a31a-ca661035b9e1", "comment": "Malware payload", "value": "392ad77698eda067a50768a470e41ad2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930902, "uuid": "ac696d38-612a-4650-834d-b56b08485670", "comment": "Malware payload", "value": "7f7ce6c60ec2b7aeb6961c1172db75c179951e621218390460166e3885b72749", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930902, "uuid": "0248a88f-0c7c-4d0f-b19e-e30a309b8755", "comment": "Malware payload", "value": "5e8e8b9b1d268e64a773218b35e283c0f14d24a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780930902, "uuid": "ca90a070-2734-494e-bfce-5273d24058c1", "comment": "Malware payload", "value": "4816d2bf17f8dd40b076d228f043e96e3a526d276dbdb1c406a27a1d76013ea315d1612d0cfc64279b5ec3d961b7e9d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930902, "uuid": "f00c7891-cb35-442d-94b5-e19bb5d0faf9", "value": "T1C435E639E2CC6B52D51D2EFA40F23410D31CC449BA7AD39E9DDF08984642FADCD8B699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930902, "uuid": "5c655952-bc97-43e6-9dc9-52079fef3572", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930902, "uuid": "d9cc1d0a-1dba-4567-9b57-b9caecd9157f", "value": "12288:FemzXHVqG5xLuPePTdpdAaNJ5dZ84FlOiqJk3uChOSR:FemzlqG5Fu8DZ8ylOiJ3uC4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780930902, "uuid": "fe1b8088-56ca-40a2-bba0-bf00e44909b2", "value": 1162752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780930902, "uuid": "ccadd7e7-dc15-4cd7-af6e-35df322da201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780930902, "uuid": "fe8f8f21-3e85-4f4f-9b6c-a5499c7c3957", "value": "as.al_file_Ssn2Eg_decoded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597108af-637e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780952974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952974, "uuid": "41f1f835-108d-4934-aed4-e8ec21ddeedd", "comment": "Malware payload (Mirai)", "value": "92be9eb21fde93cfc8abbaeb5a99b03f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952974, "uuid": "ab12fd09-bc19-4ceb-b9b2-e02834685f9a", "comment": "Malware payload (Mirai)", "value": "7f94d5fea33dddff0d0ac3aca3176ad678ccc4f24c76e3a6a3f0dad4870106f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952974, "uuid": "9edf117e-31f1-45f9-9865-9af74da7165d", "comment": "Malware payload (Mirai)", "value": "24ad840e63690ffdeca51401c593016d6f9a7e84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780952974, "uuid": "7c3f41df-bb9c-48e2-a057-f6201c970dca", "comment": "Malware payload (Mirai)", "value": "5bd6612b14c85dbff988ac23631aa74e1aa56eb0303bafab810ce3f8e1303e2bf0bc7970b6e32fd4f547963c24591fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952974, "uuid": "176a7c18-a45a-4c95-86bd-c18b7e84d9d8", "value": "T12EB32CD6BC818B11D6C115BAFE1F118D33134BB8E3EA72138E185B2D678AC6B0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952974, "uuid": "43c79c20-12c3-475b-9e6b-708714d62b70", "value": "3072:a6mRAzgU97LwolnEqMmyaLaKrgIMjdHazXPDJd8eNuj0UMsJ:Nblb9ya98BHarPDFNkosJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780952974, "uuid": "a1a2b6b9-7a0f-4c40-9566-8705f03cb8e1", "value": 112252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780952974, "uuid": "28e362da-b9aa-434d-891e-212ad797e5fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780952974, "uuid": "219ce894-923e-48d6-8f28-bd5c5c8a7daf", "value": "jklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137fb460-635d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780938683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938683, "uuid": "837f5e98-9284-47e9-8500-ad7ddf29fb2b", "comment": "Malware payload", "value": "3395c3641bc1f1fc20ac4b7865579357", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938683, "uuid": "cbf9307d-dc70-4c8c-8fda-349e2fae3582", "comment": "Malware payload", "value": "7fc5f129253acfbf6fc86e072056791ec66cd30c2a5db7013d8eca0d76a5e52c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938683, "uuid": "89840ac3-2ede-414b-9c49-9839bc7dd861", "comment": "Malware payload", "value": "0a7cbeaf02cb1f93fcda9cdcf16ce33f43fa482b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780938683, "uuid": "b069623a-601b-4652-98fb-8c0d738f932b", "comment": "Malware payload", "value": "c0b42509873a4543fb6d99f516f17593a0b5188d225a3b1919194853c76153ce6a63af8b5619c3cb315bc30e91e5c422", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780938683, "uuid": "fc03d478-545e-4d23-869e-1a4b7a0f802a", "value": "T19B3136EB4B053A9D4401D9A673651648E0A8E6DA304FE764FF491CBBA3C85483359F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780938683, "uuid": "d6ac4edc-184d-4b8a-9e0a-1fd02db2f3b3", "value": "12:59lr9ZHkLrGfWA3Hrr3hAUN3Mtyr9iAa/WprfPG5r/EtBkRkuzHrruzIJptI5rI9:tH7WP2aQwEtBkR5HCIJpMvlO7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780938683, "uuid": "5da2a9f2-24a3-48a5-951a-81c188e8a548", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780938683, "uuid": "5de9eb91-35c2-40c0-ac8f-e98c7d4b1daa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780938683, "uuid": "34802566-fc22-4f46-a0d7-4b0e2a3426dc", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95fb830-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911930, "uuid": "d20ddcb6-15c6-42c6-bfca-aefb7a90f993", "comment": "Malware payload (Formbook)", "value": "68b45b4220514c7e3cc22a9435fccbaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911930, "uuid": "5f3f125f-71c6-46ec-98db-2563531f615e", "comment": "Malware payload (Formbook)", "value": "7fd7bd2b8be87e7a7d1f1a35b8e2f115a9393b11684ee7e94b5d66b938906afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911930, "uuid": "abdda2d4-374e-49de-9654-5ebe3c699888", "comment": "Malware payload (Formbook)", "value": "e2ca397e5699bc80f4b4e80ef7b044267fc4f7ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911930, "uuid": "370fe4b2-be5d-4258-af06-29bded49a71c", "comment": "Malware payload (Formbook)", "value": "d8d8bbd78c2115172b2cdc30b4511b876234a19f3cd9f1b0e983e29d1f602652a2acfbc43beaa653110571fb34449048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911930, "uuid": "6c4dc9a3-b629-4124-94e4-b4821659a49e", "value": "T1D11512186A4AE607CA9627B40E70F2B4132D2EEEA521D707AFDD6DDBB677F010E04147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911930, "uuid": "6731b5b2-6c6e-4598-846a-bde5fa717b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911930, "uuid": "ae07bb2d-fdf6-4065-8148-88c486bf860b", "value": "12288:erFc3jdHL/kCer+lh9E2IhUAcJBgpFO11zDP9+inVIuCR6t1tqOyRknk0Hro9+D6:nxgHw9yRcJBgpFO/PIsVIuCRIpMSjEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911930, "uuid": "34b728aa-8e06-4282-9703-bee1cc288e24", "value": 920064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911930, "uuid": "e8d2fed4-c1d3-4f18-991c-03ab5bee5cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911930, "uuid": "9885c777-0c10-4269-af2c-aa68169d5583", "value": "7fd7bd2b8be87e7a7d1f1a35b8e2f115a9393b11684ee7e94b5d66b938906afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5b165e-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780911234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911234, "uuid": "afe33158-f213-4781-80fc-bcb5c4e121f9", "comment": "Malware payload (SnakeKeylogger)", "value": "4e2c4606f5c1e7524df614a67d8e0158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911234, "uuid": "08a1cefd-5d27-42a6-abe2-4f385accc9cb", "comment": "Malware payload (SnakeKeylogger)", "value": "803d6aeb379857416ead51f62c9d5484809d36becdcc1d6d591870049fae9b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911234, "uuid": "4a8adf35-fe56-43ef-adef-6b4db129a131", "comment": "Malware payload (SnakeKeylogger)", "value": "5a88f63b1776e648f7ed95fa6ab7584ec0bfe1c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911234, "uuid": "4313b43b-c0dd-4918-8638-6873f726606c", "comment": "Malware payload (SnakeKeylogger)", "value": "ef6786ea0421793a242fe7062065da8e5106960237eb207b14ec7373d36c10a6a3405044e782a51e4e51e6f969644076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911234, "uuid": "9bc7bdae-7091-4702-a716-f73e22e1cfd3", "value": "T1130512946689D20BC591077409B1F3B417AD1EEEA801E60BAFEAADDFB57EF100D14393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911234, "uuid": "04a949c6-fbbf-450f-acd6-9b4ee39a2343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911234, "uuid": "51dcea32-666c-4173-a188-81bdf80002ee", "value": "24576:8PYQ8YCkVhQiHxPY68gSyEjAMLBfcsvZmYDCkI:5tYzhHdY6xWACfcsARkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911234, "uuid": "f22c49e9-d3d0-4cc2-aede-11e290e80c9d", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911234, "uuid": "b774e57b-6b04-426c-8e8c-321bd24875f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911234, "uuid": "06c4a234-1cbc-401a-9a9b-2154a6a4d2c6", "value": "803d6aeb379857416ead51f62c9d5484809d36becdcc1d6d591870049fae9b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d092c78-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780912043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912043, "uuid": "1dc715b7-7b59-429d-a6ad-425ab71dc396", "comment": "Malware payload (PhantomStealer)", "value": "60d994c0817f06522785a19e42758264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912043, "uuid": "8328e6a6-a2b9-4a04-b934-448226321849", "comment": "Malware payload (PhantomStealer)", "value": "80941f145866655b28fb0a6baa2b6efebce45de9e564347515f7531e88b48d48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912043, "uuid": "b3d3ae30-ae62-4ed0-b3af-b646ab5184aa", "comment": "Malware payload (PhantomStealer)", "value": "b3f88feb344e360726054e8b9a603423e4f86d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912043, "uuid": "78571b2e-6ada-463f-8f3e-869fe9f09d85", "comment": "Malware payload (PhantomStealer)", "value": "358c4fbed247ebd256ef648ad0f4118a52166fce20b4943f22ae399a40b780f5500523dd3b43d939edd8ad18dd48ac25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912043, "uuid": "3db1824d-ae0a-4d78-b294-f015b1ddddbb", "value": "T1D965232C2706D403C2812BB9AD71F2F413691EEE7814E3979FCD7FABB867A545C440A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912043, "uuid": "f580601a-8701-489a-8327-762c740660b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912043, "uuid": "1a03a48d-5ad6-4d63-97e5-50f46b347693", "value": "24576:U/06eADiqH4C61+xjmF+0zuF/zNh8KO1PDRyutYNjmRmvv43YAIe67RZYc67+OAA:l6Jiq4Cq+xjm4FrNh81tDN2n43N61ZY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912043, "uuid": "f4df16e3-db1e-4907-ad2a-ba86b8301596", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912043, "uuid": "6e7fa1b3-76ad-4732-8a9f-7668d62ddf17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912043, "uuid": "6c5fe210-5b4b-4f27-b6bd-6bfee0931e4f", "value": "80941f145866655b28fb0a6baa2b6efebce45de9e564347515f7531e88b48d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d640996a-62f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780896060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780896060, "uuid": "610b0f7f-f551-4dcb-810b-a57350a9f42c", "comment": "Malware payload", "value": "14aa825aeebc4e24c342e979b9d2dc85", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780896060, "uuid": "736d488a-80ee-438c-94da-b93db3c3d903", "comment": "Malware payload", "value": "80e48530ea78b466d1e904ecd1ff403419aee4bc789af5eaa9ddef3476e05ec6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780896060, "uuid": "a3fe8401-e7a7-455d-b2e6-238415c0c6d8", "comment": "Malware payload", "value": "de6240c42381642f3470570f34024cf588e5f17e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780896060, "uuid": "612ee6d1-7b4f-4425-b92f-70d27a3400b4", "comment": "Malware payload", "value": "b205768efd31d67d1455fd8d3cf8b7ed7e0e6fc8d8fe3451790ff4f4731da00e971de0402603fd830c6fbf549cad1a29", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780896060, "uuid": "3bc99c06-2436-4686-b322-f11c2943957c", "value": "T104018CDD800A9B5011D6E89D32DB2444B828C3CB25428BB9BF6D243D8BA9A0C701AF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780896060, "uuid": "cf9b0d14-f703-4bc0-9804-26b92135a04c", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkac1IiGAf1cEI3T9IN/FnjIsejxI7tXSX:kXCKysE2hi0ziQvZohasvl6+/x4lTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780896060, "uuid": "f294354a-97c7-4b59-bed9-b8c175617242", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780896060, "uuid": "ff2f3d26-9d4b-4a56-bc2d-ad97891140db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780896060, "uuid": "fd7badaf-3773-4529-b86a-4cb90ac97879", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1a5d8b-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908101, "uuid": "a2abb9c7-ec22-4d67-b08d-4510dfab1295", "comment": "Malware payload (AgentTesla)", "value": "38c7f40974c3da3c278278712a0529f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908101, "uuid": "3e9bd3c1-d989-4604-a0cc-1e74cee20de1", "comment": "Malware payload (AgentTesla)", "value": "812d449eb3750a33e26741c13a405b9c00c68306a26755dad33114c6980d78b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908101, "uuid": "0ef14ba5-9ccc-4b3a-a7a4-9291ae086ece", "comment": "Malware payload (AgentTesla)", "value": "bf0ca7c17242846692d071d44a3ca7551a77b5bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908101, "uuid": "49c85e3c-7617-41ba-9f04-df45230a861a", "comment": "Malware payload (AgentTesla)", "value": "fa7956d358ff8b29d2f4da5b2f6278af41efb95ef04c6cc7f953e1f4df051ba06fe98c6673dd71b44f594f72aaecb8c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908101, "uuid": "f7c1295d-e2e4-4d3b-bc63-2f4f0972c340", "value": "T17FF423206292EC6BC6164371E87686FFA7A3EC50E24492473B16FF5E3FB25585C06783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908101, "uuid": "7f64083b-9acb-4f61-b3d5-7984369b1f27", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908101, "uuid": "0db8d76c-ae86-4129-a523-f8716addb02f", "value": "12288:wzYrcdMuKIYkJjujQBeifSoblSeSugtaLjR3fYT53BHy90MyZTBYP92r6lNbal/L:rcd/YkJjGQFRbpqaLlfYV3BHyQTBosm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908101, "uuid": "cd7cdc86-fc32-4915-a0f0-d0b0f64d3942", "value": 727990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908101, "uuid": "9c9ac3a1-450d-41bf-b2e0-d93083e8bc23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908101, "uuid": "4a7fe07a-f0e8-4bf9-85e6-65bfa6fcd60e", "value": "812d449eb3750a33e26741c13a405b9c00c68306a26755dad33114c6980d78b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660733ed-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910475, "uuid": "f6dfa467-6790-4687-90b2-bb6a8df0ed5a", "comment": "Malware payload (Formbook)", "value": "e5a6cf272b9d1191e74ce2c9f64064e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910475, "uuid": "ce376b58-140f-4a65-b981-fb4f35ed3f91", "comment": "Malware payload (Formbook)", "value": "814e9182e488fc28c23dbe7a004846b6aa709a1cb31a11e335f5a20d2a7fd35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910475, "uuid": "476092a4-6ed9-4f62-bf08-fd08f7942f75", "comment": "Malware payload (Formbook)", "value": "1abc8031eb27b4de65702a3ae9b3276d0abc5539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910475, "uuid": "389aa589-0c61-41fa-9331-bbf1209f6640", "comment": "Malware payload (Formbook)", "value": "67ec89d6abbc4603ccc7c16b6405b6f847fb04b2530f28f322d096bdb476f3e3a82bb5fae44838b818e8389068e994b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910475, "uuid": "11df9757-c1d0-47a3-a482-a07936869d81", "value": "T17C2512682618E103C8936B780DB0E1B41B785D9DF921CE4BFEE57EEFB9767640820742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910475, "uuid": "9a927bfb-638d-448b-a616-6ddc1bdd689f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910475, "uuid": "31eac2b6-5d5d-4f27-8d6a-990b0adf7c05", "value": "24576:ZnNrQMyQrXBJDyrkbnZHTRUJYzfrwlGzdlOdl:PJyQrXBUrO5zYGzd0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910475, "uuid": "4709cc68-6a1c-4934-ba32-1c67d2a2f27a", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910475, "uuid": "d60c04ef-8a70-4f9f-9850-91e44d7f9fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910475, "uuid": "340baae1-3e4a-40e9-8bea-0aeb8b1feaeb", "value": "814e9182e488fc28c23dbe7a004846b6aa709a1cb31a11e335f5a20d2a7fd35b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889a6065-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912680, "uuid": "beb950cc-5ba8-42ef-96dd-0d94c8734b3f", "comment": "Malware payload (AgentTesla)", "value": "49017aa1aea3971db0849ade4555b361", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912680, "uuid": "490223ab-1b78-4462-8814-8027c545eee9", "comment": "Malware payload (AgentTesla)", "value": "82cceb44c38ffdd626c9e96b676d09337e99602f2ed7514017fe0072f34bd98f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912680, "uuid": "d594f7cd-5e7f-4255-80c0-adcc515c8019", "comment": "Malware payload (AgentTesla)", "value": "cfe18d17cd6d539a7cf2e38217637d73274bcbd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912680, "uuid": "4a93ea8f-d43b-471b-82e1-c25892b22a09", "comment": "Malware payload (AgentTesla)", "value": "cf3bb8dfb78c8c0dc7dfb320bce03355eedbe45fdd15997bb92e6657475c791dabb421e3e5a7adad7949a43a693a3be5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912680, "uuid": "5b1b4b97-599a-4b67-812b-4644498c1486", "value": "T107C44116E951A02FF4938DB0697995467C2D2E3212D0EC5BB7801F993074AABF1F0B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912680, "uuid": "f957abc3-e074-4e30-acc1-fd52a2c6ed35", "value": "b3e7ae6246738dba2540c3fb45ce48f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912680, "uuid": "49d7fabf-7422-482a-b04d-184c1342df23", "value": "12288:yihdglMyJqsUcAlmHiIon9MBWh4dGuHl:5kqLcAlJhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912680, "uuid": "2ae79d54-538a-4797-a11f-2b351da72f04", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912680, "uuid": "8466a507-af13-4dc7-885b-6affa5143344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912680, "uuid": "555b54c9-2cd5-4d06-976b-329f74d72076", "value": "82cceb44c38ffdd626c9e96b676d09337e99602f2ed7514017fe0072f34bd98f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f4f324-631a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910240, "uuid": "f26bf391-3fc5-4c6b-bffa-19c6d1fb1473", "comment": "Malware payload", "value": "9ea84902acbfa7594872eb64b12c84a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910240, "uuid": "1234aa6c-ce75-42a9-b1d3-db4e15f23604", "comment": "Malware payload", "value": "82e917cd6c1dd4e8bff33b5187d3ff589b898363bda0b11e3b5a55de2abda2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910240, "uuid": "ffb9bda2-f2fc-4e47-86db-7c67b1ca0092", "comment": "Malware payload", "value": "b926dd2525f9eec96b587098c0fe8f5054237730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910240, "uuid": "92dcccd3-e345-4aa6-ac5e-2fb47b393989", "comment": "Malware payload", "value": "87ee0d5bb8aebbb2fae135210f5bea96462d30e4922d492b44eb9c217fd1953df222b3d58fc8b8374be61d3483d7a1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910240, "uuid": "bab069c1-de6b-43bb-b762-08151e4093ea", "value": "T1E085BF0573A442EDFEABE1768A13C507C7B17C450637861F06A4BA766F33B716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910240, "uuid": "4666a9ab-e06c-430a-b0d3-b7fd00e8529d", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910240, "uuid": "6a501f47-8a08-4e05-8d76-dbe4b7271cf0", "value": "24576:8CZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrG5Aas1cNUtwLID0Lpu8XcWJ8Y9ivd7:v1H4jR2TYrQbDTrGbO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910240, "uuid": "f16cb1bd-ae86-4e30-8653-ae31d36e1573", "value": 1852928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910240, "uuid": "4fe3943b-8847-4ad1-aa35-e61f45329433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910240, "uuid": "34fdf3bf-dac2-4086-9517-c7c930c3e6f3", "value": "82e917cd6c1dd4e8bff33b5187d3ff589b898363bda0b11e3b5a55de2abda2ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6e8330-6313-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907289, "uuid": "c83c6704-5e99-4468-951c-25cbb11cd63b", "comment": "Malware payload (Formbook)", "value": "4c65007fc8d04ec806fea9ae8697b290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907289, "uuid": "06159054-becb-48ab-90ba-932a689bb376", "comment": "Malware payload (Formbook)", "value": "839827a2b7f35c91f54ada0f8cee7b68bb52fce97d3199f740ad975beb24dd21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907289, "uuid": "8ac1dbec-579c-4a8a-8def-6ee1cd2dfd30", "comment": "Malware payload (Formbook)", "value": "8e98c927026eea8d0414f27be34b9d0ee3f359fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907289, "uuid": "8f198d96-cd51-4024-95fc-5bac3ae61bbc", "comment": "Malware payload (Formbook)", "value": "9c4b0d432f303d69249ff9a5205e0fc637e6359a58f5bc6f48165839d06db20122988a7b43df7bbfc67f44c5588e046b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907289, "uuid": "70df2466-ad0a-4169-bc50-0f050e85b7ae", "value": "T114251210664ED826C09A1F754C72D2F81BB56EA8ED31C6079FED3FBFB83A2615805346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907289, "uuid": "98d63dab-91b1-4924-aa07-0631670cef98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907289, "uuid": "1247a7fb-6115-4701-b8f4-589b7fa4e98b", "value": "24576:dkhwZtExac1grVSGBeN10bdaTob7M5120TrFDjWrd+z7sDH8sO:d0wYh1kVSp0h8m7C2gtjWrEQz8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907289, "uuid": "daaa496a-cf47-4904-b3ae-5316a0e56844", "value": 1028608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907289, "uuid": "6091f218-97dc-493f-8d1b-d1479975a0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907289, "uuid": "039540f0-f687-48f9-a217-e7392669b367", "value": "839827a2b7f35c91f54ada0f8cee7b68bb52fce97d3199f740ad975beb24dd21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f53c88-632a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1780917155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917155, "uuid": "aa17ae12-f5f4-4d55-b851-f2aa90008a5d", "comment": "Malware payload (ValleyRAT)", "value": "1998c5690a4d57487f1a490b41b4f2f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917155, "uuid": "76679e1b-62c2-477c-93fb-0cd2ee2e38af", "comment": "Malware payload (ValleyRAT)", "value": "84245361f072bfb435a63cfea7cd49ece38e245d6c39f53843c522479e8b6fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917155, "uuid": "43141cb2-64b3-492e-adb8-e7c7e14f08ae", "comment": "Malware payload (ValleyRAT)", "value": "a460b10afdb9fe4f8610ec39af21b5e7fc90c82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917155, "uuid": "bfab8812-5b15-432e-8f1b-88860aa10466", "comment": "Malware payload (ValleyRAT)", "value": "e26431d5cd5136912ff4e666fc3df658274bacc2fd6cce3dc7f0168bcfdab06689ac66ebdf99fbd3536eedd135ac9e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917155, "uuid": "f2e4c197-02eb-48cc-b6a1-3bccb2933ec2", "value": "T1750861667601CCE6E04682B19893FBE123BABD7689E4C30731C57B2D6FBE14D8DA3550", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917155, "uuid": "4463c9fd-eda6-47b1-a3cb-51b58e5a6b36", "value": "33100aedc979741e5464b8a91cb38f35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917155, "uuid": "5378d5db-64ea-4268-9d36-22e0b6eccc3e", "value": "196608:XxIdETpCjPxXOIdxBN8C9WCkhq+SiRVR/l8jpvUFgAW:tpOxXOId7N8bRVR/EvUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780917155, "uuid": "86e4ac74-88e8-4545-9801-12b3af899938", "value": 79227904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780917155, "uuid": "7630f862-4f60-44ab-a5a8-217fa194d5b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917155, "uuid": "51eeae27-2680-4c8e-bd01-fd10946dbb1d", "value": "ainsapp6565207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6333a05c-6346-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780928938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928938, "uuid": "05a06b0c-ab42-460c-9cbf-7a1c3b39db97", "comment": "Malware payload", "value": "7bd01561d2bb2b823b0914fc8ff56ceb", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928938, "uuid": "e1de993e-6667-445b-860a-6ec4a57f17f9", "comment": "Malware payload", "value": "84257fb468b194ba01b09ae23374d99dca6c1077bc432cb62b9270a2bebc6b29", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928938, "uuid": "9c3c0630-916a-4361-a473-974aabbe7b2f", "comment": "Malware payload", "value": "d23fb5ce28d73c59f023f6b6750b0a5d9bcb661e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928938, "uuid": "38182bd2-5786-4d69-a2e5-4558263ca358", "comment": "Malware payload", "value": "62ca8a5467b1024de74a53ecd93411a53fe24403e3359f3917c0de70c6559aed3188de2a5f492222d729341545790c9a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928938, "uuid": "4349687d-ca7e-4c78-aed5-62e1866d1ae2", "value": "T1F9D584B50753AEEB7C44ECEA1BAB9BA1933A683C07C96B5155D2E44578F93000C6C4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928938, "uuid": "7e73c49f-8fce-4671-a24d-b9eb325e3c2d", "value": "384:Nr0Blw003hVTmFF+wk0cRiKvAYVH1tFU7VZFFMNGao0JKW1E+gRc5u0MqlFFMTQw:JYEGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928938, "uuid": "4b3bba00-9c5e-49f1-b589-f5511dd6d0ab", "value": 2915755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928938, "uuid": "8737a7e6-0cc0-470b-a574-c0dbdac00043", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928938, "uuid": "14fa4143-f805-41c0-af77-ca58ed08c862", "value": "NEW_ORDER_MP.S.006025-01626.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dca6891-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780913092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913092, "uuid": "cae4643c-6d9d-4876-bcb5-78ce15e1377d", "comment": "Malware payload (AsyncRAT)", "value": "12966f457af8507b1cdfe236460bf10f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913092, "uuid": "f344ed6a-45ff-40d8-b9f7-8f7f365666b9", "comment": "Malware payload (AsyncRAT)", "value": "847845bdbe757d94dd9126247fb15fa799e3bdefe79acb46a72d17b0dd07f1a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913092, "uuid": "dfaf3eee-40c5-4596-ae75-01194118331d", "comment": "Malware payload (AsyncRAT)", "value": "2d6769e779a530305cb0d13f4227cae4fd08397a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913092, "uuid": "f83680a2-642a-4147-8ead-e738687fecaf", "comment": "Malware payload (AsyncRAT)", "value": "5be0ef0fac0f5f98f8279dcbe3c4523e30f3bbd10ed25361ac3ca703ea429812c0babf9800c97c59d930e7287ce00d58", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913092, "uuid": "80065af3-3957-4b44-9b7a-b188100a9899", "value": "T171F40258364ED413D0825F749D71D2F42AB8AED8E921C3038FEA3FAFB57B650590A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913092, "uuid": "1ad6cadc-ad3e-4821-878a-386c664659e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913092, "uuid": "e20b298e-8837-4c28-89ce-054c13253d67", "value": "24576:1uhwZt3ITPUR620OjZu0J74UPz/RpG6TM6nT:16wnILfL87R/rpQaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913092, "uuid": "bb94277d-8bbb-4d91-8d42-25cb10f9840e", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913092, "uuid": "4101d837-8a5b-46f8-8d37-6c7dcf1d5963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913092, "uuid": "cf429fba-2386-4ae9-ae9a-c5e085590eef", "value": "847845bdbe757d94dd9126247fb15fa799e3bdefe79acb46a72d17b0dd07f1a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b192851-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911396, "uuid": "70f06061-7131-41d1-9fac-d40ea79838c4", "comment": "Malware payload (Formbook)", "value": "d5abc57ef2a6df263f578ffd5b67a1e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911396, "uuid": "299db2f1-8a0f-4d38-ba36-c6a958752e93", "comment": "Malware payload (Formbook)", "value": "84ba64e1bbd5aca89c4daeaee79703d8c9aa6fba1d889fcdb2d3ff0b56780e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911396, "uuid": "f0935674-6163-4255-a2ff-aeee1c1090bc", "comment": "Malware payload (Formbook)", "value": "ee3244f08f9a2eef63badb9457232055e712e568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911396, "uuid": "e00b218b-f0a8-4fec-b4e3-4800008a115e", "comment": "Malware payload (Formbook)", "value": "fefa78fae789f26f0e3f3f940558cd21d74f323a02d36cdea03f64cfe94dd807a310ced58e93c518b1fa600bed3e9447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911396, "uuid": "d611db1b-dde1-4191-8a72-6b5bc82fc730", "value": "T1831512AC5A0AE517CE245B788A30F3B4036C2EDDB501C7179FDC7EEBFA66A451D08252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911396, "uuid": "e79e827d-e610-4a1a-91b6-0c3cb479df3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911396, "uuid": "0ba0d624-27d7-43a9-a8a8-125e0cd6e7c7", "value": "24576:5Rf9klJzglOi0tXMwvYOx9EDa8ojRwu/mbeeI:5RMz2OieM5W9EDapRw0aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911396, "uuid": "8483eb34-5439-4ea5-9463-b14b3619be03", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911396, "uuid": "37aa4705-ea6a-4431-a8e1-53e5cf655a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911396, "uuid": "7846fc77-41e2-4c6e-8954-7168a23c2c3e", "value": "84ba64e1bbd5aca89c4daeaee79703d8c9aa6fba1d889fcdb2d3ff0b56780e50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ee9ca9-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780910874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910874, "uuid": "11194796-c6a1-4785-83ec-e332a8de98a8", "comment": "Malware payload (SnakeKeylogger)", "value": "6c03417d67f434a7fc5379c7d5b35846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910874, "uuid": "ed8b90e9-5e6d-4a9f-85a6-daae96780e6c", "comment": "Malware payload (SnakeKeylogger)", "value": "84e6f00fa79970514daca9644433b8f4c7508b6852f3bd31d2ed179d6cf92ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910874, "uuid": "1fbbc133-8f6b-47e1-a477-b76d6372d33f", "comment": "Malware payload (SnakeKeylogger)", "value": "b2063999a76db5cc650703a3da5e95008a16f7ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910874, "uuid": "30b08bf3-ab94-4d63-87b5-779cc091c976", "comment": "Malware payload (SnakeKeylogger)", "value": "c976a3d55badf71984cef6316a464dd2e6055cd9bf50f937835c8cdf477889845d0aa8de589b70331a5da8c11a1004ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910874, "uuid": "03c43153-6140-4c59-8f98-4b850928dce2", "value": "T1CC0512AC6A16DA06C9516BBC0972F3B5653D6ECEF401E31B9FEC7EDF7926A014C04182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910874, "uuid": "2f01a077-70da-4831-97e6-1bae1bfde367", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910874, "uuid": "9e917520-17ef-40f6-9e0a-6167c15285e6", "value": "24576:9dmxsbr+wpShPTBa1BuTlbsOqOdEK27amCC:9dcsb/mPta1BuTlwODEKc19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910874, "uuid": "dc45070c-929e-46bd-a523-b67f325e3f0a", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910874, "uuid": "a76e14e9-069d-4611-be24-5e07479d62af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910874, "uuid": "5f05786b-e1c6-4a4d-a5d2-f330ffd0f9a8", "value": "84e6f00fa79970514daca9644433b8f4c7508b6852f3bd31d2ed179d6cf92ae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3f6e10-62f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780893248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893248, "uuid": "e455c8fb-6cf7-471a-80fa-3097fee6844b", "comment": "Malware payload", "value": "6e494723f2c27e2eb8589629cca1ed10", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893248, "uuid": "cea6fc59-097e-4210-98e8-fc5b1c6710ab", "comment": "Malware payload", "value": "852a577b227aa856399ae836d9db15eee38a4f62301a8590f80a009ec29dad8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893248, "uuid": "ad6c87bf-66ac-40c9-961b-3d0f89f777e6", "comment": "Malware payload", "value": "d539dde663e02f66845cf9d83d6be6c763923c76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893248, "uuid": "b8c77698-1d45-41c3-8b5a-dcc58a8f5bc8", "comment": "Malware payload", "value": "0e136d02cd221ae831f8294e58ad73a6ac33fdc82ec88ff2b283cb2ccbee65e06eb70ec8e9e536f08be6b249af9a4d3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893248, "uuid": "d6700741-b670-46f3-b62d-7c08d05825d7", "value": "T13CB19ED9D10043EE4C84F84291868E14B02C6AF19FC36BB8316163375AE8277C9D9CAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893248, "uuid": "6434a703-f102-4c20-934e-4101ffc4ca4b", "value": "96:eJsUa4j4k+q0O+iWznX82ty+/TkIiB7+YG5TMmpzIrfBjhnjRVk:eIHq6iWpp/SB7epjpzIrfjjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780893248, "uuid": "15bd1feb-23f6-404b-a623-55f213a6ce24", "value": 5170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780893248, "uuid": "718f45ce-4711-44b8-a7d3-9e4c339b2c72", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893248, "uuid": "e2564c2e-32b8-4128-928a-b08580cce257", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee935507-6318-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780909415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909415, "uuid": "0c558856-5047-4327-9a47-9c8d5bbee95c", "comment": "Malware payload", "value": "db4b18e58bdb9eee360c8d94a65b1c5e", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909415, "uuid": "aee82660-ad3a-4dd9-a959-0566cd7d1e22", "comment": "Malware payload", "value": "859ee2ee778782c9274bd3c892be60ad1b4a9cd7c87a17fc8dc7a8c4565e31e3", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909415, "uuid": "0c4860f9-c87b-4f7d-8fa2-aed20fb28134", "comment": "Malware payload", "value": "0eb6fbd15a2588f3ff8469e5c7a8911e22f2c62f", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780909415, "uuid": "6db2c453-5888-43e8-b167-87aa5504af37", "comment": "Malware payload", "value": "cc465eacf4f652bdca63a5acd0ae5bf48869c009c20755977a1fb47b80f5456d00134eff5b00c9c1e59d4ac656e8f59a", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909415, "uuid": "c4edf725-d4c3-404f-a40d-5f8d0ff4f613", "value": "T15FB633F2843F877727A4937E33E6991481B6E47A01DD0618DB1DE6AB423EF789408B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909415, "uuid": "5423c0be-5887-421b-b302-182909eb6515", "value": "196608:+zb9nnB77ZiO5bCaEbm2t2CTLXn8PqAZkHTJ:+zpB75Tc2Y2kH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780909415, "uuid": "5568771e-6086-42e1-a121-708fac4986c8", "value": 10582868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780909415, "uuid": "954da148-eae6-43c0-a4f9-0b879419e07c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780909415, "uuid": "d4fe3f4b-8464-4d44-b99c-bb6966166557", "value": "fscan", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c2b872-6315-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907976, "uuid": "90162e60-be52-4dcc-8ac7-9411e8fb6d18", "comment": "Malware payload", "value": "0db756b06d4359699b6b99dfefde36c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907976, "uuid": "d9558a4e-0290-4e0a-9611-355203b1807b", "comment": "Malware payload", "value": "85f3f11948fc8d14314d6f42c4f82a81be4a1a46bab975843f4af691935cdff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907976, "uuid": "5f3c9ee3-35b6-4042-84a8-38da0ae4ba61", "comment": "Malware payload", "value": "d907de6065e800c3b155b398fa6e0ae6fa064e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907976, "uuid": "3a533cdd-e9b0-41b4-89c6-6015cda47b4d", "comment": "Malware payload", "value": "404c8e2b7e0458a76c74987e2982f1625919a9e9b1dc5623e4beffe91250d027d347cd884296bde132ad28043422c928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907976, "uuid": "364b87c7-8f18-4a91-b1bf-a6d4ef8fac77", "value": "T1FC96236212555717F1A5883AC63F3EE831BA5F668241A8FB85837FFC39315D3B202963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907976, "uuid": "3995c9ce-e667-4890-9909-5cff97efc14e", "value": "38f7b7a1130ca30ce6e5684202773a7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907976, "uuid": "543e98c3-a8e6-4fdf-adac-850a26b95046", "value": "196608:odpP7SEgxTiY6A4IblqFQotzM80svEPV1qtP9JqhvagT:odt7u6hIblkXQ80TtYtPrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907976, "uuid": "e5f5964a-4026-415a-b96e-59f17b007d8b", "value": 8663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907976, "uuid": "c8357871-92ec-4755-9387-b6604980c58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907976, "uuid": "71a76bb8-9f84-4ad4-8d00-7c394c8b6da3", "value": "85f3f11948fc8d14314d6f42c4f82a81be4a1a46bab975843f4af691935cdff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aba4e76-6356-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780935903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935903, "uuid": "94400ee4-8b6d-4353-b067-88f7a7ec2190", "comment": "Malware payload (PureLogsStealer)", "value": "57505643f1d3291fb56d49ac099d3126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935903, "uuid": "36afa155-f4a6-4b7e-892b-ac4881665956", "comment": "Malware payload (PureLogsStealer)", "value": "861bcfebff619c6746ef0782b4c5b54553a5c9a7955d29ca1247b0e7e06b3fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935903, "uuid": "30a58729-dc22-4944-a1cd-d433ab0231c5", "comment": "Malware payload (PureLogsStealer)", "value": "b0cb09ccf39064b31b73cfde796941fbbbd040a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935903, "uuid": "c2e57f30-04f6-4c0f-8067-b53a777de71f", "comment": "Malware payload (PureLogsStealer)", "value": "6a1286e7739185d887bcf111404fffaacab8b4912255357bc888f3403bfd7eaa1908e80f1c37cca14f5d97251064e8c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935903, "uuid": "aa9887be-c22e-4545-9c78-f7615b152b77", "value": "T156F4BF1FB6568E12D2C85637C0C7A90193E5E9827533EB0E758923D62E073EBDD0A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935903, "uuid": "27db3d36-bf91-48c1-bff7-00b722aeb029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935903, "uuid": "7a9165b7-185a-4a36-b651-b1afe1a91d32", "value": "12288:zF4rByjLnaEK7oQqVEGSdgzHqpnFQ51pF1k2bURaQpW/j4XvRfzWxzHH:zEoLnIa/SdIl1k2Sn+EpLWxzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935903, "uuid": "a226ead6-2843-4cc1-86cf-8289f66d589f", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935903, "uuid": "73da6dad-8f04-42e8-891f-b3b4797ab947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935903, "uuid": "e0602973-43ba-4812-a0ff-930dd773638a", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.67713639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf03b820-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780912771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912771, "uuid": "788769be-b6b4-4ca2-a2d1-58b33fa3d5d3", "comment": "Malware payload (PhantomStealer)", "value": "f3e06fd6412d150c3df9e3c8d82edba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912771, "uuid": "d4953f22-150d-4909-a31f-deebfcbdb9f8", "comment": "Malware payload (PhantomStealer)", "value": "863e5790dc76c8ef082144e1f7ed91e92cb72960172b56af593737c738cfc8f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912771, "uuid": "448b0fa1-bab7-4c5b-81af-b2de490ddece", "comment": "Malware payload (PhantomStealer)", "value": "5adfed4b2928c84723cbb3bccd80c6179ac215ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912771, "uuid": "8c1ffeaa-a774-4d0c-aaf5-4ea45275f083", "comment": "Malware payload (PhantomStealer)", "value": "be9dd410f26e8029e9f9eb2c54313f7734d3ac40906380cd240033a4341723c833eef2206851c344d09e31a47ce58f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912771, "uuid": "01efa60d-542f-4c94-811f-1f223e54bfb1", "value": "T1A0652355AB6AC902D8E527B51571F2B663784EECEE20C72A4FE8BCDF3839311095C253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912771, "uuid": "3a032487-6eba-43ea-aded-aaa29e8e7576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912771, "uuid": "281313ee-0390-40b9-9285-9a90d9be8715", "value": "24576:d3fvPszkVcwHN+QdZMsm8tHct4GsJraZEgHjcKemzdkPLw:RnPukVHHN+xsjHfRJramgHjcKeskP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912771, "uuid": "dc20f835-1863-41b7-8e71-6863db8bcb95", "value": 1524736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912771, "uuid": "0860ba7e-933b-440e-b407-95a3acb30a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912771, "uuid": "b0d262cd-c431-43dd-a62c-983e36e42cb2", "value": "863e5790dc76c8ef082144e1f7ed91e92cb72960172b56af593737c738cfc8f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c89e456-6328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780915989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915989, "uuid": "356f3586-f04e-438c-8bb8-aa9ce087c379", "comment": "Malware payload (Mirai)", "value": "ad0821f1a795a25a192d8efebf7af6a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915989, "uuid": "b5ca444a-cf44-49af-bbed-50088933e50b", "comment": "Malware payload (Mirai)", "value": "8655580fc4ff699fa378ded54eb818a4e0eee2ab4e02c84b82b0baf59d35ca7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915989, "uuid": "e5587d1a-ce64-4cca-ada9-27ea9c71f802", "comment": "Malware payload (Mirai)", "value": "fd5c286cd792c5a4a745f4daad04cd462843aaf2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915989, "uuid": "5e4628d8-5ea8-4a6b-868a-52c05642d0b5", "comment": "Malware payload (Mirai)", "value": "7ed6e9e085adef2b5c0e48c6dfc3e6810d1a99b14578ff04b01c6e78b2e81c1af444230f89fd53a46c958115b423bae0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915989, "uuid": "19b9b57d-4dcf-4920-bda8-560b97055b33", "value": "T12BA38D9BF24B05A0C86246F04BCB4F9E3E2323D19E6785E32D2E267A18751CB5D06BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915989, "uuid": "529c6a85-ac3f-4b63-a458-22d905c1df69", "value": "1536:7ye6mfppdwlYfIqRnSWqmmwW73T73gLEb/LW/:7V6mhpdMefnSltwWTT73gLEbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780915989, "uuid": "4dff4f03-d024-408f-bc48-875539ffb545", "value": 99608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780915989, "uuid": "7b8dc83b-1201-49ba-9463-de9d928830a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915989, "uuid": "ba6a38da-6463-439c-8e2d-e1b0f8c207c2", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb27c797-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877197, "uuid": "0ec63dd1-7c6e-4c6c-adfb-e1c09aac5bbe", "comment": "Malware payload (Mirai)", "value": "afba82fd183f36900143fbc65e7f6bb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877197, "uuid": "da6fc898-b6cd-4f2b-86ec-93e23edb73cf", "comment": "Malware payload (Mirai)", "value": "8695dba927673dfc709c589d9993aa8002068fee82a41f6d0e92ecd1f260a6b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877197, "uuid": "e2b28557-8589-41bd-ab3d-e6de8099c34a", "comment": "Malware payload (Mirai)", "value": "9137725c751fc6a66b6f912cc962d665f5f0068b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877197, "uuid": "eb665369-aa1f-466d-91a3-7c6dfffa4af4", "comment": "Malware payload (Mirai)", "value": "05d1bcf48a3661c55065e0a4ce0388307e7919ca4f0fe7c12179d96a3264461b558e401fe4b7cfdebd605b91b8aed579", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877197, "uuid": "ae28337c-5bcc-4cb9-b73c-5b6367bdb324", "value": "T197948613D9114991E1A44CF2362B3285B94797BFC4EB32D3ED264AA1FF2542F06BADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877197, "uuid": "5c027e1c-c84f-4ccf-912f-7512d52dcc02", "value": "6144:6CB20H9wUBoP0Nx3X+kQXAa3E7Z+iPwojoVcj:6d0HyGdX+k2AaUN+iNjCcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877197, "uuid": "86aa9ea7-80a6-4df0-a917-bc86f9bf4cae", "value": 417660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877197, "uuid": "fd82534b-1c83-49e4-a6e1-33f6ee9d5d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877197, "uuid": "2434ee72-f5d1-44e9-8953-4f94655c51bb", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08757d3-6327-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780915861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915861, "uuid": "1a849676-f32d-4d81-b69f-65b8d3f287a1", "comment": "Malware payload (PhantomStealer)", "value": "493b46a92c30c8d9d1b0b3315cde057b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915861, "uuid": "6acc0c52-889e-44e5-8fdf-ac32fb46de35", "comment": "Malware payload (PhantomStealer)", "value": "86cc797fb5b5c13bf7595edc8eb5ac58bd57a1e78d60b8330d04b844ca66b082", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915861, "uuid": "f260f05a-baac-45e2-93cc-fa42bbb018e8", "comment": "Malware payload (PhantomStealer)", "value": "732e4d9aa291775d920971cf6d53b8197dd24bfb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780915861, "uuid": "15814e00-ce3b-4649-b6aa-14bb550052fb", "comment": "Malware payload (PhantomStealer)", "value": "61217447505099213d2e6fdba5df8745607c31553c2f0578880911cefb36de50e6727913977e979af35a9b8ab41ded85", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915861, "uuid": "4f2f7603-9e63-48ed-978e-f1ce209a0107", "value": "T1F5912AB4AEF8C82A690EAD7B30168E0508A47B40F00E762FA77495CD5894D18076FBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915861, "uuid": "b6b12ab3-7399-4546-aa68-f898c05ab3ce", "value": "96:i26Azc2OFzVSM6RU+oPRi0EiBB8ykaQ+sr:iMc8BUhPw9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780915861, "uuid": "d0dbdf4e-3ed5-4b43-8b6d-b61d7418a6fd", "value": 4467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780915861, "uuid": "39aa9e69-a40c-435c-9fce-77cc4b5053b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780915861, "uuid": "a5e04be0-fdb3-4517-80f1-ef5bc1fd13c1", "value": "VULKAN ESPA\u00d1OLA SA REQ_080060026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7949dd1-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910692, "uuid": "05d77d89-b9c1-4cf6-96ca-4ed0e8deb82d", "comment": "Malware payload (Formbook)", "value": "74a07e64bad70af7e108ac7277c74f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910692, "uuid": "f62f7f35-ece9-42af-ab2e-633a6a26c981", "comment": "Malware payload (Formbook)", "value": "87069a637feda85a7685d41e9f7a33b9b96fe7a8ff47fea6065372f8b28b61ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910692, "uuid": "6aea2c56-8e8c-428c-b7c2-2f59904bd831", "comment": "Malware payload (Formbook)", "value": "49a15354abb5c74e55fc7b9788bfb078d8b6013f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910692, "uuid": "63896971-1833-47c4-a94b-ef9cf16f3f47", "comment": "Malware payload (Formbook)", "value": "e75f2960363340987ec3793e5dd169f5a5062d0a83d894370abe96b2127843d4e691ff79c04012419297fb5cb9802c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910692, "uuid": "2e0c79c8-ba00-4def-8f42-e84b3f4b4499", "value": "T108252289A218DE53C2931B701DA3E1B1163C5D9CE620D307EFDA7EEBF072791166A742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910692, "uuid": "f5f68665-df6b-4772-8f95-c45165179731", "value": "24576:ynNrSsXqE4mHZS+QR9OLc1tAQMZs+usr0FKuSexNg:iORErZLc/ADs+usgFKulNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910692, "uuid": "27880ea4-e78d-4822-b88a-77d3592edef8", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910692, "uuid": "315d7379-b1fe-4645-97b3-ca31a7f7d81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910692, "uuid": "d489cf02-4291-40a9-86ed-436688e8ac48", "value": "87069a637feda85a7685d41e9f7a33b9b96fe7a8ff47fea6065372f8b28b61ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfa9f52-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912312, "uuid": "2b024454-0faa-4e89-bbb0-9d4e3cfdbdc2", "comment": "Malware payload (Formbook)", "value": "eac8a642b3aa37bc2d2ce305950c2232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912312, "uuid": "c4cbbde0-b711-4f86-9fc3-9e27ba9e3a82", "comment": "Malware payload (Formbook)", "value": "87d6e4f14c49abc1b9c37e8ad0db345db9caf35c2e4aa25a63f857d4aadc1faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912312, "uuid": "bf9bcc95-a41f-4bf4-92ec-e25a0adb260f", "comment": "Malware payload (Formbook)", "value": "c78b4f08d3963caeb3644f94acd8377546e67e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912312, "uuid": "39a30b10-f4dd-4928-8e5f-aa60ee51ebee", "comment": "Malware payload (Formbook)", "value": "45ad99cb8f59406c47b552d3747b3be593840a5c397e93f3bc33979ed6fc6999173d4b812ea85fafadcd08aec1e35e0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912312, "uuid": "57268818-921a-43a0-8bfd-a9a88b0e472d", "value": "T12C2522A49798D922CE754BBA08A0E33A437D5DADF921D38A8FFCACCB385D34554241D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912312, "uuid": "bdc0ab7a-64e9-407d-9c08-dc2ae5f952e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912312, "uuid": "9041169d-6d69-4884-8f7e-ac77141688e6", "value": "24576:mZTgWIN5vkGlz8SszL4fUMK7rJ3vPiHdLNdPvOFbAhdTF+h:mZTgWIN5vkGlz8SssUZ7tfPedpxvhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912312, "uuid": "9e525908-bae7-49fb-8471-91b848ad9184", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912312, "uuid": "0d0022e7-d55b-40d3-8335-0bf58417140b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912312, "uuid": "4dc27189-bfb4-4077-8719-66056df74acb", "value": "87d6e4f14c49abc1b9c37e8ad0db345db9caf35c2e4aa25a63f857d4aadc1faa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77134b4-636d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780945803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945803, "uuid": "c7245f34-8d2e-4ee4-a502-fce9977ced4c", "comment": "Malware payload", "value": "51a5999097c73a3df07c58da18ef369f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945803, "uuid": "a3e04208-e04a-4ea8-8867-d815eaeea1fe", "comment": "Malware payload", "value": "87fde30bc260a22caefc58e431e805330b5c0503ff5550ba571634756115387d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945803, "uuid": "f4e6b252-5026-4177-b8eb-33431fb299d9", "comment": "Malware payload", "value": "52858ba42c70148ffbfab08dae2ff02370c668ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780945803, "uuid": "9cf860bd-3e6d-49bd-86db-137408586e2d", "comment": "Malware payload", "value": "01e3cb4523bfab884cf866626d4a2a89f996e6493c65fb0928fb82f284bbb80411e839291c901c63360ba01cd20bf40d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945803, "uuid": "1cf75ff3-646a-4877-9f07-d8d70ea8f307", "value": "T10C130845FA67D8BFC9D2E235423789A49A34711570627837FA46C3B82C53B74CE92E34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945803, "uuid": "5275a78e-b318-41b3-b758-8141b2efb550", "value": "384:BGrx9cv4M9g0ARv1O1wWrDbn6DJuoeLhCqEmgNVIcB73RQRvxmTp0tFx7cNpS4OD:k2v/W0M9SPL6DJualmgNWcNWfycgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780945803, "uuid": "85591c8e-d96e-43ca-a620-971eb1d122b3", "value": 41600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780945803, "uuid": "1e7e8f23-6aba-416f-906a-96ce81aa53c3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780945803, "uuid": "7e7c80f3-c899-4366-8fff-6c1f3beefe66", "value": "client", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510c2b60-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780907863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907863, "uuid": "2174bff7-e20f-42f5-82e6-0c86c4051264", "comment": "Malware payload (SnakeKeylogger)", "value": "6ed44b357734d5517d4a206ec1b729fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907863, "uuid": "81f725d6-bc4a-4701-a633-543b5a121349", "comment": "Malware payload (SnakeKeylogger)", "value": "886eacbeaa4ed8a24c1a2e04373ab59140b9e704fe31e659530ceb673ae714f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907863, "uuid": "5d6ae0a3-d7ff-444f-ae03-7cbc7df8e967", "comment": "Malware payload (SnakeKeylogger)", "value": "69a6c4459576f97a9ee3f970aea26f2d2063340f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907863, "uuid": "fdce9d81-f386-4934-9cd4-34c0891f46e1", "comment": "Malware payload (SnakeKeylogger)", "value": "d8a2498bdca749a9c5013516211a9c56faf382d4833eeec35903a44aeb0031bf27b6fab7430692cfe6d3a5eada27fc66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907863, "uuid": "9950fbd0-464b-4d41-8989-960f798716c3", "value": "T165351244631ECD06C18A5EB40D70EBF911798D88E925E3239FFABEAFF57B1463845290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907863, "uuid": "9b3226d8-b51d-4466-838f-5e86cf945273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907863, "uuid": "b5e6715d-376e-4a37-9e03-a5e85a87fb46", "value": "24576:a4TS1aOmm5P3O1pxrT9xckRuxivbf6Y7E:a44gm521fnYkAsv76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907863, "uuid": "b0c5b951-79b6-4a9b-b20b-d114a5dfa844", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907863, "uuid": "61c511b3-b9dd-43fc-b9a9-add7593a7a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907863, "uuid": "af7fd5e5-3c74-4990-b1de-5e72b05976f8", "value": "886eacbeaa4ed8a24c1a2e04373ab59140b9e704fe31e659530ceb673ae714f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3ffd30-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911346, "uuid": "25dc5955-2808-4983-ab6f-9a8225cd7827", "comment": "Malware payload (Formbook)", "value": "75b184742989d301ef35a237ef376ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911346, "uuid": "0a55cb85-ab4c-4de0-9448-21f5a00c3146", "comment": "Malware payload (Formbook)", "value": "887bb57c73bb53e963aeac0a792349c58aecb3629aaa8019eb6e813f9411b92c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911346, "uuid": "26430702-d91c-4e1e-8cd3-190ceec0e537", "comment": "Malware payload (Formbook)", "value": "812dc8e74f6405cea26e3f0ab588136e364d61f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911346, "uuid": "6235e813-c3b9-4c3a-8269-c652557fd401", "comment": "Malware payload (Formbook)", "value": "ff000f39d1c606d21822b5bc168ff6af379d030f312bb3875b74d758aea47a5f67188e175fdd0d835abb362c2d9a40d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911346, "uuid": "84455f3c-30dd-42fb-8b85-3ebc0c5e345a", "value": "T166542379D3FFE053DC3AA7B5B287A06BC68ECC111956004BA746973D6BA42CD2D08647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911346, "uuid": "e9273fa0-cf0a-476c-aaac-e047212c3785", "value": "6144:tEDuVGynb4/l6asduILuKiruLTVxQGXTwdcZIbiYjO+q:QuVhY7sduSuKirubLEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911346, "uuid": "dd77495d-9cea-4c4e-9ee2-f1c8e84a5465", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911346, "uuid": "a69621de-9014-4676-8e8b-cd979d4886d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911346, "uuid": "70ffebcd-919c-460f-b05a-20807b2e2f22", "value": "887bb57c73bb53e963aeac0a792349c58aecb3629aaa8019eb6e813f9411b92c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a1aa0e-6339-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780923466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923466, "uuid": "34828554-bad4-4805-a4dc-228d8adf0b7e", "comment": "Malware payload (XWorm)", "value": "39b4a249d99adc9ec081ba7cf0669b43", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923466, "uuid": "41359f62-8250-446e-a440-d4a52bc46a52", "comment": "Malware payload (XWorm)", "value": "88d2a0e496d4d3132f4200d37337428247f761733a03821576574500789f3532", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923466, "uuid": "1519648e-1706-4a49-aec1-6710ac3ac482", "comment": "Malware payload (XWorm)", "value": "439b86f31f8816fdd86ed6f0ee19a37d27914d8a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780923466, "uuid": "949f5716-82d0-416b-865a-4b4319be3ac6", "comment": "Malware payload (XWorm)", "value": "d3eb5a7f000ee21fb500afb2f0fb14e35e8d6b576d79aae4523c23abfef4d1beee1e922c761fe34cf8852e8ab9ff4b79", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923466, "uuid": "50b179f9-8c93-44fc-8671-f45e8de94b9e", "value": "T14AE229A1FB16017B4F5267CCBF89D12085BE935A4826B5B1F9CFC30E9A09C8CD7B4859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923466, "uuid": "732b4dfc-358c-4ae1-ac10-3ffe79b7a390", "value": "384:yhs6GE1/T3YMOp6Jx5XwG++Hqa4B64L0sk4mxsQROlDA4p9l4x4RgbwRhYH5vwBO:n8MZ6wbSqa4CskaDpzibwR259h4eUPSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780923466, "uuid": "175a302c-d610-4e48-980e-4c56aa7e7dfc", "value": 32492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780923466, "uuid": "55bf5fc6-c055-4527-ac6a-97b120184050", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780923466, "uuid": "9bcf2202-0b2d-46f4-93fc-9102e71afc75", "value": "T. HALK BANKASI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be1e8e7-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780910404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910404, "uuid": "af73657d-59fa-45a2-85d0-45408435e844", "comment": "Malware payload (AsyncRAT)", "value": "2c7ba1687f1b1021d85b3a71421c6590", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910404, "uuid": "fdcaf543-d7fd-4c2a-9fb1-fbca46b60557", "comment": "Malware payload (AsyncRAT)", "value": "88d52e8d9bb86b9e831342c86f32ee04fbc9d680c38c61d320ff3eedfb143c94", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910404, "uuid": "dfe99db2-aa1e-487b-b6ae-4c3d375cee4a", "comment": "Malware payload (AsyncRAT)", "value": "1c189ab9fed5cbaa0a050b63ff700e7c27c5766e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910404, "uuid": "10bda33f-3440-4a4e-ad48-1883b15cebdd", "comment": "Malware payload (AsyncRAT)", "value": "debf56738c9243779f063aca66ebcbcd34b970548c5d26e40f13915c4015c0f5177ce00b58834c00daac3f607e4768e9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910404, "uuid": "c333c311-9321-40c8-ba74-1fa867fd036f", "value": "T1EBF41208121DD70AC0AE5FF56870C0B427B8BD5AA521DA5BDFDA7DCFB876B0009163A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910404, "uuid": "32f931d6-ec7b-4957-95c8-9e613f11b634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910404, "uuid": "6b581ee4-cd9e-4a35-9e2d-f4d84fd72c4a", "value": "12288:sCJ+QRZ4nxX550JcmtwTiTaGPUe7fMpJnclenxjSubA1X+zWD5ovgnWKyLCzVNM:vPZ4nNr0JcqYejIJcWPoD6vWY0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910404, "uuid": "5bdbdb26-f068-4f0b-8474-a0e582b1a437", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910404, "uuid": "14919dc7-a133-4bd1-bb8f-7dce2681a647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910404, "uuid": "04bef13a-095b-4f6d-8fab-a689aacb1833", "value": "88d52e8d9bb86b9e831342c86f32ee04fbc9d680c38c61d320ff3eedfb143c94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1740cc68-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910343, "uuid": "2b4d127a-da72-4544-bb2a-316ea83dff99", "comment": "Malware payload (AgentTesla)", "value": "aaded244fca2ca08f58bfa087d415f8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910343, "uuid": "4e2bffe3-0276-4b7e-8018-ebfe255d3f1a", "comment": "Malware payload (AgentTesla)", "value": "88d88f8979c5158368d05acc80ee5dc7130189787d4c6d5af28f2cef62367d02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910343, "uuid": "4694bfd6-349a-4523-91df-41cbf2ffa02a", "comment": "Malware payload (AgentTesla)", "value": "0104f37aa6f8410a3cb1c34186b572659ef25db3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910343, "uuid": "c9a07b99-e52c-40f2-85b6-15dbad0081ca", "comment": "Malware payload (AgentTesla)", "value": "f4e4f0fd8dfb9f90e25aa5c7bddd805596a232b7a10fecf800e918decc487c09adaff11ca19791a5d1fa9aef8a5c7dae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910343, "uuid": "47e7409b-fc9c-48e2-9f89-0d3c27c503dc", "value": "T1D8251214251DCA13C0A95BF059A2C1B827B82EAEE935D70BAFC93CDF74B9B50181375B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910343, "uuid": "1dc7aa4b-6423-4ddd-90dd-9739e902cb9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910343, "uuid": "7c1c2d2b-0ba5-4a35-b889-b8045906ce15", "value": "24576:8fl0nNrT3k/nzfXFWcDcFpWET22WIHgtENrJ:8K33sfXsLWl3EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910343, "uuid": "da4d07c5-e77c-4bca-a4d8-94ba9047434e", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910343, "uuid": "076c7b15-6aac-48c6-a28b-93291a8eb52c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910343, "uuid": "54228ca5-0206-4f00-9b99-62f1e364d3b4", "value": "88d88f8979c5158368d05acc80ee5dc7130189787d4c6d5af28f2cef62367d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ea658c-62f1-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1780892540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892540, "uuid": "2dee60b1-21a4-4d3b-8481-eeb26242a3f5", "comment": "Malware payload (VIPKeylogger)", "value": "fd0f5f6dfcd6d4881cc171d85ecc513a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892540, "uuid": "81a6a7d7-5b47-49e6-9dcf-9bb9ab0444fe", "comment": "Malware payload (VIPKeylogger)", "value": "890acf534d6b5440ea027acc0c96aeea2086429da0e8f323ef7eb0515c962ea6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892540, "uuid": "8bc33881-c3be-4e09-a93f-c473e5da0b70", "comment": "Malware payload (VIPKeylogger)", "value": "451bbb278dff2c15108699e26a1bfc1b1bc8e73e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780892540, "uuid": "589d86bb-708d-4fff-a596-d0d602b5bd82", "comment": "Malware payload (VIPKeylogger)", "value": "6e77b63938fccdade16d50de8ed4acfda2db812dc7e16a50d22116ab406cbf30bcf0e7dbb226585979f5ad832ce8f9bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780892540, "uuid": "05bf990e-3e1d-4f57-b463-3a5973a1c79a", "value": "T1F405E83DCD65412ED172D728855A085FF8822A0B123CE84B69CB374FAF638467BD636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780892540, "uuid": "0311a014-b71f-4a3a-a009-92f44b5bef02", "value": "3072:LAwZXWn3r4liZGavtNkjpJOlKSVRvC+grbPl1VloGWFCdx6nu0OamRNiD9gzaiiv:ts3rz7v37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780892540, "uuid": "1f62ea86-9023-4860-8f98-9389adcb8813", "value": 809684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780892540, "uuid": "931278c9-05f1-4059-9e8b-e1ee1fc226d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780892540, "uuid": "f7be9702-7545-4565-ae42-aed40623cc9a", "value": "copy_ABSD663882OGS766626.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a422243e-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780908002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908002, "uuid": "ee76fb24-159e-4dd6-a87f-39fdd1b00b98", "comment": "Malware payload (DarkCloud)", "value": "103d2decb7e031fc30107bbec3479f0d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908002, "uuid": "bd54aed1-503b-4d4f-b004-7378d849c6b3", "comment": "Malware payload (DarkCloud)", "value": "891704a13b4899e521b79b00473c6dccd3cce1dd4e7c022bd11f00fd3d40310a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908002, "uuid": "1731932d-839a-4239-9316-d9125f7d8dbc", "comment": "Malware payload (DarkCloud)", "value": "9c64b0d35f260c216847f49f5c7ffd347dc0bb2a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908002, "uuid": "598df637-a0a8-4a55-afbd-9fcbbeea6f85", "comment": "Malware payload (DarkCloud)", "value": "341e0b297380e1e6a988c9f6f31661bd27246d8ac9d3f8a5572b3cf293c61271b3013fe457b5dab18ea76b683a3f5313", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908002, "uuid": "93fd97b5-4f48-4a0b-8b6c-672d59bce4bb", "value": "T1CF55F154231ECF02D4AF8B755860D7B003765E88BD21E3D29EE9BEDB7836A8148553E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908002, "uuid": "840c6234-6151-4e8a-b807-7582d69c7863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908002, "uuid": "a40b24ba-a0b5-44f3-a113-849eb3308410", "value": "24576:qLqvEmYeAiyzbFyJOrk1bbegnZ38E6kTKp5QyNdfR:kctYDHoJOrkhTZ3okTKDQy7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908002, "uuid": "0d87727d-0215-4e2d-983e-a42bcabe845c", "value": 1293312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908002, "uuid": "3dd4a792-0f80-4d26-b974-85285dadc684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908002, "uuid": "55d95ae1-a226-4d68-9fb4-9d770520b43c", "value": "891704a13b4899e521b79b00473c6dccd3cce1dd4e7c022bd11f00fd3d40310a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecab9e0c-6313-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907265, "uuid": "abe80b3c-80d4-4dd6-9624-3b42807e6087", "comment": "Malware payload (Formbook)", "value": "37c9ab219931ecac9f5f389cc4f52a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907265, "uuid": "de1855bf-cfac-40b7-95d7-a35244486cf2", "comment": "Malware payload (Formbook)", "value": "894280d247de3c7a1d658b84079439193dd66c195d44303555aa647e4cf89b28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907265, "uuid": "672609d8-3553-4b60-a8d2-389bd70c7bc7", "comment": "Malware payload (Formbook)", "value": "d0d6b689841a4af19e3f15faa27b531fc2d4f179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907265, "uuid": "106709e7-80e0-4027-b3d9-048a18c14b8c", "comment": "Malware payload (Formbook)", "value": "d779ebe0961c46a331541b2dfa507fc2509ae7b074560c892e8a25ee602ee6dec4edf3a2d08cdae401468d264fd0b6a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907265, "uuid": "134c1dcb-a27e-49b9-80b7-eff5bb3fe89a", "value": "T10F541209C7527527EED4D1B4DAD7E773E68CFA71260F4D6FA963090EA39BAC07804602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907265, "uuid": "444aef7c-99c0-4772-9bc3-8d7e476014a6", "value": "6144:P68dBAt0UYp4Yp8RnZzYHQInmTWYmTdBx4i3pxbKYtQnKxezUt9zk:PbBADYp4YpuWHxmTlmTTx4i3pxbKoQnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907265, "uuid": "e270cc85-f7c5-44e7-96a7-92f47efeec6d", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907265, "uuid": "68e773f6-3f68-4c03-a803-c6c44269687d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907265, "uuid": "936c1045-00a8-4a34-8d5a-7bcd698d046d", "value": "894280d247de3c7a1d658b84079439193dd66c195d44303555aa647e4cf89b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59df3ddd-62e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780885114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885114, "uuid": "5c453312-af14-47ef-b221-9082bdcd0bb3", "comment": "Malware payload", "value": "fa6e4cf5a8ed135a67e3b62b0e1166cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885114, "uuid": "04090f0c-f2ee-45bd-9e5d-c86dc3e0aa35", "comment": "Malware payload", "value": "89fd50b5d8e2e028364277a16783b5f39b465b6a31bb3f6698c785603bdd906e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885114, "uuid": "05aad7d2-3c44-4798-91e6-ad59d06269eb", "comment": "Malware payload", "value": "aefcca99b7835b3870433a7fd569ffaacad04436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885114, "uuid": "87430fa7-9930-4b53-a3a9-907fba30bded", "comment": "Malware payload", "value": "bc6a0810f1955435b44450b7c690b712f8558839690d0bc15014e0cd3445810d5626496d5ef70d60f4f840fbeea0f52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885114, "uuid": "9a56335f-5613-491c-bcfb-31c71173fcba", "value": "T1CDC64A47BCD10AE9C0AA633188B26292BB75BC490B3663C72F9077783E727D46C76754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885114, "uuid": "d437d4c3-baf3-4d52-8b22-e54be2954d3b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885114, "uuid": "00d26636-b8af-4c0b-8c61-1b2d55bae1be", "value": "24576:eQMc6xGr2XI8SZDZFHcz2AEMlSy8HEMlSYbxXkVR9On5iFBele7t9Dyifcm+qCY:etVxWdbZt5caAEMz8HJXkzcicYCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885114, "uuid": "bb761a38-3394-47cf-86e5-f292839e5356", "value": 11743920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885114, "uuid": "b463abff-4831-4a5e-906b-b0bead0907dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885114, "uuid": "09962b10-1c08-456c-9086-e6905945dbf3", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b3e844-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908481, "uuid": "bf6a1868-cf33-4cbb-8b70-d337d8ec74c2", "comment": "Malware payload (Formbook)", "value": "8114867c995244e411b84acb22bc455a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908481, "uuid": "64b64cf7-fcb4-45a6-b4af-820c0ad01cc5", "comment": "Malware payload (Formbook)", "value": "8b11b0e8f9fa1b47a03f7cdebbcab5c3f4284d290e9ad30e6d1f911156f94356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908481, "uuid": "c3aea944-ad48-42cc-83c2-2b5fb1446e3e", "comment": "Malware payload (Formbook)", "value": "c9375e8970b0e029b57351b6ff95c1c77ce1ccff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908481, "uuid": "6de300af-8335-4322-90ee-be8db3b4e185", "comment": "Malware payload (Formbook)", "value": "6d3675d50d5080b38beb6e96ceb5a60fd0b9a5730432015a31191ae51a4f913e2403c4b75a2c788348375048e26524a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908481, "uuid": "dbd26674-5a64-4cb6-b87e-cb70160b75d2", "value": "T169351244231AD903D1D64BF44A61E2B457B44E98F812E213DFEABEEFF87E3515A00396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908481, "uuid": "6526e177-6c5e-4d35-b39d-99192526302c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908481, "uuid": "eeb0db06-1a10-439c-8e0e-ac533be3ff6d", "value": "24576:AAEFT0DU1qd3Bu1ASZt07N7CwJND6ksGsUP82P:A3FQzdxudKRuQNWkU12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908481, "uuid": "eb97e783-5530-4ae7-a950-29c0e8146763", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908481, "uuid": "60d0fdba-de09-4385-bd80-3dafe4e17c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908481, "uuid": "fea0e449-ce7b-4ef3-a9c8-acb4d0e30f67", "value": "8b11b0e8f9fa1b47a03f7cdebbcab5c3f4284d290e9ad30e6d1f911156f94356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96b1d04-637b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780951819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951819, "uuid": "1fc9d9ca-53e0-436c-a153-e04ad87a0c41", "comment": "Malware payload (Mirai)", "value": "0607fe6c1fce7132e6b6578f9efa90b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951819, "uuid": "71878ed9-40eb-4388-a318-78a24e755d5f", "comment": "Malware payload (Mirai)", "value": "8b2a4869eccdb92a1016a7ac998d5655c4ab451979ef6039ca273b34bc8fe447", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951819, "uuid": "0a514816-d6c1-454b-8371-a60a2c9866e7", "comment": "Malware payload (Mirai)", "value": "a10a751d6ae8e9ebb65da520ebc49242a4787a72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780951819, "uuid": "de7cca40-9c35-472c-8d34-87317897dae2", "comment": "Malware payload (Mirai)", "value": "002b55888d256712990e9000a77409c8ec57699cf91a0e02546862574e40a37262b7dba284ad30a6c257fc9f0aa8b357", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780951819, "uuid": "5647a713-8910-4ab3-a234-5e820f6aa07c", "value": "T157262A97B8918643C0E4367AACBDC1C433631EB99B9762676D00FE3D3ABE6990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780951819, "uuid": "8024a871-b4fe-4870-839a-cf0cc52e5db4", "value": "24576:EBWtVok1kRwp420m39mXOoozuYrU8x7e8cj7EawrPQetZjxeEiJ7SBXytB7lXM44:RE1Umy9Y226EnPO9nRV+g0osMU1F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780951819, "uuid": "c9cde5fe-bc14-4fa6-8c34-09426c58029d", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780951819, "uuid": "4bce4ca3-3614-4820-8b97-612250737bdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780951819, "uuid": "900b3b51-a3a1-4cb5-a934-fffd66c5419e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a93e72e-6320-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912469, "uuid": "13603d74-152d-4b77-8f2e-95ce3af00170", "comment": "Malware payload", "value": "0bd605acbf5567b3d83bf4ed8807fdff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912469, "uuid": "676f59e9-2346-4ddc-83cc-b822bd2ace51", "comment": "Malware payload", "value": "8b7acb99772eba58865965c5a6303c3ca8257e2371093d49983b9979b2940a1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912469, "uuid": "bb6c4a2d-8d28-4b10-aab9-83d2cd427a2e", "comment": "Malware payload", "value": "fbc6817ccb94bd84bd268c75cb22c6f3adc950ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912469, "uuid": "0acf602a-e13b-410f-8ae3-6cf0f45bbbac", "comment": "Malware payload", "value": "66f559aee62956362e366c4f131c294e67d8f2df1d8f3aa39d551135dbab8d94c5fb49a134d372c61de7c4c52c07c3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912469, "uuid": "ee8a64a9-c50e-4a47-9e81-d87e7bf38daf", "value": "T13BF43F12F951A02FF4A789B065789546BE2D2E312694BC0BB7C12BE930745ABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912469, "uuid": "a74a7418-654b-4dd2-b5a0-a709421a380c", "value": "f4d5ca3ca2eaf3c60cd50c13ced6b23e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912469, "uuid": "873699f8-5904-4b20-9ba4-acda499ad41c", "value": "12288:CR5TX+L3idy/n/Ke+dTKcANGqR/fTLsUwj95twDpgm8rY2EWk8AyBUjRdS/A8Mtl:+BvnhqR/9/pEJ4btHf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912469, "uuid": "8f45f0ed-cc50-454c-9d78-3ee73065ef0e", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912469, "uuid": "496c4a20-cd32-40fd-a357-bfa2b9679bbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912469, "uuid": "e17cac0c-f0aa-4100-ba42-1948cae86a2e", "value": "8b7acb99772eba58865965c5a6303c3ca8257e2371093d49983b9979b2940a1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa02cc8-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780910456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910456, "uuid": "e6c5cbee-4b96-49d4-8ee9-0fa2e96b9cd8", "comment": "Malware payload (AsyncRAT)", "value": "1b8592d2206d7d2d6449a878329f5133", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910456, "uuid": "904cedcf-6ebb-459d-8311-23d6e38f9f54", "comment": "Malware payload (AsyncRAT)", "value": "8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910456, "uuid": "38e7278d-2418-4426-90ee-9fcb1fcb96f9", "comment": "Malware payload (AsyncRAT)", "value": "7a5cf0da662195b9f5ae5009e10db6d9bf2bad02", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910456, "uuid": "364a1973-b08d-4bb3-b51c-fc295344e97b", "comment": "Malware payload (AsyncRAT)", "value": "9aa53bedbc79dcc665f65f9874ff84e87bb0ec9499df66811c96937b6570973acd39411d7fad948e91fe5af8e284948b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910456, "uuid": "282ef7fd-9cb3-457d-91ad-b875090261e8", "value": "T1ADE41228262DE61BD4AA17F41DB0D17067B80E88E525E7039FCA3FEFB8797261445383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910456, "uuid": "7ef20de0-a37c-4bfb-8033-5cc13daabb47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910456, "uuid": "25f861c8-fd56-48ed-b197-0c826f13eae1", "value": "12288:zDdnxX55xUBf6rXToKRL0qUjmgek2MK4QN1edHPIM89t/Eszomgfrpy8ICc5jIHe:z5nNrxsfU8K9J42MK4Ced5o4tfr6CUI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910456, "uuid": "c59d9b1a-4d80-4c72-8ac8-41f86bb3c618", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910456, "uuid": "2d3a1cb6-a665-4401-88e1-585ea8929711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910456, "uuid": "e14f6332-4421-4702-aa09-3fbc42390adf", "value": "8c8492a4f923e63d050459bd3de9e35524f0d9efe8397ad6ee2fc89bd713f9c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cfd337-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780939578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "6863ccf6-5f9e-4b1f-818e-fd5a51bfc147", "comment": "Malware payload (ConnectWise)", "value": "3280e3fb4c987bc05f0516ca7a50fd1b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "8d59c7c3-cb4a-4c70-ad71-05f19038f3da", "comment": "Malware payload (ConnectWise)", "value": "8ca45c2eb1f7c02f7aae453e565b14cfe15c6524c6c5abae930f52f0c6b5f099", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "a2a1a166-686f-41a6-ae59-ebdb345012eb", "comment": "Malware payload (ConnectWise)", "value": "17a4153669b032362c6399aebf9b705bf43669b4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939578, "uuid": "dd57e34e-c537-4c1b-ab5a-70bc2924bba0", "comment": "Malware payload (ConnectWise)", "value": "cde8f8d71b43fcd7ac8b25298cb91d6639f4ba630ac9264cfe31bab2927ac8d6737b784a8b03be6d1d36d96f8f10ea4a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939578, "uuid": "d903d5ba-7b1f-4e73-9b6c-252c5ba1bd8e", "value": "T1DE646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939578, "uuid": "6928da16-d682-4b2e-85b7-7d2c9ddb0dff", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939578, "uuid": "f38130ad-2bb2-47b5-b684-ff7c435f8bf9", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:R1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939578, "uuid": "6f8756f1-6191-4d63-9347-e2e714c4a202", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939578, "uuid": "8299f171-dd3a-45db-a67c-a128ddfebcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939578, "uuid": "73a5728a-4469-4f6b-a30c-aaa71d5874d1", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9bdde2-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908632, "uuid": "fed8ff1f-b920-459f-86e9-edfb37b2f763", "comment": "Malware payload (PhantomStealer)", "value": "c1bc031a8405cf24b6ba8680b345c859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908632, "uuid": "6e31bd8f-9667-4c21-9ae2-972317a9615b", "comment": "Malware payload (PhantomStealer)", "value": "8cc13d005f8d4017555599722e72e8984f3740282747598cf7159c8a398eab1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908632, "uuid": "581fee3c-4e23-4917-9590-5c01feab51ec", "comment": "Malware payload (PhantomStealer)", "value": "3034f6f91e657f711a83d2bc818eadea4d945f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908632, "uuid": "0f4a2b4c-7119-4ec5-b0e9-1937cd1ec875", "comment": "Malware payload (PhantomStealer)", "value": "7127c1b3172f0da4c06d7ea1f17d145fe2a5df8f9e782aafebb61a46d4720f6a37ad766d0c4c97944a676023127d794f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908632, "uuid": "6af10539-3eec-47bd-b0ac-8775c6389a4a", "value": "T1B4751216620ADD03D5E64FB45960E2B01BB44E98FC35E3035FE6BDFFB87A3906905282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908632, "uuid": "7dc0d6df-f882-4b44-ac36-af0c31cdc745", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908632, "uuid": "f0cc634c-586a-45cc-8cbd-a5ba738c29e5", "value": "49152:hZLr3FQswIbCYHyzbWP2oWaP88eiiUcM2X9:bFQswIusyH8nW/8e/UGX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908632, "uuid": "ac41b34a-65a8-4228-9f69-9ccf1476ec83", "value": 1582080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908632, "uuid": "549ecb75-4579-4363-817e-c3ccdc4fd6d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908632, "uuid": "79899234-b1a7-420a-9f7f-2771144e6781", "value": "8cc13d005f8d4017555599722e72e8984f3740282747598cf7159c8a398eab1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee18aff7-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877202, "uuid": "4aa3daeb-4e5a-4aff-bd74-1c95a9daaefa", "comment": "Malware payload (Mirai)", "value": "a56945f02eec80df7f550919ca387b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877202, "uuid": "a5203130-0f91-4a62-9eda-3e255a5471e3", "comment": "Malware payload (Mirai)", "value": "8cdd79ae6fdb0012868d48edcf1ea0bb5a103d80347a49bf53938ebb11416653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877202, "uuid": "73fd7730-29b3-41fc-83b7-d8333e297678", "comment": "Malware payload (Mirai)", "value": "f26c22da274372d4d04343dcd109cb7e90a2b0df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877202, "uuid": "9743e91c-3c55-49d0-8d5c-cb2cecd7660d", "comment": "Malware payload (Mirai)", "value": "9b2316ef9f7a90f43a0225251e5a446385e5260f92b83dc71f093bed5df1785234bf8ad58270459826f6e577b20e61b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877202, "uuid": "871d5bb5-f669-49ef-87e2-dd297db750b5", "value": "T1E69495139A254DA6E465CCB3127633416C8E82BB89E636E3E97A8D60FF2540F41F7DD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877202, "uuid": "751c7cba-000e-4aac-b5af-89bce002302a", "value": "6144:a95niDnL6PdSyYZ8nZ8STmchtnBfIqujo84M:o5niDnKSDXS6chRBfEjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877202, "uuid": "9a7033ca-add6-46c1-8362-5a3d354ba26b", "value": 443820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877202, "uuid": "a8e48142-8ac7-4529-8b2d-cf1798398d87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877202, "uuid": "25f88553-5c69-4e78-bbde-cd227a141860", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7557a60d-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780912648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912648, "uuid": "17d2c2f6-4336-4462-940e-f9dd2cab503d", "comment": "Malware payload (SnakeKeylogger)", "value": "35e9cf5f73a3d2a4a0d36dab32d483b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912648, "uuid": "64070951-d132-46b8-b2b1-ce35c676a852", "comment": "Malware payload (SnakeKeylogger)", "value": "8ceb2c538d49fe528d9219f61da05a62a5da83dd212a5ac29356c07e98b582c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912648, "uuid": "4a997916-fbb6-40d0-a8c2-753b791e1990", "comment": "Malware payload (SnakeKeylogger)", "value": "d516e627cdbc5f60f09a4aa889543f9e7ee54803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912648, "uuid": "f14a1960-565a-453e-bb01-a20550701ab8", "comment": "Malware payload (SnakeKeylogger)", "value": "1045ebb1673a6acc371d22b3941e05c43986271f61c5b7e8f0db95b5b37489472f55e6be205a983253c3fa4987a7dbb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912648, "uuid": "e5981fd4-b725-46c7-a1f7-1b094f62d629", "value": "T123251279AE58C513E59727346AB0F17023798FDCF600C2979FDCEEAB392AA145848385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912648, "uuid": "b853aaa0-522f-4384-b062-42160b4e7227", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912648, "uuid": "c13579bc-c22b-4d8d-8043-50658e694204", "value": "12288:sNovbQbl1ifKC0+AmMmQyUxvSsvmtKPxLvF0/kV63wbX8JeOiMKm0tLg4VJ9Ka9c:gLPJC1AmHnGvDO+xL9+4bsJ15k9F9yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912648, "uuid": "761bd2bb-f058-439a-a9a8-f67924010f7b", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912648, "uuid": "c22b2cfe-db0b-4399-aae0-bf6f2f963998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912648, "uuid": "21d2bf92-cf3b-45b8-92c7-47a006be22f2", "value": "8ceb2c538d49fe528d9219f61da05a62a5da83dd212a5ac29356c07e98b582c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59dc67e6-6383-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780955122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955122, "uuid": "66f8e6d1-fabc-4bdc-89f6-634506ec7177", "comment": "Malware payload", "value": "273e31adc2094161909678040731e308", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955122, "uuid": "48b41c18-297f-4744-9591-819467c9193c", "comment": "Malware payload", "value": "8d05ca0d48d4332c894bf787ed6d9312e63c1e541e4262ab4bbc1cd16c4a969d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955122, "uuid": "75c083f4-5f33-4b04-b244-cb3be1073651", "comment": "Malware payload", "value": "e0ead4b8e3d104c7b467fc876fe4a226648229fc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955122, "uuid": "f4f55deb-7bd0-4d64-9328-faa58be5261e", "comment": "Malware payload", "value": "33a53d12f4e1507790be390712c0851a9c597390c0004a1bd0b5fcbf33d7be5e6639acfebd5e9cb31ace153e526afe9e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955122, "uuid": "d5ce48cc-72b1-4e02-a476-ed5baf735c62", "value": "T1E6723A0FAA814036C7D01470867B4A27893EA8752788FCD7FBF454CA49A86E6F43606F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955122, "uuid": "cfe929b5-2522-4575-b730-0bb536aea338", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955122, "uuid": "5315cdc7-f1ec-41b8-a931-4df93729eccd", "value": "192:CqwNiyXgzhDDR9y/a+PPhYX3O51zF+9kRaGKUSfDzQvXfRfoaXXuMGJxTmv8U9c9:0i3DTy55N09tDOAcXuFav8U9c0Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780955122, "uuid": "88557009-3918-4309-8099-ddd9d61b866b", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780955122, "uuid": "1b67a5e1-2f7c-4227-9e53-fc2bba762891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955122, "uuid": "d418d896-0659-4af6-bda4-eccfa39c15d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f7a272-6362-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780940885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940885, "uuid": "4400d570-4812-4ea3-8eba-80917073d2c5", "comment": "Malware payload", "value": "288bbd4a422eea077106cba408521595", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940885, "uuid": "4a8c0f7b-cd59-4b9e-8c15-187b58e3b25a", "comment": "Malware payload", "value": "8d45ae4cf4356c118fbe4fe462c69a73d63ced0e445e2c9db31c409fdcaf40c5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940885, "uuid": "4a71975b-9910-42de-bbc7-402adb0084b2", "comment": "Malware payload", "value": "73a5d739ce15472b491bbade92ea693acd128fad", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780940885, "uuid": "9ff4ea12-bb06-4be3-b57b-830327be0340", "comment": "Malware payload", "value": "67a42409422524018bf6a1ebf369028df4013fd1a9df14c2e93361d2133f7c31ee456d6f2b52aadc9ed9fdb9af5036bf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780940885, "uuid": "9a38d539-2342-42ce-a12b-a55c6cd495c4", "value": "T1955678F1D721DAFEF1A1082388B53E18089BA5641D2D647A7F928DC9FD1CBC0861BF59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780940885, "uuid": "fe8125f5-e6da-4164-964e-391b80a0c7aa", "value": "1536:taBrCsRKT/kuKEEnnjb8ESspuzDt2DdpUtssFPQpw6bYtyif3gwRgQ2P/yIBXDi/:L75de6LjXqEuoCt0FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780940885, "uuid": "6dcd760e-4f59-4ac9-b389-e62fa0beb90e", "value": 6185893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780940885, "uuid": "f48d52eb-4cda-4113-baa4-e5a43531031d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780940885, "uuid": "fabd657f-cd94-415c-bb79-5f80ab8955dc", "value": "photo_vacances.jpeg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67eca698-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780913055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913055, "uuid": "77e2f3de-ed4b-48cf-9e17-1d253acb21fa", "comment": "Malware payload (Formbook)", "value": "dda4fc259a21fb118a990b54709e350c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913055, "uuid": "2160c38e-0836-42b6-848b-542a7193985c", "comment": "Malware payload (Formbook)", "value": "8dc1eb09176de75ffcc67bb41e032b98a9afd401449e170fc548775d4fa3f855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913055, "uuid": "63e56a27-411c-4d24-8b3c-38ba277f4f17", "comment": "Malware payload (Formbook)", "value": "a929b5a986efc0a42f894c8914872067f3bdcc5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913055, "uuid": "5579e982-f552-471d-b758-bbde0e897496", "comment": "Malware payload (Formbook)", "value": "81466584985094595e23ec76b69ac43c76ced3e5372fe82daa0ecfebc5d81222fc452143f6d284d500a0abc022ecba15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913055, "uuid": "0db9474c-3ff8-40a7-afe0-9fc57b8143cc", "value": "T171251219621EDA0BD4964FF84961D1B557F89ED8E822D3038FE63FDFB43A7200965283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913055, "uuid": "d8469e7e-4ff2-4f30-b372-ecd6dd5e04b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913055, "uuid": "bd313a73-d110-4e41-b8d0-b18301c8c05b", "value": "24576:fhwZtIUxyGuf1qtHVXQxm8pIMUOj2/870PMckDEwej:JwYB4+nUOO9PDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913055, "uuid": "e4dbb8c3-e6cf-4410-b846-ae25ea2db4eb", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913055, "uuid": "09bce7de-64c6-44ff-b779-4cfe7bd651b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913055, "uuid": "0f71c225-7c9c-4d01-af38-a02147e45d0b", "value": "8dc1eb09176de75ffcc67bb41e032b98a9afd401449e170fc548775d4fa3f855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a75dc7f-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "deb0a0c7-5c72-41a1-b9fe-5378e81e9c8e", "comment": "Malware payload (Mirai)", "value": "280ef99b60c0632ea63946b8481c2ad6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "2f81139b-2d2c-4096-98bf-232571bcda82", "comment": "Malware payload (Mirai)", "value": "8de52d0d7a5de43f21cb38020f21e76506dd739b8866b5af1fbb7ca8d2f21dc8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "2eb9deb5-c35d-48d5-bb94-aec7d872e274", "comment": "Malware payload (Mirai)", "value": "a3210b7f911294d7cc51073ef7985fdc3d5640eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "7408357b-e009-42ac-a697-b8bdb41f791b", "comment": "Malware payload (Mirai)", "value": "7223f69c4553d40fc526a8976e0bb5cca232de138a4cffbce13b1b8667645738648687a9e1600cb505bb7d310c6697c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939581, "uuid": "9788c043-7403-4d15-8cd7-bd09b4869c35", "value": "T19CC3E71E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939581, "uuid": "6f576299-642d-4fa4-9da6-eabc69b43c29", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h3f0j:IaOulLUUogcQ9BvMEWSWC2h3f0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939581, "uuid": "3b08dbd9-faad-4a9f-834a-3308a4263bbd", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939581, "uuid": "3a0840f0-9fb3-4272-8204-78b44d87fd26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939581, "uuid": "50fb5879-4c74-49b2-ae0b-8a0aeea5160d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9663bc-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908263, "uuid": "978f4d30-2ecf-407e-b05d-70fe91cf86f8", "comment": "Malware payload", "value": "7b2534235f44ac9ff42139a93a80b8e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908263, "uuid": "4a52240c-879d-4311-a5e5-55c8e167e70f", "comment": "Malware payload", "value": "8e0a4d936fd5bbc992d60cf386acd32df7907d23ded322704a5d124ecaca536b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908263, "uuid": "3906fa0f-9c05-41d9-8464-d95caf208eb7", "comment": "Malware payload", "value": "d6606679c0078ba8bf25a08721fc99b16f5b1456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908263, "uuid": "598bda0e-1827-4066-b916-aa5316b9a55d", "comment": "Malware payload", "value": "354543b301103cf7e026b97833e2a22d952c34bf831a073141f3d9def00d80d26d7586ae22a581f1659e8a51bdfa609a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908263, "uuid": "905dc978-3d9f-4e74-bccb-c2a17a71158d", "value": "T1BC2512292643D011CA1667315F7F1FD9D337DE280639824B8BA316ADDE3772AE1E0E85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908263, "uuid": "b1bd0de4-5431-4ef3-9ff4-1dd716483454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908263, "uuid": "8336732a-5e3a-4177-a183-6f00bed15285", "value": "12288:Qgx0FLB/bBNTiwX7aeiEbgNjaz0+HyaCuVdyrxvD9wBIFX5xHH6oGHpzCU85:QtFJz7c5a8uGrxW2xHH6oGHFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908263, "uuid": "a01e953b-e597-4da4-9334-c41624e70454", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908263, "uuid": "c9e32731-cf0d-4aa0-8c8f-4b955fa0c693", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908263, "uuid": "98f416f4-d4d5-40c0-a146-411366e9fa53", "value": "8e0a4d936fd5bbc992d60cf386acd32df7907d23ded322704a5d124ecaca536b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371d5cac-62ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780890210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780890210, "uuid": "f55ee636-cd50-4ae5-985e-d6961e72f1de", "comment": "Malware payload (Mirai)", "value": "3ad8fe4e889084e1c37b92bc53c0e520", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780890210, "uuid": "bde88563-a5bd-4671-be2e-9365d36b9d92", "comment": "Malware payload (Mirai)", "value": "8e0abd410c5fa71886d8780038a47a155f9f69a83bbe04e5a42aa90e98926f61", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780890210, "uuid": "a0e90737-727e-4bf4-abff-04d0bff03dfa", "comment": "Malware payload (Mirai)", "value": "c4dd5420007447a264aa39c2469fc5b035e0bd5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780890210, "uuid": "bc4f3eb2-f6d6-400d-a22e-816b3b7fb009", "comment": "Malware payload (Mirai)", "value": "15842307fd447f49f327e7d4dd1ba6a9c8ff84559c897120e75614b0f340ae155fa3d85e9eb8015f7054f73e07eb1354", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780890210, "uuid": "490b1dd7-ec2c-4a11-8058-00a470056021", "value": "T16451A4C895844F743C52AE17FABA412C7096A5C314E36F919AC4BFFD216EF58314075B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780890210, "uuid": "fa3d4a73-5c7b-4ff3-90f3-104fba4362f8", "value": "48:ia27127x7ja282oIa2g02gwxa2s2YYa2O2yGa27O27y7Ga2fT2fHNa2F2BTa2S2L:i7787x7j79oI7gFgwx7tYY7fyG77f7yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780890210, "uuid": "55920a9e-0cf9-43a4-8037-f2523b70899d", "value": 3022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780890210, "uuid": "252fa862-442c-4cf3-96f5-d5df1c0af5dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780890210, "uuid": "8ebc3e62-75be-48bc-8a50-4c33509bed31", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5309851-6320-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912728, "uuid": "45d07ed8-d8c1-4d49-a9ea-50717355672e", "comment": "Malware payload", "value": "1ef8b5a6d59ecdcbdb810e8958f544d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912728, "uuid": "cfe80ead-6947-4e77-a892-7c141d34d921", "comment": "Malware payload", "value": "8e19d1b0427b14723465546353ef0cf1d047d262a09e98bc7124f07400e23fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912728, "uuid": "8e5416d6-a424-43da-b58a-7bb4a11bd0c0", "comment": "Malware payload", "value": "284c612d05d7c36aca10aa4a3ec94a250b495fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912728, "uuid": "557890df-43da-498f-8838-5335ef06cdbf", "comment": "Malware payload", "value": "ee1eae0869478e3db14b21104cc5593061bdec316c0ea3fd4819aae48d57dc30900855573d320349f2c03914dc02a0d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912728, "uuid": "aced4487-4631-462f-a8b1-7b9805407c21", "value": "T100A42010B8FB501DF863ABB15FE8E8768A2BFD75192970AD20C43B176773D828D12536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912728, "uuid": "cc74ef7c-4e35-495d-8b46-f80e1c20de63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912728, "uuid": "d3882470-a551-4f3d-814e-3a253d5c146c", "value": "12288:nxXEa0hPYHf901b+O/5nGvEy+T+SNxhP7r9r/+pppppppppppppppppppppppppz:jAP91q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912728, "uuid": "b7e678c1-ddb3-4ed7-b919-8fa700e78921", "value": 484352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912728, "uuid": "03ff65c1-87a6-45de-9407-71963e1108ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912728, "uuid": "43aa422b-6c75-47fa-981b-e2b67f4d5827", "value": "8e19d1b0427b14723465546353ef0cf1d047d262a09e98bc7124f07400e23fb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb92cfb4-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907639, "uuid": "7d8b77a5-9e2b-474a-9408-4e27b515c2de", "comment": "Malware payload", "value": "cc2f2c0e999e49c6ce6ed88fb557c6f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907639, "uuid": "b301aaf9-c82d-4d0e-ba6c-03c05429321e", "comment": "Malware payload", "value": "8e9dd5ac729751e79f3c5759acc6ae13d3e47419a38a90a518777c2d15cb7d26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907639, "uuid": "01a54508-5802-4651-89af-be0baf857982", "comment": "Malware payload", "value": "64a7e12493c7f8daeaaf24008c414fd7061051e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907639, "uuid": "c83ba8b7-874d-4db9-b51e-a242dde7ae77", "comment": "Malware payload", "value": "6dcdf86cac84cc2802f39775a41166b77affd9f5dfb544f425f7a22e4dd5393d4f0310aea53ecd9c1ffd17ab031d77cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907639, "uuid": "09890da6-b48c-4e08-84ea-be59129d92a8", "value": "T193073360DBC1191BE897613C96B3CA61E2F2B56217238DAF179113763FBB2D0443E6D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907639, "uuid": "f3788ac5-dae9-4b73-9092-d87d3df05c8d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907639, "uuid": "af30ce32-8377-4036-867f-3fb063948376", "value": "393216:3ZqpoKux6Yrjsrcr6tZq5Xl4yJOHsxtEDweEMJRlE9:JqpGrXsrcr6tZq5V4y6wt7epq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907639, "uuid": "c8bf2204-b367-4898-b36d-0c6f55014949", "value": 18334921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907639, "uuid": "2348c93d-84e9-4a07-987f-ecb89ae0b8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907639, "uuid": "37d1d8f9-1568-419e-82e3-9998e30fdcdf", "value": "8e9dd5ac729751e79f3c5759acc6ae13d3e47419a38a90a518777c2d15cb7d26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8678ce30-6356-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780935869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935869, "uuid": "623ee574-572e-40ec-98bd-e8c201eb122f", "comment": "Malware payload (Phorpiex)", "value": "1392b14287699b76bf8910ea4a83cf33", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935869, "uuid": "e4c26dc1-3283-4871-900a-ce16a414aaee", "comment": "Malware payload (Phorpiex)", "value": "8edbf47b7de22459f34096ddeb982ade3b7c7098febf08bca718d9b64af27b19", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935869, "uuid": "5646252d-d1d7-4bee-a016-1a42f79b77a8", "comment": "Malware payload (Phorpiex)", "value": "4aae777023b48be73aaee8f8029b5206a3368f83", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935869, "uuid": "f8388c0d-7b1f-4d26-906a-cdc0918dbc10", "comment": "Malware payload (Phorpiex)", "value": "7d3ff955e05c0be3e279d2b08ce8b09d76dbeef39393e36aae6b09da90374dbb64e2b19b2e2d25b9f12631716449e7c6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935869, "uuid": "1ebc795e-aeb7-4b69-8c0f-7a40ebb45850", "value": "T1D1825C0FB8424726C1E100B09676967BDA79A87137C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935869, "uuid": "71b7f550-d039-47d2-a441-dbc1efc73224", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935869, "uuid": "cf960e0f-abe8-44f6-9998-9d0d004ab59a", "value": "192:NKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSvu9zw+ghSSCgbO5qmEd/FN2GJxa:P0W/ytwEN/0Gu9JgwOcoav8U9cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935869, "uuid": "17600e76-fa03-4e4f-89d2-72978337caa5", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935869, "uuid": "469339e2-080a-4822-8937-27876aa8715a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935869, "uuid": "0ea1627e-a859-4289-a346-5d2d35f1f6f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f517e7-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780910443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910443, "uuid": "0628a7ac-3009-469a-b74a-57fb03bd7153", "comment": "Malware payload (Expiro)", "value": "b15bc2e6b93fb013e344f426a60d85c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910443, "uuid": "c48d11ef-75f3-46fd-8dd2-50e6e99e8f57", "comment": "Malware payload (Expiro)", "value": "8edf63e404795c64cc17d553a80a5c3df86f30592838812312e665bf7c8d735d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910443, "uuid": "dfc3b044-352a-4bcc-82ac-3b434e71846b", "comment": "Malware payload (Expiro)", "value": "d58458448941b21a4e98ba8fa8d4a7ce61ecfeb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910443, "uuid": "4a1ce268-5a00-49f6-9099-19b244fb4700", "comment": "Malware payload (Expiro)", "value": "d961169ff45cbf48708efaf711e9947d87bdb416d8ec55bf59d5b389893585f90eec11bdf21bcabe4da8b97d985a3dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910443, "uuid": "9ca1b990-6298-41d4-bf20-2beaf481b1f9", "value": "T12F85230052ABD917D5964BB6ACF2C03457784D4EF422C61BAFC82EEF7276B6509C4363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910443, "uuid": "bbb6c77e-f4df-47ca-b811-72c7fce449cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910443, "uuid": "67220ce9-4887-471d-a8d1-ff6f8c2f676a", "value": "49152:BTG7y2+GjavK7mpEaE4nqmGuFNZ0pBFvJJk6zUzgoCUyGc+VUBM:BTUy2aK7Ra59bvKTFvJJr+wUyGdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910443, "uuid": "c821e74a-21cc-45b3-b2ed-5435ebfb8dce", "value": 1857024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910443, "uuid": "501ba640-a3bc-4a68-a2aa-f3ca09276b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910443, "uuid": "2d664948-33ba-4835-a7ec-d34b4848aa96", "value": "8edf63e404795c64cc17d553a80a5c3df86f30592838812312e665bf7c8d735d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcc8a4b-631c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911075, "uuid": "57513f30-d61b-4929-9dca-19b86b4e6c5b", "comment": "Malware payload", "value": "9424ec719ddb21e75969e4327c3501f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911075, "uuid": "14761540-c138-4935-9c95-bedb21b460ae", "comment": "Malware payload", "value": "8f24fcbe3feb9cfe7ceebe9e402c12357990b4124a8eab9cd16823fd67f46e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911075, "uuid": "fffb2949-dd04-41b6-b0bd-ba49e9af3fc8", "comment": "Malware payload", "value": "0a59ee6df4a20c95d2e77b277a7df2c596ccd53f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911075, "uuid": "cabf43c2-7e2f-4e49-8d88-dc586233b306", "comment": "Malware payload", "value": "1f07554337daec9a0b7e138097a76b4044b90891be6e8a4bc2695865cf1965d84b8d2489ef4dbed0b105e992364a0d1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911075, "uuid": "df042fa9-cc97-44f2-83b1-e2104723c05e", "value": "T152D37E6DA3D1B05CCDD62E786C37E68001F6BE2F696342D5ED7871E92A712F02EC0646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911075, "uuid": "7f32c157-bf1b-46a8-ab0a-0fed270864b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911075, "uuid": "814a21c9-4d78-42ee-a79c-c9624a92e65c", "value": "3072:pfbGc+9mDRuMt5MkX8wsnSAgmMtbeWzDw3CTU6An1rQrL:pfbGniYOswE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911075, "uuid": "f57716ab-c487-43b2-be64-be6838e8ec7b", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911075, "uuid": "053aba63-9c37-4031-b647-fd8317af10c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911075, "uuid": "2a4f088f-8636-45a2-a5c1-a6760e49ffc5", "value": "8f24fcbe3feb9cfe7ceebe9e402c12357990b4124a8eab9cd16823fd67f46e55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53179d01-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780911731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911731, "uuid": "d54e06a3-cbb1-49ac-a141-86a25ba5459e", "comment": "Malware payload (Expiro)", "value": "b6e953b96517ab189a8d62f61c6b4fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911731, "uuid": "ee39b73f-e74f-4e4a-b678-16798488aa76", "comment": "Malware payload (Expiro)", "value": "8fd05fda12c171327139b846e98cd6c5e3a9032e73d47e58761dafa8e047c3a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911731, "uuid": "fe833098-1ca1-4452-adec-818249c5359b", "comment": "Malware payload (Expiro)", "value": "c1e7e6fbcd8d6b96e6fc7e9fd86c8b880ee990c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911731, "uuid": "950ccf45-ec7f-4a7b-b66d-2e5bfbc18d13", "comment": "Malware payload (Expiro)", "value": "c178795957aa1aa744a917362efdb934aebd3be30633997cdee46250c422f079a5596b2d3ef47748925d2364b454e043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911731, "uuid": "13d1ce73-6470-4e20-bcba-322a8f793549", "value": "T17B85235C6A47C117C7880B360BB2F7B416ED0DDA7A02E122DFCC6FDBB926A752D04196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911731, "uuid": "354ba506-19f9-4373-a297-c9c587cfc45a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911731, "uuid": "96d96bde-db60-43a3-bc79-5b288fe8b72b", "value": "24576:RCtKVXKTm7iN9vJ+03XyI0Oj9bzpwyivBq2xQLdGvWaRCPbPPBc9OD:qTmeNj0ePpwVkGQ5GvbC7BSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911731, "uuid": "cb1ca589-2656-4d3a-aa6e-d18307ffe762", "value": 1809408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911731, "uuid": "afd332d3-deb8-4fd5-a087-10d377f0fb45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911731, "uuid": "7968d0b1-9d75-45ef-8c9c-0bb7bbd64e48", "value": "8fd05fda12c171327139b846e98cd6c5e3a9032e73d47e58761dafa8e047c3a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6aff80-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877196, "uuid": "c3d68ab4-1ab7-4536-be83-11ba334b1724", "comment": "Malware payload (Mirai)", "value": "743ae1a44b8f5e65821a046b39db2014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877196, "uuid": "9f5ba5ed-acbe-48a2-80cd-f06a864b1aa9", "comment": "Malware payload (Mirai)", "value": "8fe53d14c069f754c7c2d2185af740614faf0796f64c7616ca4b4307b2fb4f83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877196, "uuid": "ba76818d-4158-43a3-8491-cc30bf7b3005", "comment": "Malware payload (Mirai)", "value": "8ad195343cbeb742ac40d014dfe6c80da8622484", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877196, "uuid": "48a904b6-1a85-4364-981d-db3c54df11fd", "comment": "Malware payload (Mirai)", "value": "0e20fe6d19bf6f6d7d1db3769cb08a7ccb9fbc2290631e7312a3c515e7d285360f4e51a01494dd38d097a769e16fe2ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877196, "uuid": "89169e3e-3f13-4f95-9b3a-58ed9b70367a", "value": "T18D746613C9254894E1148CF2226772655A47C3BB88E72AF3ED5649A1FF2381F61BEFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877196, "uuid": "c0b83224-f702-4038-9795-74cf38e8b306", "value": "3072:VpZDxddM1ZLpxiAZld8xXNdog5W+0JG1+joCDvmA:VptdY6AZldoZk+7kjo8v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877196, "uuid": "187eee4a-18c0-4536-9148-e6ae398c881b", "value": 370884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877196, "uuid": "bedfb2b1-4ce7-4a33-bc34-9dd55927528a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877196, "uuid": "a5539ada-2fb7-49ae-8fdb-3ca91dfe9342", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1d9159-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "5bfd98c6-cdd6-44c4-80d7-fd8456aed5a6", "comment": "Malware payload (Mirai)", "value": "58861ab595ea8f569f4c1a36c9e3a1b6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "b4f4cff8-6c60-4663-a6fd-7001b88d16dc", "comment": "Malware payload (Mirai)", "value": "90762b23f27df7fe853cd15ef0c03912d6d447eeea02ac28df5c337a390bdd65", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "51a87a08-fee6-4594-98f9-5627a0018467", "comment": "Malware payload (Mirai)", "value": "56095011b302f2210eec409ed1b6ee43a10ded34", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939582, "uuid": "81d7db23-f1d1-4095-9ff8-7a14090dc381", "comment": "Malware payload (Mirai)", "value": "da9e10e8d195f6681d8785f17c12c62e3b7cde593d61a9a962e3d34317509099ccd551fef5cf116c605081902b541cb0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939582, "uuid": "4c239eba-344c-496f-91fc-bdbaa92b82ad", "value": "T1A283AD32EA292D44C0455570B0B98F395B73A5C083476FB66AFAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939582, "uuid": "5e2cb117-6c81-4be0-9822-728ef9da20db", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7L:UeAsdukuhoNJVwbmuUqjLjwWiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939582, "uuid": "187b8e5a-bc9d-4338-98fa-c2d2a0051e90", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939582, "uuid": "13ff4338-84fa-401c-b2db-9d3a4155f996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939582, "uuid": "69951320-30c7-40ff-b7ef-064b8631e9f0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d7264c-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912226, "uuid": "c048a1ff-03ab-4302-ac78-41ae1f27f997", "comment": "Malware payload (GuLoader)", "value": "786fa6e98c7910b8fda4668f469b5355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912226, "uuid": "4801d322-d951-423d-bcb1-8855413570c8", "comment": "Malware payload (GuLoader)", "value": "9082b4c986dabd4cf4d2014dd5cde755707319fd5be80382f106e88f2606d3e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912226, "uuid": "b0c8b999-e5f8-43a4-9db6-3c899d2c4818", "comment": "Malware payload (GuLoader)", "value": "6e112a867f5189ea9ad9a2ded31b2ec12b1595db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912226, "uuid": "5d402ec2-8daf-41a6-96a9-a115fca86232", "comment": "Malware payload (GuLoader)", "value": "eefbe10dcc8327aef559fadd7466e4d4b8fe6faf2aa0994c67508fdc7a662b79f7d1aacd8a53b3f09e516ae4d806dd12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912226, "uuid": "11b0c682-117e-4297-bb3e-c88a7dcaf924", "value": "T16F25126DB52072B1D42DC7734A25DFDD3B610D21A3F078ABB291373586B0220D6BAB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912226, "uuid": "38acc8af-31b2-4e57-8dd2-29103d937b84", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912226, "uuid": "91191252-0978-40fe-ac0a-be9cdaed28b1", "value": "24576:zfLE6f5nXjXzldlMrn3hH6KY+eAZkJGrI7+nbBOh7:bdfZXDzblihH6KB1aJGndOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912226, "uuid": "32bf5832-419b-4719-9872-6514bfe6a329", "value": 1014248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912226, "uuid": "dccaba1d-9ce7-463f-be22-4106323b16d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912226, "uuid": "7758195e-9662-4ef0-b4df-87c7659882a5", "value": "9082b4c986dabd4cf4d2014dd5cde755707319fd5be80382f106e88f2606d3e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581ccb07-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780907874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907874, "uuid": "66a1e372-74e1-42d7-b83b-fe8b92436358", "comment": "Malware payload (a310Logger)", "value": "b6ce0287f89ee9e21f44200840448ffc", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907874, "uuid": "fa0b7484-6d6b-4f94-845c-d958cd06a23b", "comment": "Malware payload (a310Logger)", "value": "90ce82f9e97f2dc76a216056f991cd2c363b6d586bbe865f0747e04c59002864", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907874, "uuid": "87a48b37-6ef6-488c-8330-e8d444d0d381", "comment": "Malware payload (a310Logger)", "value": "08aa025793083cfda2afdb3a348ccee306182c35", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907874, "uuid": "c7101f10-7c9d-47a3-9967-7acf45f7d610", "comment": "Malware payload (a310Logger)", "value": "9f44716efd1774a9536d018ab5b1ee5b29e53e9e6ebd93b8072ec9dbdfa816289f682b4ebb8e1db57360a4d2d7ba45fa", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907874, "uuid": "08b42d32-47e6-49ad-b34c-317aabfcde65", "value": "T19B944A13EB60A01EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907874, "uuid": "587a2f2a-a65c-446a-9827-76233e424fc1", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907874, "uuid": "39218330-0438-43db-8641-e49afa92233f", "value": "6144:+H8d1/w5KA81IJ8GpF6nuTmOOUiBUrjlqelRNwHW7WFRvvOyRyLkXUmA:+cjYKkJj6GmZUiqrxJYWSJRyLkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907874, "uuid": "c820c474-21b6-4575-a92e-268d66363c2e", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907874, "uuid": "1d51d69c-ca97-4ef7-865e-0d8905b6b7d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907874, "uuid": "202ef9d5-2c9e-4df4-be3b-253e87d04872", "value": "90ce82f9e97f2dc76a216056f991cd2c363b6d586bbe865f0747e04c59002864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdd7215-631d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911565, "uuid": "cc173336-296d-43d9-8ff7-502430fab92a", "comment": "Malware payload", "value": "9513164cc6be0c0bcf906af94f872397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911565, "uuid": "308a27b4-9b40-4ff1-b015-0f495592aea2", "comment": "Malware payload", "value": "90df712c78109b43b1372b9ac75684e2a121cb198f3f7c5c8ab01500e5030494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911565, "uuid": "47450a44-6eab-4473-a5d1-ec2e9d4de80f", "comment": "Malware payload", "value": "fa155128268a29f1dd72ca4e96dad3cff87be159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911565, "uuid": "a353a1af-425f-4856-9d6c-bb868fc72ee1", "comment": "Malware payload", "value": "7b1b7a15115840184b6efb69e32d28d6d0ea971c030bc1f0fe66c364bdd37c3f8fb4093ce1bed5f3cf25d61d3149ba13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911565, "uuid": "924ec6d2-2de1-4545-be46-7dd977154a55", "value": "T1BD252359F375831FE865D371C8BA8A20D7789D6C398A520F738972913CA36CA46243FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911565, "uuid": "47c2be8f-de9e-4296-894c-f0fae845364c", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911565, "uuid": "cfac37b5-9bed-4ed8-9b15-82881c560871", "value": "24576:AA7F2AtluF48qHwgwIV/9GlMeBEFmNZpJGSqQc3DKtbPik+n:ArAb/vw+9GrDHVSKtTik+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911565, "uuid": "92e37c4e-2f83-4f0d-a2cd-b0152cb9ce86", "value": 972112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911565, "uuid": "df17c9e3-9cf3-4e74-a3c1-501fff6443dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911565, "uuid": "8a9a6a52-2e89-42d7-8040-4757a8409f4b", "value": "90df712c78109b43b1372b9ac75684e2a121cb198f3f7c5c8ab01500e5030494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22aaa7d8-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780911650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911650, "uuid": "0ff1c8b9-bc1f-4b18-8a5b-e1d4ca8658fa", "comment": "Malware payload (AgentTesla)", "value": "73ba8d807d512c3b912dfacb5a57cc7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911650, "uuid": "e684a0f8-bec1-4d28-943e-c7614681a74b", "comment": "Malware payload (AgentTesla)", "value": "90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911650, "uuid": "188672a3-6caf-4201-b830-1a16f55aca5d", "comment": "Malware payload (AgentTesla)", "value": "0f41a7bc939ca93ccbd1b4375c38e1e1f8817f07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911650, "uuid": "89458e0a-1778-4245-a51a-6ff3bc90f7d2", "comment": "Malware payload (AgentTesla)", "value": "f3befb36621ae8cc842e32e0b6dedbe76743b6a7bec075a791dd57071fb3376b4c9b65388e1dec296697362da0351130", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911650, "uuid": "ac678967-8b38-4859-8932-4921258fd54b", "value": "T1772512586E46D507CA905B394FB1F279126C6DEEB401C6239FDD7EEBF93BA520C04282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911650, "uuid": "bf64de93-9210-4091-b857-1f11c514fca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911650, "uuid": "4f4d5e01-aefb-4c91-9d0d-77a0456169b0", "value": "24576:SEOp2g6zYF7nNAE9WdEnDqGLAlyx9u0myKOmoV8k34Q:vc0zKnNbW4tL+A6+Vf34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911650, "uuid": "3502f6f1-b4a5-4568-bc91-f13ff115d2ac", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911650, "uuid": "7403a7e4-4d47-4a70-a61f-f7d3413af4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911650, "uuid": "7fe84f6f-9604-4215-b22e-d4a4a637eaf2", "value": "90e4a4b341c0fc976c1832f1eed2ef6bbb0cc7635ff507ea574e7233c6655515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f6743e-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780907894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907894, "uuid": "40d0406c-2e36-4f8a-ae6f-32ce1e8b9034", "comment": "Malware payload (XWorm)", "value": "afa05e44834c032c256a7c95a9e714d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907894, "uuid": "d3e8e5e1-e26f-4dc4-bfeb-af85eb5b1c1a", "comment": "Malware payload (XWorm)", "value": "9137813c72436292c576c8312df2a2ef14507ff4c4a885fb29362ef57e9b01cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907894, "uuid": "3a9702e5-8b86-43a8-9fc8-410bf17652af", "comment": "Malware payload (XWorm)", "value": "dc9e55ab600f9da6008ef3f628ababb2ff5ced72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907894, "uuid": "baa0494e-5a10-4c90-9547-36c79b615ffe", "comment": "Malware payload (XWorm)", "value": "5de841611a5cf0b9c645f8898adab020ce784217f9cf9f3733ad02972833f1847a2b754f326e5f90031daeb1424df960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907894, "uuid": "78cd2781-da8a-4071-8c6d-c14f57dc8ece", "value": "T17005F150225ACF06D4AF5BB05960D3F413B78E99AC10E3D38EE6BDEBB47A3413945293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907894, "uuid": "d4f9c967-10fd-499b-87be-dd2353691ac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907894, "uuid": "f07ec9b6-7157-499f-bedc-c31cf08afd0f", "value": "24576:oeJIt+EsCtPKCbCd/4hLyuAQzL1zaJzR4TS1:wt+EsYbCd+LoOxza5R44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907894, "uuid": "2592656f-9324-4abb-8fa5-3e96b5023984", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907894, "uuid": "392edb3b-28f3-4a84-98c6-99b9c1003a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907894, "uuid": "1a87b0f3-d40e-4c3c-9592-6c70d10e2dbb", "value": "9137813c72436292c576c8312df2a2ef14507ff4c4a885fb29362ef57e9b01cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a1a476-6332-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780920379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780920379, "uuid": "cd8f286d-0513-4df9-ad0e-3659d9bdbe4a", "comment": "Malware payload (Phorpiex)", "value": "0e9e98f0f82f16bc7cd49ea66ee62ad5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780920379, "uuid": "83570a9f-beb1-4bc6-9bc1-0ca52f5fe74b", "comment": "Malware payload (Phorpiex)", "value": "9150748a7cc0573901194e8a90caa10b04e8626127cdccaf13e6e11ec1c851db", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780920379, "uuid": "440e22dd-122d-4dde-a8ea-3fb82ebabb52", "comment": "Malware payload (Phorpiex)", "value": "dc7641024a1fb32361c70001c5e441c5afb0368e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780920379, "uuid": "3a6fe8dc-c0ad-442a-85d8-19f8e1fbc9a8", "comment": "Malware payload (Phorpiex)", "value": "e7c95b0e4c07efea92794239536719c73930c547c7ee0b8fc73f79576f6337bae7bf94746d2f9fb230dd9c017fb3fb0a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780920379, "uuid": "180b972d-de34-47c6-aea0-14701207c37a", "value": "T18C321B2A7E450332D3A049F85479438F653C5633E783A3EFF773965E4A9A2458840EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780920379, "uuid": "d1fb9acd-ea3e-41a0-9b80-6ee6d6d7b167", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780920379, "uuid": "0430a817-5605-48a1-9e18-20f9a9fed115", "value": "192:s3ouWyyTBa9x+emleasOPFJxTEZmFhSacV:s3oQyQ9wNcasOPFwZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780920379, "uuid": "eecec28f-7779-464c-9fa5-48d7810c4ccb", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780920379, "uuid": "1d3b8db6-46f3-4eda-9f9a-b61be7e8f526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780920379, "uuid": "e41fe275-a88d-4133-82f7-dad6251b0ed7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4724db0b-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780908275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908275, "uuid": "f9676709-9595-473b-a2e2-149e41edd09f", "comment": "Malware payload (PhantomStealer)", "value": "986237dc499466ddcd2af846c0f7e5f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908275, "uuid": "64b4f9dc-d654-4c96-9093-9f240e0d829f", "comment": "Malware payload (PhantomStealer)", "value": "91953ec60dacc96b02dd7e426bd5cdb4dc59b99ac540f8e8104e1783e8390817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908275, "uuid": "a008ad52-6dd3-4ff3-ae50-9f8f370e4308", "comment": "Malware payload (PhantomStealer)", "value": "aca8be0d6dc4e965b1374522af9d84f22bc006b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908275, "uuid": "09c809f8-fff7-4737-9875-6d5eef3bfa32", "comment": "Malware payload (PhantomStealer)", "value": "1b81c4c8e4c745fff530ce52595224ccb24a4b46156af623a5663bb8f577514182f99b3f537e886dfaeb052a86f04f93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908275, "uuid": "5765d8ad-6830-4527-bd62-a1de0a54a928", "value": "T1C96512042206DD1AC4934FB81EB1E6F425649EC8FD06D157DFEABEAFF87E6992401381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908275, "uuid": "432450b2-ec1b-4394-be5d-a311e03afe45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908275, "uuid": "9b28e4ad-f585-4f73-b831-b490c8b0df97", "value": "24576:100AEFT0DuWkFO4aGjXd0Kql6Ya8cagnzbhqJq2BbfvaLLG:L3FQwTa466L1PjlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908275, "uuid": "0cac0849-19c0-4c1f-b68c-18b9a081f23d", "value": 1542656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908275, "uuid": "7b93c955-d523-48b0-aa73-96780e28c173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908275, "uuid": "b1e88f87-0a4f-449e-8c4d-efedf8350bc6", "value": "91953ec60dacc96b02dd7e426bd5cdb4dc59b99ac540f8e8104e1783e8390817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68694d09-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780908331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908331, "uuid": "7637eb5a-93bc-41de-8eb4-27cfa3961fe2", "comment": "Malware payload (AsyncRAT)", "value": "e0d7fd34800282da526e36cca06c423e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908331, "uuid": "fff1fcf9-8de6-4ae8-a915-a67691a3e39e", "comment": "Malware payload (AsyncRAT)", "value": "91a77246cfceb74040adeb24061028a06b26c824acb8092a9b2e61a154eb4960", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908331, "uuid": "4a291526-902c-41ff-aad0-8279018e997b", "comment": "Malware payload (AsyncRAT)", "value": "9ae6d7f477e8931c90223d2ec46a2024d56b0bc9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908331, "uuid": "14660b2b-2697-45d1-9ddc-004cb29838bf", "comment": "Malware payload (AsyncRAT)", "value": "0295a359b9e381074e5449017f4d2421ce07dcce91486d16d3bdcb9d313b8ac7ea6f563d46484b185393335131840671", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908331, "uuid": "4cf8faa1-650b-4be5-923d-faab87bba0f6", "value": "T1D1F40168260ED907C4960FF41D71E6F826684EC8DC25D203DBE7BEAFF87E6456940386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908331, "uuid": "314ef040-8e8f-4858-aa91-7d44ac09e0a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908331, "uuid": "bfb164db-4fd2-4d51-801a-c62b28e74edc", "value": "12288:QgfAJRkVj8GirD1x1dt1J0SfY57AZIIJcyN0/GWMBb0ZCs1Dmiz7nao/Xi3ZtZgN:QwAEFT0DTZ1JXfy7AZgyN0/1q4VMs7nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908331, "uuid": "b32fdbf6-80b8-4aed-80b4-0d94652c77e4", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908331, "uuid": "b9477dbf-ac06-4028-856b-f2de441abb32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908331, "uuid": "744130ea-07f4-49b1-af51-14b672ff3410", "value": "91a77246cfceb74040adeb24061028a06b26c824acb8092a9b2e61a154eb4960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2e5363-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780912879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912879, "uuid": "e1dea90c-b801-4533-9448-27c698e97d70", "comment": "Malware payload (AsyncRAT)", "value": "dcf31e889ae6377e7c84d595f021fcba", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912879, "uuid": "ef0c2f3c-9c97-41a4-becc-2bb90aa1c1eb", "comment": "Malware payload (AsyncRAT)", "value": "91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912879, "uuid": "76255999-d797-479a-89d2-9748a77a21ac", "comment": "Malware payload (AsyncRAT)", "value": "25aaa582be634eb2a34095e604a522ca8059ef87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912879, "uuid": "0ca0e37f-2228-4ccd-a73a-18fb23df38a7", "comment": "Malware payload (AsyncRAT)", "value": "3e78a57ef07da7d5d3a925c1ef9af22720799cae6c5c04d14cae2f7fa36800ee142b15b1f31b95c0b07fd8fdaac5f6f1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912879, "uuid": "fa9c7e8e-e3eb-4826-aa82-a43fe8c64f57", "value": "T190F412689E59D443E8DA07781B61F2752339EECCE600C3571FE97EAF7CBAA015908342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912879, "uuid": "5a4c9ee3-d9fb-4ff5-a85f-f7e2c38bf76d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912879, "uuid": "cb7d5706-56cf-4447-94b7-57b8b7550247", "value": "12288:qjvbQqP7ZtEm0deRTTDmomzx/9dstgZIKBHfsQQwdmkYgdfgNh9AZdZA2Y0odqjI:qb7zEo976xrSgZhB/sLks/9AZTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912879, "uuid": "e44b96fd-41b4-48bd-84b0-912d896c79e4", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912879, "uuid": "34c39fdd-8b6a-47ac-b642-c8afd2d83c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912879, "uuid": "0a6c0c2c-f4d4-4a0c-ae7b-e32d14c8553b", "value": "91d57a66876b61cfb6a4cebf5aeb4dca024dbcaa70502e396348ed77c23b8684", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06378d7-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780904989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904989, "uuid": "27ae98b1-34cb-4842-99bf-a51de84a4149", "comment": "Malware payload (AgentTesla)", "value": "b2856a87e6436c54bb56f955eaafc1b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904989, "uuid": "b370c81c-a422-4cdc-8d2d-a3116d91fa8f", "comment": "Malware payload (AgentTesla)", "value": "920ab505745e5ca892fcbb46cae0996fc8f0d66059afd560d795800146a38a63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904989, "uuid": "2a712258-d71b-4948-b0b9-42d5c6e52285", "comment": "Malware payload (AgentTesla)", "value": "f2ae9afb60400ba75e193be5def0db324122cf8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904989, "uuid": "8f483b67-d026-4482-8106-d99aa2008095", "comment": "Malware payload (AgentTesla)", "value": "b0972804f092efb29c782ef7ca961d4ca2e176e227b5380e356f777d1baec591c08870148ff0e713fe96b5e33449020b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904989, "uuid": "e5b14bea-7046-4408-bc30-05beee785195", "value": "T17B251218369ADB01DCE6277919B1D23103F9BD8DA631D21B8EF8FDCB3464B166918393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904989, "uuid": "674a6342-6cf9-456b-bd77-04899e8c66c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904989, "uuid": "4c5b5a8c-5a39-4b6e-8abe-9b75129f95ce", "value": "24576:C8+glXQDtHS8pyBp42gD7DVSoSOyK+udE1JzlmlI15jVUB:CdUSH1yBpEfMo10KeJzZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904989, "uuid": "0990a804-7a77-4336-92fe-fcfe5a8654be", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904989, "uuid": "22d039b3-345c-433d-bc46-fa7a1f8cf753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904989, "uuid": "d6749498-a898-49f6-8512-4e80f6a89a7e", "value": "PO-071924677.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b256c1-6303-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780900131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900131, "uuid": "6de0528c-cd66-4f19-83c7-be066d067fa8", "comment": "Malware payload", "value": "e46b1d9ee3e7582b3652a9545ffdf70a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900131, "uuid": "e4e6a484-719e-46c9-97ff-97cfc2d7959c", "comment": "Malware payload", "value": "923cb8d84e0bf45def36878ff5d6b80144610a708df24946659e29af727b71c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900131, "uuid": "a8058b20-d85f-4f87-8ed5-7e35fb1da3bc", "comment": "Malware payload", "value": "1509d1178649ceffa6a154c9b33db7844b1d3c9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780900131, "uuid": "434e76e4-0349-4079-9838-35844759f59b", "comment": "Malware payload", "value": "0b1c025d3a580160061e94aad7310adc7725c42ee52c58087168ef32504e993e028ac68dbcd6577ed1f33830e1283e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900131, "uuid": "c54b4943-9197-4b0a-9e8a-6efcc14d6334", "value": "T17527CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900131, "uuid": "47f86a84-ca7a-4af0-a6e9-a585efc9705f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQd:cqYUQuVDt0TZEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780900131, "uuid": "a46512e3-4836-4f37-bfc9-edde96b56691", "value": 21102592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780900131, "uuid": "2e9d5c10-7a24-4aa0-a310-8399b2b72ffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780900131, "uuid": "13027592-1ded-466d-b892-6b2c1f71a4e4", "value": "923cb8d84e0bf45def36878ff5d6b80144610a708df24946659e29af727b71c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8941ad-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780910085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910085, "uuid": "b8457f09-b82a-405f-8185-1197d1baf1ef", "comment": "Malware payload (a310Logger)", "value": "979ba843fdd0cc303f2d5018b3eaaaf8", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910085, "uuid": "1ba89c57-0bba-475f-9f9a-1639b0b2e6ec", "comment": "Malware payload (a310Logger)", "value": "9288cf7cdd21059eeb0c6b51c80a75eae9aeb405c02ca1cd2335580bab8dc29d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910085, "uuid": "7eea408d-270c-4f9d-9b40-a6eac7342fef", "comment": "Malware payload (a310Logger)", "value": "2bbe2279709731679b81b1a92ea778f4fe1d835a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910085, "uuid": "38fade05-c581-4fba-a103-0623d5d8d142", "comment": "Malware payload (a310Logger)", "value": "4651d5ccd7d1b41bf6267304e7610d2c75381350e298023af279c45e1b31c9b0ba2566db3f66cc0cd36d30546d586818", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910085, "uuid": "d9b319ad-03ee-4e71-89db-7b6601d24327", "value": "T12755F1D43A2AE706DC920A34AA74DEF516B80DA8F401BAE39FDD3F5B74AD1605D0CB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910085, "uuid": "458c4981-a37f-4157-8970-2f989934b45a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910085, "uuid": "afcb9eac-a596-40c4-a85a-ac3d0c10b842", "value": "24576:dWaCzZ5S5aTkpsPRsAz4I4YADTvzOrhHKG9/2keFNBXLLqclPF6ogksCFaSX+:waCV5caT2sPpaYA3vz4x9+keFH7eCA9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910085, "uuid": "228efef0-91da-4acb-9b7c-40153597ef83", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910085, "uuid": "13635d0d-2750-4982-bb1b-51fc0114d9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910085, "uuid": "b677e4fd-ed4c-4e28-bba8-9d504a0d532b", "value": "9288cf7cdd21059eeb0c6b51c80a75eae9aeb405c02ca1cd2335580bab8dc29d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c7914d-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912860, "uuid": "3b556d2b-4ac9-40ac-8cfe-e18dc137a437", "comment": "Malware payload (a310Logger)", "value": "5895329f61091842265167dbdf4b142c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912860, "uuid": "37cb722d-16ea-46f2-b1a5-11fa2f33a7e4", "comment": "Malware payload (a310Logger)", "value": "929ce5419ce634d288da30a22563aec47b28ec03b55355bf86d1f506cd40d38b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912860, "uuid": "576f8a2f-8650-4388-beb3-09f6aee2699b", "comment": "Malware payload (a310Logger)", "value": "1634b74b70b5155268679c7bc2b5263268021fa4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912860, "uuid": "93650bf2-7e77-43c5-9622-bdf9b685ba05", "comment": "Malware payload (a310Logger)", "value": "451f9cc90b7b457a244874053df6417b0849dae7f0857e87909f72abfe438d1381daacc98a1c26c197450b5e53ba410e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912860, "uuid": "c549de77-2f33-47a0-a103-03217024e5bc", "value": "T1284523157A58CA12D8D927B44A60F2B12338AEDDF511D32B5FE5BCE73CBAB424848353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912860, "uuid": "774ba18f-7e64-497a-8dfd-ceb2dd6add86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912860, "uuid": "6cc4291f-66df-4799-b863-3194b0c77fd8", "value": "24576:R2tbTJ2PznFzEVeg7/qTWwPtefS9Nh4Zoj:ct2E7SNaS9NhQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912860, "uuid": "63208d73-6d2f-435b-a2a8-9eb159053e9c", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912860, "uuid": "857be692-a901-4578-b0dd-327775b7822c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912860, "uuid": "1f4fabb8-e80d-4469-8a47-6b69865b65d0", "value": "929ce5419ce634d288da30a22563aec47b28ec03b55355bf86d1f506cd40d38b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e790295-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1780911751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911751, "uuid": "cbab096b-7ad1-4ca1-aae2-d8d8d072d95b", "comment": "Malware payload (DarkVisionRAT)", "value": "d53d7a240d75f851a332f678b839a6b3", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911751, "uuid": "ce477c8c-0b97-4e6e-9ef0-d05078b98169", "comment": "Malware payload (DarkVisionRAT)", "value": "92a4270557ad29e087495c1ffc93bea0e03cc16943e8836ea708d4e428eae088", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911751, "uuid": "924062c5-b862-4e11-8911-23d09bcaaa9f", "comment": "Malware payload (DarkVisionRAT)", "value": "bc342853b1580a4af46c97145308d97bc2dffeb4", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911751, "uuid": "50e43120-2fb1-400e-a0aa-e5541e3416e5", "comment": "Malware payload (DarkVisionRAT)", "value": "e307a035b5e629c4d66ce549e899dbb12b8910b3100ddc8624d935422f3c4c635b7e48ba28393d90d8b1f131e5e8a24f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911751, "uuid": "574765a5-63e4-44a2-aeba-67fc35e0773c", "value": "T1A1A501D0BA05D886ED5313F1482AEA7011B95D9DA4E0A21D75EA7E277AF334320B7C4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911751, "uuid": "f9dde116-18b7-40e8-8df0-63c8ad18df3a", "value": "49152:v5AAlBiZDEc7h8mIn0Y8bu0B8S5vykp+M/R31iMzwd:/aZoconeS0Bp5vykrR33zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911751, "uuid": "70eba090-529c-445f-9a31-74d4c8a1af4a", "value": 2172928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911751, "uuid": "d40687e4-f6d1-4c2c-a0a6-cf5964ba9d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911751, "uuid": "cdc4b3ab-72d9-4998-a36e-e9dd82f6aab3", "value": "92a4270557ad29e087495c1ffc93bea0e03cc16943e8836ea708d4e428eae088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd5ff7f-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780910917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910917, "uuid": "de5e0359-8930-4d08-bab3-52705ca081da", "comment": "Malware payload (GuLoader)", "value": "9a5ef62a2495c56d93187644f4e22fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910917, "uuid": "5cb2be8d-42bc-43b3-a6d6-fbfb63d2f2e9", "comment": "Malware payload (GuLoader)", "value": "92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910917, "uuid": "2a093716-c91b-477f-ab83-ec2012b93995", "comment": "Malware payload (GuLoader)", "value": "2789785b618d651138b6f797b1f0b36f7abce850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910917, "uuid": "3f8a22a9-0057-4996-a91d-88f6e9ea7ed2", "comment": "Malware payload (GuLoader)", "value": "17dc9e53642c62e4ee848a66b70b9a8ac3fd5fc49fd74be0584ae440d4fe1186c0345dd47b92a1c4d6815029bbf172f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910917, "uuid": "894ca578-a15e-48f4-a1dd-7b371898bac3", "value": "T17F441210A714C157F1A357303C299DBE1FDEF8140064BD076795AE2EBE726C29A0FB69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910917, "uuid": "f67af4ff-4bb5-4279-97c6-f767d4785180", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910917, "uuid": "6417cc82-e492-43ab-b505-1040e6781dc1", "value": "3072:yWJ4TJIR1Djt+ul45dkDaJOdo7Xq2/Vg7wIRESO90DxfoduYniDVPwSTSeMgN1r7:ymGIhxAkDYOdoXmMWmO72AkgN1xF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910917, "uuid": "ce1ebcd1-c6b4-4730-a33e-36da32f15d86", "value": 256390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910917, "uuid": "09ee32cc-1323-4757-8504-d231aa4c6a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910917, "uuid": "adc6583b-b221-410b-9d37-c519d39a4ef0", "value": "92b4d4fcf62df03ff908adc43c39189ccd71ba78c7e61916985a80815d4ec18b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d0d2f8-631b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910449, "uuid": "18c0c848-99aa-4ea0-bd3b-01eadbf2af98", "comment": "Malware payload", "value": "b0d9bae056aef66f87220933b55aaf46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910449, "uuid": "54edc0a6-cc2c-417d-a9ec-a36e04f6d1c6", "comment": "Malware payload", "value": "92f7726e96f12e7aa56928e3ee54aebb3f400cce1b44ecdb4901c81c19cc31db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910449, "uuid": "3909de53-d0db-4d92-bb2e-a21674ff4b80", "comment": "Malware payload", "value": "9aeae9686c77cef8939a06dfad7717ae6fab32c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910449, "uuid": "a5637dba-e337-4462-8b94-a74bd19963c5", "comment": "Malware payload", "value": "a2652989ff7de1da7401bbdae4f47de33e4fcbc9b5f35d37715878520ee62e4cd26c8bfa2ab80f2df31ea3ddebdb8f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910449, "uuid": "a696dc9f-f263-410a-a36b-0dfc80d4cf8b", "value": "T19E85CF0573A442EDFEABE1768A13C507C7B17C450637861F06A4BA766F33B716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910449, "uuid": "fe59328f-0c30-46bf-a36e-dc4862a87099", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910449, "uuid": "5fd924b8-8091-40f8-a475-5af6fb065882", "value": "24576:aCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNr8KAas1cNUtwLID0Lpu8XcWJ8Y9ivd1:p1H4jR2TYrQbDTr8SO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910449, "uuid": "b61bb90f-86e0-41e4-ad7f-1c7741caa177", "value": 1852928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910449, "uuid": "ab57cc74-49d6-496a-bdb8-8017c347846f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910449, "uuid": "02e035be-908e-4a6b-9afe-2160223be56d", "value": "92f7726e96f12e7aa56928e3ee54aebb3f400cce1b44ecdb4901c81c19cc31db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570baa39-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907443, "uuid": "2a255605-d0de-43f3-94eb-2caabcef35f7", "comment": "Malware payload (Formbook)", "value": "fbf7051228538068df84afabffa2477a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907443, "uuid": "a04b65c3-914b-44e4-b132-944c4fe706bb", "comment": "Malware payload (Formbook)", "value": "934e735fd8e32296eb2127b7087df1fbf3116af52c3a9efd23d620845e07da57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907443, "uuid": "1a33a920-4029-457c-bf9d-770b69e2b7a1", "comment": "Malware payload (Formbook)", "value": "6ef7911581ad35436e7a58c5293b81e06c1fe91c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907443, "uuid": "884a9330-5ae8-4e53-9369-c5cea08534da", "comment": "Malware payload (Formbook)", "value": "1a9bbac3e168cce438aac351329fc48fc890a30c065ca73a0cf6d33056a1dec53ab1e144a425132a03cf48ddabd52ff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907443, "uuid": "e918512f-bfd1-4897-bfe4-da0474c437e7", "value": "T1E8251254A30EC816C4964EB15D72D1F42BA86E9CED32C2079FE93FFFB8766645802381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907443, "uuid": "ac11e67e-07f3-4a9a-88aa-b3d0ccdc68f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907443, "uuid": "af57b33a-fffd-45a1-906f-06b366ee05eb", "value": "24576:gthwZtHY1gK3DL2tkYvjy0OmTmc6aIykpDHG07czUSgaAc5c/:gbwo1tDClvjy0xmc6aIykpF7Kfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907443, "uuid": "16896ad4-2238-4f83-93ad-774b153e3936", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907443, "uuid": "50bb301a-0b20-422d-991e-e6fb3ba81ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907443, "uuid": "f21f87a8-1f56-4689-94fe-37f165357740", "value": "934e735fd8e32296eb2127b7087df1fbf3116af52c3a9efd23d620845e07da57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e861e268-6320-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912841, "uuid": "2ea6dd3f-7ddd-4c9a-b676-45589c485784", "comment": "Malware payload", "value": "d8343941d90b1c0e58afa0a2bd733388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912841, "uuid": "2804cc6e-6d03-4d9f-84c3-17501605a6bc", "comment": "Malware payload", "value": "93ca24a608dce22755557a5c7f14ce3dc525e0e42b6a74eec69264afeadf174b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912841, "uuid": "4ddd8f4e-dec9-4a9a-b8b4-e180f4476fbb", "comment": "Malware payload", "value": "f728880dd5a6b0218c5290073b964e058516fde4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912841, "uuid": "2d408a33-523a-49b8-ab3c-148b104722d8", "comment": "Malware payload", "value": "af18c12796ae61efd789f4f2985f11a9b37938f18fc46d0977908fc921d93b0137c6b2c47e89446b99dcd51311753b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912841, "uuid": "2bb230f0-16ed-40be-8262-d2213be887f3", "value": "T1C2A42E10B8FB501DF867ABB16FE8E8768A27FD74192970AD20C43B176773D828D12536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912841, "uuid": "27add9b9-6fa8-4c32-a713-e8913d4f9d76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912841, "uuid": "929814b0-4535-4a80-a771-bf1a49e07f1e", "value": "12288:qzKcYKmeSsYPS1UIG1O49014lDmKEbI/NLP7r9r/+ppppppppppppppppppppppJ:XzN1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912841, "uuid": "f723e50e-3b5f-411a-a42c-5faf5ade7cff", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912841, "uuid": "f2dbc2fe-1faf-4c64-88aa-ff68cb56e39e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912841, "uuid": "2e248ce1-57b2-4726-bd8d-007aef068654", "value": "93ca24a608dce22755557a5c7f14ce3dc525e0e42b6a74eec69264afeadf174b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53963d76-6342-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780927194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927194, "uuid": "b8967e76-5b73-42c9-b974-a6027184af60", "comment": "Malware payload (Mirai)", "value": "6341fa9f534df1040ab3283ddc86f757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927194, "uuid": "31ef96d1-d756-4d38-9ee3-5c30d6a4cd4a", "comment": "Malware payload (Mirai)", "value": "940fca0d2a7a0e28f5dc4d6963612d032f456af4ab76ad6349156d7556ce334b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927194, "uuid": "e578e206-affb-4fbd-905c-cf69ea2b1037", "comment": "Malware payload (Mirai)", "value": "c693924f14810463285bf2480a60ab42f9e500b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927194, "uuid": "873bb0b5-4e18-4720-be10-8deae97db439", "comment": "Malware payload (Mirai)", "value": "d09376c69573bdc2bf689256e5c7d01857a380340c497a1dbe748573a7d834cedda5ca1f9f361fabe2d5d505c0bbbaa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780927194, "uuid": "97a3f340-5171-4755-9d0a-6203476fc29b", "value": "T125163A42B6046FA9C924493389B78ED117727E556F325347AB48FABF6CB23024F11E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780927194, "uuid": "edb90ce4-05c9-4b7b-a6a6-4420b1f4abef", "value": "49152:Pi8Yzbp7jlFSp8KYRqNyEHV9BszV6tfWfOzdoaS+cmB1:K8Yzbp7jnSmKYRqNyEHV8zV6IOzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780927194, "uuid": "3cd899c6-f575-4d34-93c8-59fb93fdba7e", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780927194, "uuid": "aa105b7f-4dfe-4c43-a982-4a8a76f6522b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780927194, "uuid": "a32622e4-ec8f-47a3-88c0-cfea4f374b11", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b89a07-6376-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780949721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780949721, "uuid": "a6f2df0f-613e-489e-93b2-36505ed6d8d4", "comment": "Malware payload (Mirai)", "value": "abcf4edbc53f34692b0ecfec467d7547", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780949721, "uuid": "988b6cc7-7d4e-4a4b-90f6-0be10b577e47", "comment": "Malware payload (Mirai)", "value": "941751acbd26828024ee7ecba36e2567255c2483c2072d93d51983c002e68527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780949721, "uuid": "94e92e28-cdbe-4b60-80ba-82b502ef32e6", "comment": "Malware payload (Mirai)", "value": "941c0094e8a3ec98d637136e4e00f248685440b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780949721, "uuid": "68606c5f-e247-414e-a571-36ecb0cee2c0", "comment": "Malware payload (Mirai)", "value": "f57713a1e39f34fc8dea1f4840a90f99fff6b4466c377b42f48ee3a1e6d092fcc4f6c98f4f18830e19587c3e871fa329", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780949721, "uuid": "5e0f07d2-0c1a-4d7f-91c8-2dc36bd05b3b", "value": "T16BB35A25FD75582BC5D0713B11E34630F1B7439929BC9A1A7EA31D8CEF18710327BAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780949721, "uuid": "21b0194d-6d98-45b7-8d59-21dd0ffb52dd", "value": "1536:hT5kKiLKyRmogby241AXJ3+NlhoSFIfGZ77O3NW55Osw91WtxWJg:Z5kxmobVofr3NwXWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780949721, "uuid": "33265095-b7c5-45e8-be2d-a10c207ea140", "value": 110192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780949721, "uuid": "ffbe2046-d1e6-4dad-b9b1-df06709a1093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780949721, "uuid": "04a05437-6d49-433c-898d-69185858be67", "value": "jklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0476194-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907995, "uuid": "efcf11c4-826b-4654-a0ce-a2ed94cebc48", "comment": "Malware payload (RemcosRAT)", "value": "2c95d3b744582718bf3aa70027f0e474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907995, "uuid": "f4e46673-e5e0-490f-9946-dc7eb2ec51bd", "comment": "Malware payload (RemcosRAT)", "value": "9518759689491de178398c9ddf5238f8442c6f63b08b468f938c4e6d013738af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907995, "uuid": "585a0a41-27c7-46da-b1b5-0ccde18d9e0f", "comment": "Malware payload (RemcosRAT)", "value": "84cdcfc5d542ffda19f07e4e7c0ff9ed115642ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907995, "uuid": "396e4ddb-ca14-4c56-9fb6-b5c46bd4a385", "comment": "Malware payload (RemcosRAT)", "value": "f2c003de9d18d205b7250d064476279dc79b5f40e53dad76cfbc58a5990c0dc08e079c961ced216660d55dda830ff1bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907995, "uuid": "63b041f4-b840-4faa-9e76-57fbce6dc921", "value": "T1BE551204631BDD42E4B783B814B0E7701BB56D89A874E2175EEABFEB3832751541A3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907995, "uuid": "018d15c6-7fd5-4f79-9148-0be6bafd3da0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907995, "uuid": "7c44a749-2af4-4f5e-a50a-cfed443f804b", "value": "24576:kkH9Xu1O7ACunle5fu1OB9cPu23p0Iywl5vHUkZyR:kcU40bw5lOT3p0xwl5fRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907995, "uuid": "7b1d0008-6254-4372-914b-2796eb77e7c4", "value": 1393152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907995, "uuid": "eb111cc2-31c4-4ccf-be05-08c5b021bcd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907995, "uuid": "53dafe20-0e79-4b27-a1bf-e5dd0671f612", "value": "9518759689491de178398c9ddf5238f8442c6f63b08b468f938c4e6d013738af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04f43bf-6380-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780954086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780954086, "uuid": "febe494c-3d85-4953-ac4b-d72b81e0a597", "comment": "Malware payload (PureHVNC)", "value": "77f3dee3fd8b2daa71dcb3fabdfa33fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780954086, "uuid": "4d427bd6-ea1c-4413-9500-83cb9a895abe", "comment": "Malware payload (PureHVNC)", "value": "95a7f2d921eb4705c96e4db92c434ea00fd335f6a6a7752fb9fe66b89cfa6cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780954086, "uuid": "1b2ffc14-dc2a-4be2-aa01-01aa05f5ffdb", "comment": "Malware payload (PureHVNC)", "value": "3e8d5f94f9e2553f7309c03845d3e4a27344dcdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780954086, "uuid": "46d20645-df08-4a5f-9e32-4bc495d838c8", "comment": "Malware payload (PureHVNC)", "value": "22e117771d0a04ad7976c1df7575f2b87067ffa3ebaeca1b73d900c1e3c2a8d36982edcb05e9095f2210d418a57fdc81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780954086, "uuid": "0afe15e8-6c7b-4a57-9a2c-47cd97db43ad", "value": "T198C41247BBD00B12CB9511F8D1D36A304BF7A98B7AB3D349360423C98E457E4ED5AB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780954086, "uuid": "3f7aef78-97cf-4003-98d4-4952439046fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780954086, "uuid": "a4948909-7018-4935-b238-f06d6e43974c", "value": "12288:a6OvLD5GtUKxub7RAExq1Ur5imDUUwtu/u7JMH74yzSGUVjI:a6OvLAaguCw+UMu/jH0FG2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780954086, "uuid": "8037389c-d3a8-43b5-839f-7f04ffdc9c4f", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780954086, "uuid": "c766ad5d-7c97-43a2-af9c-ec8aa037e2a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780954086, "uuid": "76169549-33f7-4fb4-8762-a1aa92435ad0", "value": "SecuriteInfo.com.Trojan.Siggen32.43381.10044.32113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5c0314-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877201, "uuid": "b96fc32d-04cc-4028-a4f6-05647d9b1449", "comment": "Malware payload (Mirai)", "value": "a29e8d05b5c5313553b9f527b5c0e51f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877201, "uuid": "d98171c6-eefb-4b9d-9701-863955f6f280", "comment": "Malware payload (Mirai)", "value": "963f6980a931d02133ef243fb1c48694ddf2c1d5a3d2a7b5653b127174d318ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877201, "uuid": "ac8efbe1-01f2-4dab-93f3-042772cf3a1d", "comment": "Malware payload (Mirai)", "value": "b50fc5450256074c0e020fb2a53e6e4261301b8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877201, "uuid": "ddf38d64-e905-4164-b576-6ad1762c296b", "comment": "Malware payload (Mirai)", "value": "659d631ee69028a62e1247241910f75d6935928ba9bc16fdb004087caaa36fe086b52aa7cfe22f7ea5be4a0ff1a4d9c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877201, "uuid": "17f0a31c-afa2-4ac2-ac03-5a2d866151af", "value": "T14794B71799218AA8F1248CB213773241AD4783FB49E661D3EA6E8960BF3051F51BFFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877201, "uuid": "64029416-0f47-433a-a50a-49b202cf63b0", "value": "6144:D/odKarx8OXg3EaJK9yhHeaHtIiXSXxFjodhyQT:M4HeaNmFjUhy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877201, "uuid": "fb63b6be-9ed5-4c48-850d-81a4203239e4", "value": 427432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877201, "uuid": "93061187-b131-4386-9166-887386ceaf21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877201, "uuid": "2f96fbe2-a265-40fb-86e2-99b26209a054", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905036be-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780910116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910116, "uuid": "9c71e6d5-1244-4ce1-9b24-c5b5a6d0d56e", "comment": "Malware payload (Formbook)", "value": "93cf73f1ca77782992bc29132e99bacb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910116, "uuid": "abf8c700-f9ad-433c-a8ca-3a1be3e41f53", "comment": "Malware payload (Formbook)", "value": "965c9a62cf36fe6434b84be2f6a224eb2f7cfd62327b58864736461957fdfeda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910116, "uuid": "cec15989-a08f-47ec-9658-4c8c6643d633", "comment": "Malware payload (Formbook)", "value": "005fd1e83a6023d1c1eb197d00231f33a7b0d211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910116, "uuid": "95d4400a-a91d-4860-a13e-af13c5d187d1", "comment": "Malware payload (Formbook)", "value": "36f8f6032937dc02e6fbf39d03517948d4c1e82aa1bf8cd01b117fc6ca069d21869e76ef2fb20326b5dbe66f5adef6db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910116, "uuid": "34bc7b49-2d92-4869-8438-bf1ccfe86330", "value": "T14835E0D43A2AE71ACD520A30A935DEB15AF40DACF400BAE39BDD3F5BB4AD1505D0CB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910116, "uuid": "f3bbd937-eb15-49ea-9b55-d4b7e4860131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910116, "uuid": "11404ec7-ab13-406e-8a9d-65e78d5d32cf", "value": "12288:YfNbymaCJRSOQF6CRXy+2fLR+gC54s5r1FTNYkVg71yMUt40+2wZsi4fhEUL8EGD:YZaCzZ5CR6fLR+hr3jBo+bG3EtjhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910116, "uuid": "945ebf3f-0a6c-4f6d-8468-fea7fcd18962", "value": 1157120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910116, "uuid": "f6d29c0c-6206-46c8-b6b7-c0e017bf3414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910116, "uuid": "6debd627-5aaa-4267-bfe9-b71b10e9fb02", "value": "965c9a62cf36fe6434b84be2f6a224eb2f7cfd62327b58864736461957fdfeda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0559b423-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780907736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907736, "uuid": "03714315-3bbe-47ad-b16e-215480a7fcc9", "comment": "Malware payload (RemcosRAT)", "value": "28d7b8421cd6333073815b953f33a698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907736, "uuid": "fc498de6-c8a5-47e0-8326-5afdcffdc510", "comment": "Malware payload (RemcosRAT)", "value": "9754624d2d03454398fe85b78262db290fa8737cbebe6eab87c640b2e4c1c04e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907736, "uuid": "c77303a3-3844-4535-806d-849f2c41ef3f", "comment": "Malware payload (RemcosRAT)", "value": "1acec66870a1abd7db67492c48e07c5d0f05c0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907736, "uuid": "9e04b265-2faf-4613-a04d-ea22eac4a85a", "comment": "Malware payload (RemcosRAT)", "value": "7fa75a6ab97d3b11559587180034adb5a6ad8c32b66a0e35bce4205d183eb5d4e8742b7595c2131ec89691020edf7f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907736, "uuid": "301b4884-9840-4e1e-9528-932310a7e5d5", "value": "T184A49C2AD1A4DAB5C8136C73CCF86750883BDF375E3996927E96341B94BED2A4C3101B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907736, "uuid": "ddf67074-b3f2-40f6-aec8-a15fa6f8c3fd", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907736, "uuid": "23bff912-37da-4ba6-8580-380ae7ab9180", "value": "6144:J2zoP0O5dLyV+6lkzIZ3+R6EoHcMvll5sqht9S2/xd03YT60FhGOVT0zm:J2XSd+7lOIZ3K6nNjvP825dgYxeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907736, "uuid": "b6e25556-15a2-479a-a189-23e711bd74fb", "value": 454880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907736, "uuid": "ab4e9069-e631-41a3-aed0-6dbcf8df83e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907736, "uuid": "cd145756-778e-4b1e-ab50-ba3b8ea94e5b", "value": "9754624d2d03454398fe85b78262db290fa8737cbebe6eab87c640b2e4c1c04e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cc8a99-6301-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780899328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780899328, "uuid": "d848a706-8c91-4604-8b85-a7bf2a9e0c46", "comment": "Malware payload (WannaCry)", "value": "0433f205b2f4cd3880478bcc259564a9", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780899328, "uuid": "80c4ffd5-9270-4726-a694-b0b4d0100866", "comment": "Malware payload (WannaCry)", "value": "980373db2260f6c8e54ab0bda5aedd4df2ee7ddd92f5e4c3dc899b925a4b4db0", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780899328, "uuid": "776ea3ab-26fe-4170-a0b5-c117f2318d79", "comment": "Malware payload (WannaCry)", "value": "55eebf365f0ab5188243f18289b9c8c2ce7ee2d4", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780899328, "uuid": "b9c20523-ace7-4995-9535-1388c29c7e95", "comment": "Malware payload (WannaCry)", "value": "feac0043689a2ad4862104c24d074498adc569a83e29377f4257e040368f43edba911161c463a7ee888d75a991e7bfb4", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780899328, "uuid": "57ffe596-92d8-44c7-8a9c-aa1ef96d4ba7", "value": "T1F1363358226991BCF0410EB484B38D56B7B73C5777BB5B1FCB80426A0D53B8BABD0B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780899328, "uuid": "4f7e62d0-6374-4ca3-a23f-73b34ccc9b6b", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780899328, "uuid": "da866957-331a-4bcd-9f25-4b80b78df9ea", "value": "98304:DXDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DXDqPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780899328, "uuid": "f13e4822-711f-4ffc-a896-086da427e28d", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780899328, "uuid": "43e79f7a-bfb4-4a2b-be16-62ce52e767fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780899328, "uuid": "797506d3-61e6-44c5-8bd6-e4c07a826153", "value": "980373db2260f6c8e54ab0bda5aedd4df2ee7ddd92f5e4c3dc899b925a4b4db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c2af8a-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780908625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908625, "uuid": "59c65202-f7c6-4b0c-8355-60a49d6d75c1", "comment": "Malware payload (GuLoader)", "value": "b47978b3cc825d9597de564d9028b115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908625, "uuid": "68bf70d3-0e15-4031-a9ad-6e2457f02777", "comment": "Malware payload (GuLoader)", "value": "982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908625, "uuid": "571a2d2f-5fff-45cd-babe-0058485a353e", "comment": "Malware payload (GuLoader)", "value": "5d5d34a88b46baa8fcab0060355f21e8e0eac3c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908625, "uuid": "06daf623-63d4-40b2-9b44-0437fe5cd539", "comment": "Malware payload (GuLoader)", "value": "8720ddec8b2e7c962f170dee356f1bcd503cbb2976440b40646502b5c4a7142856665dacebac9ba46512c7133551d0dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908625, "uuid": "feac2c06-b0e6-49a1-880e-a991f969571a", "value": "T1A0E4235174F5C0E7EEB30F72BB665AEBA8AC674146256B4E2311AEAC7D311C14C2C48E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908625, "uuid": "c1caa6d5-f566-47c6-b864-73f740bca784", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908625, "uuid": "7cf0bd69-75b1-40b3-afed-0e3671f437f7", "value": "12288:pwfHI3pxTfXb2eNjHW9qcFSVBR7cui8bb4Jl5i4o8yya+c0ED:pwfHI3pxTvb2eHYlF0BB00Y5U5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908625, "uuid": "81f37a49-a878-4aee-bd00-d05b4a10edd4", "value": 662808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908625, "uuid": "45dbae3c-d706-4e52-b6e9-e13ec58ffcc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908625, "uuid": "ca22c5dd-19ff-4c53-a965-661813199bfc", "value": "982ba92eff55877f6eda5e5a4f4e730a001f84ed736200e8ddea822cfb660b04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8134547-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911069, "uuid": "34687f2d-1992-4473-87e8-01cd830caf0c", "comment": "Malware payload (RemcosRAT)", "value": "747265226f54d131fd25bcc6b9ed3a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911069, "uuid": "181c41b3-9a5d-4745-ad39-ebd95d79b23c", "comment": "Malware payload (RemcosRAT)", "value": "98cce079164a5c1664f26841559b1d8019d146bfd6e9edc86d19c328f3ed5444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911069, "uuid": "0fc0501b-05d4-49fd-acf1-ee2102b3f17c", "comment": "Malware payload (RemcosRAT)", "value": "dea12f11cb1d1d32782ffd93afcff926566abb39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911069, "uuid": "f70bac40-dbcd-4a96-ad82-1195d9f99adf", "comment": "Malware payload (RemcosRAT)", "value": "3fb19c36620b955719dabae5f5de098074a56b4569f5fc02e718c139e217eaa434ad6647179c0042fd1bfb1eea0dafc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911069, "uuid": "adf1661b-b099-488e-9a9e-adfb5390c4a7", "value": "T1D2152259B375872FE426C371C87A4A60CB38ADA8B44D970FA34971653CA32DB49243FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911069, "uuid": "ddd8fab4-b2f5-4642-93ee-197e3c725388", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911069, "uuid": "41b862e3-c5a0-4b39-8a0c-c1604870199f", "value": "24576:zA7FkChDsGQ9tm2plMeBEFmNZpJGSqQc3DKtbPik+Y:z3ClsfY2prDHVSKtTik+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911069, "uuid": "4dc65542-779a-49b5-91ac-ae58490fb129", "value": 910648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911069, "uuid": "5b3868f8-10e2-4312-be9b-a4446389b6ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911069, "uuid": "a7d789ee-11f8-4313-b5df-beb74d86aa2d", "value": "98cce079164a5c1664f26841559b1d8019d146bfd6e9edc86d19c328f3ed5444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe466498-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780910301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910301, "uuid": "db2ac4e0-a524-42c0-854d-00e709dca769", "comment": "Malware payload (AgentTesla)", "value": "3ceb5d456198e5712772a135c3761662", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910301, "uuid": "5fc4274b-0702-4c46-b432-13bd10590875", "comment": "Malware payload (AgentTesla)", "value": "99827faa913d948edcdcca352ee754c696728c70d0b6bdb100a7fd8afee2b8c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910301, "uuid": "8b2ad63c-f7a8-4d16-8d18-25517a46817a", "comment": "Malware payload (AgentTesla)", "value": "cef1dd5e2334b7072cfb53e63d14bdc6d50d20b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910301, "uuid": "2bd29014-eac7-4f72-a687-e258500086e3", "comment": "Malware payload (AgentTesla)", "value": "a9130646f6b90d0808087375a35bb35ec329d91b04e8a13efc698d211b6635d919784a636f4fddd711c56fc4913df468", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910301, "uuid": "f6caf6cd-54dc-4fb4-9df8-0f0bfd682264", "value": "T128251259665ADB07C0A98BF02C31D07817742EAEA965C7038FC9BCDFB9B7B600812757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910301, "uuid": "9bf47a7e-21ef-4875-bf11-47f3cb49bdfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910301, "uuid": "8013e79f-4449-49e9-885f-d2f98d507d87", "value": "24576:mfLrnNrwXykOs21T3FvVYsgPcWQefhW56ddMwSKoDGDzZAGp:m9mROs21TJuVQefG4dM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910301, "uuid": "4e7f0709-623b-4464-be71-51534dc3fd22", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910301, "uuid": "4738bb43-9b5f-4778-b4d7-37d0c972f154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910301, "uuid": "6da48297-a1bb-4621-b553-40324ab9066e", "value": "99827faa913d948edcdcca352ee754c696728c70d0b6bdb100a7fd8afee2b8c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb611a06-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912873, "uuid": "a0305273-f079-43c1-9972-19b6b94fb339", "comment": "Malware payload (AgentTesla)", "value": "b6fb5eee0f5ecd68a076565b34823c24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912873, "uuid": "21eea920-4cc6-4486-acbb-52a395b0e0d4", "comment": "Malware payload (AgentTesla)", "value": "998785bfedfcd193cabbeb0ec4db8f48f6b6c11aafe86d60515f35b2159114d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912873, "uuid": "f0392c6a-0019-41f1-8869-149c77a7ebb8", "comment": "Malware payload (AgentTesla)", "value": "f749cbb5bc2c8e9ec3e08964edf5893565035627", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912873, "uuid": "950208b4-a331-425d-afbf-ac36249e764c", "comment": "Malware payload (AgentTesla)", "value": "0800beeb2634d4c36fbed0271551d78f697355aed8ae8caa8f4cc62c3bf74121617abb97b0aebef631f48d38588d99af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912873, "uuid": "fbddb5d4-f9af-4df5-8d18-0b3180e94da8", "value": "T18A1512549EAAE942C0D617B41E61F27653B99ECDEA02C2178FE87DFF7939B14081D302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912873, "uuid": "e6b0c761-0f0f-4898-a283-a4bd9f1738ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912873, "uuid": "2679daf9-3436-4e68-a3ad-e9d3061c1b97", "value": "24576:6oeSojKYOF9ues8RXAjxRPJNo2s8iCn98uQxzJyWBeB:sSfTS8FAnPJqCn9FQxzJpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912873, "uuid": "3322b89c-5ab9-4937-bbd1-e32b30efd654", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912873, "uuid": "bac78193-f6fd-44ec-b68b-849ec5fbaeda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912873, "uuid": "4badfe96-d9f2-413f-99d0-8aa8776c5716", "value": "998785bfedfcd193cabbeb0ec4db8f48f6b6c11aafe86d60515f35b2159114d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b1ae64-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912056, "uuid": "ddef01a8-fac5-4a07-92c7-0b2bff58ab07", "comment": "Malware payload (a310Logger)", "value": "1d65744bfe4abfb9d9aae5bf4e82f16a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912056, "uuid": "ef7270d7-c95e-48a7-b7aa-b8d4783cad4d", "comment": "Malware payload (a310Logger)", "value": "998a493ec76fac8aac5f00cf93f9624ed9ab2595e837239e2be75113cc8931e6", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912056, "uuid": "bfda5b64-2351-4200-a924-2c183c64c0b0", "comment": "Malware payload (a310Logger)", "value": "696990d17fe155fc6cc5a56b334495c34e6da6d4", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912056, "uuid": "8c7d917f-6c21-4565-872b-2d60aa091875", "comment": "Malware payload (a310Logger)", "value": "d885cc2d05bd7420f13edfb5caf6e175b4b851ee03d98bb495b4c9d082120e41932a595108a657a2f3b9ec0453111dc5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912056, "uuid": "2962c746-2b3c-427a-b0a7-4f24ead0e3b2", "value": "T170944A13EB60611EF1A389B0B9B9925A68267D351B98EC4BF3409F1A35715D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912056, "uuid": "9aa736c1-6cfc-4b66-a51d-e493598b203b", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912056, "uuid": "29bf3dde-f2ee-46e3-a7d7-cb439354fd5f", "value": "6144:d8d1/w5KA81IJ8GpF6nuTmOOUiBUrjsX6JvtigFtIGsKiG2VyZbhnAyFo90rP:mjYKkJj6GmZUiqrtRni89AyFoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912056, "uuid": "4effe279-6242-4654-a0a2-14f99b3f57d2", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912056, "uuid": "053d5ccc-f7cc-4150-830a-b4019a1ca047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912056, "uuid": "59e42ce4-a50e-444f-951d-4368ae978c90", "value": "998a493ec76fac8aac5f00cf93f9624ed9ab2595e837239e2be75113cc8931e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac96fee4-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907587, "uuid": "849ba463-a0cc-4105-97f3-2279d097f499", "comment": "Malware payload", "value": "497c20258f73187f7a53e3c5913dae31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907587, "uuid": "507a75c7-62fa-4b8c-9fdc-d00af61b3776", "comment": "Malware payload", "value": "9a46878ff7f921ccbeb3817d6cc1b2ccc8dc40fdfc5b0ac0f4aaf32f8780771e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907587, "uuid": "b3e69f33-0873-40c7-9bfe-1f472c498c83", "comment": "Malware payload", "value": "7074ba1cdfd3a5d3c57ec1a3201a5c0febafcc43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907587, "uuid": "389e371a-66b2-4245-a51c-43257f4b1913", "comment": "Malware payload", "value": "03171a85fa8d3c19cc949087ef739543a8f7fa9b20fdabb219c15a064899677a1cfe2a27d4ccc73ebc4caf2de32bc752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907587, "uuid": "4e89fbe5-f6d5-46bc-8f41-ae8396333f34", "value": "T1CD55CF16A7E412B4D63BD238CBA64733EAB678450770ADCF1358D6191F33AD06B3A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907587, "uuid": "9ef6b52e-3425-4789-a164-b30f74f95562", "value": "18faa8710de0db6f06416bef9ee32be6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907587, "uuid": "2aa9de6c-8fb7-440a-8868-860a82031cc3", "value": "24576:kZeUMhLoTJmNxvVN2acszKusntBIvr0IlNorY7xjTmfqZ6OhOF9fC29PRyeoZ34W:+eUMhs1mnnzKusntQ0+NkIDErFVCyRyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907587, "uuid": "78067e0b-ed8c-4e10-8f38-d843f1a90df5", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907587, "uuid": "7007da96-d706-4060-b420-6e33fe0428f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907587, "uuid": "4fde8400-5b72-476e-af8c-4c63f059b2c2", "value": "9a46878ff7f921ccbeb3817d6cc1b2ccc8dc40fdfc5b0ac0f4aaf32f8780771e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c047cb38-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780910197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910197, "uuid": "30a64a81-d516-49fa-a3b9-4fa770006e36", "comment": "Malware payload (AsyncRAT)", "value": "8175725d61d0c629223f642fd5384d8a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910197, "uuid": "978c2e63-06ef-4839-8ff2-2d70d7319226", "comment": "Malware payload (AsyncRAT)", "value": "9a84871cc46be89ec120268a71d7471ebd6daabc141dd392415febca15b8200a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910197, "uuid": "7f77dbd3-73f4-4fc9-842d-c90fa7f27568", "comment": "Malware payload (AsyncRAT)", "value": "1ad6e749bb85df7201dfd2188c8c63b6b2ccaff2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910197, "uuid": "96f2f95b-873c-4040-b74f-b3d13cfe62e0", "comment": "Malware payload (AsyncRAT)", "value": "413823470ab4112d00b1e624d6269fddcf9bd99c56aeb864dbc0a42fdf9cc8885665a459c3a2ecf223e595e4ee7b8d2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910197, "uuid": "c3d9c149-a7e5-4cc0-8cd0-ba43b94b2c73", "value": "T12515DFD83A2AEB0ACD524A349A34DEB506B40DACF505BAE39FDC7F5B70AD1506D0CB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910197, "uuid": "6a22b466-3fcf-4b9c-b2f7-44765ec8248e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910197, "uuid": "5f4f89d6-4e59-46cb-be57-6828cbda3736", "value": "24576:eIaxVYebGmtga/CuyGbSvlV4epNDJhzZ5:FaxV/bruagGbA4epNDnV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910197, "uuid": "de274613-932b-44cc-9375-3ae64c63aff9", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910197, "uuid": "e2197984-0206-4eb9-b3a9-57349a391a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910197, "uuid": "33eced47-22e7-4b46-b969-3349f6f8a866", "value": "9a84871cc46be89ec120268a71d7471ebd6daabc141dd392415febca15b8200a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624414f3-631b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910468, "uuid": "d246f908-e0b7-4e83-bc4a-1411f4632deb", "comment": "Malware payload", "value": "547f7e76545d296379652c143ad9d659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910468, "uuid": "59e3f091-1e19-49c3-a29a-b3e4023a4eb0", "comment": "Malware payload", "value": "9afd4ad6bd4dbcc0554b32c82abe5cc0ca8fc08d1c41f9c2a8a5c039ea2a63e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910468, "uuid": "46543bda-e7d7-4b5a-b4be-39a177c6e9f1", "comment": "Malware payload", "value": "873eefd62c493e95ea4bbe92e578c951aff95c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910468, "uuid": "fb574c16-a203-4399-b085-2e3bcc07e91d", "comment": "Malware payload", "value": "5bf82623c8cf4955e4ea76c685beb17ce2e86fd66176c2e2e8297411c92cb7cc29ab9123006cede91b1e041e9a71ce90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910468, "uuid": "3be9c95e-ed5b-474a-8fe0-27b96cf3ad75", "value": "T1FA258C1923E81A44F2BF5FB4AD7901204BF2FA6AAA35C65D7C6500DD0D22FC09B96773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910468, "uuid": "a39bbe86-4744-4061-9ecb-7f6a4a110410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910468, "uuid": "82138ead-5e63-4f14-8d18-4ce51f746127", "value": "24576:PsyhDBioJ/Itii3iqQdZunAvppFH2xjOJf:EG9+/3iTZunAvpCxyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910468, "uuid": "3ca4ced9-cae1-4f25-a25c-54e45092cc29", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910468, "uuid": "31b0003c-db75-4ff7-97f5-7864f6f80b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910468, "uuid": "8ca9d767-184a-40aa-92a8-65594004342a", "value": "9afd4ad6bd4dbcc0554b32c82abe5cc0ca8fc08d1c41f9c2a8a5c039ea2a63e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f2abf1-636b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780944999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780944999, "uuid": "6bbecbd1-3dab-4941-84e3-0024221fde8d", "comment": "Malware payload", "value": "85d18eab7d5751d663e9136fecb5623e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780944999, "uuid": "41e3c3e7-049b-4ca8-824f-5d73c7b7603b", "comment": "Malware payload", "value": "9b014b91cbab69a28309ae6701c2a996693ae758dc653ccf9134921cbf1f3777", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780944999, "uuid": "9a3f331e-4ef1-457c-9da6-41784aa2ce99", "comment": "Malware payload", "value": "ac9006812f23a08322fce12f356fff1025263531", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780944999, "uuid": "cf1ea306-7647-46ee-99d9-3f90585616fa", "comment": "Malware payload", "value": "9cca2c510426ffdf6b80248b84b660b0a8efeaace888aa6ad32f33624fdbc68f518261de7c0219ef570bf5f3b1cab7c3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780944999, "uuid": "ca20bbc8-0d1e-4484-9a2f-66bfb241f453", "value": "T1AB3146043AFA0728F2F39E7894BE1611883AB916CD718F0C0164524C0078A22EB7AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780944999, "uuid": "771dfb6b-8c7d-4a36-905c-97f59104d91b", "value": "24:8lLJ/Bqk+fdNubiNZApSJIC2ngRwNFnzDuKSgpugni9iC2zFVrab0R:8NxohTiyIrgRAzSg5iMzFRaQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780944999, "uuid": "6f8ac8d0-2f70-45b0-9645-652fc6c03a93", "value": 1664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780944999, "uuid": "ff16d96c-2c70-446d-a9a4-c8c1ef7dcdc7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780944999, "uuid": "1ea158b4-2dad-4209-98eb-adde72e3f88e", "value": "List of Required Items.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693ab330-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780911769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911769, "uuid": "446cd3bf-41e9-47df-a839-05f720f59b4c", "comment": "Malware payload (AgentTesla)", "value": "ad7e6946c356d0159915cc0140972852", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911769, "uuid": "112d2583-53c4-48af-8cc4-e405fd1eda70", "comment": "Malware payload (AgentTesla)", "value": "9b12abfc873d429bf2c5f3c4c25d01fa93c21b0944415bf580ccc358408d3009", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911769, "uuid": "240e687e-3236-42c2-8d51-696d2535fed1", "comment": "Malware payload (AgentTesla)", "value": "d921a6e7358dd77c5ac7950d48213d834b2cef53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911769, "uuid": "93ae1f22-e975-4e4d-89ad-8048f664f4de", "comment": "Malware payload (AgentTesla)", "value": "f5f67055025df2ad8deec69fbe99fc81eb7bdd410a087c6326611a6d6b48e93bd56dead489b56a9ad2609b8db2b76a48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911769, "uuid": "1039cd93-6ddd-41c8-a753-5242bf3081ac", "value": "T11C435D27C787B9D3D4D472F01892C6C21EA6BC0F0B2B55566248B9DBBB33208D697B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911769, "uuid": "e6702fd5-8a06-424f-9017-ca72fd1fb877", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911769, "uuid": "6250166c-6b66-46cb-9143-7ea36668d01d", "value": "1536:TdbyMyQNVuDQuA+m0sr8XstNJXrMqbni:TdbyEuDQuA268wTXXni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911769, "uuid": "0aeeee7e-ef81-45cb-a4fc-8a037c394011", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911769, "uuid": "ce748a7e-0f5c-4a32-963f-147cb772f5a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911769, "uuid": "f2e52131-36f0-4594-bbf1-c1d2a500dd70", "value": "9b12abfc873d429bf2c5f3c4c25d01fa93c21b0944415bf580ccc358408d3009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a7de34-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780910424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910424, "uuid": "cccb2bcb-68e1-447c-b150-ad1cea82096f", "comment": "Malware payload (GuLoader)", "value": "abafa3e9b77ac35e0d47a6aa1e76ab85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910424, "uuid": "c0ab8fff-d65e-4b7b-a296-0ea001b6ac53", "comment": "Malware payload (GuLoader)", "value": "9b458b55111c99b766aa1d91a7bc3ba2e4010a939608d76d896642c935312892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910424, "uuid": "7caedc10-b851-4780-8e92-3c42e2ba5f43", "comment": "Malware payload (GuLoader)", "value": "e15e243a5284a39c48e08ef60692e43799c16c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910424, "uuid": "b62ff79e-2423-45fc-96d6-3ce7bb5a41aa", "comment": "Malware payload (GuLoader)", "value": "28a6d01bbd9c1e132187a938e5e01491315069991a5d96c39440a71dce1ff6330a3dc3ca64a5cbc27c6a5bf815c4cd52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910424, "uuid": "decca0a0-02b7-426c-91a5-2ce300f320a3", "value": "T1F60512C2BA346996D660CE3161BE593D4F3AEF76A548250B31807F0B28F759F610BE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910424, "uuid": "036449a2-d0a2-4100-8693-19513ca15cae", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910424, "uuid": "b300a69b-19ba-4d8d-91b8-3be85e770564", "value": "24576:2budKX7/oKS3FCmC5uENNSMtzbw7uNQ5yprVu:oudKr/o13FxkTJ5w7Qprs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910424, "uuid": "d2008372-60cb-4131-abad-c9beb03db50e", "value": 809152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910424, "uuid": "6bfec873-2f79-4804-a620-0c341290c022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910424, "uuid": "f7f8de45-5c2c-4baa-8c9e-e1c5b71ff589", "value": "9b458b55111c99b766aa1d91a7bc3ba2e4010a939608d76d896642c935312892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df460c20-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912396, "uuid": "f58e9da3-5940-4c8f-b08c-63ba59469833", "comment": "Malware payload (GuLoader)", "value": "13a2676c3701494b4b4aaf31ee4eec96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912396, "uuid": "93d49a23-e6ed-4feb-8d73-e22f1047bf8b", "comment": "Malware payload (GuLoader)", "value": "9b45aaccc113770707f6e310f7fdd231c3a646345fbf29f98795c56da503b1d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912396, "uuid": "7b544a7a-d4af-47eb-bfbd-84ed90781703", "comment": "Malware payload (GuLoader)", "value": "444f60702b5e2f64548335179bc25fa826717117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912396, "uuid": "89741b50-58c3-4556-bb93-774d1dd36d96", "comment": "Malware payload (GuLoader)", "value": "eb35ef039ef1210d9c54764a3d71d25a1f834692c53df315d7c81ee4af4e781b23b6a78477f0e99eaeea692d490128ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912396, "uuid": "2f50ef21-2b5d-4140-9458-95816a84d205", "value": "T102A402543F6DCF07D2968CB45EB2DE6BC6348C419D6A5703AB703C0EA839BC5EE49A50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912396, "uuid": "eff578c4-8687-478d-97b5-e5f975c95a0e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912396, "uuid": "f8a3aec2-fbb2-4527-a30b-1d97c6ad4ae4", "value": "6144:EpkXGh6aeKHGX2RK49s2vC9euoucQjt0gUwF5+nPtV:BBGOeO0gUw/uPtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912396, "uuid": "7d4b8551-d487-45ac-8b99-40fa4d90146c", "value": 490589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912396, "uuid": "f233c492-da92-4d29-8b9d-f699275f7808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912396, "uuid": "d104c528-b791-4317-95d6-e26d06bdb6f3", "value": "9b45aaccc113770707f6e310f7fdd231c3a646345fbf29f98795c56da503b1d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e460ef-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780904978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904978, "uuid": "cfee6c75-79e7-4027-b97e-ca4ffecfd5f4", "comment": "Malware payload (DarkCloud)", "value": "b910d9fddb0f902a8f89e761e2bb7fdf", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904978, "uuid": "b33ed0b1-78eb-4088-bf71-e25c6aac1501", "comment": "Malware payload (DarkCloud)", "value": "9b6fd06daa436340cd677a28625519891c3ad61101390f6cc09a54186f59dc6d", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904978, "uuid": "d6419303-7d7a-4a46-b5c3-273f46edecbd", "comment": "Malware payload (DarkCloud)", "value": "18de717e25ebc9c51de1a63d1a74e56d29f15e77", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904978, "uuid": "22422300-e926-4222-b476-318bad592572", "comment": "Malware payload (DarkCloud)", "value": "5d4a130ca6b21d08043e6ae206b03f287fbccb0f61de270f43f33c715f1cbf4fc48215577fe8f9aaf2f8292d3163cb91", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904978, "uuid": "0a4fedc2-279a-4e01-b878-90511ab82239", "value": "T1D275CF36DB8272C4CD588F73D26A04A423B4731B82D1D3ABADD546F49A21E7E673E071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904978, "uuid": "7774441c-9ab2-44d5-a695-663fca9f709b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904978, "uuid": "99519aa3-6b0a-434e-ae1c-3f775295a29f", "value": "24576:yPBmgm2YEAZKXu6VSVP0Y2RatalIAoKqHIXmefpfST/O11C8Uj:m42SK+6VMalIr0fdvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904978, "uuid": "3e99ff65-d368-43d7-a70c-e352f2cd30c0", "value": 1697792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904978, "uuid": "84d71111-cd7a-4879-afbb-8d9812c4dcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904978, "uuid": "77775468-9fb2-49fb-b69d-03a36dceb72c", "value": "inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d046d2-62f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780893731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893731, "uuid": "e40a0325-f2c8-42ad-b68b-71653a617c5a", "comment": "Malware payload", "value": "e48faed55fd66eca70d9b97d93e5083f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893731, "uuid": "6dadf652-470c-457f-9911-589af3bb73c9", "comment": "Malware payload", "value": "9b7a7547405f745d1568a74867877a23cbebb4de6a4adf03f306aa06780fefc0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893731, "uuid": "2893fb93-5169-464b-ae22-fc716e64d01e", "comment": "Malware payload", "value": "d4b36352984baaea312921756b687c57963f6146", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780893731, "uuid": "15966f69-0288-488c-958e-9d6d87b138ab", "comment": "Malware payload", "value": "f09d46447775ae74b6805ea3f3f2b79b18496ad3a16b6034ac4f1d5b406f334c5595bae8616b2a51554b30cc29f1d272", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893731, "uuid": "4f127856-d7e3-44bb-b400-43803b6f5986", "value": "T18F6633B0E1135889D0816C571BC5617EDA3656BB58E363DC886FA337B0A63CD7438AF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893731, "uuid": "c469518f-e4f8-4f9e-98d1-4b1a972ad0d2", "value": "196608:IumSENSTFUEtxzGmdMbh81emNbcC9OHE2TZdTdRAgz:IqvtxzGmQ89JOdDxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780893731, "uuid": "80a023a7-4685-4bd3-9efe-2b2d67cd7a98", "value": 7114663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780893731, "uuid": "d1224463-34f9-499d-b372-c8ae060cda43", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780893731, "uuid": "1f05dcb4-beec-498e-8463-20ac2ac1cc6f", "value": "dvr.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c6c446-6394-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780962437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962437, "uuid": "cb57fd64-8204-44b7-aca7-58f86d3837a2", "comment": "Malware payload (PureHVNC)", "value": "9ebc35ad0b3807dfc5b37ea5e7a9f500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962437, "uuid": "7a65bf21-3f7f-436d-9696-19f844580992", "comment": "Malware payload (PureHVNC)", "value": "9c6e7d595b4baef4e6dc1237ecff473eebb6f386811557f2232bd3e52289f625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962437, "uuid": "f80a6f08-9502-4ab7-a390-28c48df2ab32", "comment": "Malware payload (PureHVNC)", "value": "26c8332619de6ebf80db37e647c1f3cf1ff5d11c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780962437, "uuid": "8b0bd1bd-8649-4b9e-93ab-23c2ad98c362", "comment": "Malware payload (PureHVNC)", "value": "52f5df6a2fd5fc5f3dbe61c14d0040215d72afb0c3c9da156b83285451830fb69d48c0b046cc02912f3286575d34a64b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962437, "uuid": "a73c6f9b-0d57-4ca1-95c8-d0f311ba3e93", "value": "T11DF4BF1B72528E13C2885737C1C7591093E4E6827633DB0F768927A61E473ABDE4B39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962437, "uuid": "a51e7658-854b-44d3-a626-6621a1639aad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962437, "uuid": "8c23a4b5-c548-4272-914c-6287febf6a7e", "value": "12288:bHhr3jZ7XaLWi9b7DEl+pDoRKGjiwCzNP89S/Y1/mXB10BGuFvCou:bFN7XaLp9uJbjiBEOB10kuF6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780962437, "uuid": "0170ff94-87e2-4c7b-8e5e-b74a5095b39c", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780962437, "uuid": "3ca30269-0056-418b-aabd-e9c9964e6d08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780962437, "uuid": "d2e1a915-6724-4466-8c69-41b61db1ed73", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.38121114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a04ef4f-632c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780917649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917649, "uuid": "75624923-d3e4-417b-aac9-784d4d390f71", "comment": "Malware payload", "value": "d58c1b6217999116a3d473fed2be1fb2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917649, "uuid": "2874c48b-6926-4dee-a254-e1629bb80a21", "comment": "Malware payload", "value": "9c70b1b91fae1708ecd6a91a743381c6216792f1479570cbcafd020a482fc474", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917649, "uuid": "b314e1e2-23c3-41d2-929a-0f0e0a263fe9", "comment": "Malware payload", "value": "3ee73fdf482e06af872ed662c3caf1e8e19750da", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780917649, "uuid": "2e81dcfc-d463-4186-bcbf-2c919be2a327", "comment": "Malware payload", "value": "e384e518c8a06ab4e2f9a0ebaf238ee4132c8bcd7a8c478d4fc7f690af861e0f8e7ec7db7b5b2c1b61b54ff6f1b1dd69", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917649, "uuid": "2242018a-77b3-4438-a531-85bba91f7039", "value": "T13545AD23F54180B2C6252A3145BB1B3AEE749B110B71CEC7ABD4DD795C32962E73B24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917649, "uuid": "7e73b394-7a25-4248-9efd-7cd908d73b37", "value": "ac51304d204bc7df33f87725bbcc7185", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917649, "uuid": "abbe9351-8711-4d3a-8d63-b41e2c1e8740", "value": "24576:y6LmiIc7+pVi6ks/vRduTD9VLHIFkJphLWm8Z9x:yekbRA9VLoarhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780917649, "uuid": "8d6853ba-1edd-4dbf-b6e2-904c2063ae9a", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780917649, "uuid": "0491f112-2c2f-40c5-802c-0ba2b406630c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780917649, "uuid": "8d5b9611-d7fb-4a71-8932-2645275b49a7", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c719fb-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907755, "uuid": "80782b48-b314-4c22-ada5-26e27b8cb2a1", "comment": "Malware payload (AgentTesla)", "value": "abb7d42d459deb25c1ac48b91173ddb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907755, "uuid": "9dcd93b0-3ed2-406f-b476-d85f612e7f57", "comment": "Malware payload (AgentTesla)", "value": "9db2ce42b7375f4c70e286983c0aef3ebd0befef2d0ec96610f10c36c6df9eb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907755, "uuid": "11b9cee8-926e-48b4-85e6-9d62d4bd1d66", "comment": "Malware payload (AgentTesla)", "value": "3cefa641414f63367fcca3242495780f8aee2514", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907755, "uuid": "f86796ad-b8ef-4f8e-a374-1919ac2026c7", "comment": "Malware payload (AgentTesla)", "value": "c5fbb31d328276714036071330df40d210ea0e388ef2aa88bdda0ad829082fe5cd9e768937d33c5bedf8bb34027ae5a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907755, "uuid": "7d5b4756-10b4-4559-9026-64eaf966b1cc", "value": "T129350140231AEA12C8D25BF48860E7B557B49E589D10D313DFFBBDEFB87B7812905292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907755, "uuid": "4df2b16f-d9d0-4809-9c90-c2438dcf96f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907755, "uuid": "be3f1221-5de9-49ae-b6e4-68408b9ba8b1", "value": "24576:kc94TS1KMMGdltmQjN3zIdgzxKrFRieGeZ:F44KTQBj7qF4eGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907755, "uuid": "b12c644c-4207-4c9a-a179-160556f09e62", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907755, "uuid": "51fd60d6-4dbc-4529-ba89-7bd5743482d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907755, "uuid": "3ea4e38a-24b9-4bf9-bf08-b2e10d4fd384", "value": "9db2ce42b7375f4c70e286983c0aef3ebd0befef2d0ec96610f10c36c6df9eb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ff558c-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912250, "uuid": "2622160f-a6b1-421a-890c-632feb8f585c", "comment": "Malware payload (GuLoader)", "value": "2206e1afe798f52e007724b5a6a701e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912250, "uuid": "0fe4f65b-6015-4583-aa3c-6369d7c063d9", "comment": "Malware payload (GuLoader)", "value": "9dc82c403d09772be87f0a7bb9da05b1e443df6b3dbc195e28576e45a76e4726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912250, "uuid": "0138ced4-eea9-497b-9992-3cf887ad01da", "comment": "Malware payload (GuLoader)", "value": "cdebcba00412e8017b73669721739bd621923c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912250, "uuid": "e3c171fe-6ec7-45b1-8cd5-2275e0210434", "comment": "Malware payload (GuLoader)", "value": "e4631c4b1013a615ca76200245c9529210e86fe1cb723a45de789048c427aba1cb0fd6fbcccbf2235f96c3d65d71fcce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912250, "uuid": "69c214db-aff4-4ee9-8d4d-c110914d0f45", "value": "T10B3412013064C877D6EA23F106D79B7A4FD98D0D17705753ABA1FA5BB8BF282430A355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912250, "uuid": "db547886-637e-4427-9982-f6f7681e6c68", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912250, "uuid": "b5327fb1-34ab-4887-a4ce-5bc8f79c2cfd", "value": "6144:58dWRKRhNh7kPGrczS0S4564Y9PINlVO+F0zKY:OMRKJhoPPT564Y9YlVOGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912250, "uuid": "aab5be1c-f5cd-46de-ba35-f89c2633333f", "value": 237920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912250, "uuid": "2aeafdd6-f22c-41db-b4c2-0fa047ab6cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912250, "uuid": "eef03b22-a0ea-4c94-99d6-f58cd289fc4d", "value": "9dc82c403d09772be87f0a7bb9da05b1e443df6b3dbc195e28576e45a76e4726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276cb573-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907793, "uuid": "03bf2ed1-3068-471d-ab63-17295123c8f5", "comment": "Malware payload (AgentTesla)", "value": "55bd005de10bb987e309e2daa2acfe21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907793, "uuid": "b1341881-1bc2-4644-9294-cb54fe2e48ed", "comment": "Malware payload (AgentTesla)", "value": "9debce014d1843f1e22b4c687db8589fd08115a841a8db4916adc9562b59639f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907793, "uuid": "aae72e1a-26d0-4ab3-bf4b-a2ab42a8264d", "comment": "Malware payload (AgentTesla)", "value": "d98bfcbdedefa956da40a545aefe54f66cf8c1a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907793, "uuid": "855a60de-510a-4b21-bf9a-2cc37e4c2839", "comment": "Malware payload (AgentTesla)", "value": "43e563bbc85537b49f4934614d745bb45f3fadca1f7d567d325b9bf59e467be397775b1bb5865f52e7d0c13422bf0684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907793, "uuid": "8a3dea73-90d6-4770-b362-1235bfc5694c", "value": "T1C2250154231ED902C8D65BB41990E7F907788E44A611E313CFE6BDEFF87A79229053A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907793, "uuid": "36b82b81-809c-484e-8d75-f18878c67b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907793, "uuid": "b71efd0e-9b6b-4e37-b494-8f6a5ed91285", "value": "24576:w4TS1vokEax5Q7w5Fa7D99Rfur/dL8j9:w44vlbFaVHur/dL8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907793, "uuid": "beb8ba7e-0a7a-4110-935b-cb12678c955f", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907793, "uuid": "ea06e2ac-7b48-409d-a0a6-6e1d34762c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907793, "uuid": "61c6ec89-5b77-48ff-a543-9c2f258b39b0", "value": "9debce014d1843f1e22b4c687db8589fd08115a841a8db4916adc9562b59639f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aff870e-6328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780916120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916120, "uuid": "5460a63f-c9a1-4b48-a78e-a2a2fd07c6e2", "comment": "Malware payload (Mirai)", "value": "0ec062fbdebe41deca845cd4e167f627", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916120, "uuid": "aac54a0e-e81c-4b68-bab5-91ad5796d0c2", "comment": "Malware payload (Mirai)", "value": "9e009a9fbb1a7c6b213d50856a3313630f96e50fc0389e93f24f598601bd5b59", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916120, "uuid": "fa94608d-8b39-4ddf-a27f-1deb87546d83", "comment": "Malware payload (Mirai)", "value": "66ef2a5223b62bc78ca2f610b508788116b4b880", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916120, "uuid": "d58967c0-d11d-48c1-a773-76181fe8eab4", "comment": "Malware payload (Mirai)", "value": "b4016773cc7735b265adab9b0ba08011e8e03dab1daf47ba0283f3ee45ac231ff12292c243ccec0225c0c1d331eb5945", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916120, "uuid": "3f092ab7-3543-48b7-80be-10229552014d", "value": "T1FED31A56EB408B13C4D61775BAEF424533239BA4A3DB73069528AFF43F8279B0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916120, "uuid": "e68868bb-41ff-4b69-8dfd-33a86185b443", "value": "3072:lS6VGvy5uaDAFEsHY07NSIYwxGnnR+MoNxViH:lS6VBuaDAFEs46NxgnnR+MoNxViH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780916120, "uuid": "0726ebb4-185a-4215-8241-cfec18b31213", "value": 140758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780916120, "uuid": "4c41cac6-4576-4639-a64c-4d94ed3ed2e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916120, "uuid": "b50256d0-cc96-4df6-97ef-6fbd5ed075b2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fa5838-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907574, "uuid": "5e2326f1-0d4e-423f-ac9e-26f4f1aa7958", "comment": "Malware payload (Formbook)", "value": "4ca08a20b171d8cb0368bd2b9afd0232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907574, "uuid": "08c3f306-1eed-4cd9-a8cb-688a74445260", "comment": "Malware payload (Formbook)", "value": "9e06ead521eb683238b0e668c13f6806477c64cec24cb6ce87ede8811b6f1f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907574, "uuid": "a3a27af5-eac3-4a62-b646-0080edd68f64", "comment": "Malware payload (Formbook)", "value": "c19e93ba9b85997a3cf383e2385feae605060149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907574, "uuid": "9a0bcf2b-97dc-4c61-be91-40369bc29f7d", "comment": "Malware payload (Formbook)", "value": "dbb8505febca5e881ee69c37ac673bcb46e6f7a43d81179ac1670036ea8d7970cb1b8d7078b8ee10e2b7064606872289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907574, "uuid": "11b6d8f1-f028-49d0-be51-0882ddbdebf8", "value": "T1872512446356D816C5921FB49C21E2F41BB49E98E910D3039FEE3FEFB6BB725051B282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907574, "uuid": "3cb37f55-baae-4e01-9528-d4792f384588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907574, "uuid": "9a9984ee-3fc3-423a-9d72-8ec7867a47f2", "value": "24576:WhwZt4a+Ca/vFTV/0cFDEkmjqW9veBMfHFsWS5P:ywIalUFV/xvxEveBYFsWSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907574, "uuid": "c63e6a2a-fab8-48d0-8844-a2fc3aac21e8", "value": 1032704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907574, "uuid": "b885f13e-717c-4588-9d81-8b05d4fdb0a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907574, "uuid": "7a633f58-e7e6-43f3-9201-911177918213", "value": "9e06ead521eb683238b0e668c13f6806477c64cec24cb6ce87ede8811b6f1f76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e38422-62e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780885669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885669, "uuid": "17713171-fdc2-4a92-9d38-a23416d2c283", "comment": "Malware payload (Mirai)", "value": "2d5ebd9068445ac75d7a5794d9f9e4de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885669, "uuid": "b3b9cdfe-9ddc-4eb7-8491-a8db3d4a2a0b", "comment": "Malware payload (Mirai)", "value": "9e38eea825017a43691dccef381491a5d0de4afd1a2dbb8f7fa6a318002547c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885669, "uuid": "82744d63-0d02-4052-9948-9e385c0f0447", "comment": "Malware payload (Mirai)", "value": "e9a93f6f8561e570a05a2aea4a6324e0b97c8d78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885669, "uuid": "c8f9e8e0-f98b-4f6a-8a3e-52870e7b3557", "comment": "Malware payload (Mirai)", "value": "69ab57ae31307585bd5db8ec9f3f363843cd76c05cbfa9f2ff8f2ab632626dab8f449161e9748ded9242eb75a61a13d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885669, "uuid": "9aa959ce-5d92-4740-9f04-8ba70e523c34", "value": "T123F3A91E6E228FAEF268C73447F78D25A76823C622E1D644D1ACD1145F6039E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885669, "uuid": "78c35ba7-5655-4e60-95e6-e5132220d659", "value": "1536:rxLIZs8hLzVi3N7u3z1KCEniQ3QekrlZHMEhT9c9fvsO8L+Q+J+IdsgV:us8l5L3z1KCEniyMrl1c9Hsvva+IXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885669, "uuid": "425158b9-6b7c-4324-93d4-662ef07adead", "value": 161144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885669, "uuid": "6eee500b-74b8-43eb-a868-31d727effc5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885669, "uuid": "8195b036-9098-45af-af4e-6afbfc8871e8", "value": "CRY.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09354d74-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780907742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907742, "uuid": "3df9d263-af78-4954-a408-d75b6266d229", "comment": "Malware payload (SnakeKeylogger)", "value": "30b421dfa3feab17c4f55f21bb191831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907742, "uuid": "3f88f9e7-5f17-44c8-82ef-ba31d77c6f06", "comment": "Malware payload (SnakeKeylogger)", "value": "9e5498fd437ca7c8760fd8bc37797649570d84724ff05a1bf8bdf21ecb813a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907742, "uuid": "3d2924e9-da4a-4266-aaed-36d572471359", "comment": "Malware payload (SnakeKeylogger)", "value": "71aa8f81469618ab1d685bf2c285d413c4f2caed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907742, "uuid": "b004a0dd-1927-4a4c-8122-6d61c4aa2085", "comment": "Malware payload (SnakeKeylogger)", "value": "e8b6e8a130e07ba3d70cec81ddd20cce459af8c896db6c23fde234e4094063534fcfe1bb403531a14be4ea4f0991c0a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907742, "uuid": "10d49cff-c7c7-4272-b321-c40b22e52060", "value": "T16E150154331BC816DA961EB41870D3F812298E44A901D363DFFBBDBFF97A6893A452D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907742, "uuid": "7378d1b8-a98d-481d-a14d-1a4d379656d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907742, "uuid": "0bcdfe1f-dafb-449a-b9b5-b1cdeddb13b9", "value": "12288:1SCbA/pg6S1Daed0Z4FdEXCz+ipYI5n6X7CV3mt5FYHCiuDUiYgmuM1bOqjBvOhV:t4TS1RpgCz+kL5na7CVk3Uea9bOqAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907742, "uuid": "9dce3f83-2d64-4efc-94b1-cab5956bf51b", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907742, "uuid": "202c9d54-3173-4779-ab91-eb173f76d209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907742, "uuid": "93ca6905-a04d-41c2-96d0-8cff1b46d488", "value": "9e5498fd437ca7c8760fd8bc37797649570d84724ff05a1bf8bdf21ecb813a9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639b29cc-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907464, "uuid": "87da16a4-a77c-4e3f-b44c-13ce8e6b2779", "comment": "Malware payload", "value": "39c605efbbf293f8d3ad888770cfc87f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907464, "uuid": "3ee2daba-5e2c-4f7f-a567-bd0ce474abdc", "comment": "Malware payload", "value": "9ea9612bb86cdd3faf296c6c72d12d12f21ed51b8e04eac501179dcce8f47709", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907464, "uuid": "9e987819-aa75-4c33-ad68-66838d9af212", "comment": "Malware payload", "value": "12fd5393eb940db2851f00f220d28328f693548d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907464, "uuid": "ed247fab-b92d-477f-ba0a-08d3acf17495", "comment": "Malware payload", "value": "0b349513e537a678857c73a0c11d68c1e7fa6034dd933a125d6dbb833bd89efb7994519e89c7c5ca7c54a05808c9bf95", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907464, "uuid": "bdac5dd7-516f-4a14-8f9b-3b69bf0d5fea", "value": "T16A01AFCDC0129B204099F85E329B61807820C3CB95468BB47FDC143D9BBD758B0A5E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907464, "uuid": "56d55a56-7e53-47ad-b1f6-0206fad3bbfd", "value": "24:kXCKysE2hi0ziQvZohajhYCjDYjJGAx0d7:e9Qp+Msjh7jD4GAM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907464, "uuid": "5d1c0192-84e0-4c27-87df-c94d7eebcd37", "value": 838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907464, "uuid": "e1e2173a-a724-4ef5-af73-1d9f19e7f4c3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907464, "uuid": "c80d1636-0021-472d-825f-4604ccfbd384", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f3a99c-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780907461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907461, "uuid": "45433dad-5618-4d86-9c0d-a58d4930f3fb", "comment": "Malware payload (PureHVNC)", "value": "925f48309ba1667f10a38de23c133241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907461, "uuid": "59905fee-254c-4617-a0fb-29fe30df4d34", "comment": "Malware payload (PureHVNC)", "value": "9ed5a0fc2342bd12c2caa4ea10a5887ff774c7866c2c10c0ffbb522280a2599a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907461, "uuid": "b7fe98a8-7e62-4b7a-9ae3-65934a2ba2eb", "comment": "Malware payload (PureHVNC)", "value": "a3f345ce3070786c47612ff9be25d7d6972a5a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907461, "uuid": "d52a3978-3ac9-475e-b2a4-1a8fcec76270", "comment": "Malware payload (PureHVNC)", "value": "045efb57e186ff1ea95de318579cc6bca93114613d7f515ebf68771f5aa968a50eb0396b6ac1eb08ffaf163c7ede21ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907461, "uuid": "b755747f-36e0-4798-9f3b-77dae7b218fd", "value": "T11A6512586358CA16E0974FF45821E1F42BB05ED8EC21D3038FEA3EEF747A7256916293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907461, "uuid": "31bbcfe7-493d-45a2-bf57-1df63138f7cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907461, "uuid": "e80dc477-33ac-4820-9cf0-e8b8fc3fef32", "value": "24576:QhwZtdYulU+44U0W37kUSAEWHSKBeNnP0HdvmFRqi1g0Iqh69+n/1:QwXU+44UdrkURE66NPquyi1P96y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907461, "uuid": "f5e51d83-1388-4a4b-aec6-b6f123c4d3c9", "value": 1419264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907461, "uuid": "eb95fa19-a8ed-456a-9505-966b162d79a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907461, "uuid": "add5619d-51d4-4811-90ca-239a70b4facc", "value": "9ed5a0fc2342bd12c2caa4ea10a5887ff774c7866c2c10c0ffbb522280a2599a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b7dd98-631c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910749, "uuid": "debf7939-3edc-4ba1-b4e1-83ddbf7b782b", "comment": "Malware payload", "value": "a06ed9b53b1b2ad3c494912b8621ba8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910749, "uuid": "ce492b29-e265-4fb9-9edd-c2903412fd3b", "comment": "Malware payload", "value": "9f2d73245a535b6b02238e3207e7e4ad7fb423d5cf17e567ddf57f7957b21942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910749, "uuid": "009cf81a-0278-4d35-b14f-760df4613b7a", "comment": "Malware payload", "value": "df68cb7f5a6a9340f7885555468537b66c326d33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910749, "uuid": "27a02c98-50fa-411e-9d53-ff1d28c19bb5", "comment": "Malware payload", "value": "fa2d7dd5d35b6cde230e452e3c6a7371def2c0254e3a34717ed5ab083853565b9f6485ee98c49c536adab049bf070c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910749, "uuid": "c8bb63b9-ea9b-4303-bd30-41ccecad399f", "value": "T19D15E11559972F99C63F0BB8C0520568B3F0C507E3B3EBAF7FED14B91862784CA2A591", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910749, "uuid": "c94f2450-71cd-448c-8d57-d68ec01854fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910749, "uuid": "83423167-2862-40fe-a677-cc35dd401695", "value": "24576:lVlO8rm16CllVkoav+HJX66LghoGFq4H/+Qa7Ks:/lHm16Cn2+16thv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910749, "uuid": "913f8d95-391c-42ef-a69f-c39629ec248e", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910749, "uuid": "7103141b-bdba-4871-8275-b8000920f15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910749, "uuid": "6bb77889-c6f5-4057-8bb6-1ab0028c4c63", "value": "9f2d73245a535b6b02238e3207e7e4ad7fb423d5cf17e567ddf57f7957b21942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750c6e15-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780928968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928968, "uuid": "8fd15803-cd42-47bf-b3c9-3f60e188b2e3", "comment": "Malware payload (PhantomStealer)", "value": "f7d674375b237540d3d5294969d6c319", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928968, "uuid": "b36a70c1-7acc-4eb3-bd5d-8c21f826178d", "comment": "Malware payload (PhantomStealer)", "value": "9f780ec9275d8141a46034b1e6a7c914f4a7637a981c521c16161afdfb9e7358", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928968, "uuid": "ae99d066-0619-49e4-8744-d1b3d9a233d2", "comment": "Malware payload (PhantomStealer)", "value": "f41062e8457b371f652b3993acc2dc2768b4f020", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928968, "uuid": "d9d418a6-bff6-48d7-8344-efdf4a5c6005", "comment": "Malware payload (PhantomStealer)", "value": "3340fbdb3d68253b0be6020b2c265ec0136caa6c36e44a65351c473f877e80b16db55270731b4dab751ed9a7a348613d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928968, "uuid": "fea50423-97ef-4d1d-b1e0-63165bfeb80b", "value": "T17C91E9FD6667A09089687F914CCE194A5E370FE692094019C6F86E3F822CE28537DECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928968, "uuid": "f552903d-95de-453c-8cd5-af16ca2ed8c6", "value": "96:LHnuwqyufq3t4HM3y08C1dLommtQ2S1BqxFwGRHz:Eyft4HMC08CXLoH22IyFzRHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928968, "uuid": "99e3b686-ce0d-49ab-b288-6f64e5dfbf23", "value": 4251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928968, "uuid": "1fc0bbac-40bd-42e2-a313-2f788ccf1e3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928968, "uuid": "d623dd58-2ada-48c0-b59d-0e90150f40d6", "value": "RFQ064-S-700470-2026_Item_list_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e471f7d-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912475, "uuid": "cf9d0546-6fea-4fdf-9a37-cf4e53be8e1c", "comment": "Malware payload (Formbook)", "value": "8c997189f2bbac72fb318fdb5e54e2d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912475, "uuid": "440f176b-849b-47b5-ac50-e622cfd78e2d", "comment": "Malware payload (Formbook)", "value": "9f88592a5afb313401f7fc0a8a0ee9c9a7e185b5955ae378663753d72a0600d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912475, "uuid": "bcbd5812-0e9b-4efa-a5ab-e26d4f234e2d", "comment": "Malware payload (Formbook)", "value": "efbf0ad5660243d194112e65e51d33e8c1ec78b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912475, "uuid": "cb6aefa1-bd8d-4638-8d45-b5aaada93861", "comment": "Malware payload (Formbook)", "value": "0b9bb96732e6fe82806693b0ef68e1c47813b6db9dc20602019aa07d30c34cd17d16c126cb3088da250b3ce8caa6c753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912475, "uuid": "19a1aa96-cd58-49c8-8b7f-e15a144292a8", "value": "T1CB252359BBEAE852CAA5473548A0E73503E59F2CF913C2E78BEDDCDB342B3761815201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912475, "uuid": "a93a12a6-90ce-4465-b029-a0de08c0977f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912475, "uuid": "0c8f5073-0b3a-4f73-8ab5-b9e169fc2077", "value": "12288:TCeqA1ub+24TM/STvI63M6CjHAoQ1X6W4oznKEyQkmdLUM+KTG/V4nszXgwuOipc:f91QSE6ZCDAX6W46lNU3Ko3uOiptn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912475, "uuid": "f18cc80c-5668-4e26-b9dc-3d737f305e09", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912475, "uuid": "7dda13ed-cbfe-44d3-a7fa-9a2c3f8a301e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912475, "uuid": "0a57127e-1422-4818-b13b-eeba339a275d", "value": "9f88592a5afb313401f7fc0a8a0ee9c9a7e185b5955ae378663753d72a0600d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7cde6d-62f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780895267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "f651c1ac-6727-43eb-a234-d9055f0f25ae", "comment": "Malware payload", "value": "4e0626296fc351d61d2427e094f8eb2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "feb52e3b-33f9-4a03-a1bc-7d935c4f2803", "comment": "Malware payload", "value": "9fc440f8e9de378d3e7b45961fb016786a2321e73ac8e838e51d49e132ad4604", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "e8444efa-eb72-48ed-9198-cfcc8e8b8941", "comment": "Malware payload", "value": "0977124d8e7618fea8239f295cb03ae7c1d4fa9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895267, "uuid": "4bae838e-4ea9-4ce3-a8ca-abdad3179b51", "comment": "Malware payload", "value": "3aaf7d318e2f2191c96f5d90875892c6b55fd2f4e19d7efeaff3547b28cdb97daf0a492644e2eeeef82781bae7a77e6b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895267, "uuid": "d1729dff-b125-488e-a050-a22845e218da", "value": "T168118CD7A7246CB22D49816E73EB840C6282021F08DB6FD07C8D64A61F5C598F895B78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895267, "uuid": "8a84099c-7696-47c0-b052-15a80dd0ca9e", "value": "24:oE+H1mmDMK9CF9YhEU4MoTdyy3Anho4H1b2:5+H1mmDMK9CHYhEB1Tdyywho4H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780895267, "uuid": "6323dc57-0f7f-428b-9676-38e04b6e6bf9", "value": 907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780895267, "uuid": "987d9d53-3544-4cc0-b042-5b435fd0bc13", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895267, "uuid": "b9587bfa-3dcb-4e46-98bc-a783ee7966e8", "value": "check1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edbc7f7-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907537, "uuid": "83277baa-486e-45c7-a69a-16f43a4a019c", "comment": "Malware payload (Formbook)", "value": "827b9dcc192842029cb8587e999f2619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907537, "uuid": "93539dbe-7eae-466a-b6fe-1dccb42c3fce", "comment": "Malware payload (Formbook)", "value": "a021f0d66c377fb74ad292433b58c2a015d31efee3a04ceb1023d85215881940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907537, "uuid": "c9897b78-b958-46e1-8e56-a964c5282a09", "comment": "Malware payload (Formbook)", "value": "0336e37c690b4a0e2a9fdea87026505cab39cffe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907537, "uuid": "ecc8df2c-d37a-416a-8228-7e95dc8d2668", "comment": "Malware payload (Formbook)", "value": "a25bdf8ad805427ddcea651f5c3612a001fae5dda3728f1643501e68311b445f3e96e5cbebcb04c4112cd915ef71afea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907537, "uuid": "104722ec-71fa-44b9-9f21-ecc7070f2797", "value": "T1DC251259661AC817D5864FB80C72E5F42BB09F98EC15D203AFEB3FAFB4BB3150516242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907537, "uuid": "a0608f85-4efb-43d9-bfe4-4e3a71dba876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907537, "uuid": "fae75abe-ad9b-4d87-b3c6-676860ed1a5c", "value": "24576:qAPjMMDXs78ZZJiEuxvTbeMm8j6kbjTU2hwZt:q2bJ1hWbaQbZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907537, "uuid": "b7b68a7f-a76e-4fd6-b37d-9ec271ec503a", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907537, "uuid": "2b93aa0b-74f0-43cc-9539-ce426deb12a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907537, "uuid": "e6af4f7a-a020-44e6-9c82-6f16f6b62f60", "value": "a021f0d66c377fb74ad292433b58c2a015d31efee3a04ceb1023d85215881940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f92c06b-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912182, "uuid": "bcccc19e-b2a2-4c7f-a9bc-568e4232d4ac", "comment": "Malware payload (GuLoader)", "value": "ae5f2f7ace440ca63a6f5e177ff93b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912182, "uuid": "f1671461-59c6-43ce-8b9e-2581ff75b686", "comment": "Malware payload (GuLoader)", "value": "a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912182, "uuid": "7da3defa-a96e-4d87-86ee-e72d5e68b218", "comment": "Malware payload (GuLoader)", "value": "df87540b6af75f79909d9ebfc739e929bfbc5ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912182, "uuid": "fa88e232-7447-4740-9860-b60477f55cb6", "comment": "Malware payload (GuLoader)", "value": "989e9d1443725b19941713d976466b1a4a5b727ff115c2990689d8b08d45dec2dbc1094169f3fdfbafb7746ff9ce218c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912182, "uuid": "2d217332-cb3d-41e8-97e1-55a15d8e51f2", "value": "T1B7641212B290C467CE971570487EC7B6C6F182F8432D6F676B14376A3872AD34B1EE28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912182, "uuid": "dfbd4091-6f28-4ec3-821e-b0edb0bcfac2", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912182, "uuid": "40a5d7bc-df0e-45ec-a0af-00eb0901c8a9", "value": "6144:K9X0G7HCo89joe9fL6HrXUcxKterwHy9MtTHiytdjbWYaSFs/ktC:80IHCoK0epLorXrmekSORfne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912182, "uuid": "aec940b8-d011-4d76-8012-0742c1a3d150", "value": 334056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912182, "uuid": "da7d0711-77d1-4548-a896-3b77fc7e8e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912182, "uuid": "eda77125-91a1-4ea3-ac08-7e255be49a7c", "value": "a073704e18e10cd3e8d20e61b0671292d2a7ef52e4cd8e2b1c88a7ff62c3bf73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8679b546-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780911818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911818, "uuid": "fef35d4f-ce22-46d4-aaab-0f79075c83c3", "comment": "Malware payload (RemcosRAT)", "value": "4058b3267107df2c1da87c0a53e668d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911818, "uuid": "3670dd3a-0bb3-47bf-ace9-a4c1df72fbb9", "comment": "Malware payload (RemcosRAT)", "value": "a256d4290bfecae2bdb862778861fc0f698d60b5c110855c4b3a0881e61fdfa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911818, "uuid": "beae79dc-96e0-418d-b15b-c5f6c773a16b", "comment": "Malware payload (RemcosRAT)", "value": "a60cd99a7f98ef3b2f2ab9bc03b28c54e82414f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911818, "uuid": "49b1751f-3b07-4a26-a839-c36509905866", "comment": "Malware payload (RemcosRAT)", "value": "04648121c39f76628b3c32045efa2bf8b03312781e7f2b2bd13f3175064a89fc4b50c9960f8f4e46cbe2ca861cd92699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911818, "uuid": "dd90dce8-b72e-47ed-aa5d-2207840f7858", "value": "T11FC422018680D87BD2B648F0C978C9F676E1AD60EF66154F63C03F4FFE3A9519A4E216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911818, "uuid": "04621faf-8f17-4773-9d7d-a1f48780ee8c", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911818, "uuid": "e907780b-a393-44b3-95e8-9bff1e0e695c", "value": "12288:t+CLHlZuNR57bWS6wB4ldcAZZCLdtCP5EBH0jrsbF0qIS:t+CzlURXR4l1ZwcP5gUAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911818, "uuid": "e7c46cc1-9d0b-4c27-a09c-cbc0adaa2b9d", "value": 594584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911818, "uuid": "d4151986-31ba-4dbd-b918-8f8ccb9f1f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911818, "uuid": "858b91ae-b9fb-4246-a0aa-89678f5d139a", "value": "a256d4290bfecae2bdb862778861fc0f698d60b5c110855c4b3a0881e61fdfa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c99f44-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780911358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911358, "uuid": "ac60cf44-9c1d-4aa4-84c4-275259845392", "comment": "Malware payload (MassLogger)", "value": "904d23627a50699c1fcd2026321066b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911358, "uuid": "552f77e9-d0e9-408f-b242-f77bc3186796", "comment": "Malware payload (MassLogger)", "value": "a2d8949ed4991ab426157ba3d4646b06dd52e5a3fad19da967444bd11ac600a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911358, "uuid": "418c9550-6760-4a22-be5c-5ccb44128c72", "comment": "Malware payload (MassLogger)", "value": "eabc8fd2f10fc609bc0666dac6e21ff995b2b213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911358, "uuid": "382cb789-3ae3-41e8-aa6a-e2f850836518", "comment": "Malware payload (MassLogger)", "value": "bfd112aa79fb8f029155c2a08fb7bb4c8112c1ce7bded7f3355fd22c1c96d52786d4c883aef83a04c7595484fdcf69ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911358, "uuid": "7dbee382-0ec5-4ebe-b8ea-a8e6ee55d71e", "value": "T1742512786B06D403C7957B394EB0F3F532291DECB802E3569FD87EABBE66A550D40182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911358, "uuid": "abdb6431-3547-4ded-87bc-fabdd10ee274", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911358, "uuid": "a84bbe30-908d-4229-a717-230368c6cffd", "value": "24576:c8DL2uwyTqel9lNzfTBlSQw0ENi1+kvsrZHeK:3L2uwyqiDfT6Z0ENa+is1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911358, "uuid": "2c1a9e31-d391-4ba3-a5bf-9b69d6aa59a5", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911358, "uuid": "31244485-52bf-4a3f-8da9-6dad896168b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911358, "uuid": "857bd946-b26b-45da-a74f-a2f8015c3c3f", "value": "a2d8949ed4991ab426157ba3d4646b06dd52e5a3fad19da967444bd11ac600a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e089bb-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907812, "uuid": "812d7651-00f1-474b-8629-57b699ff487d", "comment": "Malware payload (AgentTesla)", "value": "a43bb6b4236e09e8bfa8bc1424ca0ec9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907812, "uuid": "a65c7ec7-656e-4cc4-a51d-d99e92ead8e1", "comment": "Malware payload (AgentTesla)", "value": "a2f790621f6a7f8abd2f5126fe48f00bc2b8074625464782bb549f09ad88d50c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907812, "uuid": "1517b59a-3679-4b08-8582-ea7c761bfd98", "comment": "Malware payload (AgentTesla)", "value": "ff0db8619a2d5fb98ad4b7d31a550c044fe41ea4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907812, "uuid": "d4d86942-40e0-46ce-b918-c899950683c9", "comment": "Malware payload (AgentTesla)", "value": "71406e94a59c75f5d91abc00aa8c73bcc9beb8a0537e9f1a9d044db21d47200e5295a9d7d07ff337733f5405fa1aab69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907812, "uuid": "e7b1256d-5412-4946-94e3-e854d0cd94a6", "value": "T1A4250260730ADE06C4D24BF00960E2B457688E45A911E3579FFBFEEBF87A7463D44292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907812, "uuid": "651188f0-6e5a-4ec4-82a5-a6ba6011e83c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907812, "uuid": "88f73461-73da-4eba-83ae-6965b6b7343b", "value": "24576:RUTgi/ZDVdqyUelA1HlU2mom/Dby4SWNih4fdCguO4TS1:vQ/ZA1HlU5/XLSWNih41C444", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907812, "uuid": "3734d53b-68ae-4ba2-aec8-d6c8053ef3f4", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907812, "uuid": "4a1d63bf-e766-4efd-8417-93aa3fa5094b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907812, "uuid": "030b9ab4-8fab-4775-a6fe-9c1da1c7771c", "value": "a2f790621f6a7f8abd2f5126fe48f00bc2b8074625464782bb549f09ad88d50c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c47e25f-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911371, "uuid": "f6961fc6-b7ea-432b-ae9f-61cd67b182fc", "comment": "Malware payload (Formbook)", "value": "e8e89a40c10bb5dfd47a538c13357f0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911371, "uuid": "de3e8ce5-cf8e-42de-9570-b8cfb8f982df", "comment": "Malware payload (Formbook)", "value": "a331fc529c635de6385adbaccdd063a20b47a53e7e88f5add8c585c8929a0cd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911371, "uuid": "f7a81d92-af9c-4400-b328-5cac6d68dcfa", "comment": "Malware payload (Formbook)", "value": "863c2e213ef85a41aa83b9b429b2b2ef8ddbf54d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911371, "uuid": "1d24bc7f-781c-40dd-b438-56b9092b340c", "comment": "Malware payload (Formbook)", "value": "76858ed686e20db18b1e1544eb9461a30fa30e31755460bf0c2d26f7266c5ad546eebb53513d38ae7a51c62cb579c3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911371, "uuid": "eadf5f66-c9ee-4280-b3b1-de8181ea5bd3", "value": "T14254125047595378DDCAC3B915FE8B130A98AC3583ECB24B67D25A10A0FDAF69C43B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911371, "uuid": "e7122063-5390-46d9-bfb9-a88df54c426a", "value": "6144:+83sjbLYDKlJ+YX7oyIN9UYXcHNQtQ4ClKnwhUY1hCjQE4:+Eslv+yo/UmUQtAknwhUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911371, "uuid": "c9d0c2ab-411a-418f-9a3c-fe27c8caa7ad", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911371, "uuid": "d8dba9ec-3f3e-4049-943f-a0e2b91f9447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911371, "uuid": "b1cd1f8b-ebfe-410d-88f4-1b7a01634788", "value": "a331fc529c635de6385adbaccdd063a20b47a53e7e88f5add8c585c8929a0cd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb5e3ce-62e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780887506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887506, "uuid": "8766e74b-28fc-4b65-a457-8fe1c0c91776", "comment": "Malware payload (Mirai)", "value": "26852538cb8637a24dc9e7a8ac2c3d9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887506, "uuid": "049c00c0-b606-49ff-b8f5-82d31e775343", "comment": "Malware payload (Mirai)", "value": "a33f472cca8c742a5bbd6f17fc3dea62cf984c4c26f35576d101488fbe3b36d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887506, "uuid": "52bc5cfc-c6a5-45ea-99dd-cb0abe019141", "comment": "Malware payload (Mirai)", "value": "6e81eb4104387c8cf45282dca9149ead3729198f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887506, "uuid": "00b5d97a-b316-4912-958d-f67f673532fb", "comment": "Malware payload (Mirai)", "value": "167cba32b56c31e4d70d87ff01fd11c19b0fd4ed02a387ec764573cc6b960b85a89dcceaae03688dcbc48c377a62435d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887506, "uuid": "bb04d065-8d8a-4fb3-aa70-7db6659506a9", "value": "T172938B8FF20B55A0C86246F01BCB9FCE3E6322A19E5394E73D6D167A18751DB1D06F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887506, "uuid": "64a90ccb-c40d-406e-a6fd-a6466d5b8ac7", "value": "1536:bIPCMbS5tIFluUfiq2vMXot9bBkx6aJQN1GgJqY/LWK:0BbS5tIFluUfiqkKaJCx6kQNIgJqYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780887506, "uuid": "0a507821-207c-441a-b46f-cd7caa569c7c", "value": 91420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780887506, "uuid": "a20378ad-f095-41ff-ba4b-f2ebb78d8a3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887506, "uuid": "9434c2ed-ff07-4e1b-a39b-b1f34e6ee102", "value": "CRY.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef484a44-631b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910705, "uuid": "f24703ea-3b58-4a71-9d90-6cc881434244", "comment": "Malware payload", "value": "066ed94d70a02ea2fc2333e6e76efd19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910705, "uuid": "5453804e-6467-4444-bf0c-5e398ba741f1", "comment": "Malware payload", "value": "a36dfca12c70894f05c305cc6b19fadd505f50a5ea4672bf616397f933f38d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910705, "uuid": "434a3b8e-3c69-4691-b815-afe8a63b3200", "comment": "Malware payload", "value": "6efaf314f9f2abd6e21a83b51fbe646228bac700", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910705, "uuid": "680dcbb4-987f-435f-a912-513c98466c8b", "comment": "Malware payload", "value": "864f108ab880afa610bb317874a74ab74158ab2fe7124b9add33803cc66d3b9b455195fbf10d359b3535ad1eb1a16cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910705, "uuid": "f55f6286-e1af-47fc-b179-d34e36ad02f2", "value": "T1F315E0215E876F99E63F0B7CC0124450B3F0D847D397CBAB6FED14B919A2B88CD26592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910705, "uuid": "823ff7c1-c6e3-4f9d-8184-1e737022cf68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910705, "uuid": "0fd1706c-69b0-47c0-96a6-227a88fd1e60", "value": "12288:yhg5sKvieNCvdiO4mWCbZlYfm5K8nizLQJwv+esJpmv5odwAKoGXaW1LEtn:hHVNo8ZmWCllVkoav+HJpddwAKoGXaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910705, "uuid": "2807d86f-e718-4f8f-a0a3-cf06ae6cc7ea", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910705, "uuid": "bbfe18b5-ac9d-484c-b80e-c34cb0108053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910705, "uuid": "54a8edf0-0d94-45bd-a7ce-3e80b3e25662", "value": "a36dfca12c70894f05c305cc6b19fadd505f50a5ea4672bf616397f933f38d5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c3edb4b-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780910780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910780, "uuid": "ee006219-ee46-47b1-864c-bfba46f57132", "comment": "Malware payload (PhantomStealer)", "value": "97fc3a2ab88097c629c8a7f00c4a5cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910780, "uuid": "32524ef5-0a5f-4176-8002-a2eb5b9c7acb", "comment": "Malware payload (PhantomStealer)", "value": "a3940a0d567976f02cbd431e106d6d4b9b4e21263de880ed8daa1c3c06434bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910780, "uuid": "4e22664a-34d9-4995-abb9-83bca99713c3", "comment": "Malware payload (PhantomStealer)", "value": "bf799ecf56e65d372c9b3b963653f321e79b3e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910780, "uuid": "22780148-4d34-4676-9b21-4461d8636ba7", "comment": "Malware payload (PhantomStealer)", "value": "d2058bf814506afae56b01a436aedfb4d2bc57f03aacce2cd1f1ca59b9656c5e73c241e4f193a83e56b1e1057e8cd705", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910780, "uuid": "f1481a65-fc8d-4475-8f47-56870335d936", "value": "T1396522944705D90ACC4167B49E71F2B4177E1EEAE201E34BAFEDBDDFB937A548808182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910780, "uuid": "0d51e7ca-7324-46c2-a34c-0e2c377c1436", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910780, "uuid": "40e4cab8-e416-4943-8a8e-1ffc7d3bdc09", "value": "24576:adGjTD4qrQGc7oK3mtwF3toiU7c9yj0YafRgklgyGEBaKfb7UElWZPLFkQhZ/N:adcxLKWtwF3uQfg00KT7ytFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910780, "uuid": "c2c59001-5d3f-4c14-8c64-570cfd4e1271", "value": 1528320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910780, "uuid": "dc84d822-2094-40c3-a9fd-3976c1654f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910780, "uuid": "51f745b1-249b-429f-9c8b-f2a12f636b28", "value": "a3940a0d567976f02cbd431e106d6d4b9b4e21263de880ed8daa1c3c06434bcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca4f07b-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780911694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911694, "uuid": "b692e351-d5d6-489e-ae5b-08259b584645", "comment": "Malware payload (DarkCloud)", "value": "165db7da835e65ec86fdc01e755c28b3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911694, "uuid": "dfacb9ff-c0f5-4d6b-a81f-2b8a89aefd75", "comment": "Malware payload (DarkCloud)", "value": "a4903ba8d565b62bfbcd98c98c45a1b8c46d11064bc0c06f1215b2ff9f5ff30c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911694, "uuid": "92230fce-a54a-4757-8ef4-c87c5b716c67", "comment": "Malware payload (DarkCloud)", "value": "f765ee4ba0afef42354d7c20e21daf4a16257047", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911694, "uuid": "4d95f993-c9d5-4736-804e-11e62dbd1ee9", "comment": "Malware payload (DarkCloud)", "value": "e327a81977075954409a851499ac32d01d8a0106c8523931629d1fa8d81e6546647dc867d1ecd771e88a2cd6e265c3af", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911694, "uuid": "37acbbbb-1077-4228-9b37-dc7acfd6ad9c", "value": "T11545221C9B16E607C6911B38AE71F671226D6DCEA802D2279FDCAEDBFE77D051C04242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911694, "uuid": "71430d2b-ea91-440d-a565-0c44029b8cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911694, "uuid": "73d034e1-8c0c-4b52-b1b2-53759751d068", "value": "24576:lfbXfvLdZmFW8tlseo64yj0yg+9BqTiJGWVYd7T:lLfxIs8LpNrI+9BFsuYd7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911694, "uuid": "f37dca3a-6888-44d3-8cab-fc80702cb785", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911694, "uuid": "8f47816c-8745-43d8-8098-efcf0fab95ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911694, "uuid": "329284c2-f369-4823-88cc-e03988db3c4b", "value": "a4903ba8d565b62bfbcd98c98c45a1b8c46d11064bc0c06f1215b2ff9f5ff30c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ecf136-631c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780911144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911144, "uuid": "835c8a3f-a78f-4685-b5a2-f9e75c32b032", "comment": "Malware payload", "value": "3772e027e64fc70cdac71c887bf1f626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911144, "uuid": "c6047f87-eda7-4978-a9fe-701e8db8cc59", "comment": "Malware payload", "value": "a54e19ff6b02ed0f2f637db43e381db7642e9b6faff9c407c968ccce28d2821c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911144, "uuid": "35a28cdf-ea8c-4108-84d3-d6a8a264a6aa", "comment": "Malware payload", "value": "dfeab59bd754b89d5d425a053623dcf3ee4b9e0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911144, "uuid": "eadc4bc3-8163-4f74-a531-f587adb71873", "comment": "Malware payload", "value": "ffcf12178a35c13491d187291da152e72c47f4a1ea4ad28c2e9e2bab03fcb7ffbcfbd1aeb37a8b3539bf0cc0828d6e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911144, "uuid": "4b5d2a5d-5d2d-4a56-b7ee-d48359a08019", "value": "T18C55CF16A7E011B4D63BD238CBA64633E6B678460771AECF0359D6152F33AD06B3B325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911144, "uuid": "0e861ebf-808c-4a2c-9f6a-280f3bd19b7d", "value": "d4652face233fd6b259d63f8abb6894f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911144, "uuid": "f5a09bce-5086-48cb-b09c-40e06b09db73", "value": "24576:mvFZ7RU/5ouxIxvVC22vdF4+BVDhnD23oxYLGAvP9NZJmenoK3pGT8K35rErKk58:mZi/5FxnF4+BVda3tqAvZIenoKZk32rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911144, "uuid": "247ac5db-57e5-4669-8004-72f3f76dee19", "value": 1346671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911144, "uuid": "98ee8cd2-9a72-4731-b2ed-be8089e9504a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911144, "uuid": "b93e55e6-c7b0-4bc5-9eeb-86860619d2c1", "value": "a54e19ff6b02ed0f2f637db43e381db7642e9b6faff9c407c968ccce28d2821c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2add27c8-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "25163ebb-3bae-4da9-9082-3460fbe45202", "comment": "Malware payload (Mirai)", "value": "ba836d206de9f92695dbedd83d54a64f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "acda2f8e-5cd5-4eb1-ae06-d529bc466b51", "comment": "Malware payload (Mirai)", "value": "a5a37b0a779eee7b8eec398db28a4e91c3b2d18ebd1f7c35616e7c41fd9a984b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "39be5f95-f2a2-4e0e-9a29-22b2882b6d7e", "comment": "Malware payload (Mirai)", "value": "0d1266758d14601b8a9a4e5ec46d0ca3f415be61", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939581, "uuid": "e41e8d1a-2f1e-454b-90ba-225fcf08c7c4", "comment": "Malware payload (Mirai)", "value": "e08d04ec4cc6c83e71e3ba092e746c8d42cbdddea46956d089413f6da7ceafcad6e065dabfe586ed2f28b3bcecb7e681", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939581, "uuid": "e585e5b5-f4a0-410c-8c29-803632823b1c", "value": "T184C3D60ABF210FFBD85FCD3B06A9170225CC555722E9BB3A7574C928F64A21B09D3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939581, "uuid": "bf6beaa6-0de8-467c-93e4-2112bbf47317", "value": "1536:QhwCvdHmez3BK9LW05Biw6PmPQ4+efKmWhS4cUz9KrZ9nTDCV5bOvd7JMWN:MwCvdHmezn0nUPMu9KryXsMWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939581, "uuid": "0303d0fa-a8a3-4b53-b311-9c9c6d732687", "value": 123348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939581, "uuid": "b0299c5c-c5b5-4615-92b0-9b2cc8862aa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939581, "uuid": "228264d0-cd21-4d1b-8a1f-3cc718be3eea", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d06d70-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780910736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910736, "uuid": "7f0db870-2ff9-4483-aa2f-037f1b0aef17", "comment": "Malware payload (Expiro)", "value": "1269715f68cfa715c89ce5ec4081ee31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910736, "uuid": "a7fdadfe-1f95-427a-b4a2-8a0515a24c45", "comment": "Malware payload (Expiro)", "value": "a601e192858590dd9f73d8062f1dd6d812029ca2e9754ca22e25ad37d62de0a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910736, "uuid": "de577cfa-29fa-4fa7-aab3-ccadb9f6f0e7", "comment": "Malware payload (Expiro)", "value": "689dd0b68fd94c87e932704eaf01278a277d4137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910736, "uuid": "d7e86650-1f13-44f5-b23b-06186b11456f", "comment": "Malware payload (Expiro)", "value": "ae7a87bd03226967a39fe09835bb37111dbefce0afebc388905bf6bd1e61826717dbbfa19ca64f8164d4dc68a71a48b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910736, "uuid": "1b55db91-51f3-4ab9-9cd8-3b5fda22bbdf", "value": "T17036335E9539C186D8EA02718E60D9F00A311DEECA10C9DE1EC9DD977CEBB39491236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910736, "uuid": "6550e0d3-7d1c-4cc3-a49a-eb1d0e8814d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910736, "uuid": "75a8fd68-748c-4632-a06a-6e1628ba94f7", "value": "98304:fMHjQtt5rWAawjuiUTN2kgZ/UcdnksAfFQ/MfmqDCP6iNiba8R8Cb5hLT9/pLRuR:cQtPztUw/1UAk72yiX82e5hP9/dRuz+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910736, "uuid": "ad37e454-667e-4264-a4d9-710109004769", "value": 5175808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910736, "uuid": "ce968440-26a4-4905-86ef-d06e5cbaf2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910736, "uuid": "24a9d30d-ddf0-401e-aeb8-b7ce8dcd00fb", "value": "a601e192858590dd9f73d8062f1dd6d812029ca2e9754ca22e25ad37d62de0a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d87ef5a-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941492, "uuid": "f706f34b-f93f-4a9a-a3a6-ef1b02a7f0bb", "comment": "Malware payload (Snojan)", "value": "883adcb7eca85f1dfbcc76a9b5f6da45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941492, "uuid": "a243027c-5f41-494d-a964-dc29b46d1fe0", "comment": "Malware payload (Snojan)", "value": "a65245ec202919aae548d9dde3a39ad265d08af0703463af4f841bb8e9325feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941492, "uuid": "e0848837-5470-4b07-8514-3fe3c9c2a8e9", "comment": "Malware payload (Snojan)", "value": "df641449bc6c959693212494ab4d75b0ccb5e655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941492, "uuid": "94c62bae-c740-47d5-a8cd-c29c4118d8de", "comment": "Malware payload (Snojan)", "value": "686c7fb26a11074dfca5f5aff62c9e358804f53527ec158039a0194a8ebd1907cfef88ec7a6bb4b26688551f3a27417d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941492, "uuid": "f11d87ab-58ed-41de-b90c-c524e9a76446", "value": "T124B4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941492, "uuid": "a8edaceb-f90d-436d-b020-7565cc07ebd4", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941492, "uuid": "2ce563bf-3683-46d4-9218-aca4a2585447", "value": "12288:/bE+uvh1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+0k70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941492, "uuid": "875d5fc6-40fa-45a6-afaa-5d3cf867ba81", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941492, "uuid": "5e3080d0-ff80-42b6-bae6-3d5819367032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941492, "uuid": "2f3c7588-7b4f-49c3-bfa7-1d68a4977387", "value": "rEzTfEIVRQABALcM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ae9461-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780911781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911781, "uuid": "4f0f3350-6f0b-47b4-bac0-f9c6bb86612f", "comment": "Malware payload (MassLogger)", "value": "cfda148971620d3773a4e36c2fd04bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911781, "uuid": "66aa830b-4050-4626-8193-0a4a956d5bd7", "comment": "Malware payload (MassLogger)", "value": "a6a4be0c04b60ae7b77928507231bb35bb6c0625b61fc489ac120ee1cfe4ed54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911781, "uuid": "2d4f5d6a-46e4-4628-b147-8a438823849b", "comment": "Malware payload (MassLogger)", "value": "7ffc06edc924b4936d9d134b92ba6bc3caba0810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911781, "uuid": "a3eff972-9a05-46f5-ad49-6f7990c3c83f", "comment": "Malware payload (MassLogger)", "value": "878aa2ce602a08ab6f647a5024e135e8979ca7547837984242024518bc08a3172952daeb90e53041fb624745d25ffd0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911781, "uuid": "49c8fa2d-c50d-47ee-ad34-4121797ec83e", "value": "T1D3251268670AE607C9911F389D72F2B522AD5ECDE800D61A8FDD7DEFF9ABE081C04145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911781, "uuid": "07f15140-1263-42ea-a323-a1cb0edf117f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911781, "uuid": "384fe770-d784-492d-ab3d-3c5f210bccb5", "value": "24576:BVj+g4CyNJossz5h7K2FdIhHuA+ZimZikf365:BVjN4Gz5KsXZxf3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911781, "uuid": "eff0d3c2-d228-4be3-9607-e9308367c470", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911781, "uuid": "e961a738-73e5-4ce7-88ec-d30c6f42957f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911781, "uuid": "b5d52ae3-f5e4-42e5-9d10-1f6bd97bcd3d", "value": "a6a4be0c04b60ae7b77928507231bb35bb6c0625b61fc489ac120ee1cfe4ed54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556e778b-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780908299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908299, "uuid": "54db4319-12e4-4dfd-93e2-2eab452940e3", "comment": "Malware payload (MassLogger)", "value": "f40a4ec6630d5542f81d39ff056d8a39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908299, "uuid": "4d6ef984-2a8a-41a6-be88-c3540675bdee", "comment": "Malware payload (MassLogger)", "value": "a6c4f4b0e6df5033db3fffc8239c22b376ebdb5a1de76d66371da62db32b268f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908299, "uuid": "def5e7c3-6eec-4fe5-adcd-e97844a161e8", "comment": "Malware payload (MassLogger)", "value": "fab519126465e215dcca0d7cea953945888a703a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908299, "uuid": "643fe9be-2dd1-4ed8-95ab-b840424903b7", "comment": "Malware payload (MassLogger)", "value": "0ab6c14a823639648fbdf88305da774861fc7b0fc05f89a7e1059dcf0b02e80acbfc689d99e6f2bf4a4ff1a99d1d21bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908299, "uuid": "b6776975-8006-43a6-954b-073a0f87438e", "value": "T18B050254161AD803C4960FF449A0E3F466684E98ED22D613DFEAFEAFF9BE5957800343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908299, "uuid": "a77e3e07-414c-4229-8e6c-5979f06df4d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908299, "uuid": "7c64c4db-af11-4c9f-b0df-00217a934a93", "value": "24576:VDzAEFT0D0brIc7dPCpgqjmJVYnx8pwJEJYP311706R:13FQK7Fy6JVui6KY/117", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908299, "uuid": "63de3db2-ebf8-45c0-81e1-ffa02574eff9", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908299, "uuid": "1a29e0de-cce0-4197-93d7-6c4816d7f539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908299, "uuid": "96220806-0cdc-41be-bdfd-0cc77d0db1ab", "value": "a6c4f4b0e6df5033db3fffc8239c22b376ebdb5a1de76d66371da62db32b268f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a20046c-6347-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780929406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929406, "uuid": "ce7b9d88-47dd-493f-ab49-815dd4d8b099", "comment": "Malware payload (Mirai)", "value": "5a028cc95ab60a37c2f161e0bb052568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929406, "uuid": "328331fb-839b-4274-b01e-e744b9839433", "comment": "Malware payload (Mirai)", "value": "a7a7a65aabc047ae3d10c01b9c7413a5748a94a4ac9f9755b6026031849b9f71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929406, "uuid": "99f0bab2-91f1-4e41-b7a9-07cfc1a66fb1", "comment": "Malware payload (Mirai)", "value": "912da8dd6e3b3333a5a0ec6d06a0fb516981d23f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929406, "uuid": "834e8902-28e0-475f-a31b-a91864c658c9", "comment": "Malware payload (Mirai)", "value": "7fd33774d93c385e0eea379af48cabc54c7df5005de9e9bbbc91af4f395183ff94cee23f7fb6cb1fe2c02c28c8d3222e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929406, "uuid": "ab657eb0-7601-4581-a36a-67ef8797b94c", "value": "T11E262A57B8918A83C0E42676B8BDC1C433A32EB99B9753675D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929406, "uuid": "c2a8e8a2-ae91-4db3-a3e8-50e951f63870", "value": "98304:8mFwDafXW+edmIoJ97sJ5xn2252Of7iVpBaKE:8mFn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780929406, "uuid": "048b4c36-76fe-40ee-9a6a-fdd3344a6b03", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780929406, "uuid": "75a9293d-20f3-496f-9b70-baab74c4f07a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929406, "uuid": "b5c2e463-fb47-4795-aa42-e098b7d36440", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63475929-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941394, "uuid": "9c9f343d-d49c-42bf-a0d5-8b95bb90bfbd", "comment": "Malware payload (Snojan)", "value": "1f7525cf4ba315964d577dbf23202bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941394, "uuid": "fe614ddd-4a47-4dfc-aa49-473006db3ab4", "comment": "Malware payload (Snojan)", "value": "a7da7296eceb961c6da5f6f33a58f001c3a1133b28f26e16e2af0aa3e6556808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941394, "uuid": "5bba51ab-ed72-4e2a-b881-547f52df228d", "comment": "Malware payload (Snojan)", "value": "59e9fb5649ee6f9f9e77724d24f85b8cef8cd8c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941394, "uuid": "49bdab78-7049-4989-841d-a255ee67d195", "comment": "Malware payload (Snojan)", "value": "ebdebabe742ae1cbf365f3006167267f6614cf6e798f65a9fdccc52a8410f12901139615b217c9c2b2c5702dd242e920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941394, "uuid": "d4bf1ea4-f423-484e-8cd9-41378f03e47f", "value": "T12835232471C0C4B7D46B403544C9CA76AA76B07247BA89DBBBDD63F9AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941394, "uuid": "5a371c91-a0ac-4f27-8877-96191dad47b8", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941394, "uuid": "b4788898-7839-4f1a-9c97-f3330a606932", "value": "24576:/Y+Ek70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyLBP02:+kQTAKYS/v6h3+1uhZcT2NnvOyLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941394, "uuid": "99c3d231-5a9a-4c4e-88fc-aab54e33f848", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941394, "uuid": "ede6fb9e-a47c-4254-a921-b9b26774999c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941394, "uuid": "7c0ba257-678a-40de-97c2-8e1a0eabe024", "value": "P2dn4IpJ4S7oYqnN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbd3987-62f9-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1780895727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895727, "uuid": "4ae92376-4028-4797-be48-2160e7583396", "comment": "Malware payload (WannaCry)", "value": "6faee58d13b62ee1311f9e993f4fbbdf", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895727, "uuid": "b23fb3eb-952a-4c15-bdd1-7f11b66db31e", "comment": "Malware payload (WannaCry)", "value": "a7e119df5e8a39312308a121388d85388ef25f5990401206eef6be9c8bffddb0", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895727, "uuid": "08ebc6a1-b64b-440f-b31b-6fae8180ebc4", "comment": "Malware payload (WannaCry)", "value": "185c2c116e3dd045cbe5ba18ee8509d6a285c3a5", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780895727, "uuid": "894235cf-9bb2-4486-9261-07649276aad0", "comment": "Malware payload (WannaCry)", "value": "fc6f7a0e9b1b64c9e94a8eb7ca58b64d35f6bac01c8bd5d35367ae48be4bca3627be2a49173ae8c860285d26ca5ccf94", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895727, "uuid": "18b697a3-23b7-402e-a82a-fbb706100a06", "value": "T10A36339921BCA1FCE0111BB484B74D2AB7B33C4963BA5B0F47C487AF0E53796AB54742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895727, "uuid": "a94b856c-ffc0-4b61-8dc9-8214a7458276", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895727, "uuid": "22c771ae-e5fc-4c24-8df6-f457c605d495", "value": "98304:DXDqPoBhz1aRxcSUDk36SC593R8yAVp2H:DXDqPe1Cxcxk3ZCzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780895727, "uuid": "198e9368-d568-4f5f-9989-9d00d5a35ee8", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780895727, "uuid": "2ff4a6cf-b41d-4106-8512-06f5ad9878cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780895727, "uuid": "760eb811-555f-43dc-912b-fc4d5dab17fb", "value": "a7e119df5e8a39312308a121388d85388ef25f5990401206eef6be9c8bffddb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49ab32e-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908513, "uuid": "3d4e14ac-721a-4d69-aac5-17dc8280abfb", "comment": "Malware payload (AgentTesla)", "value": "9cd43d0e97124dbde084c4e1cfa40688", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908513, "uuid": "72d5236b-bedb-4c58-aaad-17067ba0f4a8", "comment": "Malware payload (AgentTesla)", "value": "a8846738a8a449ee440155bda5fefa931fde05aaeafb24d166f67d053759fa77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908513, "uuid": "157fd9b0-f7bb-48b5-b00c-c14620961fe2", "comment": "Malware payload (AgentTesla)", "value": "8c1d155c89a303d0583deb078e70012003b1fa49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908513, "uuid": "9286bd00-a4ce-49e3-9f6e-4be8525dd789", "comment": "Malware payload (AgentTesla)", "value": "5a68c78dac8334ea7e70744e227d9ce9d64b851ce29c3da3459dd1f587ef25fff61bb3523e00c433ade8a65d49327dc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908513, "uuid": "cb06a1c3-7dbf-4397-9a73-a1f35aa0537e", "value": "T13D35F1102D562F14D52F1B78C1660054A7F38C478F6AD3DBAFEE1CF83A66B85CA1A613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908513, "uuid": "faddee7f-6ebd-44a2-b580-15d5d980ff43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908513, "uuid": "48f60084-a083-485e-a059-b4db0d447b15", "value": "24576:Rjb6e1AaPedLAR0Uq8FOzPKPK3HAtK2E07p:RjbNPe/Uq0IGXQ2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908513, "uuid": "a2b06fae-46a8-4aa0-86a9-f224f14d3e7d", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908513, "uuid": "d54c6b11-3415-4c1f-b41b-3342e426acb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908513, "uuid": "2415c1d7-dfd4-44da-b028-bc23523451fd", "value": "a8846738a8a449ee440155bda5fefa931fde05aaeafb24d166f67d053759fa77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cce5ee-6384-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780955733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955733, "uuid": "2b445479-a46a-4eb3-91cb-5431fe99e84a", "comment": "Malware payload", "value": "f6b5d021718566182c94af86dba1c1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955733, "uuid": "cdd6fe7d-e057-476d-8b43-fc597c1ea25d", "comment": "Malware payload", "value": "a8a02fcd5ee2939a265a72623fa5a101b5d03231306589e11254ef0c50aed375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955733, "uuid": "773003af-f43d-4ba4-9400-e767e8905cf4", "comment": "Malware payload", "value": "2274d41a32b451d0ef4164a56ee8c17266d2a535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780955733, "uuid": "91e244d4-b93e-4c1c-ac1b-9180e25a22b4", "comment": "Malware payload", "value": "16f89cb07a711382237da3ca4a9c20ee21ae64212364576a62ad11054b64ea319170ff1ad76bd89477ca39a5d836f5fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955733, "uuid": "af107499-7b03-43a4-aee5-c181a5a453ce", "value": "T15195490B7CE40DEAC4AA633289B75292BB75BC490F3263D72E51B2382FB26D45C75354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955733, "uuid": "11e797d2-c934-435d-bc95-b33d1320ffb4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955733, "uuid": "ec368b66-c723-41ab-aec4-2a932a169ce0", "value": "24576:+KBuBJtZYFCi7JbkrlGYbXlr79pd6eMyBk/xhot8u/nBele7tKDyiTrAZ:+Kw/t2FhbkhGYbXx9pd6CBk/x+t8sn1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780955733, "uuid": "10dc88d7-7288-4dfd-9790-1e7066d42360", "value": 2058400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780955733, "uuid": "ec9cea47-743b-44e7-9e27-157650a02c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780955733, "uuid": "b0023366-c5f8-4bb7-93b3-77ab96bca4bb", "value": "\u041did\u0435sinstr\u0430\u0440\u042564-v.8.477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7f6803-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780911321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911321, "uuid": "1a3fb101-43ac-4ab5-8a76-24dfc20f476e", "comment": "Malware payload (GuLoader)", "value": "94cb6fa33a286b6e283f7955e1cbf62d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911321, "uuid": "d5fe9302-f29c-4422-b705-5e1a4290a4e0", "comment": "Malware payload (GuLoader)", "value": "a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911321, "uuid": "42de62a4-2424-4237-a415-767825f497f2", "comment": "Malware payload (GuLoader)", "value": "6444103c3add87fc2ec252790932fb428ec76fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911321, "uuid": "0c2d71e7-20da-4235-be60-c96810b76a6c", "comment": "Malware payload (GuLoader)", "value": "829d1a818a2ad899a7c4f986892a4dd10ec3b333e65c82e6ccf9c551abecedf399579cc51842a2b51730143a65f2bb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911321, "uuid": "64bc2132-f696-446f-8b1e-c9a452d4206a", "value": "T143252398F375831FE855D371C8BA8A60CB78AC6C3449960F6345B1A63CB37CA46153EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911321, "uuid": "c75d47eb-3996-49a3-8387-af468b3b33d0", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911321, "uuid": "7357c18b-85ff-4ed2-95f3-82bceeb3520a", "value": "24576:oA7F7uC9LPvhdBuylMeBEFmNZpJGSqQc3DKtbPik+v:oUuCR7BHrDHVSKtTik+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911321, "uuid": "dc584fcd-7d88-4a71-9e5c-a1a8514e4123", "value": 966240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911321, "uuid": "832981b7-6b66-4a41-9b25-ab5252c71c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911321, "uuid": "561d0093-5257-4107-9483-e2b9a9cbebb9", "value": "a8a141ade35e940a15eaec90cbb1a1ea35ab84725fb76bc82d46c3c88dadda04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c97e474-6348-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780929759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929759, "uuid": "461fa58b-eccd-4d4a-86d2-c4df84e77dce", "comment": "Malware payload (Mirai)", "value": "700411d19785f0ba2ded0d3218446b26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929759, "uuid": "bd86dc0b-39e1-46d7-bb7c-60ed89f43462", "comment": "Malware payload (Mirai)", "value": "a8bab0629cb204e43e4f8ed99f50bb40c644ddb8463b0151c589e3832553c57d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929759, "uuid": "14b3725d-8bac-4dfb-b498-ff912d7dbf42", "comment": "Malware payload (Mirai)", "value": "30e11c565253ff5c4a5f996f817a0f8ecf33051f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780929759, "uuid": "2ae39cab-50c6-432d-b0f1-315a4618c1fe", "comment": "Malware payload (Mirai)", "value": "b27b8a7b1fb5216ac1fd6febe111965a1b746e50c2287f8f02d203cf940056ebae5b8d1f2664e4653bc1efb1aa5ad54e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929759, "uuid": "b30e2ec4-042f-476c-b333-51efc0acd4f1", "value": "T11C262B51FACB84F6D9031D7040BBE2AF17316D098F25EB87EA447F1AE97B6910D36218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929759, "uuid": "0fb3ca35-9c51-4d79-bb33-f115b17d0214", "value": "49152:nlAAjDhh8wzQ98GEoyDZvUX39Iqk/GbzBC07uJAo5XX86pxuyvmezvwG0VF1:nlAegwzQdEUbzBC0m5XMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780929759, "uuid": "3184ad7d-fa70-4106-8ded-abbe4b0b4390", "value": 4485120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780929759, "uuid": "cc89e9d8-8cae-4117-ac42-90b0194d9b4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780929759, "uuid": "a98e27b5-77cf-48ba-9d4a-a28ecc11997b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ada14f-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911890, "uuid": "3f78c40f-54f7-49a5-ac0d-d83c0fe9fc6e", "comment": "Malware payload (Formbook)", "value": "de9744446b2778a51d3f0e1d82862017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911890, "uuid": "f91fa65b-e637-488e-a35c-40bf3302e708", "comment": "Malware payload (Formbook)", "value": "a8bb0249e51a19d2a7c9d326c496cc4a5564c3be5389cee77c292de6c1285aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911890, "uuid": "f866d922-e69e-41c0-81e1-62c0b2b45295", "comment": "Malware payload (Formbook)", "value": "3814789b0411401a0e4b971bf3ba6b25e7f7cd1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911890, "uuid": "5b6810f3-1401-4990-9a9b-b62b267a8ea4", "comment": "Malware payload (Formbook)", "value": "97de3a8aa3583005c6a4023a05309851b200a1eb8ad2bb570651ac5d2777f13f47c0232175a1c99b318937f13b3e1652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911890, "uuid": "65bc1852-3fa7-4d6d-b96c-c00f83afacc9", "value": "T1C225121C7504E603CA912B381EB2F37523691DEDB611C71BCFECBDCBB62A6450E142A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911890, "uuid": "b2928185-b831-486f-b2a4-a59f3780761a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911890, "uuid": "05e6e115-6ed3-4810-83a8-23633630e99b", "value": "24576:lxErqGBvK3lGt88cLrJeraDhWHzp/BQ8dEjrR9d:LE+eK3UtLckSAz1BQ5jDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911890, "uuid": "fc08d2b8-c48b-44ef-8f7a-d827eaafeb7e", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911890, "uuid": "776bc794-53fd-45e1-9368-f78b3ffbf1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911890, "uuid": "993a6809-2ee0-47e8-a4c5-5f1898719a14", "value": "a8bb0249e51a19d2a7c9d326c496cc4a5564c3be5389cee77c292de6c1285aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edaf8fd-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911644, "uuid": "e49c2100-ed07-43a2-a950-b9d723173576", "comment": "Malware payload (Formbook)", "value": "40b58b9bc973e1432500c8e2cbbc5e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911644, "uuid": "e3d0d6b4-9b0a-4b6c-8c54-bf5d95257622", "comment": "Malware payload (Formbook)", "value": "a8d0d39ecb6c9bf04fe201e447a7f5eb9b53b7bcd659946c568a9ed65ade2b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911644, "uuid": "fc0d2008-c662-468e-a513-e4b6ae6656b7", "comment": "Malware payload (Formbook)", "value": "cd678ea5249aa8b35aae043a5033b2501ba914ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911644, "uuid": "86a51e75-1db9-4728-805d-6aff34f88674", "comment": "Malware payload (Formbook)", "value": "f111e4865aafd1b7627847ad670b3275d5610c62c9f680aa82c5ca2f86fbfaf2aaf48d2cd50905da1482a9f3af3218e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911644, "uuid": "97e4573d-0339-4077-8ced-ddf580640cf7", "value": "T17875AF1A23DD496CE4B9EF384F32379406B1FC2198B2D70FB74853797A26A905E89353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911644, "uuid": "19e88904-5dc1-4c30-98db-fe718f2c9344", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911644, "uuid": "f3b0c35f-4710-4b99-abc5-a0ec997b137c", "value": "12288:QuhowH+T53ltmG5VhpQAJMYBUwo92piHlMmau1ouSl1rFumN2H8+9VL72Bc36oKg:h3hPCmQui1rBgc+9ooyfJuz0jy+3Ym+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911644, "uuid": "b3482282-2722-44fb-a0f8-3deb167c20a6", "value": 1561088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911644, "uuid": "a06284d8-3e87-4a50-af42-5d476181fbe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911644, "uuid": "5c88c31d-96e6-4085-b8aa-a202656bfa7f", "value": "a8d0d39ecb6c9bf04fe201e447a7f5eb9b53b7bcd659946c568a9ed65ade2b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a4d6ad-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911281, "uuid": "73e8bfab-f384-496f-971b-fdbb2d0c9aea", "comment": "Malware payload (Formbook)", "value": "a5001f76ddb878e95ee9911c17b64ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911281, "uuid": "a1e8ac8d-c550-45b1-bc7f-9999657a4b17", "comment": "Malware payload (Formbook)", "value": "a99bac1e728dc56860037cee42d2b3f22c50f987e10e010db92f29f88b6f8521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911281, "uuid": "e9f8f7af-0c70-474c-8c5a-db4a2fc0acec", "comment": "Malware payload (Formbook)", "value": "62d718de68d1dc23e2405c1298dfed0607b06378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911281, "uuid": "a80c781c-f61e-4af2-8f1d-aaa3222d9bde", "comment": "Malware payload (Formbook)", "value": "1f6e060399d610d7737b76fd2875b192a78f77b12821a16d25ae71e9edac53636405f6cdd031e557fecd3d94fa13412c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911281, "uuid": "56506a10-9be0-4761-a56a-b7785ef83606", "value": "T17F5423CEEF1255B7E6510FF99A6A11871E3E89B4887CB347CB6A224971344D8890C7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911281, "uuid": "aac6df4b-7cb0-4b05-af20-9ede4a70c8e1", "value": "6144:ilqiSZRLVRANitpQ6ENjrSY0VtZOFn6xFTwUM8dKgtMXok:XiSXVaApJejrSY0e6/wUrkgtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911281, "uuid": "d71f1826-3ba9-4fa6-b6a0-e16220e9c7b8", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911281, "uuid": "a9ce2474-9db0-4c4e-a3c1-bff892e5efcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911281, "uuid": "8bba1a49-65f1-4dac-a953-5a8daa90d966", "value": "a99bac1e728dc56860037cee42d2b3f22c50f987e10e010db92f29f88b6f8521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9b24f3-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911081, "uuid": "d3c94f38-fb48-4d22-a577-0f46e235a9a6", "comment": "Malware payload (Formbook)", "value": "1cacdf7fa7d6fcd3cedf72835a4acf98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911081, "uuid": "fcdcaa59-7ad9-45fe-8579-4b87f702d9a7", "comment": "Malware payload (Formbook)", "value": "a9b9cb7942b46d4296423500146163cad6ee7873cb980ca873eb0466f5823b6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911081, "uuid": "6dcd7889-3a18-4cfa-b886-7f5feb21944e", "comment": "Malware payload (Formbook)", "value": "faa7b5bd195755e3a685e9185b070ebca5e5beda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911081, "uuid": "d9e148bf-d834-45e8-85e9-1642a5bf8044", "comment": "Malware payload (Formbook)", "value": "98020bf684f871ab8f3ba824a442ba26efbcb079bf0b87e866ce16a400078ec81611f10644a29f910435326814fcaa77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911081, "uuid": "64735699-d41c-41ca-9bf6-bf2c58c9fd41", "value": "T103351258B279C407C9A487B50470E1B403BD6EAEA821D7979FE9BCDFB9F9B014D04293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911081, "uuid": "ac6fcae1-1aeb-45f7-8e2a-babeb350accc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911081, "uuid": "93bc8c40-e688-4d22-9012-8f5005c34951", "value": "24576:Is1Ia8wQrRjQ/wu0HLTrRkTFkeprEuuk9GR/QnG8P5sZe:ZIa+4qLT+l+KQlk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911081, "uuid": "e36bb610-53cf-431e-ac6c-43b663781651", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911081, "uuid": "e82ea252-7f86-4c4e-90aa-9b89a87962e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911081, "uuid": "f4d5e424-2cdc-4fd0-891b-1f5398aee5d7", "value": "a9b9cb7942b46d4296423500146163cad6ee7873cb980ca873eb0466f5823b6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d810dc7-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780912957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912957, "uuid": "e46bada2-da5f-405e-af44-6b4cb6dda96d", "comment": "Malware payload (SnakeKeylogger)", "value": "3ae850063d4849d019715209c4672cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912957, "uuid": "357c7625-513c-4f2c-ab89-eb0c530b8fe3", "comment": "Malware payload (SnakeKeylogger)", "value": "a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912957, "uuid": "64771b0b-9c55-45ad-9add-6ae3ee20d4a6", "comment": "Malware payload (SnakeKeylogger)", "value": "460ca530d8a85a0390480e4d70c9906c30c648e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912957, "uuid": "be3ad3e8-1e5c-437d-9fa6-0b2785b6eaac", "comment": "Malware payload (SnakeKeylogger)", "value": "db0b687f9d5bb96d850fb353c14136e22f2665bcf9879e024a9484bff1c9538ca5d03c873b13eb77615d7f3f61ec1f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912957, "uuid": "f6cb4292-b990-484c-bafe-98a71ee2f58c", "value": "T1E40512646F48CA03D8D323B80EA1F276A3B88DCDEA15C3165FE9ACEB79797604445353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912957, "uuid": "2d1dbc4c-e6d1-4a31-9e13-a73fc32a2186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912957, "uuid": "8cae1bae-7223-48d3-b034-70536699a6c6", "value": "24576:cev6tcBvx6XkykwBgoPNYamURtVoZ7dt:VS1XfdDDi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912957, "uuid": "b0bbd50d-a280-46c0-961d-ac5f43e74e31", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912957, "uuid": "a2460265-0c13-4db9-8f1d-13466cfec562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912957, "uuid": "88dccdc6-4185-41e2-a9b6-8aecdef4456e", "value": "a9de89f097322550ad36a1ea587db236ec2d4921aa08e71c20efc22e36d1eec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7127b699-633b-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780924237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924237, "uuid": "8d5326e5-d9f5-42b9-94b8-524556fa367c", "comment": "Malware payload (Phorpiex)", "value": "6a4d5b1d3b14ca12a0ade5384502281d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924237, "uuid": "3831fb89-d03b-4241-8803-afdf3cdcc460", "comment": "Malware payload (Phorpiex)", "value": "a9e844605415b1008fb3ffc201692fa1546d4a78aa0bf2ff8cc37a1be2b6487a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924237, "uuid": "89a0e53e-e269-4fb2-9dca-e47950d5c769", "comment": "Malware payload (Phorpiex)", "value": "cb3187e15569c7658f46c6c72e3a5aac92c5e8a1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780924237, "uuid": "49100446-e768-47b7-a136-7d45bc579e1c", "comment": "Malware payload (Phorpiex)", "value": "e6148fe8b376e71f30306694fe72b28a6aa22fc800d637baae4bda30b5d95c6165fc4d81a3afa844445e36e4ac6b4140", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924237, "uuid": "8cff7da2-0b1d-437a-9c9e-726de6615cf9", "value": "T103825B0FF9424326E0D10074866242BBE979A87A73C454D7FB918AED1B686D2EC3325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924237, "uuid": "b0688da7-07ff-4d0b-8dc9-71b4d3b679dc", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924237, "uuid": "8f828410-427c-4b1f-a0a3-95317ce818d7", "value": "192:y6hSCngTBvPV0K3EdRgqwPGle6/C/KUSf8zwAVYNd5Lo+EI2DoCGJxTmv8U9cthX:TIPVGwPG0Ud8xVOdVo+A0jav8U9cX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780924237, "uuid": "b2ce3797-345f-493e-8880-7c27d23d7b21", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780924237, "uuid": "b04e4922-a38e-41e7-9713-67d474a46be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780924237, "uuid": "dac4acf2-bfe4-49ad-8056-03d806c9c8ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b7e2a4-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780911553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911553, "uuid": "682236a0-2253-4a8a-93e8-844bf2044685", "comment": "Malware payload (DarkTortilla)", "value": "00e7ac67b9e8cbd06294593290e3b678", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911553, "uuid": "a60c26e2-a5a9-44fc-84a9-04ed141cf92c", "comment": "Malware payload (DarkTortilla)", "value": "aa07b7367de6b7acc7e205067ffcb4eae4d63286563a59dc671f701645146d01", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911553, "uuid": "38d72014-b459-47a0-9b07-a14cc35fce7a", "comment": "Malware payload (DarkTortilla)", "value": "67b3f9f5336403e50f444307ba647594e1e560e7", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911553, "uuid": "6885d226-7432-45bb-8e9f-9ff7f409caab", "comment": "Malware payload (DarkTortilla)", "value": "01ad247aa7b93fdcd75d1c67d04036f74a93d44d3ec82522395ebe751d65512fdd8a55ba0a425ab198f535086884212b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911553, "uuid": "89f622a5-a758-489e-ab7b-71723c650075", "value": "T12775D02E2ACF445CD1D1DF789B3337D407B0847748F2D35B7B885378EA1A6A5AA8C252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911553, "uuid": "bd3353c1-fd8a-403e-8f21-b9a2d7666ecc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911553, "uuid": "69fe263b-53a9-4a2d-ad7b-c51ea7953ed1", "value": "24576:PMPCmQui1rBgc+9DXd/kfPeJXpqdYc3upAOPmRO:kYus8dXEfRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911553, "uuid": "6bd53315-ff0f-4b5f-b53a-742a2750d07d", "value": 1606144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911553, "uuid": "b308be58-39b8-4219-9b18-c1e1b246496d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911553, "uuid": "011186c0-6a56-4508-8969-ca8ccb4b4944", "value": "aa07b7367de6b7acc7e205067ffcb4eae4d63286563a59dc671f701645146d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1f3d8b-6328-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780916122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916122, "uuid": "db76a16e-6e22-4592-9d8f-ac4d34103a95", "comment": "Malware payload (Mirai)", "value": "397a20e746123bd080d458f6db94e395", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916122, "uuid": "205fb351-a316-4155-a2e9-d12e9e0f2457", "comment": "Malware payload (Mirai)", "value": "aa0aec086c581a5b3e703e116b8f00a353c49672dfcfda67abf86cc354b5b297", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916122, "uuid": "f2ab9629-1961-48a1-a1dc-f293164fc2f8", "comment": "Malware payload (Mirai)", "value": "53e809362c11a94ef3218a6fdcef03cc6e235e72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780916122, "uuid": "aeac1126-6c72-4104-aa50-cb21f6a5a18a", "comment": "Malware payload (Mirai)", "value": "a0585a1344c5945aa969c565ddc90f379906a6ec7aac951bb6fd7476c706ecafeabf5bd084975666f031d0154c7577f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916122, "uuid": "5a20cd4a-1d29-40c9-b147-459831cef5ef", "value": "T10B333984F64B81FAD4074C7001A7F73F8F31E4E90264965EEFA9DE36DE676429211A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916122, "uuid": "0e76d40b-da4f-4cb5-8c71-39d4d6141cb8", "value": "1536:n9eIw2MG8jViTbj1Cx2Qe1QLiTwWpIeufK1aNPag4zCYdkC:n9eIwW8jYTbj1ozeuipWeufKsNPb2CYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780916122, "uuid": "467724ca-f986-4538-b903-742564d4fe8b", "value": 54352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780916122, "uuid": "80f3dc60-9837-408a-8ba8-37105df2961d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780916122, "uuid": "dbdb0b22-4dc2-4a4a-8ad0-6ee200c1c304", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9468c8a-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780912306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912306, "uuid": "3b3a8eb6-caae-44c2-99a8-83b047f89547", "comment": "Malware payload (AsyncRAT)", "value": "bf60422cd6be29dec23354ba9c503454", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912306, "uuid": "9256002f-45a2-4565-bbfa-f5d2b92b5553", "comment": "Malware payload (AsyncRAT)", "value": "aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912306, "uuid": "8c486280-74b2-4f5e-b024-a14bb7e7b333", "comment": "Malware payload (AsyncRAT)", "value": "cbb6ef5dc04b91f30330c3134ce8b661158419e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912306, "uuid": "1f7320b0-33f9-468c-be53-fe721a7e8ba8", "comment": "Malware payload (AsyncRAT)", "value": "56f5de34c48da50201c70ecec3679f5a0d4d3f1f0a042eafe904ab19810cff6d5f943be9e9ce6a76bac972f8366acd8f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912306, "uuid": "2e942b46-33c6-4a33-97a8-833d3ab22d62", "value": "T14FF412B867A8D757C87A8BB10922D27047B91D5EDA30D31BCFD8ACDB3D297619408393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912306, "uuid": "69e0e8ca-eb84-49a0-aa2e-875cd25dc97c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912306, "uuid": "44a7f4a2-9481-4515-87f9-82da56db0e83", "value": "12288:+4ZvsHPNzQF9rqPVGkVPdJL5hU+S5CQWiFiROPU512sLb0KM9R9OCtHn:1ZvsHPNzQF9rq0kVPdJVhmviYs54IbmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912306, "uuid": "93c77813-53ad-483d-a8de-64fa8f78a9e0", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912306, "uuid": "b89afdfc-c26e-469e-8dbe-c755ded2c9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912306, "uuid": "3ff4f921-5a6e-412b-9d13-11cb7f9baf91", "value": "aa940c1b4d36e35870b5f400f63f3b86e9804043f447a06b372efc54a6ead17d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a4c761-6346-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780928964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928964, "uuid": "d9a017a4-9687-4c72-9487-7c1520d75b4d", "comment": "Malware payload (PhantomStealer)", "value": "8d7d862764133123ebda6629a56ae121", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928964, "uuid": "18a9167b-98c0-4cf3-9fb8-3ad8612a5b8a", "comment": "Malware payload (PhantomStealer)", "value": "ab17872420939f56f7b6d8bace656d8351e613a0d3b5804b5983d777eafa0272", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928964, "uuid": "fe37ea0c-7145-4376-a79f-2c82333117a2", "comment": "Malware payload (PhantomStealer)", "value": "a8d586623728657e6ba396bd788f06698138be22", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780928964, "uuid": "56361237-5453-49dc-97c5-cc6f10c8b62a", "comment": "Malware payload (PhantomStealer)", "value": "5fcfbc7745f152ee2e99376f479eea964a6f0161693c9a3e17a3e9408900442320ff059237f1411f8f1a1ad7a5263ca9", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928964, "uuid": "297d022b-a4d7-4ca4-8a01-d358abc4fb08", "value": "T111E533F9FE89F87C711AC8AFE86C305245B30FBA030A47E58A44841FBD5997256D7B18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928964, "uuid": "cad04e33-8d03-4469-9914-b17f33291c8d", "value": "49152:R5Csk1advqzDWSSThmewO58FvFcUj0lYCPJ73iuI9rhFXlaZ5soaek:RAsIaEaS8QOicUj0lxPsuOVNlansoaek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780928964, "uuid": "1955f8de-cbf6-45b0-b6dc-3043cc9e1b4b", "value": 3169160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780928964, "uuid": "d8465e38-4991-496b-ae31-ed887a6b19d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780928964, "uuid": "c419c169-7d96-4053-b418-61fcc33a61f1", "value": "Quote_Q080626.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d664c5-6356-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1780935895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935895, "uuid": "5645f86d-a065-4fd2-9bc0-3ec3143050f0", "comment": "Malware payload (PureLogsStealer)", "value": "76c6588e045362ec0c7685196c385a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935895, "uuid": "794c3b5d-a574-45eb-9814-856310eef315", "comment": "Malware payload (PureLogsStealer)", "value": "aba177f7474cff25ec56a8d1b8f0b80c9104c2d9e8b6e4eebb9dcd5e625b10c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935895, "uuid": "22e2dd57-93de-4232-9acb-2d1fa4ad8fdf", "comment": "Malware payload (PureLogsStealer)", "value": "5907f2d9476fa87a95bfef98fcd7907497e9010e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935895, "uuid": "9e1e2ce2-4f0d-45b6-99f6-48b6dbcefde0", "comment": "Malware payload (PureLogsStealer)", "value": "18a3277435b91839b501cfa52df638067a9e7a3fca965835e3533216666ed2a4ba6c51c261634ec7061cfbb5f1eab2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935895, "uuid": "b5a682b1-9d59-430f-898a-d55c0d42232e", "value": "T1E7C4010A3BD45711CA9056B6C2E3A9B403F3E54B76F3C34A3A804BD60D85BE4ED95F89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935895, "uuid": "b3cf81e7-90e8-4ab8-b93e-df27bbd586ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935895, "uuid": "3de67e98-f7e5-4d0a-8d73-bc3843aa0ff5", "value": "12288:P7rBP2jmXAgnZHEW+Y61Hui0TUOxX5/E79cBRrsq:jdujyA6EW+Y61HxoHxX5/E79crrsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935895, "uuid": "55d91281-c854-4dd2-9ff2-ebf33465ed1a", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935895, "uuid": "d5712500-6f8e-4051-b128-1f57727abd25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935895, "uuid": "99aec682-9375-42e8-bf65-8371ce37de57", "value": "SecuriteInfo.com.Variant.Barys.508189.92481565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a137ce0-631c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910911, "uuid": "670aee52-60a5-4279-9843-beac6d506186", "comment": "Malware payload", "value": "a6c5e17748d406eb59b99b7606191a34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910911, "uuid": "0863acf3-8e1e-4957-9b19-70bff5549155", "comment": "Malware payload", "value": "abb06c6789ca3f26dddd3cf457a085fc3fab60560d7596e7554089a112b823e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910911, "uuid": "856cee94-281d-4a39-8c59-e9ae995f1ded", "comment": "Malware payload", "value": "a33c20323811d8e242d115a9a8f7b5e9456b1979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910911, "uuid": "1584ac66-08dc-4c5a-b288-ca1b73c85993", "comment": "Malware payload", "value": "7d1387a0c13af3819ffaabc986f600e31befd88b7fe7afa9e96d15fce9e54716fefda84a3c1c59547574f2febeddf855", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910911, "uuid": "7a93f2b1-3b36-4a3c-86e2-874b653b8f0e", "value": "T17A55BF3D37D74A9DE464E374A9333B920BB0F426D979C70BBB7582B8482AB615930713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910911, "uuid": "917e8487-8a2f-4726-96c0-f23cf622813d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910911, "uuid": "ba819409-b2e2-4bbf-9c58-050c3da532a7", "value": "24576:8L/9GUN5AidLVkzQU/Q3RvIvW/J/Itii3iqQdZudAvppZeiE:m1G0bhmzI3RK/3iTZudAvpbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910911, "uuid": "c067f96b-54af-446d-9b3f-64d579d9d34b", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910911, "uuid": "ae2d8ddc-a241-4df3-9455-1179b5cb4839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910911, "uuid": "7fd2256e-9ee2-4563-a6b2-0fa53af368ed", "value": "abb06c6789ca3f26dddd3cf457a085fc3fab60560d7596e7554089a112b823e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e89d443-6341-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780926837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926837, "uuid": "07abb4bb-c8d9-4d3b-ba10-441d8d4df40e", "comment": "Malware payload", "value": "bc885a0ea101489f73e49f4cd771ae33", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926837, "uuid": "550f765d-a300-4e1e-a92c-710f41b03cae", "comment": "Malware payload", "value": "abb381c26520d856f9d7f8ea742675c12c49fb95fbbd325007783153fcc2a617", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926837, "uuid": "312d57a6-8bdf-4f54-a032-b137e759ebf6", "comment": "Malware payload", "value": "1902896117af024672c4e473199cd51620c39605", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780926837, "uuid": "0d6a0c53-2cc7-4cb8-809a-2a90cfbca4e0", "comment": "Malware payload", "value": "f595e47acee3f536367566e5b5b9380f67ea9793e97714a9f40dc4779bea9790361b812092223efb148b6daf8626e0e1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926837, "uuid": "d62e3312-3e79-4419-b28d-e1108d125efa", "value": "T13731C99B0B193B984424EAA773B01958D564F5DE209FD7A0FF880C7A92C8549330DB4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926837, "uuid": "d1949faa-4f2e-49d9-84b9-06b19865895b", "value": "12:5QrWdfua+IirI4KU2/rVaYryQvrQNZ1YQrL/bCr9CeWA7rWsrcYrrFJDCY9AFr9X:5dfuMXDU2rnsDfA2yPDRmmMg/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780926837, "uuid": "b4926492-24b4-44d5-8e5c-05b222c40715", "value": 1608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780926837, "uuid": "1412de21-849d-4857-ad6e-e4d3c2d9ffde", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780926837, "uuid": "76bc4b30-b7f6-4a68-9865-bd7b71dd724a", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069508ce-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911174, "uuid": "326c6c3e-2241-43ef-b129-91fa778740da", "comment": "Malware payload (Formbook)", "value": "6a9e746ff38f16765c3b666c30ee9db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911174, "uuid": "18c43e52-fa1e-4523-a604-bf60f1f9a0a4", "comment": "Malware payload (Formbook)", "value": "abf64e6e2580c4ffb8e4740271bab74654cf1eec931ed50e7f6a7e6eeaab8fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911174, "uuid": "a875beb5-9848-489c-8dc2-8e6dfd3ea471", "comment": "Malware payload (Formbook)", "value": "810c72e34e4276931c0df44ebe6a668f20dea444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911174, "uuid": "adc74903-29eb-47e9-ab9f-7ebf81fe150a", "comment": "Malware payload (Formbook)", "value": "1a3d303c04605f7e6454c6a8e347033f993b8024f88b71d3039b5559f45c91371b0a0f80708a799de44e08570dd68333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911174, "uuid": "ddb6670d-9214-4120-9182-afbe4b283aa7", "value": "T180351218B66AC503C65546741931E2B897BD2EAE7420D78B9EDD7CEFB6F2F054E00283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911174, "uuid": "3815e48d-d68d-44fe-9cc9-f85f4ab00179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911174, "uuid": "a6ed2eb9-66ed-48c8-b812-858ffdc51d05", "value": "24576:yi1ISH0NvQU3zLcrdw5tVfbBNLqwErcUeCAoFhVm:9IME4UDgruBBN5wc3CAot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911174, "uuid": "eedb8c4d-e912-477b-8f9f-b51d5728dfb3", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911174, "uuid": "1420e0ba-0169-46e4-bc3a-8fa4322c3aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911174, "uuid": "8c4cf1c4-c17d-43c7-9997-12bb19cdfd1f", "value": "abf64e6e2580c4ffb8e4740271bab74654cf1eec931ed50e7f6a7e6eeaab8fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b0a497-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877195, "uuid": "1333cfdb-f86f-47d8-8ea0-08316e57b1b6", "comment": "Malware payload (Mirai)", "value": "88a0a0d6afca40886048f7e78a92a8fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877195, "uuid": "7c0209c0-7ae2-407d-b17c-6e4a656b34bf", "comment": "Malware payload (Mirai)", "value": "ac5617a78e956575e784a3e35f84c4ce917a4896cd7a74750e9862ac94a8c253", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877195, "uuid": "d1149c21-8125-4836-885e-584323c878cd", "comment": "Malware payload (Mirai)", "value": "65ade19ed6fdb65e81385c20b6341975de57dd16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877195, "uuid": "e4e00e7c-3fea-4e1b-bb22-27b4f3720b24", "comment": "Malware payload (Mirai)", "value": "cb9deaa53761999e061feaa1fa84e50d02573bfc87e4bad630a563b06571804623cf184eaece30a80e8a92dcb146ff13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877195, "uuid": "f8635c92-628c-43a6-9b0f-77cc59f0d42e", "value": "T1C384771399154492E1255CF2227733C5A94BC7BB88E632D3ED5B49A1FF3182B41BEEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877195, "uuid": "95a41cf8-3e24-4db5-9aef-fea0b4f1677c", "value": "1536:1eZGb864TeOxxlH8y2LKOoj9BKkNrzxXnPhvA/g1QqD9aiozqy4sLUjHejTstmGe:EZkJoxb2zMKkrzZu/56+joCfg4CcsAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877195, "uuid": "89a24684-ae0e-4902-ba7e-56fc6be427a1", "value": 383220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877195, "uuid": "89e5d8d6-2ad2-4114-9862-325aba6de5e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877195, "uuid": "8060cbdf-28b0-40f9-896f-c9c787c8075c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49ee6f7-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780912835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912835, "uuid": "5fbc0cda-e328-44da-8965-de45f44761bc", "comment": "Malware payload (njrat)", "value": "cb4ef2a24ef3197958e33b2dcaa38e18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912835, "uuid": "a3aecbae-a0ea-4b24-ac97-fbc7f5d6ed2c", "comment": "Malware payload (njrat)", "value": "accadfe65231c7dea9502fc93f84a57550d9d814ca99d5ebcc8822dfba5556aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912835, "uuid": "e592496b-22f6-4609-8e20-acfdf3f24602", "comment": "Malware payload (njrat)", "value": "2dc57aacab86b90fa2c7b8bf40c723b62d0fd821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912835, "uuid": "6c4044da-0d45-4e86-b1fa-969fa2e04ca1", "comment": "Malware payload (njrat)", "value": "c9028a4b5159fa91227264b5e8c15eb7fc394d8d2c57907b9975603ce060a0f7c37535d32ec71bbd6998304b985dd23f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912835, "uuid": "e9770114-2955-4a32-b795-a467b1e59bdf", "value": "T1400512686E2AC642D4E207B54BB3F2B263B85D8DE211C2575FD8BDEB38757142849313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912835, "uuid": "fef99f64-e64b-4964-9df6-692b212d9f18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912835, "uuid": "e2828d39-1b4f-4400-a16d-f0fcfe68ce96", "value": "24576:QAie8GDDnSbP971UulGeMcjaaGIl7X5EN1:niyDnSbPv17MoaNId58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912835, "uuid": "ffe38ec1-076a-4185-8aec-8fa3a40dda1c", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912835, "uuid": "842d1eb6-14e1-4cca-b141-6d2854d1142b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912835, "uuid": "01c4590b-13a6-47da-af8d-7f08f5a49ba2", "value": "accadfe65231c7dea9502fc93f84a57550d9d814ca99d5ebcc8822dfba5556aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14264c47-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780912914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912914, "uuid": "f9050a5c-3f80-4833-a163-8533328aeaac", "comment": "Malware payload (AsyncRAT)", "value": "fb81c1838ff23c836f0ddc136859d009", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912914, "uuid": "9694b64d-d5ef-4466-8e96-f0f01ed0befd", "comment": "Malware payload (AsyncRAT)", "value": "acf70399dae65805a61e95b8a94602341ef0951d53aae400f99fbb0891bacffd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912914, "uuid": "fa017f0e-41ec-454d-b156-51d34fb80365", "comment": "Malware payload (AsyncRAT)", "value": "31584744cdd31a0fe924df68134a3a57cd2a6a9e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912914, "uuid": "96072570-2d5f-490c-94c7-02b647dd2152", "comment": "Malware payload (AsyncRAT)", "value": "ac560a0f1f2aa96a6e25c79916bbfe4e47dbdcb359424b5a75e070b20f8d5b3d81a1c9abf2e79e51c537b90ccf520098", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912914, "uuid": "2ba44721-90df-453f-8252-fa5e80b87c03", "value": "T1FAF402287BA9CE06D4EA37790E60F27253745ED9F914C2168FDABDEF7866B610508303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912914, "uuid": "9f9e1dc6-86b4-4e34-b0bf-c62effee99b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912914, "uuid": "e2c9a1a1-6f00-4f82-b16f-70340e461940", "value": "12288:luyI3W/i3GvbQW3qXVddVuHpTy9EK4chL5O5HdoYUnDM6ShYfMQD1J:vIo6XVdiHpTy2KZhMF6YIDM1YMIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912914, "uuid": "5deb897a-0801-4f9a-9fa0-760c376d6e3e", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912914, "uuid": "0c827307-32a3-4d5a-98a9-74cde3f0af90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912914, "uuid": "822c1610-1acc-4663-86f4-dd9f449b845f", "value": "acf70399dae65805a61e95b8a94602341ef0951d53aae400f99fbb0891bacffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf59520-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1780907963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907963, "uuid": "37fafd1a-6cf9-4153-9adb-cd71b386e9fc", "comment": "Malware payload (MassLogger)", "value": "69f50c0060900c5e10e5b30660f6669e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907963, "uuid": "6e4daf62-0cf3-4231-86ea-0584b07c0f2d", "comment": "Malware payload (MassLogger)", "value": "ada6d9edab9d620fccb517b99673d74bdf21521c9de8efc624b0a988d3b8a52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907963, "uuid": "0466b209-a8db-4962-8339-80bb2d8e5c3c", "comment": "Malware payload (MassLogger)", "value": "2968853effcf8732db57bd43db7d5a1e00bc6d60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907963, "uuid": "c08a4571-3efb-477b-819a-ecbca4967054", "comment": "Malware payload (MassLogger)", "value": "40bf2e748ec84a4ccfc759d25fdeaa09ea2b3828397b43c49ce25c1f1d289686ae2a0ae0ca36ebd3ca1975a03c38503a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907963, "uuid": "9a091bd0-aea9-4ae2-ac80-52bd2d969ad0", "value": "T1543502642329DE02C4D74BF46860E3B817788E45A921E313DFF67DFFB97634229452A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907963, "uuid": "8ecb42b7-2fa8-4d06-91a1-8243bb56b71d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907963, "uuid": "479f0f8f-93e4-4c3f-bed9-ccec83fbe68e", "value": "24576:b4TS1NcVEAujXPUNLHlRHgXqETLDu2gcgTkh:b44y+PXObDHgacDufB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907963, "uuid": "62d2917f-8178-4498-914a-686de00e7763", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907963, "uuid": "2828aa91-1015-46a0-b94e-330eb7dabc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907963, "uuid": "134571c9-6979-4fde-a09e-a73c7395dbfc", "value": "ada6d9edab9d620fccb517b99673d74bdf21521c9de8efc624b0a988d3b8a52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e489d03-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780908287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908287, "uuid": "be7b7a49-f4b6-4d9e-baa9-6ffbda754581", "comment": "Malware payload (AsyncRAT)", "value": "6ea29dc51e9f6b611d81bd8152e2dbcc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908287, "uuid": "fb023d8d-a3a5-4dee-8043-3896ed09c9e2", "comment": "Malware payload (AsyncRAT)", "value": "adb964cf76f216318c20012708a1e916dfedc7be162432ea4c50294d35609821", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908287, "uuid": "bbc90bb4-03a2-4344-9567-dd2c65b3c44d", "comment": "Malware payload (AsyncRAT)", "value": "0793d34ed01e29292e7753fe565ab548434a9138", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908287, "uuid": "76064c94-0358-47bc-a9d7-9c04f252227a", "comment": "Malware payload (AsyncRAT)", "value": "dc0f252b338d7cb931480573b79985c03016682b220a9353b58b19a20c559ecdadc83e18a13470cf3fb960b25ee61caa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908287, "uuid": "3152c156-29fd-4320-ba80-1f8032a0d5d0", "value": "T14A15E1142219CD46C5AA1BB82A65E3B053B44E9CE415D3179FD6BFEBBC3A7B02D00B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908287, "uuid": "984d0395-99f3-496a-a6ab-e932cd0db399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908287, "uuid": "fab909a3-7f6c-4274-ac39-f1d55385e26c", "value": "24576:Po37AEFT0DTGDkCP+sAcWrGdMstPY8iXdifF:e73FQu5+UMsPmXwfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908287, "uuid": "184c08e1-2a13-4999-b71f-6bef1b902745", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908287, "uuid": "332e7f50-30b6-4ed6-9ee7-4a6a3583711c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908287, "uuid": "dc3daa88-5cf5-422b-b478-d7d2126c48c4", "value": "adb964cf76f216318c20012708a1e916dfedc7be162432ea4c50294d35609821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f71d11f-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780910142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910142, "uuid": "9809d203-3148-47d7-a0f2-07b16d21631e", "comment": "Malware payload (RemcosRAT)", "value": "aa32520840e4d4aa6307238dc5ce5e51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910142, "uuid": "b38ffd6a-0b66-4a39-8478-65f815ccc0ac", "comment": "Malware payload (RemcosRAT)", "value": "ae19993ca28123ce277b975dbf1856c38b4e7aa0c35f6baa74397f0749828a4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910142, "uuid": "443eb7c4-93bb-4143-85e9-0c94e4e6dc8f", "comment": "Malware payload (RemcosRAT)", "value": "0ad7cf3e415ae4f8501fa6dded68a15d70f45371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910142, "uuid": "1173ca47-913d-461a-a52b-27a1a519a56f", "comment": "Malware payload (RemcosRAT)", "value": "6e9e9176aa23e5aea988b1f4ee4ee202b7f9cb54cc5e9a8a8de1e55a9457a9484a39632eb4d46ac87f329054fa8bc5be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910142, "uuid": "4bdd1ac0-a139-48e7-9691-ba05e17f8fad", "value": "T1A355F1D43A26E706CC620E75AA35DEB05AB80DA8F501BAE35FDD3F5BB0AD1506D0CB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910142, "uuid": "4388de14-3d4c-457b-ae70-853b827cb827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910142, "uuid": "5ab71348-40c8-479a-a57e-bb5490801a17", "value": "24576:66aeB1o2Ki04JgbhUemQSUfI5fDElOiBqz74V54a1zUzZ5:va21o1N4kmQOBuOa1zUV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910142, "uuid": "d7c5c4a2-f2af-4187-8558-0a9bc68964e1", "value": 1395712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910142, "uuid": "240fb8fc-bcb1-4c92-b726-74f279ac194f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910142, "uuid": "a0ef67cc-401c-4adf-935d-7ec86ccd0efd", "value": "ae19993ca28123ce277b975dbf1856c38b4e7aa0c35f6baa74397f0749828a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980ae585-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780911847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911847, "uuid": "89b0c0f2-5a11-47ba-877c-0d8910f94f73", "comment": "Malware payload (AgentTesla)", "value": "59181188e931ac089418d2ceb0e4732a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911847, "uuid": "b7848f6a-fb81-4461-816a-a56552ffe9e5", "comment": "Malware payload (AgentTesla)", "value": "ae9085760f4553683f57ddceb9ed30fd8dc3cd30e339d3e1c2b6dbb082d94873", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911847, "uuid": "a9f0edea-d323-4ffd-9b20-2194449a8132", "comment": "Malware payload (AgentTesla)", "value": "55f544f97728632775211f55002fb0b1c2047a22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911847, "uuid": "8604b307-cadf-4d61-a7d5-5a4c60001ae8", "comment": "Malware payload (AgentTesla)", "value": "4e8a192861fe5f76d6202e01def9759465031b36a112fbb0f0ffcea178d923c3c90b4c737f1d46cd532b66f86cc76491", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911847, "uuid": "f129fb27-f47e-4386-8bae-9d6ec8d07c96", "value": "T11A1512686A1AD207C6D19B785DF2F77912691CEEF841D723AFCCBEDBB927A100C14142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911847, "uuid": "b3be5cbc-7196-497a-90fc-631f30c7d35a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911847, "uuid": "066f0ee6-96d2-4045-b41c-cfa606dcf00b", "value": "12288:mrx8mR/paE4Q5MUnET9APynNxGgqOiljuEGe2onyFRhKakvG308RBP1GtW/S:O8+/pTR5pnETqKrGgLjbVhrk23lGtW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911847, "uuid": "bc551e0a-9037-48d7-8e13-7b0597093667", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911847, "uuid": "f3b0c44d-93fa-44af-a6f0-39905961e449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911847, "uuid": "9716d232-7c03-47da-9533-c4fb288eb705", "value": "ae9085760f4553683f57ddceb9ed30fd8dc3cd30e339d3e1c2b6dbb082d94873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8340fa6d-634d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780931999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780931999, "uuid": "a66e0963-09d2-4c32-8b94-714f0bebb6f2", "comment": "Malware payload", "value": "6fd769dadea87b2fe1a49a02eefec04e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780931999, "uuid": "dd514c62-b265-4d28-8f75-f3a02975dce3", "comment": "Malware payload", "value": "aeb6d6d527348ee95eb3551c92cffc89d57dd7973ffe2f3c155180d31f52bdc1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780931999, "uuid": "34478703-df1a-4db0-8440-137393d38a7e", "comment": "Malware payload", "value": "7e1554b2dbe8bdd1a95c18bf27ac8e5fd98ffd99", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780931999, "uuid": "23363543-2d30-450c-aa1a-076cc107269b", "comment": "Malware payload", "value": "b12614f45cde8b1d0a1e2bc741a866707bb28ce8fbd59644b9928fd884904f04f5239effd3cdb895339440e9eb34307d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780931999, "uuid": "9bf68206-0314-47bd-bff9-30f1552d54b6", "value": "T111137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780931999, "uuid": "01a18e1c-ab75-4b28-909e-da5842ae8b03", "value": "768:OXRWNGxVh9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:qlxcco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780931999, "uuid": "10238b24-d98e-4d6f-9e4d-fe7367e39e4a", "value": 45529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780931999, "uuid": "4eac542e-9e0a-4390-9693-b4eae2091603", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780931999, "uuid": "ff1659f7-1b6e-4f45-b998-6a5b4c271e70", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cd052e-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780939593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "409686af-b087-421e-8f81-0e34fc547ec6", "comment": "Malware payload (ConnectWise)", "value": "bfd6c1f1b78be5648edb3d9a750746f0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "92483a46-9b9a-4fc1-8e4b-d9ad9657f58e", "comment": "Malware payload (ConnectWise)", "value": "aeee150da1460a8f4d234a2c61ba9c812bdea002038866b027e5b17bee0eec4a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "06d51c2e-9e96-410b-8d6c-f6c92714eb13", "comment": "Malware payload (ConnectWise)", "value": "8a8efdf289e17d1b67f8e99f21e8fae68e31951d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939593, "uuid": "eb1f0df8-0d9c-48fb-a562-138e24a05336", "comment": "Malware payload (ConnectWise)", "value": "b7d2b88e6dd6dd7a29d3482fa5c684fba39fc0d2020e2964a8393a078f6369a9b156e7381e4723aed01c39a4b1afe165", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "31ae424a-6aa1-4414-abd5-b84000ab2926", "value": "T10156F101B3D695B6D1BF0638D87A56696774BC049312CBAF5394BD392E32BC04E323B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "ffd42313-852f-46ff-97b7-d3f7e6dfa548", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "b49e1a4f-879e-4ef8-88e8-820ec1c970eb", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlHFeFCb:KhfefPtHxcp9ym3nltDUJVWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939593, "uuid": "18575fe4-3606-4484-a5f6-e63c0ecd5fe3", "value": 6057960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939593, "uuid": "ff8f91e5-c729-480d-b290-4fb094f7f1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939593, "uuid": "3f824716-a42c-44aa-8dae-d62b92e37da2", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78eada51-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904923, "uuid": "35ac6cfc-2694-401b-8304-9e92df125dba", "comment": "Malware payload (Mirai)", "value": "e5aa2eb67df6c9f4edadff57ec660332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904923, "uuid": "05f61b15-732e-476b-b1ee-d749d5a7ff0d", "comment": "Malware payload (Mirai)", "value": "af31c25f23f3c2be0eefa4dbc21faf869c617acfd9efe20d9ad41a55102ad96a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904923, "uuid": "015be163-3e28-404c-b2a2-4317539a6a2a", "comment": "Malware payload (Mirai)", "value": "e8f9ea451ac18e4b3433c0df085ae1831fbe25bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904923, "uuid": "31ffd01f-8c16-4c3a-b6bf-ff1c042eb495", "comment": "Malware payload (Mirai)", "value": "ed572ceea72dbe2ba7589dffe28d0546d57ae8a953ca2620126f1a188ca52cc1960ad4049f572f399b35177aaf07399d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904923, "uuid": "4aa6056d-723c-4fc5-89c3-500290700b30", "value": "T179C31A82BB43DAB3E85314F111F7AB359A31FD3F083AD986E3647CE199612C1961636C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904923, "uuid": "2c55ded3-3727-49b2-9f81-a582f133b042", "value": "3072:XzgczWgtfvm1tM5ob7gy5r/WoOogNvgO:XUczW8fvcMOgoFgNvgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904923, "uuid": "c4b1adb4-a0a2-4c84-af6c-759193bb3f96", "value": 125668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904923, "uuid": "90dbe478-be2a-48f0-9480-51850e678a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904923, "uuid": "17acfe75-eb40-4ccd-b21a-af6f82362802", "value": "nova.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c079ab9c-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780911056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911056, "uuid": "5dc9b780-813f-4ca0-81d8-88c898583ef1", "comment": "Malware payload (Formbook)", "value": "104760ccf1b14102b3f8097e887f7fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911056, "uuid": "877894c6-523f-4a3c-9482-55997c7ad095", "comment": "Malware payload (Formbook)", "value": "af329e4d5e2b71199df9dcc4ce27958f9bbcf4a6748ee0739732e71893fbd8cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911056, "uuid": "50f772d3-08a7-4558-b0fa-f5f82036228e", "comment": "Malware payload (Formbook)", "value": "6d595d8fe1575606b5a7f515c1bef789d1720f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911056, "uuid": "309205aa-9eb2-41b2-b535-8d089d7eb6ed", "comment": "Malware payload (Formbook)", "value": "38a101a2a8fb766ee11669bd5bba809183875be929cb9bd2dd7cdcc2d4115e3fefaafb48fad8af8c3dbd383401bc8f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911056, "uuid": "ec93185b-7799-47a8-8cb7-0808c8b2ccab", "value": "T13635015B5E16F402C9415B3B49A1E3BC066E1D9EBCD1E3039FECBEEBF6B66015814182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911056, "uuid": "3d6d9199-7d46-4062-865a-e8f963c9bad4", "value": "24576:gdQqZp78Js1W5VhrhUzJCwD9ge2LQdaIHd7XAeiHo5iL:gdQqT7inECnLQdakiHo5iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911056, "uuid": "73baf036-4e88-4f74-a615-99ddfd368b99", "value": 1091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911056, "uuid": "a192380d-5568-41f7-97c7-9ad3c276c6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911056, "uuid": "54845223-d721-4798-895b-48ad1b5e73c4", "value": "af329e4d5e2b71199df9dcc4ce27958f9bbcf4a6748ee0739732e71893fbd8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5361fcb-6386-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780956617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956617, "uuid": "7a31dc3b-f96c-4dba-b6de-f2ddbc83ceca", "comment": "Malware payload", "value": "f0c8df50e1d4639d7ff95d438e2ba075", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956617, "uuid": "f24984e8-488a-4e69-abd2-177f3cde1699", "comment": "Malware payload", "value": "af618b94cc1c8af951890b24823e1b70434a02fa10dc7b7b36074e7646408424", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956617, "uuid": "c8aeb312-4865-4ead-b4ca-e600d328e6a9", "comment": "Malware payload", "value": "4cfe35dc9984d77bfd78581bd84ed285484e72f4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780956617, "uuid": "84f438ad-8f25-4954-bd9c-ca88c9358cd1", "comment": "Malware payload", "value": "445178da3534cc3e626f3866432e6c308dac93b422cdf55dd5b5289d5948b868cd8ef723d3a879c9b4644a23cdee1a8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956617, "uuid": "b8027508-ae70-4f01-be01-80d3cd9ea2ef", "value": "T112723A0FAA814036C7D01470867B4A27893EA8752788FCD7FBF454CA49A86E6F43606F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956617, "uuid": "60643767-4468-4e3a-9cf6-e3ab387c2c03", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956617, "uuid": "11268652-a322-401e-9b4b-00ccc9c9d5b9", "value": "192:0qwNiyXgzhDDR9y/a+PPhYX3O51zF+9kRaGKUSfDzQvXfRfoaXXuMGJxTmv8U9c9:ei3DTy55N09tDOAcXuFav8U9c0Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780956617, "uuid": "c95adb06-a3f2-4c6e-9db2-35f930bb0230", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780956617, "uuid": "f55bf3fb-9c58-4481-adb7-42941d611175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780956617, "uuid": "12d28d96-35de-4cd7-873d-2a313623d185", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca02c0d-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780907614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907614, "uuid": "97506100-0ef3-42e6-817d-136c3822e7bf", "comment": "Malware payload (AgentTesla)", "value": "5b2d05f2a9ed20ee368e70955e78ce43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907614, "uuid": "a2652a25-e215-4ec4-8bde-ac32abd812d7", "comment": "Malware payload (AgentTesla)", "value": "af72d6fc95c8fb056c4749ed319566be6fbc3b9119eb24412a10da9e6a18c4b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907614, "uuid": "df73640c-f74d-45f2-bbe7-17046a726418", "comment": "Malware payload (AgentTesla)", "value": "090fe5f860b9ee44c04915f9143629959b54dd34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907614, "uuid": "bde57fe6-07a3-4033-834a-43656514fe28", "comment": "Malware payload (AgentTesla)", "value": "e875251307d10737dad230edf7499cbed89b789a93bf9b8108f1bd489ec9b449b98ef4c3673fdf513b40f5642843d003", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907614, "uuid": "bce47095-c83b-410a-a20f-40c4e8c026c8", "value": "T107F412467F205AA7C1256F340E6EBB661770B9191B518B9B3240B72DFFF23C09E06789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907614, "uuid": "6bfbe49d-eb7c-467f-b742-5933ab9903d0", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907614, "uuid": "c74a6e9d-325c-4f12-b386-c433fdeea630", "value": "12288:wlnbd/HClId9wadaYOhUc6TcLSAF/khv1WAWy2g/go/2FKMHSlipI4BRLjZ:kn3IFdmAF/0Rjgo6KNlipI+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907614, "uuid": "54470b27-5d62-4797-b5d2-76c475e95200", "value": 755480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907614, "uuid": "285654c9-7ed5-4248-b0bf-30bc326b71e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907614, "uuid": "ef1ad4d4-581a-4cf1-9760-50b3c3c8d608", "value": "af72d6fc95c8fb056c4749ed319566be6fbc3b9119eb24412a10da9e6a18c4b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f38e589-62e6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1780887646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887646, "uuid": "d7141a73-4834-4c3c-addd-ce642ae2d780", "comment": "Malware payload (Vidar)", "value": "10cdf09b4fe35ef5732563ea5b181ff8", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887646, "uuid": "62eca945-410b-4b02-92c4-047a23c73b63", "comment": "Malware payload (Vidar)", "value": "af99fc284b22434b738cc291317a9bd87ae85ab3fbf9d096cf6bac870563834f", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887646, "uuid": "a0fcef8e-09ba-42bd-9e7f-2ae1df6f3493", "comment": "Malware payload (Vidar)", "value": "8107767400fc9a5a24edef081aacff72108db69c", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780887646, "uuid": "80288718-1299-4343-82cf-b4d8fe968d14", "comment": "Malware payload (Vidar)", "value": "bf8a8ed780c2406db8096faea00c175b5cd464057e9eec6a4dff6d37e9038af0d8f4655b1fda36dfdeddd5d2b7ddff29", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887646, "uuid": "af38cd39-d2cf-4795-b0df-bc2ff30c7c66", "value": "T1F8369D06BCE10AE4C0AAA73299B752D2BB75BC490B3523C31F9172782E727E09D3575D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887646, "uuid": "de021716-9592-4a9b-873c-d75b817f093b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887646, "uuid": "62a7ac03-7ebe-4539-ad85-ae13c864ab5c", "value": "98304:jYjAOXo3HLTKjdJLWF+JGABXMBQbgjpoQN:jqAOXmTWP0xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780887646, "uuid": "d111725d-2999-49c3-8759-cd2fdc170fc9", "value": 5203632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780887646, "uuid": "17865026-e7f2-4a82-be71-c46ff9fed8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780887646, "uuid": "812ece57-6fdd-4e9a-a45c-58659b5c7dc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc0200c-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1780939584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939584, "uuid": "38b1d9d0-a642-4f9f-ae12-baf889a02161", "comment": "Malware payload (ConnectWise)", "value": "69234ee6e74880be8925003d9f5c428f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939584, "uuid": "c958ffd2-33cd-47c5-a8d9-85f50757a777", "comment": "Malware payload (ConnectWise)", "value": "afa1730129c999b819d87eb03e76bcd74adf96e0d12360275304ef688fae900c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939584, "uuid": "6816333c-7c7c-4d63-922f-f14e20b88803", "comment": "Malware payload (ConnectWise)", "value": "79eba13da81fa3b3121e3e3a422b1642fb99ac20", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939584, "uuid": "fe9c2281-4570-4a67-a4a1-400fd94938be", "comment": "Malware payload (ConnectWise)", "value": "4ec6175c3692f0c9b87d6ab782c51e726fd0d0783f1a0dab8912422edd388108e4184a6e0c05c409dffdbbcd796328d5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939584, "uuid": "91fd76cc-9891-4551-8ea6-fb921ebc8e18", "value": "T1A056F101B3D695B6D1BF0638D87A46696774BC049312CBAF5794BD392E32BC08E32376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939584, "uuid": "383468c2-50e7-4988-9b3b-04c707f98056", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939584, "uuid": "2a9b19a4-df2b-4768-814b-7b651054e83e", "value": "98304:izIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zlNFeFCb:ihfefPtHxcp9ym3nltDUJVoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939584, "uuid": "53edc277-14a2-4104-aa8f-ecc533764bae", "value": 6057936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939584, "uuid": "6df0b6cc-dd27-489c-9c38-afa3326854c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939584, "uuid": "9d1aaa9a-1384-4817-904e-c1e827e7d8e5", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99137c1-6378-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1780950558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950558, "uuid": "9ef9c533-dfd2-4844-aebb-b81f3439a8ee", "comment": "Malware payload (PureHVNC)", "value": "c978cda62d928c690b634e42c731930c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950558, "uuid": "6bdf902d-5c90-4dbb-a5d3-b44d8ad878e8", "comment": "Malware payload (PureHVNC)", "value": "afb5b88d2bdfc62c7203bb195438b383d85ca24586f9ccf183f0ef6c032f4280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950558, "uuid": "5dba69de-b00d-45d4-a005-cf90b6cf2672", "comment": "Malware payload (PureHVNC)", "value": "3ba1dbd8a1041fd82ee3fda606995bfe08f1d8b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780950558, "uuid": "0aab6cb6-0aaf-41ef-a727-eb2875b61bc8", "comment": "Malware payload (PureHVNC)", "value": "6207226c1b6fc6d7fb6ee1b086ea3aae81ed5fd2909f9721f8bf6484bc4c0dee987055ff4506852117f6ea189a3899eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950558, "uuid": "0dda9b3e-cf94-4f14-871c-3530cdf785cd", "value": "T171F4BE1B77A68F21D2840632C1D7150583F46947B63BE70E7989239A29033FAEE4B7D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950558, "uuid": "fb084db1-8e08-4c07-ae5b-110e77bded50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950558, "uuid": "b9db9b7e-3ad9-49e6-82a0-e69bcbbf9f77", "value": "12288:Dn6XvX6wxRNLy8b/VhS/TV5ybcOMlKCwWucCNLvGTr9WRoJ8:+vqwxRNLxVhOV5yYOMlKeucChvGvKoJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780950558, "uuid": "db7d3034-65b5-4090-91ed-2a6fe75db1d4", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780950558, "uuid": "484044d3-cea8-4d97-8edf-624f7ea8b0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780950558, "uuid": "57140196-9671-46aa-886d-e39c5f901b31", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.65965741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecc0c84-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941413, "uuid": "43a2b80e-d73c-4754-9fb3-8d8bf8b3e219", "comment": "Malware payload (Snojan)", "value": "0ab3882b9cedd0e1c048052b9858f211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941413, "uuid": "7574553b-fea8-4838-ba29-71530bd3e716", "comment": "Malware payload (Snojan)", "value": "afdd66f2b8c3f0341e54fcee5bd67878ae52089b073f919901e824d644920a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941413, "uuid": "746430ff-6bf2-4458-873f-b7de5ba54562", "comment": "Malware payload (Snojan)", "value": "ca1edc466ac5613d6499610849cc99764a0d6658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941413, "uuid": "31e6f597-a839-4c89-8ed5-a8f35753dbac", "comment": "Malware payload (Snojan)", "value": "eb320f8694360f3b13ebb42c3ce78751402a06df888728fe89b0b01c9e9e35d474139b355aa29c1fec1f926fa8e08776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941413, "uuid": "d3040f38-7147-41fc-979f-772ef5aa3b51", "value": "T17AB4022071C0C0B7D4BB113544E9CB369A76307147B9D5DBBAED67BA6E202E1A3352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941413, "uuid": "f66a2fce-72ca-4aeb-bedf-d590cc35524a", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941413, "uuid": "1dcfa9d3-f416-4660-8fdc-55268aeb9ff9", "value": "12288:/bE+uch1Lk70TnvjcsMxdABSnLHOr2fqRVnRjV:/Y+fk70Trc18BSnLW2CRBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941413, "uuid": "e0ff9444-aae0-482a-a81f-fc33e0cb00f3", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941413, "uuid": "a10daf8a-7d6b-4a95-aa89-3d093932cacd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941413, "uuid": "3a1e986f-6226-4069-bfcb-46717fb3bef0", "value": "4Hr0mz71h37aaHyR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8bd2e2-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780907907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907907, "uuid": "a39b9e90-dcd8-4fb0-8e16-f2a7a542a76f", "comment": "Malware payload (SnakeKeylogger)", "value": "729ffcafb1b4a28bbe20ea0ff67c6b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907907, "uuid": "4f841e35-f180-47d6-98d1-e895a9773218", "comment": "Malware payload (SnakeKeylogger)", "value": "b00bc04de51686ba6cb951dbe6645bf847be8e6d33e45736adaea411cb43b606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907907, "uuid": "44fc5072-94d7-4484-abbb-6108f72f59b3", "comment": "Malware payload (SnakeKeylogger)", "value": "23d37772fe5cc65cf6404facec0576764f536d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907907, "uuid": "13fa6fa8-9dfa-4000-8d3a-78941861d5e7", "comment": "Malware payload (SnakeKeylogger)", "value": "f0316cd9ed8d4530e9f22d8b29fdb9af9d5bf56dd45fda5f6f642bc2ecde8a978e38cb30370f4da1a1e677ad24615db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907907, "uuid": "deded42b-0b54-4ce4-a4dc-cbffc30b6a86", "value": "T1A7150150335EC902C5E75BF01861D2F916749E89A912E313CFF6BDEFB83B79129092A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907907, "uuid": "b232db7b-e873-4a8d-9209-bfa95256fe3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907907, "uuid": "0285cb1f-ea3c-46f1-ace0-3ceaeae5fa48", "value": "24576:P4TS19aX0Axf6h+SfUqQxbIAKUSHBA0XG1TDlUp6k:P444Xdf6heqQArrcVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907907, "uuid": "af933ede-405c-4911-a929-2b63825485f2", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907907, "uuid": "f50b9847-01e2-414d-ba3d-5197a4ea9ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907907, "uuid": "1503375c-fa0b-4359-8f0e-7f800462b974", "value": "b00bc04de51686ba6cb951dbe6645bf847be8e6d33e45736adaea411cb43b606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e2dc96-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912999, "uuid": "0dd0619d-fc4a-4181-b6a9-9e05189abebe", "comment": "Malware payload (Formbook)", "value": "8307ec33229de5c0d61b95f9a0aa3b1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912999, "uuid": "426db34a-8452-491d-9400-1d8eb19f7492", "comment": "Malware payload (Formbook)", "value": "b0102b82b3d908eafd6a245e857df631a9981769ab6d7f475e827a65cea69d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912999, "uuid": "fbd32687-48f6-4b2a-86f9-855deb131d4c", "comment": "Malware payload (Formbook)", "value": "655e5ae429e4dc9ed5861f11aea5fc10fe68107c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912999, "uuid": "daa34fc3-62a9-4d0f-9e29-00e7f4d30fe2", "comment": "Malware payload (Formbook)", "value": "59f7fafb7dadacf7813c86648688f690c6a168229e58244a218da8c78278ffddc0e915cab68290d8069e623016e03066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912999, "uuid": "eb6992d1-37f4-49f8-b585-a40e70196c93", "value": "T108251214A71ED917D0965EB44C72D0F45AB42E98EC24C207DFEA3FFFB93B6541846282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912999, "uuid": "dc6e9266-a01c-49b6-aa31-d71b13641f28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912999, "uuid": "8434fe50-c5f9-4309-96b1-b48244424341", "value": "24576:dahwZt5v0IaAw56OmXTXIOruZukNoh3+zpdu:dmwJv1XtruZ3ohuHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912999, "uuid": "9eca38dc-209b-4fdb-ab29-50071b2040ae", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912999, "uuid": "f5c12a79-fc3e-4257-9389-32f58bf9db01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912999, "uuid": "b32c3bf1-816e-4332-9100-68e635f28af7", "value": "b0102b82b3d908eafd6a245e857df631a9981769ab6d7f475e827a65cea69d07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d3838d-634d-11f1-a769-42010a9c0008", "comment": "Malware payload (RONINGLOADER)", "timestamp": 1780932189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780932189, "uuid": "5db621c8-3aca-4d7a-9498-370dcf0d02cf", "comment": "Malware payload (RONINGLOADER)", "value": "73a84cba28d14625441e1b0eac2a67f1", "object_relation": "md5", "Tag": [ { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780932189, "uuid": "435d14a0-f18f-4c70-99ea-4868fdbd7641", "comment": "Malware payload (RONINGLOADER)", "value": "b0521ad45fd21cdae26afdc74307870c5859421e049bbff2a545852b0ccf0fe6", "object_relation": "sha256", "Tag": [ { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780932189, "uuid": "73f4a598-61b1-4103-a247-abc42dfdf337", "comment": "Malware payload (RONINGLOADER)", "value": "813c1de6102e1cc953f86567e972d0e19d9e530a", "object_relation": "sha1", "Tag": [ { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780932189, "uuid": "7a9863a6-b3d5-4473-b24c-ac78f100930b", "comment": "Malware payload (RONINGLOADER)", "value": "97ba57e6d7327a58bc7bfd75a4c45fa311adb5ab451f7ee2e7b00145f5d0814305f631d85675a68348325159217c837d", "object_relation": "sha3-384", "Tag": [ { "name": "RONINGLOADER", "colour": "#DA46D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780932189, "uuid": "9ef21865-655b-4d28-a092-4a2a7bd55c20", "value": "T14BF52349E3A0D357D0314A7C097E8FFD697AEC322865B7DB5B41B262D2B2B6CD807502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780932189, "uuid": "b9e0cd90-4137-448b-965f-86778286930b", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780932189, "uuid": "c07f6b29-a79d-47b8-ba8e-3aee5ba3f85a", "value": "98304:dhzAJ3UifrjsG4SbcC2K2pSW7hKaAkFF41o4wr4d:dhviXsxKqLp/1K7kE6r4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780932189, "uuid": "34ad6b46-c828-4631-b951-0f86bf652e35", "value": 3331426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780932189, "uuid": "e085305c-eb90-47ea-b5aa-6f65e5a3a9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780932189, "uuid": "e0f7adfb-3062-44d4-92bd-1affa6f08a29", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0223121-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780908425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908425, "uuid": "656684e1-54d5-4545-9556-ef99f79d899b", "comment": "Malware payload (a310Logger)", "value": "f7ae4e9ee78757e296abf01245d2aa3a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908425, "uuid": "753ee4b6-3435-47dd-9389-a39a225c0797", "comment": "Malware payload (a310Logger)", "value": "b09089325b3778b1dbc63fd78d91fa9e6c87f31650244bda45b8a96ac24d4e14", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908425, "uuid": "c7643dfc-d8c3-4984-a4d2-6173bfeeb2f7", "comment": "Malware payload (a310Logger)", "value": "097bac115589427e8136988bf95df24053b2fc8f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908425, "uuid": "b2582627-c330-4bf8-ae35-cd2eb3a6330c", "comment": "Malware payload (a310Logger)", "value": "5e8fc3048da593ba2266dc8557e32e2a14a9556e686d454fd2f7e55f0e9a98b339b5d87e9e48929048d1515af5ca3ebf", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908425, "uuid": "e4069c15-14b0-49fd-8e1f-1b21c7e5474f", "value": "T139944A13EB60611EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35725D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908425, "uuid": "fd9d3069-f35a-4264-b37f-048c64b3fc25", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908425, "uuid": "b58c7c89-321d-4216-852b-e74a390f180d", "value": "6144:bJ8d1/w5KA81IJ8GpF6nuTmOOUiBUrjiBg58zNCQWFiuSxcby7W2zwc:WjYKkJj6GmZUiqrOJCRpby7WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908425, "uuid": "d2e8e9af-37cf-4492-9456-7663ad2c0a59", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908425, "uuid": "6d3bf823-fa35-4e50-9ace-302aae954984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908425, "uuid": "d5dc020a-1770-4ed7-8858-e94cefb899c9", "value": "b09089325b3778b1dbc63fd78d91fa9e6c87f31650244bda45b8a96ac24d4e14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dce68d-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908431, "uuid": "1325ba04-560d-4982-8f88-dd92578ef69a", "comment": "Malware payload (Formbook)", "value": "151dc7782abac9ed56839f75ff426fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908431, "uuid": "4fa414dd-4ddd-47db-b8e5-dd945fcda45f", "comment": "Malware payload (Formbook)", "value": "b09ba69fa3bf6102addb87e1c01b51a310509a96a66775bb1cacd94ec3c6875e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908431, "uuid": "6b4e0a93-75a3-4400-8521-5217d035cf8f", "comment": "Malware payload (Formbook)", "value": "cda5c04e956669d5723b53f8649bd212306d31d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908431, "uuid": "f05d0007-f483-449b-8feb-13527a33cc36", "comment": "Malware payload (Formbook)", "value": "b2929680fd9fa3a306af04483098322a4ff12139d358e41bef4590ea6598ad0aff3d470ef95b6bfb044f536dac57ac3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908431, "uuid": "d1981b06-9948-4188-be62-98524c1856e4", "value": "T1EB250144234ED903D4D64FF41A72E3B413B84E94A922E3139FDABEDFB87A7552905382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908431, "uuid": "c8806724-91ec-4c95-8585-1bbd6b6093ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908431, "uuid": "b4710176-5d77-420f-b06f-976ae2678043", "value": "24576:kAEFT0D+foykQwX5GAjmWBcLQncWcL6+9U:k3FQqf3j8Gyjcq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908431, "uuid": "748dc1df-279f-44ca-9622-fdaa04a11548", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908431, "uuid": "ac9ff0f8-3631-4f12-b1d1-b6ce4177c59b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908431, "uuid": "00de4edc-f8b6-4c46-a69c-990c85604b99", "value": "b09ba69fa3bf6102addb87e1c01b51a310509a96a66775bb1cacd94ec3c6875e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e0f325-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907951, "uuid": "ac0d6985-59e2-4d9d-ad62-f75b0aae6192", "comment": "Malware payload (Formbook)", "value": "70ead7440198ab55f6da76a237562b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907951, "uuid": "c85e9e2d-7b37-490c-8249-0a7eaeb5a4f9", "comment": "Malware payload (Formbook)", "value": "b199f80d4703e7477d2898a9450d0cf523d6b348fb7e3a87935c5de85564881f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907951, "uuid": "e757989b-add4-4faa-82f9-bd33e7d6cf59", "comment": "Malware payload (Formbook)", "value": "b156869791d185b25af6086f1f0199ced3486de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907951, "uuid": "b12ea865-f0a9-4c26-9223-db473f7d1a05", "comment": "Malware payload (Formbook)", "value": "ce76935983a6a85f091467e264cc94ece1673055b6b59c4e22c7861fa74312bd54e9edc6c110b53a3439bcb5f0f30a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907951, "uuid": "02c4f0e6-9b8c-46ae-8d0f-9e5f2a9da2c2", "value": "T1B84502582306CD09E592CBB98C30E7B017341E80E974D3339EFABE9F787665659642F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907951, "uuid": "4438d123-2d61-493a-8666-bbc0824aff46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907951, "uuid": "8d9366c0-5a29-474f-931e-be28371da561", "value": "24576:llR1v7D9TdgL8YlV7cVp7CxJjnb8m7B5rzlcVZ7pQNBiXROSSSbr:XP3gL8AmyJ8SxsZ7pQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907951, "uuid": "3af3c08e-2b93-48d3-b8cc-2f2e5b76f133", "value": 1205760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907951, "uuid": "c5f82266-3685-4c9a-8116-3894fa20e27b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907951, "uuid": "8e903f48-61bf-407c-922d-05a41423814f", "value": "b199f80d4703e7477d2898a9450d0cf523d6b348fb7e3a87935c5de85564881f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148a9ecf-62e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780885857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885857, "uuid": "3bc005b5-5749-43dc-a43d-bfeeade7ed8f", "comment": "Malware payload (Mirai)", "value": "6083db798118d244573619c07a5952e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885857, "uuid": "64138155-f719-40bd-a2a6-c7b024205d88", "comment": "Malware payload (Mirai)", "value": "b1cede5cbe3f8e407e02aa3c9ebdb04c78837dbd038ce58c17ebce0738c19de8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885857, "uuid": "701bd462-f8c5-40e4-983f-e2d72388892f", "comment": "Malware payload (Mirai)", "value": "6c3c94b2fe91b2e0ff4c85e55202368ea236b2be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780885857, "uuid": "58d80edb-03ba-41f9-bbac-ca517350b9d6", "comment": "Malware payload (Mirai)", "value": "911d3d97399c7d685442fbd1b194423e5fe9fad1b6d42679637f36743654a9621d6b3f1c4b553f3f1cb72a3fa782cf37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885857, "uuid": "f943ad71-6e36-45b0-9291-aa44de6915ad", "value": "T19CB31945F8415B17C6C212BBFB8E438D7B2A57D8E3EE320399256F60378B95B0E3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885857, "uuid": "e67faf66-bb11-476e-99a5-2e347069eaf6", "value": "1536:t6w2/VHgyx5y2mjL4Vc1OTgjfxI2/MmylqgdwywYN4HtnFj2ZVPWbYJ4Oxb+XFp:t6w2tN5yb4wOMjG2Uio1QYL+XFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780885857, "uuid": "14b948d4-f6a6-4706-8b7f-27c659f7e08e", "value": 115040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780885857, "uuid": "14a68351-1e58-4c1f-83ce-83971c7012ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780885857, "uuid": "25ea590b-4f84-435d-98bd-f0aa66718007", "value": "CRY.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045e6f9c-6317-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780908593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908593, "uuid": "2d4f0837-02a2-4f20-8373-712c6f5569fb", "comment": "Malware payload (DarkTortilla)", "value": "6b6164f63ad28057516116447e2518d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908593, "uuid": "30451e8f-97e5-4a28-933c-3fa793a6dd7a", "comment": "Malware payload (DarkTortilla)", "value": "b21a97a717627dd2773fd87738e5521818fd90c54272105dddbfcbe7c48c32bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908593, "uuid": "44bf21bc-f22a-4f61-9637-73e4090c8b20", "comment": "Malware payload (DarkTortilla)", "value": "2bfb40dc9022121b4ea851a5bfe73d67d41ae0f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908593, "uuid": "3c6d7d28-cee6-4000-8486-5862eed26a8a", "comment": "Malware payload (DarkTortilla)", "value": "d28703078ed24fd0b1b07b12cea9ab7b1c685af4e983b189e0a444e8a6366d4a55c3eb8f1be83b298e50e1688c9da0e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908593, "uuid": "0e81ca52-28f2-4f93-810e-d7d1b4d09e8a", "value": "T17535F1112D432F14C53E0BBDC0A61054B7F4DA4B82B9E79FBEDD50F86B6378ACA19681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908593, "uuid": "255383c1-d4e9-41ee-b6fe-9c67a3d439f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908593, "uuid": "e4a3fa44-3d07-4d56-9c5b-aa326d2f77be", "value": "24576:yTMOZjb6e1AaPedLAR0Uq8FOzPyHEQCvoGFIYc:gPjbNPe/Uq0IyHOvvFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908593, "uuid": "fb7d311f-d0cf-4bad-b000-9df39eaa338f", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908593, "uuid": "5ca63da7-16ef-4ffe-a04c-d70d075dfc4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908593, "uuid": "90b2d91c-aaf2-45e5-a1f8-1042c31bc9d2", "value": "b21a97a717627dd2773fd87738e5521818fd90c54272105dddbfcbe7c48c32bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115af836-6344-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780927942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927942, "uuid": "a6583324-63a7-4ab7-ac54-f28ec2d2b50b", "comment": "Malware payload", "value": "19e8b8935b7b065b6c3830a3cd82342d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927942, "uuid": "da1eb46b-41ad-4d98-8a9b-414bcb7218b7", "comment": "Malware payload", "value": "b2225250a1fcff06750f32d3abb999ffe26fbd21abc7b87ff0e91f8e0449652c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927942, "uuid": "6fbd413a-3c29-485c-9287-6314d4176228", "comment": "Malware payload", "value": "3b8383c31c97e7d5f768064599a721e2335f6600", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780927942, "uuid": "37aa607e-c2e3-4da2-9031-493ff3367f34", "comment": "Malware payload", "value": "61ed70107f3d763278b82629a081224c3367707dfb432083eaaba1bcd74d6fa3ebcbcfdd4cfe5170e093e2a5441e1cc3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780927942, "uuid": "157426a4-8c55-4fbc-ba4f-504379807cd8", "value": "T1CFE7D047E0AD8635D4DAE278BB2E0562A234385C46E2D55BB90C9210BFDF5F01BE27F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780927942, "uuid": "71ef3f09-9269-4ab0-8502-f074be087948", "value": "393216:qep+bWipjIs9oP810s/d/AaYT8v5Y2BqKIq0iFcyGeg/R4tGeKH6oqnGk:62U10sfv5Y2BtZTzg/R4pKJLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780927942, "uuid": "a339ba5a-e754-48d8-849f-f7a7f294cdfe", "value": 66781865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780927942, "uuid": "7276e5d2-1731-45ff-a5d3-c9de65e6d77e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780927942, "uuid": "307cadae-8f09-4ea3-b5b7-ab61d4af5bb1", "value": "rubizh-1.2.83.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed45e65-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911000, "uuid": "4db677c9-7c0f-4e4c-9110-43c18bbd1e24", "comment": "Malware payload (a310Logger)", "value": "d941a58c54aa18fa40d49ebe47f4bae3", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911000, "uuid": "f0ce6003-ae02-4f14-a6d3-c34be99b643f", "comment": "Malware payload (a310Logger)", "value": "b27396f6e5ef66d836e17ac04da32b2e44fa53b5d96e3d6a872e0b119aa3ad98", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911000, "uuid": "08a7848c-6529-4296-a14f-3027199f5076", "comment": "Malware payload (a310Logger)", "value": "9d89a298e4d6a836caa5c7444c950d99c5e914af", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911000, "uuid": "fddc813f-7649-46dd-be2a-c0c11290a5f4", "comment": "Malware payload (a310Logger)", "value": "daa6b9c99a16380cc309b118be9fd65399f960c3418810fdfca70ab0530f1f3330d081340918f98a4354d88474c4fff7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911000, "uuid": "eb2a817c-c27f-4900-bd24-12ff161e10b4", "value": "T17A4522581B06E716C96657705EB0F6B53B7C1EEEB402D203AFE8ADDBB9372225D04183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911000, "uuid": "5a294aba-6410-4748-a63c-04262a2eace3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911000, "uuid": "379b2ace-ef9c-4a82-b4cb-84902dd01f61", "value": "24576:NdvuimGpuR6CsgFpyqT+kKvbkLmEPQpqjzyUTIREFqbCZ3:NdmirWpp+kKUmE/jzTTIREobQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911000, "uuid": "80c62718-7e91-47db-8968-e9a10da7739f", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911000, "uuid": "cc82bfbf-a164-4677-a07a-2cfc4dc79f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911000, "uuid": "5196a573-411c-49f2-b045-bcaaa75ab607", "value": "b27396f6e5ef66d836e17ac04da32b2e44fa53b5d96e3d6a872e0b119aa3ad98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c3d8fb-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1780912488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912488, "uuid": "a24a034e-8101-410d-821d-409aa888bdea", "comment": "Malware payload (Stealc)", "value": "0486168873be96529d5aaf9f62549569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912488, "uuid": "e34b369a-b66a-41e9-8d8b-f6b0df4dde6c", "comment": "Malware payload (Stealc)", "value": "b2ec886d4a570a2beae18308ca01f29d60344993ce24ebeb20e76f2cff3b72f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912488, "uuid": "02d6dc96-ca77-4973-b147-7fca94ebdff1", "comment": "Malware payload (Stealc)", "value": "a8cd6ba76cec8cb7e6d1bde4a0deeec0565bbd3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912488, "uuid": "b8664181-889d-463c-9899-030d877439ae", "comment": "Malware payload (Stealc)", "value": "8ec6e6507f9dcef53f300880a5ecd641f22569e4c2b04e06c6d70883fd3d6aacd0d7a74c483465c1ed1023348d7f1cd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912488, "uuid": "881d0072-36e5-4910-aab9-307195a19a1b", "value": "T17E147C21B8928073D56B097198F9EB758D3EFC910F616DD763880FFA89206C1AF35B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912488, "uuid": "29eb3f09-5043-4822-8ed3-899f8bdf679a", "value": "c335279708b380b7120e3fd65f018912", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912488, "uuid": "fb448ace-f139-4a9e-a84c-4d7d9df8872e", "value": "3072:wXkZwkCI+eqB4MWRQ2oNbroI6TPINP42TZoprRyvUFatHsnFaHCyV/yc:wVkCI+1iQ2inAgaCcwvUDyVqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912488, "uuid": "145d4074-6b1b-4ed1-ab95-d918805ce6a1", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912488, "uuid": "04a03506-7f39-4abc-864c-2fd1c08dacc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912488, "uuid": "9ff850a4-44fd-42bd-8894-6dfd0b31a5d7", "value": "b2ec886d4a570a2beae18308ca01f29d60344993ce24ebeb20e76f2cff3b72f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e275f2-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1780912593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912593, "uuid": "e5bde006-79fb-4b90-b69c-ebe576b811db", "comment": "Malware payload (PureCrypter)", "value": "e59f44d57fb83a0bc716a2dfe57c517f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912593, "uuid": "20289990-6acb-48a1-8faa-654b3cef7584", "comment": "Malware payload (PureCrypter)", "value": "b35961a4493bd0b9618d91cf6140a128c155965c0c3bc88d9910af94d4755810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912593, "uuid": "257536dc-0b71-4253-abcf-fe52a7eed435", "comment": "Malware payload (PureCrypter)", "value": "05f4a0705f137350dda9d325b738cc23a0703e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912593, "uuid": "9392593b-cab3-4403-afd8-9d9a757c7e02", "comment": "Malware payload (PureCrypter)", "value": "0137877f883e1440c5a86ff8c20ac51f71c60bade6364621a89d0dc8148d3de75d38d7b6f6f67d95b02b225b64638eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912593, "uuid": "d1a0c4fa-201b-4288-8c83-197443089716", "value": "T1FC65E00A0DC75F94C1EF0B78C2A104A463F2CE5B4E96E7E72EC81AF5EE66B46D905053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912593, "uuid": "571b6b86-b438-462f-8842-dcd7da0ad08e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912593, "uuid": "c4dcc2d9-a7ef-48cf-aecf-92fb0ff1fe14", "value": "24576:qIEhFMxO+Nm5olKEKUDTEnU1V+wgHfJ7quTOp5:OhFMXNSooTeGxeQ05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912593, "uuid": "21d410e1-3a0b-4349-a54d-8d8a42760129", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912593, "uuid": "414fb085-17d5-4ee5-a994-e49994d87372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912593, "uuid": "75b350fc-4e5d-48fa-904e-c7c94bfb7c2f", "value": "b35961a4493bd0b9618d91cf6140a128c155965c0c3bc88d9910af94d4755810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8147e712-631c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910950, "uuid": "24e40f9e-ad00-4729-a49c-5e54b56d924a", "comment": "Malware payload", "value": "576ade5270fc1ee439fa7392c1bbc315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910950, "uuid": "1b79752f-f94c-4fb6-aa2e-2582cea3177e", "comment": "Malware payload", "value": "b3a7446cc7506070fd98ac7271a505e8beacd168c7e74a1ee924feddac80f2e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910950, "uuid": "4d47ba47-ceac-4670-b1c8-e5421fa82e0b", "comment": "Malware payload", "value": "129cae3849359e33f83be6bb49c5ea37652b4996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910950, "uuid": "b7fb07fe-e43b-449d-9bf7-a97b194891a2", "comment": "Malware payload", "value": "a71a83079b7d2f703181263eef21bc34f90027914612443df74cc9c6ce73262966e45b8397dde9836b41e88b9d946338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910950, "uuid": "f33da43c-6fa2-4882-8986-e8efb7f3bbb4", "value": "T12D45B0396A474F8DE55AA774C4333BD20B70DC298D69C306BBF84674A93B7A19930B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910950, "uuid": "a4583a00-bb7e-4ad1-9d9d-3ae7bf91112a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910950, "uuid": "39c7a44f-946c-4725-8f87-e9f8454ea5c2", "value": "24576:YJQgL/9GUN5AidLVkzQU/Q3RvIvWo6wB0He1Bzn:4Qi1G0bhmzI3RhIUeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910950, "uuid": "11b0574c-ecd6-414c-9864-1449110f60ac", "value": 1267200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910950, "uuid": "c90cd26f-eac2-40a7-bbe3-91d4e4f8fb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910950, "uuid": "2b3172a7-f2f9-42e6-a73c-fef5bd7a4a17", "value": "b3a7446cc7506070fd98ac7271a505e8beacd168c7e74a1ee924feddac80f2e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a79f35-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1780910066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910066, "uuid": "b027d17d-963d-49ad-a99e-67fdc2dd2134", "comment": "Malware payload (XWorm)", "value": "0c925341b645b92d67fe311b71ecbb5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910066, "uuid": "add855a3-88a6-443b-b450-5f46c6023fc9", "comment": "Malware payload (XWorm)", "value": "b3af31b94c5869c2261986ea64a3a071abc5cd3aef9aec7f38ee1bc4e5e88505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910066, "uuid": "337680bc-cdf8-4d38-b65d-bda13847e8e0", "comment": "Malware payload (XWorm)", "value": "82936e697e1bb79debbea25689730c0fac4a51c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910066, "uuid": "25cb6812-c632-4bcb-8bf5-f7140b044eac", "comment": "Malware payload (XWorm)", "value": "9e8b9ae00c8164cd0cf435f908458cfe6363e623c523463acbafe13f21450fa1a2711eb20c2e08a00bed8b1c42b40495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910066, "uuid": "38ff1906-7ec7-43ea-af6a-772798d3d856", "value": "T15F15AF1669C306F4C6A58B74D3B900A856F08E6F8341E3A719E836F5DF7274AB41B0B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910066, "uuid": "4f8ee82f-200a-4e0d-9c6d-675984da3ee4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910066, "uuid": "102178ac-2c11-4b3a-a463-cd7985f83eae", "value": "12288:FsnUWVL1y1ulol4u8dCWjCOGRGxElTx+PJNZJAZ9cWccwTV3IychCKayEAmD:F+1y1Vl4zdCtOGRGxaxUJWZnchIychN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910066, "uuid": "0bb0de38-1221-4bb3-af0b-3a8ec759eae5", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910066, "uuid": "260f472a-ec5c-48d5-b613-b8ba79c6cbc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910066, "uuid": "9cacbe7b-db8b-4085-b514-c6096cf5258e", "value": "b3af31b94c5869c2261986ea64a3a071abc5cd3aef9aec7f38ee1bc4e5e88505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ff60a8-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780912563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912563, "uuid": "3d56af0f-0497-481c-8c1d-fff9184d5985", "comment": "Malware payload (GuLoader)", "value": "b15f6751dfb709e18b1e9fabff085a5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912563, "uuid": "726e973c-03fd-49a4-b1aa-33ee058da654", "comment": "Malware payload (GuLoader)", "value": "b3e933c26ce4abaa94ae4c990096c2c346106e35a544dc4cdc21ef7571511dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912563, "uuid": "fde569b0-9976-47a4-b35a-ff244f601399", "comment": "Malware payload (GuLoader)", "value": "1336e90627104f775f2bc75f2a125c1e9adca263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912563, "uuid": "3a09ace5-ce1e-446f-aea1-a3da4bd46427", "comment": "Malware payload (GuLoader)", "value": "c747a4aa6b380322b672931fea1be52d164aa7753692c8409121592f18b45b6b962795e3c6caced3dc584c73c1f56fb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912563, "uuid": "86701e81-f7a2-44e9-932c-db2f4acf262d", "value": "T15FB402142F6DCF07E6878CB46EB5EA6FD7305C524C2E4703AF727D0DA938AC16A49A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912563, "uuid": "15b8036b-7981-41e3-86c9-2b5db57b1c8c", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912563, "uuid": "9dc1ac62-060a-46df-aac6-df88788bf78c", "value": "6144:rpkXGh6aeKHGX2RK49s20+zgPMLX0A3dEiKlSFRPJkKJJQKvmBOW7oU+Ln/:GBGLwyRNEiKlsJkeJGKD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912563, "uuid": "ea024c36-db85-48d6-b29d-4ac61057db1a", "value": 517328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912563, "uuid": "71930b51-7917-4b89-ab52-0acbe8478c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912563, "uuid": "08c22cfb-e59b-480e-9ead-9da0d2f42221", "value": "b3e933c26ce4abaa94ae4c990096c2c346106e35a544dc4cdc21ef7571511dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbcc831-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780910246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910246, "uuid": "98768d60-899e-4a3a-9172-fcf906d7bd36", "comment": "Malware payload (PhantomStealer)", "value": "4f4e6b8c22d9dc9c79460585b7879d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910246, "uuid": "9e5ccb24-0e9d-44bf-a513-6b3c1e1e813c", "comment": "Malware payload (PhantomStealer)", "value": "b42327d017fc33011994224cb758a3ce0f22cd7df79326e8cf0a3f7524f359d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910246, "uuid": "707d6117-91de-48ef-bb9f-539d0ffd35fa", "comment": "Malware payload (PhantomStealer)", "value": "35eadd9d819a461785ccc32d4650fa1153801db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910246, "uuid": "4b7f6120-dccc-4a84-9564-65108c954ded", "comment": "Malware payload (PhantomStealer)", "value": "8fb6838c008e01672de55d432edf14b58b6cf469cb7cca26efad0703cbb1accc5ab066665f92ffb1a2901d9f0a6f5d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910246, "uuid": "647cda28-4070-4d4b-b0b7-82416fb587b2", "value": "T1527501D43A26E70ADE520A709A34DEF15BF41D98F801BAA39EDC7F5B74AD0905D0CB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910246, "uuid": "897cb246-6726-4afe-b629-2748069dee79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910246, "uuid": "457dff6f-e7ed-49ab-a8c2-9bda9b3b232a", "value": "49152:cPRFxhFyDLIzoMywB8zc/zKyMHcN9XcnKaCV5:CRFjMLcYpzcbvrXcKpV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910246, "uuid": "da8e5638-db1b-49c0-8ab3-9ea77f00be5b", "value": 1696768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910246, "uuid": "cb5d8cb8-b84a-4f70-a2cb-86fafd2de123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910246, "uuid": "210c8dcf-e876-41d8-90d5-e34834c7c95f", "value": "b42327d017fc33011994224cb758a3ce0f22cd7df79326e8cf0a3f7524f359d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f1f7af-631a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780910178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910178, "uuid": "45bb57a1-f5af-4ca8-98ec-cfe81274f2d0", "comment": "Malware payload (AsyncRAT)", "value": "ba67fadad327372b02ce409dc6233fd2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910178, "uuid": "59ebd6be-07c3-4709-8d8c-5ac3f639da1a", "comment": "Malware payload (AsyncRAT)", "value": "b46f7f9cea4b2ecba91973ef6435c436ed9235d84c4976972f9222afc02daf05", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910178, "uuid": "010878c6-1552-4715-b9ab-a675a9a1430b", "comment": "Malware payload (AsyncRAT)", "value": "ab055873a79c9b4b69caefdd0cb1a2178c8b1fdd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910178, "uuid": "4f1e2f52-a4cb-4c84-9abc-97fee84564ed", "comment": "Malware payload (AsyncRAT)", "value": "1b2c68b69dfc282220bb5d0a7df87e87a95003019750f7564f62fae941baaa4f9b0d2bc3c7877b97d40ca316adb66a6f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910178, "uuid": "bdb9bbc8-31b0-46e1-b2e6-8a8e50f2409f", "value": "T190050158221ADA02C0A25FF45971E2F41F745EDDE512C207EFDA7EEFB8797940889382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910178, "uuid": "7dd8bb71-851d-4fde-92c0-e56f87dde9f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910178, "uuid": "08af166f-3038-4fa3-b92f-a0bf9ac9644e", "value": "12288:CAbJRSOQF6JHcjcAnAwS+w6M9ktXYd0sK34dxtIqaF87WnTymqsRs08RZeY:9zZ5JAA3wIC6mF878Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910178, "uuid": "d95c0d3e-5b51-446f-8142-2277edbdf1f7", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910178, "uuid": "2be82917-3c1b-47c6-b277-3c6fd05b23a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910178, "uuid": "c6c15376-e9a0-48c4-acb3-c07eed00fef3", "value": "b46f7f9cea4b2ecba91973ef6435c436ed9235d84c4976972f9222afc02daf05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71606c80-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780910494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910494, "uuid": "4cb2191e-daac-4afb-a520-dfc3dd2888f2", "comment": "Malware payload (AsyncRAT)", "value": "31e5990b18f1a6d2aa037fb3a3f40f10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910494, "uuid": "34d20462-f936-4574-8b04-629f2c9f4ddf", "comment": "Malware payload (AsyncRAT)", "value": "b49a043c8b0647151180e74c22807ea44a52545b878b21312dacfabedbd73402", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910494, "uuid": "cbc90acc-4259-4820-b3df-6ccc14cec3e0", "comment": "Malware payload (AsyncRAT)", "value": "dce9d46402c26b8182b163c30bc58d690a4ac8e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910494, "uuid": "f6e69e26-6e29-4bbc-820e-63fd79111bbd", "comment": "Malware payload (AsyncRAT)", "value": "3658305d2786a3fa3c55cf0e42a9b06cd2bb8e6789c5bf6962a376fe1fedd992af8416caa945d517702cf8d649a533be", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910494, "uuid": "d4de435f-e6b9-43e0-ada6-0f65294b7c9d", "value": "T1BCE4122A1B19CA0AD4A72FF00D32E1B067B90D8CE511DF07AFDABEDFB1756201545B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910494, "uuid": "8eace312-020d-46c9-84e6-48cda8b162f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910494, "uuid": "ca5593e5-6b56-4f74-a15f-f184658cb7ca", "value": "12288:DVcnxX55Kl85eEKlcVOJJ+x9SJAWP+TfNDUP/HFjtp:DmnNr+OWcsJJ89SJAWP+RD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910494, "uuid": "124d7806-7acd-4c75-9cde-d2fefe4aaf5c", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910494, "uuid": "6feee516-8fc3-4573-b297-299a40633d62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910494, "uuid": "eb5e47f0-737f-4a6e-8ade-3fe465e80ec7", "value": "b49a043c8b0647151180e74c22807ea44a52545b878b21312dacfabedbd73402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11721e40-6355-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1780935244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935244, "uuid": "016f7f04-96aa-4255-9b33-306613ecc513", "comment": "Malware payload (Phorpiex)", "value": "49e65d2a8f1537e03c1943c5bc16b5a5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935244, "uuid": "5d4ecfc1-aeb5-49d1-b646-93a4f8c6b1fb", "comment": "Malware payload (Phorpiex)", "value": "b49db194b7f2b72b55f68db30136dcceaca6332902528a63a2f09daac95d375c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935244, "uuid": "0ff3d9e9-cd2e-4910-968a-3820847cb69c", "comment": "Malware payload (Phorpiex)", "value": "3249807b1bb9810c82fe0756d812a7f73a54f9d4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780935244, "uuid": "88a268ea-2596-4e3d-951e-e9ab4d18410f", "comment": "Malware payload (Phorpiex)", "value": "a0dc12b3c41574ecb81ac8180baac7037fa26262a2058dfb1c8275e809e5c48c106aa89af089f4414771bfe5ea1cdef9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935244, "uuid": "ff3bf88c-a85c-45cc-a146-4fdad4816cfc", "value": "T1CD824B0FB8424726C1E100B09636967BDA79A87137C408DBF7E48ADE1AA86D5FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935244, "uuid": "908decd9-bbd8-46a0-b970-db882a1d9b27", "value": "31944fc5dd8a4e2a3b0515f33255f586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935244, "uuid": "27565b07-ed02-40b2-882b-eae1bb5fbc72", "value": "192:yKaqCngTtXWQQzbytjt0CzSETzl/le6f2vKUSvu9zw+ghSIOgbO5qmEd/FN2GJxW:E0W/ytwEN/0Gu9JgwGcoav8U9cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780935244, "uuid": "740f5384-0594-4d4f-b8ed-c08da749efc3", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780935244, "uuid": "960dbfa6-e3e4-4089-b7db-496088d2eaf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780935244, "uuid": "54288efd-5cf8-413c-9a13-b16e53f29693", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ce2bb3-6314-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780907689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907689, "uuid": "a8ecc89e-58fc-4580-a740-3fbcc4c64de2", "comment": "Malware payload", "value": "826792057d4671af5f336e783f427c63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907689, "uuid": "72a850d3-8244-4ecc-9f1c-cad88a3480fd", "comment": "Malware payload", "value": "b4a2be0d5f71c90379f35513a82035aefd3c1c2d9f9b454bf2da06191f13537c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907689, "uuid": "f90ed857-5f76-47d4-b0da-70603f652a7d", "comment": "Malware payload", "value": "b282dd0616766c73867e539e8754438e48c8a708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907689, "uuid": "6409506a-c978-4acc-b898-f06b1a1d0243", "comment": "Malware payload", "value": "daf2400d623add7a0435e5101042aa736b91bffd9ade3f38a0a6151fb6218e34310a29c564630c4df7af107b4fb3eab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907689, "uuid": "5c36ab5f-f5cc-4155-a77f-4e5ddc63c872", "value": "T1FD35BF16F3E405B4E63BD238CAA64233EAB678511770AECF1259D6152F33AD07B3A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907689, "uuid": "11612db4-a6d6-43af-936f-593086db13b8", "value": "2247728a7effe70965982babad4e9a7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907689, "uuid": "3c5a0356-6ce2-469f-8504-b2a7cac58d41", "value": "24576:f0JUjC6Oil0BxvVN2bUbAqkIZ+gApdnNzSjNperDrkwE00o+:f0JUjLOM03AqkIZA9A2DAF00o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907689, "uuid": "417de114-1e63-44d5-aec5-43ddc3e6123b", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907689, "uuid": "26009e00-6a41-4444-a117-34b4ecad0043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907689, "uuid": "eedea488-3a70-4868-adf7-8e0628c12e27", "value": "b4a2be0d5f71c90379f35513a82035aefd3c1c2d9f9b454bf2da06191f13537c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91222ec-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912815, "uuid": "9d77bd83-426d-44d8-854a-81f68f995e92", "comment": "Malware payload (AgentTesla)", "value": "3ab9b70e4da1748d3cd2679c6dff64ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912815, "uuid": "6d2859a6-a469-443a-9e3a-da4c991b702b", "comment": "Malware payload (AgentTesla)", "value": "b4ab9468cbd04d146ba5bb69f1636ea38bdc25baf50c68ca8b1416d5b7e391c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912815, "uuid": "a3d59841-c1f6-4fce-a583-d262119fe373", "comment": "Malware payload (AgentTesla)", "value": "e85b37bedf159a0b226ab4e93a9aeae4f8ddd775", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912815, "uuid": "c73130a2-9bd2-46de-9a99-b81d88f2b875", "comment": "Malware payload (AgentTesla)", "value": "75f7d1a750c95b72f6252ec6909cd277e0707453347bb55856c538a7fcd2231bb3835ccc46246039573cb7de8cc5b3c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912815, "uuid": "12e58af2-34f5-46be-ac8a-c6ea1c2a9f50", "value": "T10EC44116EA61A02FF4938DB0797895467C292E361680EC5BF7805F993074AABF0F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912815, "uuid": "c8f98164-8bb8-45d8-9698-e5ad47e8ab31", "value": "b294e29000776739a1f1daf34163366b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912815, "uuid": "bfabf23e-ee81-4a1e-886b-7ca0f68b19f5", "value": "12288:eCYPm3kpYWb3UwIM0k2wPfizx+Z25XvBC31wLhHT9wd6WUmY9hB1QUHkOPD:DY/jkwIMixdlvQyovtUEOPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912815, "uuid": "13630d25-03be-4bc8-89db-cf0964ea5675", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912815, "uuid": "3889e39f-52c7-4d24-8e0b-40340b37c98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912815, "uuid": "96e91b95-469f-4d52-b3c5-43983387a0bd", "value": "b4ab9468cbd04d146ba5bb69f1636ea38bdc25baf50c68ca8b1416d5b7e391c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d133c5a1-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911943, "uuid": "8066e41c-3a81-47d4-a685-5bf70f2f4b51", "comment": "Malware payload (a310Logger)", "value": "fde7de11ec404ca993e3319f2e5cd179", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911943, "uuid": "f0fa22b7-3ce8-46bb-8505-85df68370287", "comment": "Malware payload (a310Logger)", "value": "b4f71a83ef2858a522aeb1fb0143abc94c1ef06baba2e317968dff9298030989", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911943, "uuid": "401e7bd0-18fd-4a0a-8bef-ba530e3d7ac7", "comment": "Malware payload (a310Logger)", "value": "c1c9bb129a5bdbe70aa0984894e21b5da1d2b04c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911943, "uuid": "52cacdc1-b7bd-4cb1-be74-6603475c9ba5", "comment": "Malware payload (a310Logger)", "value": "d207e6ca70d216a7229c3d3a07c8198107e4d351a5fefe6fc28c8ceae77c508f79f11d319c01e3f8bf7245e6a78e90fc", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911943, "uuid": "f3819385-69f3-4d61-b979-8530bf159890", "value": "T12545225C1606D103C8A11BB9A972F2B103BD6DEDF541D227AFED7DEBB92AE110D00267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911943, "uuid": "31fb5797-f865-41a7-a5ed-88b5cdc0110d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911943, "uuid": "7b19e752-5c7e-49a4-b266-8d34723926c3", "value": "24576:FAyUb9CyTQptBKxUkd1GildQQ9NlJCu6yncGb8Sf:eN8/BnkSmdz9TJCpxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911943, "uuid": "b7a74eee-2af7-489b-9a60-4a29abaf12f6", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911943, "uuid": "e0f5ba8a-efcc-45b2-b1bc-884f734fbfd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911943, "uuid": "91b2aded-a261-434b-8a44-0465e128b918", "value": "b4f71a83ef2858a522aeb1fb0143abc94c1ef06baba2e317968dff9298030989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459ff4c4-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1780907843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907843, "uuid": "7f46d78a-a6e2-4a8d-9116-595a58c6e658", "comment": "Malware payload (PhantomStealer)", "value": "5beb33930681e2fe0155fed7996a6925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907843, "uuid": "93e38a3c-cfa8-45ab-84c7-de41fd1e3f8c", "comment": "Malware payload (PhantomStealer)", "value": "b5ceb786c927c1fdfdaf9d4eda48d50c933c3c8cbc7298cc23e3d925ea9eca99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907843, "uuid": "a6b11d37-13aa-457a-b107-6b2b5945b067", "comment": "Malware payload (PhantomStealer)", "value": "319a79c6de9d152400dd62eb5bab76dfc513807c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907843, "uuid": "5b616017-f5ac-4eec-b3fd-dad211dbb714", "comment": "Malware payload (PhantomStealer)", "value": "b51110cde9e32d71fddb32cd6ee2f13016ba1b89f94130a1b12d9f745c74d32bef625388c030c90b01ef4e26acc9bb97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907843, "uuid": "bb7d58fa-4a5c-40ea-a751-0b4dcb4a33d6", "value": "T151751215330ACE02D9A69B701960D2B507788DC99911E313CFF6BDEFF86B7463A453A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907843, "uuid": "62ca86a5-6667-4083-a128-33d9b4a610bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907843, "uuid": "6195c165-225b-44c1-a77e-51ae426ea080", "value": "24576:ui4TS1iooSfbyQVsGhWeOQy0aWL7ToLoNP9/Q9RA4GYOdcPZkgYL3NaPxrv:X44KQVsGEeONywoNPRARPcchuNO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907843, "uuid": "d289d0f8-af3c-415d-8a7d-6236ba914f87", "value": 1590784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907843, "uuid": "e9c73d89-a189-4d18-9a84-000de7c00d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907843, "uuid": "ef71b466-0135-4dfa-87b5-443dfb67c755", "value": "b5ceb786c927c1fdfdaf9d4eda48d50c933c3c8cbc7298cc23e3d925ea9eca99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a350bf-6316-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780908456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908456, "uuid": "ac91facb-44ab-4726-8990-37f00fdfce3a", "comment": "Malware payload", "value": "33aac5f81cc666c22792d198f75739a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908456, "uuid": "ba6eb952-06f3-4bae-a3a3-6994ad5f0565", "comment": "Malware payload", "value": "b5ec73294d7a284f36ad4cb2d96387ab54f670957e563cb8a284ca0f02992d77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908456, "uuid": "d5f6a625-d358-41cb-98e7-a2c2cbe92d68", "comment": "Malware payload", "value": "52048384a33796032fd2cb4f817bdeedde369881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908456, "uuid": "af50e366-a019-4259-8bda-433c6f1a3d7c", "comment": "Malware payload", "value": "408851eb03302e02c929a165c64a8d3d10c27c6cbef53aceec2233771361ff8a904759f9d1057fb0b2cd539ea92e2cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908456, "uuid": "b4f3c6d2-3be4-4329-8d6d-a1f7c5f520de", "value": "T19535F1227E463F14C63D0BBCC066005863F0A84B93BAE79BBFDD50F96663B85DC16961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908456, "uuid": "dfb91ce7-34ca-4719-a7b3-b097a17297da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908456, "uuid": "ff54c357-6601-43d6-86b2-5aed5faab51b", "value": "24576:vHSxjb6e1AaPedLAR0Uq8FOzPR95UGd3031FkTmK:vHijbNPe/Uq0IRo931ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908456, "uuid": "51250af7-9dd9-43b1-b5dc-f83f4cfce995", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908456, "uuid": "9540e076-ccf5-427e-98c2-70908ab76500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908456, "uuid": "2d6d8c47-9caf-4a06-86e2-f465b156ac9f", "value": "b5ec73294d7a284f36ad4cb2d96387ab54f670957e563cb8a284ca0f02992d77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf325f3-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780912444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912444, "uuid": "d8c584e8-ceda-42a0-a862-4d4dfb6981bf", "comment": "Malware payload (QuasarRAT)", "value": "81ab6657921371802c658665bdf034a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912444, "uuid": "4c2b9c1a-f32d-4d0b-8101-222dbc06902b", "comment": "Malware payload (QuasarRAT)", "value": "b6120aa7ee8cf2475648b7b8a287275e63e4a657b30694123ab8bf47463d5477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912444, "uuid": "5756fa04-b652-4b3f-943b-1e432634b2c3", "comment": "Malware payload (QuasarRAT)", "value": "d05301b063eebc33581275a749dc1ef76dc4e83a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912444, "uuid": "36c77b12-87a0-4c39-81ef-b9883742cdc0", "comment": "Malware payload (QuasarRAT)", "value": "ca84f5dcb6b20bb2d9db2014becfb29efb333098fa324b835c5144b301dd395727a3e0054450469139e0c00089f30129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912444, "uuid": "38d4eb88-14d2-47ea-ac4f-89f1b448b116", "value": "T15F05028AA7C08C30CA5BAE3084301D7442339F9D3E59F645EE28BC7337B7AD62865597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912444, "uuid": "d3e9571a-8de5-4c63-8e64-ae9e36cc9de0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912444, "uuid": "eb079308-dca4-4383-9059-56cb6ab7aeb0", "value": "24576:ypQSq4/p6pmrRrkwOgyybTqlH4Al6/UIZ:ypQT86p2RrkjgJm3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912444, "uuid": "264e2c4a-e2e7-457b-8003-b73fff6211e4", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912444, "uuid": "a81d2d58-b5e8-456a-b86d-29bc0a757823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912444, "uuid": "89aa8848-c3e4-4e7f-89d3-5b245331299f", "value": "b6120aa7ee8cf2475648b7b8a287275e63e4a657b30694123ab8bf47463d5477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299bded5-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "56f05d5f-76fe-4a52-9632-3740e872af8d", "comment": "Malware payload (Mirai)", "value": "7167d2003f363ecf734a7937dd3788c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "de5cfd06-45e3-4c7d-b428-772aa409ef1a", "comment": "Malware payload (Mirai)", "value": "b648413877c2e5a570952677eca1ccb18b33ac4d3a6b68e5158a5422c1234e5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "ac43e545-ffa9-4a9f-86d5-d4a292446818", "comment": "Malware payload (Mirai)", "value": "9c8408a68e49f05e442a2bd912003abfaad0199e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939579, "uuid": "24bcad50-8f88-48fa-a4db-5171329d4a32", "comment": "Malware payload (Mirai)", "value": "6c94801bc7d93fc55f0889f475610006a40ae8ef399fe308d19d7672866841d96ae604cd0fb39d282f08a6c9de6de0d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939579, "uuid": "f6ce1944-7132-4d9b-b1f3-2fe25bb94473", "value": "T135932894B8419B17C6C612BBFA6E428E372623E8E2EB3217D9215F2037CB55F0D77941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939579, "uuid": "f4fc849e-7a36-4fad-98d7-8c5c54f4ec75", "value": "1536:AGvMOjmOItNB8ny3D5wxroRiDkHonyZT3Bf4TD5v0uGupZJKvvs2/:AGUJtkyYEETn0T32TDBf0nsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939579, "uuid": "1a782521-7c82-4ca3-aede-26a641bece1f", "value": 95764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939579, "uuid": "18f386ec-ff96-4459-bbe3-57399382598b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939579, "uuid": "e3cda413-56eb-4aa4-86ee-55cce5e18e9f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d04d7a-631f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912107, "uuid": "935bdfeb-bfd5-4d37-9396-2de71e4caa41", "comment": "Malware payload", "value": "5f9d8c6dd2f91e850f2d625de76ba124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912107, "uuid": "b2ed1300-4787-4772-ae98-9791c0e67933", "comment": "Malware payload", "value": "b6e106e9362a459cbce8b98beda0004039236a1b519def32144ce534f80bc52c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912107, "uuid": "56ef3e6e-7216-4954-b5cf-54a5c2e7ccad", "comment": "Malware payload", "value": "0ce8ebaeacc64696e7c5a860213b5df2c6584b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912107, "uuid": "3a91724e-e704-48f3-bcd3-eb868bbcb74f", "comment": "Malware payload", "value": "7c26144647b06dd7e1c68ae9d20d5d0fcf128e07af1b0af1f6fa98e0b80a95d1d44143c87c28e13160ffcc64cc45ff2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912107, "uuid": "96fb6f77-5ade-41e5-8465-8cb1a15930cf", "value": "T1A505D0211D865658E5EF0F78C063045C77F4D04753E7EB2B6EEC90B4AEB3A88CD2A991", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912107, "uuid": "dabc4445-264f-4e58-8190-4f34f4ab709d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912107, "uuid": "b6fa09be-5c87-4983-9b70-57de59570f88", "value": "12288:S8J+IJOUgAUfONPb+JQN1xqVVWn4WpvVgpk8IAoG6I4Hr1AlZMS:Tr5GVQEk8IAoG6IU+2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912107, "uuid": "d7b4137d-0332-42b4-9e76-fb0cf7c01959", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912107, "uuid": "b8641198-cd7c-4409-b919-67c2ca6fdf0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912107, "uuid": "2676847c-e427-4c62-9429-6dd11910ef73", "value": "b6e106e9362a459cbce8b98beda0004039236a1b519def32144ce534f80bc52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5e47f7-6320-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780912581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912581, "uuid": "1c249abc-869a-4898-82f4-9b113d3d176c", "comment": "Malware payload", "value": "35f40ce26331170dc24d93a94ae53c96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912581, "uuid": "aceb2270-c112-4483-8414-c7c32d4899e4", "comment": "Malware payload", "value": "b75260776d9c1d1ed5d9391430354c3e2c63c747a2a28070ef26c5d3a24e779c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912581, "uuid": "0b467e6e-c18c-46de-8cb0-95d050d3cc21", "comment": "Malware payload", "value": "99c3cec046fbdeb71aa8c64bee935be134c445ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912581, "uuid": "533d151e-089a-4182-96ee-75d519d5f907", "comment": "Malware payload", "value": "d26eea01f414f1d39aa4c89e1e2fd9ad08126147412a1ec4a863b39116192ce2d2847a92d385c1aa3519d8ec20fb2b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912581, "uuid": "e96e13bc-b269-4092-9a51-47bb10c93e7d", "value": "T18BE4C32162E9CFD0C19F2475EC96B1F81617EE10CD209FDB7D88BE1A38B12A5A97114F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912581, "uuid": "50c1d55a-f858-493f-b6d1-2728212e4550", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912581, "uuid": "a8694ff8-19cb-4b3e-a89c-9514fc5155ce", "value": "768:Rz57Ngy0RKN7bFyL9bhHTEbRdM8sScR9ApqcArS+jbN6K:77bIL9lzELqSjpPEjbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912581, "uuid": "876bb643-2768-4fe7-a335-ec5bd190219d", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912581, "uuid": "1a6c8043-2db1-4816-ad17-75e65ba12461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912581, "uuid": "2849b3f1-1c4e-47cc-a995-d939df8c1df5", "value": "b75260776d9c1d1ed5d9391430354c3e2c63c747a2a28070ef26c5d3a24e779c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0f984c-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1780911986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911986, "uuid": "51242514-1818-4306-a8a8-5f3e9e0e953c", "comment": "Malware payload (SnakeKeylogger)", "value": "ff0c18c3b9f187325016dc4aa0b93624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911986, "uuid": "40f00404-44e9-4b3e-ab56-effe558fb9a5", "comment": "Malware payload (SnakeKeylogger)", "value": "b7558d75d5cb4d8b5695da781859fa80a5f405723fd5407cb55053a886f180db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911986, "uuid": "90403ccd-4746-4904-aff2-0fdb91f2e480", "comment": "Malware payload (SnakeKeylogger)", "value": "294f937150404d74551d8785e1a347ff1e5332c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911986, "uuid": "b58fb3ba-a6be-4350-b7a3-d159096dd284", "comment": "Malware payload (SnakeKeylogger)", "value": "36e2f368860e2743076d69686a8b3f289e0b318ace67c03407042a72f61d19e1d8e520bac7993962cc03f64d33a383d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911986, "uuid": "289a7e90-1915-459c-a6b1-ff624c1c5aac", "value": "T16A2512686A1ACB07C99127B41972F3B523785CEEB800D7478FED7EEBB966B111C10253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911986, "uuid": "2fa15fc5-ae9e-4d38-bae7-1956d367d1a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911986, "uuid": "0c92d697-5330-43a9-88e9-9066c1252b1e", "value": "12288:IUYsiL1Zo6V6nmdE7ksVMHwPBpHGDILr5ZmDQ+d5KCZqa4gqPiMmq5B/9MsVHJYk:AHJZ1V6xklw/m0LtZmr/8Jmz+2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911986, "uuid": "5106c94f-e904-4c14-be70-a37d383e2a00", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911986, "uuid": "9002a969-71c9-4020-ba06-d2f50ebe5143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911986, "uuid": "e35f48ce-a72c-4945-b80e-9b8418613a59", "value": "b7558d75d5cb4d8b5695da781859fa80a5f405723fd5407cb55053a886f180db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26150c4d-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912944, "uuid": "dc14138d-e40f-4c56-8336-c08c0f353fd3", "comment": "Malware payload (a310Logger)", "value": "e06d42535c1cd8375dad2b7b83a81033", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912944, "uuid": "d7e25f36-35b7-478c-8da9-b64fe5dd331f", "comment": "Malware payload (a310Logger)", "value": "b79e360b5fa92a93c615bf3a47cd89bf0359e52cddeb20a65e76a2de7504dda5", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912944, "uuid": "626a56f9-8d91-4324-96db-230fdc559df0", "comment": "Malware payload (a310Logger)", "value": "cfa85bd20f84025d5cdc1c4b86f56c2d48685402", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912944, "uuid": "235a96ca-6e64-4881-8fd3-cde48dbbafa9", "comment": "Malware payload (a310Logger)", "value": "6831bd70d29b41f0d4d7a2890a663457556940149dfe3207a7f22fb96b2ae923dec43cdf0d6c0bf149574c5f204c14a0", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912944, "uuid": "f2c378c7-a795-48bb-8f98-d3f476d6495c", "value": "T1664522599A6CC502D9D243F41FA2F2B5237A5ECED210C2168FE92EF7B479B581C09783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912944, "uuid": "6f74408a-c5d7-4f55-8893-75a4276e0f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912944, "uuid": "d708bc05-3297-4222-8ba7-f4f80bbe2477", "value": "24576:YA2OYb1ZuNfN9+LVMbZzbTW7/2F3NVlolcxMyP4:8ORNiL2S/Yalcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912944, "uuid": "68dd1f9c-8966-4e0b-be40-d171d2e35ff4", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912944, "uuid": "5bd63c80-4fa3-4136-ac2a-4b95ef9858b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912944, "uuid": "d5fa413b-dd68-4a4b-be2c-49f8b225554f", "value": "b79e360b5fa92a93c615bf3a47cd89bf0359e52cddeb20a65e76a2de7504dda5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b50e10-630b-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780903601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903601, "uuid": "a4ce41a9-10af-475f-b164-f6759809d804", "comment": "Malware payload (AgentTesla)", "value": "697d92c1b9d40b21218cf1c57127589a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903601, "uuid": "fae3cdf2-c742-4daa-981c-3a0da018a78b", "comment": "Malware payload (AgentTesla)", "value": "b7ca4310f2a4e82ddfaa9a9a6f890b3259359d3a31b9b44d69e41f7c4cbaf51c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903601, "uuid": "41d2de4b-01d6-4e18-aaf3-c9b37e57c07d", "comment": "Malware payload (AgentTesla)", "value": "6841860773cdc913927d1757417b76f11ff53183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780903601, "uuid": "331f1f73-8aca-4460-a045-985d39df16ca", "comment": "Malware payload (AgentTesla)", "value": "32d50a5f21af0f3d249bf98a485ed92123fcb829446a86fa53b74754d77fec5e4aa72edaca8cda38ada9070a19fba2a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903601, "uuid": "ea035a33-e393-4b24-ac12-114899c9dca2", "value": "T1373501552B5AD507C96017B84EB1F2B913B87EEEB511D306AFD8ADEB7936F014C04283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903601, "uuid": "8b33e773-330f-4a2c-a6d9-95120641b420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903601, "uuid": "e9e34891-ec69-4d5d-97eb-fac4605021d3", "value": "24576:f/0YNK+w3SlTwdqXY1xYhLVjjVw4QrVVxG7MxguL1wmBaaBj:fsYNZlA5xew4Qrfgc1Pau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780903601, "uuid": "ab841b7c-7b9a-4463-a05a-90730415c64b", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780903601, "uuid": "e807972a-32dd-4648-abdb-6d0cb9f8eec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780903601, "uuid": "fd5d3ca3-a070-47fb-b422-cb3ec9e9ba72", "value": "Ad_PO_00151pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e633961-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780907831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907831, "uuid": "74a145fa-104a-44c8-8362-9af9e0f9ea3f", "comment": "Malware payload (DarkCloud)", "value": "2001fb146b06bb10895faa3e974bdb3a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907831, "uuid": "9d9aed93-1455-424f-a3b7-30752e5e59de", "comment": "Malware payload (DarkCloud)", "value": "b83df496537599eb055a897fa845b54003de4af855aa23f13c0e71224baae1e1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907831, "uuid": "48ad4a2e-6fb5-4f61-b598-1faeb4959850", "comment": "Malware payload (DarkCloud)", "value": "1bb48b019749f49e14770b4f1494c4a8bbd0cfac", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907831, "uuid": "0fb8cf85-cad8-4ffc-a9f4-7f1af1d9a5ac", "comment": "Malware payload (DarkCloud)", "value": "dbe995297cab035e02a671a838a66baaf384497632363123656d3c793221beebbce3e2ef5dd640f7d68840df54543593", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907831, "uuid": "ceed3ad3-1923-461e-8ea4-ebc6d46aabc8", "value": "T1C5450224320ADF06D49F5A705570E3F9127B8E58AD11D3C38FFBBEABB4BA5452841293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907831, "uuid": "8c2dfa29-2328-4e27-8512-07f66ae578a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907831, "uuid": "ae6f923b-3c36-4d24-b513-a314dbdfbb03", "value": "24576:N+AwBaaJmgVJ16u5cRLKxWvM/DRoGsV1+5mL6BWL4TS1:h3aJmgB6ucRLKccoGK1r6BWL44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907831, "uuid": "32823fac-0411-461c-903b-a2fc6e2ce993", "value": 1261056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907831, "uuid": "1dd54ca8-9876-4ced-a2ed-955fd51aa3ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907831, "uuid": "5e6f0fc8-3f76-414b-83a5-c0e0836b4c04", "value": "b83df496537599eb055a897fa845b54003de4af855aa23f13c0e71224baae1e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83ab3fe-62cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780877192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877192, "uuid": "a59374b7-4004-4c7a-ae3b-914f3dae6e2b", "comment": "Malware payload (Mirai)", "value": "fa06f4ca018a15dcf45ccff06080b003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877192, "uuid": "85e37278-04f0-49ce-9ae4-ce3491933fb0", "comment": "Malware payload (Mirai)", "value": "b84b3506a2d6e76d80ba1685304864fef4580bd04b0487c713c1e2c3807b0f68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877192, "uuid": "ba518079-f284-4b95-bf68-8c4bb3961d48", "comment": "Malware payload (Mirai)", "value": "39a9e5d2e07d6f01ec5c77526047765230093b83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780877192, "uuid": "8799d5bb-6a3e-48ae-a21a-9af5878465a9", "comment": "Malware payload (Mirai)", "value": "db388c1e217739eb4434e91684d883a088c48731a514abf24bfaaeb12ab17d7a10f6835b050896656a978b7dd5762487", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877192, "uuid": "848addf9-e51d-4510-a26f-f44250b9e6f0", "value": "T1A884A653D91188A5F4255CB312273242B846D7BB48E726E3EE6B1962FF3141F41BBEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877192, "uuid": "8e145041-75ed-47bb-af13-c2d2f5a18069", "value": "3072:KoPpTlaMjsbj3LrYjnjN7E3H7Y/cKbSyVKjbioLJ+qky5/0yf3D8Mzg4Ve/:LPpMPUjnjNE8EKbSZLJ8y5xf7Ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780877192, "uuid": "d4243b39-46df-420f-b5bb-6b951988ae0c", "value": 397152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780877192, "uuid": "c4c2652a-cbd6-420c-932c-305f1c5f6051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780877192, "uuid": "2fb5ae40-4aed-4535-a90d-9238df6280d9", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57572e5-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911896, "uuid": "f1ad7c35-d433-4fd2-8569-df8bcfdbc475", "comment": "Malware payload (a310Logger)", "value": "d19b893f5a883d3b7e7e4118b5f0fd97", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911896, "uuid": "6244a698-b4fb-4123-9e23-7f37ffd4d366", "comment": "Malware payload (a310Logger)", "value": "b86a02f589f2fc40a5d8d2ffa516e9fcdd626aca89517d8bc347381faad834bf", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911896, "uuid": "aafc8d5d-0485-468d-b0a2-0394c06b7b60", "comment": "Malware payload (a310Logger)", "value": "6ca5f3ed73cd501281a7e87f979a55e15850c9a1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911896, "uuid": "1aa1ff44-88cc-4807-b544-532dceee20ed", "comment": "Malware payload (a310Logger)", "value": "abc6a918f6e5bcaf55998c1166325bf53aa01d136a4106edf7fc9fbbafce9258dcc25140c82929be8049d958342cb4a6", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911896, "uuid": "f1f16f5b-f322-41ab-aae3-dac2677f8ef0", "value": "T16645126C5E47E507C9819BB95AB1F2B503BD1DDDB440C30A9FE9BEE7B92BB106C04182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911896, "uuid": "f3ef1c9a-d027-40a8-a24c-452176ee0fd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911896, "uuid": "7f7b7af9-efac-4f20-adcf-0bdde5ae985c", "value": "24576:wDkzGqEr3EGEqY9TJDPc+coRQsMSfbEQracjoVg26:LGqEr3qz1DP//usMSYckd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911896, "uuid": "cfa6b9c1-449f-43ff-96ae-7b12caba62fb", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911896, "uuid": "73f5f8ed-0d9c-4d63-8de8-20b9e2e0953f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911896, "uuid": "682cc26e-c194-43b2-92bb-40f1223cb5bd", "value": "b86a02f589f2fc40a5d8d2ffa516e9fcdd626aca89517d8bc347381faad834bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c08808-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780912778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912778, "uuid": "ac7ab612-02e2-4854-b601-c1812f12e2be", "comment": "Malware payload (AgentTesla)", "value": "4c36fb8d646107f6b0af5837fb2f05ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912778, "uuid": "8f976e28-1f1a-45a1-ae5a-ae4313f9a7da", "comment": "Malware payload (AgentTesla)", "value": "b876cb153069236d1bd8ede8cfaa686f1ff4549ff41c14fab22b4b74f61a217f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912778, "uuid": "8500002b-feaa-4601-b5a9-cb05e24d303f", "comment": "Malware payload (AgentTesla)", "value": "533c3a80795723dd6b37f23c9c36b4cf5696b73f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912778, "uuid": "3c59481c-f4eb-40c3-bd55-5f14b5c6d3fc", "comment": "Malware payload (AgentTesla)", "value": "2a67138758c292374c1f8375ef52a2aa1bb1c98b3e9907cc829c26c9c7d0e6633adf4570e18abeb4a00e624dfe6554fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912778, "uuid": "53f2193a-8a3d-4d98-8516-daaba93d3339", "value": "T1A4251254BB59C902C89A3BB80AB0F27463B89DDEEA50D2569FE9BDDF38377114845303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912778, "uuid": "182e4923-e964-49ad-8550-f8111bbe7c77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912778, "uuid": "43e0cb69-d87f-42ce-9306-cab9da0f27c4", "value": "24576:bCcJUtSb1u5L6PwY4ueZNcO5a6jaiC9jW:eyyt6be0sa6jKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912778, "uuid": "90e0091e-babd-49b4-964b-9ec21a37eb25", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912778, "uuid": "bab4053d-c5c1-490c-879c-0e95a19f0837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912778, "uuid": "d6df74dc-3795-4af3-97e8-d8c276f80310", "value": "b876cb153069236d1bd8ede8cfaa686f1ff4549ff41c14fab22b4b74f61a217f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6007dd9c-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1780907888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907888, "uuid": "3c28ea02-1785-4d17-a86f-4ea506506a73", "comment": "Malware payload (njrat)", "value": "9a47be4bd5c8fc79ce124c7bb77b9df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907888, "uuid": "3c5ccd23-7e53-4c0d-9da9-2a0433416cf2", "comment": "Malware payload (njrat)", "value": "b895b13fe9541d946ac4a48d0f4d69733f814e7f5729264c2546844bec03152f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907888, "uuid": "ed156857-7206-43c9-88f4-d765d111782c", "comment": "Malware payload (njrat)", "value": "549ef01f1f870d78177e2a4c3e663f542c97dc41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907888, "uuid": "882e9389-95e2-4283-a7f4-d51e8697f0f4", "comment": "Malware payload (njrat)", "value": "ac5768e3bcbae6db32abfd150682c99e377ff12445bf57e200404ca5353a6e40e483293504a8544e2fe22c0738ac4e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907888, "uuid": "9e52d5c5-b26d-4ad2-9223-c78ca948b08b", "value": "T13725013D77E08F21D19929B9C6FB883503E3AB86233BDB897E41158A1D023A4DD4E7C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907888, "uuid": "7ca430e1-3e8c-4d7a-96dd-f419be092413", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907888, "uuid": "633136a0-3ae3-4751-8cfa-5b9096f0fb11", "value": "24576:4TQzL0INizTdm1WysRp4Scf9/f1z9h1Cxq:pcINgdm1WQfF1z30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907888, "uuid": "e3eca83b-6427-43d9-8798-71a73f64fc5d", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907888, "uuid": "e14d1b7f-0fe3-4976-a765-5f360de0c7cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907888, "uuid": "c8bdd354-ffa0-423b-94f8-b84452c64641", "value": "b895b13fe9541d946ac4a48d0f4d69733f814e7f5729264c2546844bec03152f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7af4ca-631b-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1780910462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910462, "uuid": "b566ca33-bce1-4d53-b42d-941336e9633c", "comment": "Malware payload (Expiro)", "value": "8f590be1c5bf09ce8228f35c91c9bb66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910462, "uuid": "a254c173-c1d0-44c8-a834-17d6db939b56", "comment": "Malware payload (Expiro)", "value": "b923645ffbd811e12f5d9689a2b2611feecf6ce1d7e8b22dad9a45e13991c4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910462, "uuid": "83aedc43-0001-41dc-aa13-e7bee363bd11", "comment": "Malware payload (Expiro)", "value": "b7846a9fd3c6ac93e1478d10bf841bfc18f00c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910462, "uuid": "b9b71603-2a1a-47dd-a8c3-a7cdcb8232a8", "comment": "Malware payload (Expiro)", "value": "822b394fdcf03615f775fcaff7fed95c827e36953a57eaabd510091e7f41227df638b285437309b4eeb6cc206d7db4ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910462, "uuid": "52967d18-834f-4a72-900c-125292332d8c", "value": "T14C852224761BCD27D2954BB1ADE1C4702B748F49DA22C61BABEA3EDF71673A40A44343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910462, "uuid": "c66af4e3-56b0-4d5f-ae27-386380deb2a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910462, "uuid": "8c3c3dd3-2400-4042-93ac-3c9ddf4d314a", "value": "49152:GyPzYZ0/glLwedm81y+T5ZpZQFzgvtZEj6+up:Gy8O/6wedh1hZp6tgvt+j61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910462, "uuid": "43fd028b-9b4a-4851-89cf-9b83939e1f17", "value": 1855488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910462, "uuid": "fe771a1c-0d5a-44fc-9ab8-5e7941e13315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910462, "uuid": "14cfdf09-4586-41af-a67f-cb8b6703deb1", "value": "b923645ffbd811e12f5d9689a2b2611feecf6ce1d7e8b22dad9a45e13991c4a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983b97ac-62da-11f1-a769-42010a9c0008", "comment": "Malware payload (DDoSAgent)", "timestamp": 1780882642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882642, "uuid": "0f29b252-3969-4208-baeb-7ddf2bd48f81", "comment": "Malware payload (DDoSAgent)", "value": "0d1d61f24f3a90ff3d95eb72d3a6ca95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882642, "uuid": "79cc68a3-f0ad-4c87-8825-a700d39ecf8c", "comment": "Malware payload (DDoSAgent)", "value": "b9a75b071539b6e54d7e7b49873b1b301a19fa936ec35ac7274134abd215d161", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882642, "uuid": "9f76e067-0f25-4705-a65c-aa696f2926b3", "comment": "Malware payload (DDoSAgent)", "value": "040d21e65288c164c049a54ca2a5d5938cd734a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780882642, "uuid": "6abb05e9-0212-4168-b76e-7617c58dba33", "comment": "Malware payload (DDoSAgent)", "value": "834e76ae1af46a8c877c00f07cbd8326a4db22bcaa9f905c3f0445ee34d87048d714e8979b18ebd85a482a0c3fb02c70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882642, "uuid": "283a167b-8c36-43d6-8a25-b9a2fdbb67f1", "value": "T1899533AA7E406F78E9C09847F71B3655DBC217AA60627A32347524F0E6A04FF8D907DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882642, "uuid": "7bb92887-709b-4429-b3dc-50b5957b974c", "value": "49152:nq547o6dHkPedHbzg0cS9SG7/6YIhf1/Pih5y:qS7J/dHbzaBqWhf1/Pih5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780882642, "uuid": "71351710-f143-4fcb-b0ba-5c4df2f94499", "value": 1902640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780882642, "uuid": "19cb65d1-148f-46da-9d79-f8bb36dc5ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780882642, "uuid": "5d0ec781-16a4-4a2a-b33f-df80a3139038", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7513813-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1780911014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911014, "uuid": "2576e4f2-1fe0-4230-90bd-fe6d6382f568", "comment": "Malware payload (Socks5Systemz)", "value": "5a05133824459a23e7fec7e5faebb9f1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911014, "uuid": "ca7ae67e-3f62-4670-98ff-189e943babc7", "comment": "Malware payload (Socks5Systemz)", "value": "ba34345ee8984d204fbdc2751659d062d94880721dbe92f29af51bd511369c89", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911014, "uuid": "734758d6-08b5-4135-bfbe-7355dd77bbe5", "comment": "Malware payload (Socks5Systemz)", "value": "d2aea9bb964036c4694fa8493150007af0447965", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911014, "uuid": "76d2b82a-77a5-41cb-aaa2-357b71d08b41", "comment": "Malware payload (Socks5Systemz)", "value": "4c597440475f87c6bb690abd18b4a23d918ab8601abac38354231795ffd718e5b13ce062b8f9ec4b04b1ff14958de84b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911014, "uuid": "db7f6879-820d-4d41-a0e7-b170d1252e44", "value": "T1B8E5330251E289B4D15469723CB8C6081877FDA60CB6E81AAECF7EACEF7F9D5B005315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911014, "uuid": "e074f25d-38d9-4f0d-a20b-d58b63519f56", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911014, "uuid": "ebfaaf0a-3824-41cb-a72e-52f13391b7e4", "value": "98304:Nu00UUqbukQoFtGyJ/bOBiPwTZpwPN+SSrl:400U9baorGQbOBt/wPQ3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911014, "uuid": "8c92ee6b-fa8e-494e-aa5b-a348c796a9a7", "value": 3305334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911014, "uuid": "04179be2-465c-42da-b907-5642b22bd7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911014, "uuid": "a7e7c75c-6fa8-466d-8663-18f83d0e1ac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d81043-635f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780939580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "c738feed-4bc6-4b15-9222-fb39bdb03337", "comment": "Malware payload (Mirai)", "value": "060e1fe2870670b27c602cc450013b25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "7f0e0127-7a0d-402c-8662-f38d444bfe63", "comment": "Malware payload (Mirai)", "value": "bb12b6c9f057edef4d13af8726d78e39c03b688f822b67db24a2d9d77f751646", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "9dcba00a-d425-4a4f-8b8e-e217257f2d67", "comment": "Malware payload (Mirai)", "value": "91679053090354a0a5e095c15adc2a819c7f976c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780939580, "uuid": "70522782-ec26-42dc-9549-8da345c4962b", "comment": "Malware payload (Mirai)", "value": "b81c10b7da9b0d7af7bbbca472e72d01f2dff5f2b58be040cc3d89bd72f9cbe722517b128eb7193470f38abd11c6260b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "5669410a-9fb0-487c-8209-6afe609e1a80", "value": "T18E357D2AF2B3B0BCD017C03053AFDBA2A835F47912216D7B35C496352D66DA01B69F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "758a50fb-f173-4ec4-b12b-ee55ac58462e", "value": "12288:X39v0uT0xHYTnCFVzuQrZW59EnMt8FPtr0myI/pUxi5k:X310uT0x4nCFVqQrqCMt83JpUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780939580, "uuid": "4f96c6a5-b323-4963-9541-30ce23c29e9b", "value": 1070064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780939580, "uuid": "4c334f65-f7fe-41b1-82fc-ce263c60d75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780939580, "uuid": "872a1442-5378-4099-9139-f50acfcad784", "value": "dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d15d8e-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941371, "uuid": "99bfa761-7119-4433-a168-865f7393cfb8", "comment": "Malware payload (Snojan)", "value": "9d6028f30ed199d48b4921fa73000d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941371, "uuid": "50bbbe6d-49f1-42d4-9738-dfcc77155d1f", "comment": "Malware payload (Snojan)", "value": "bb1e66220cdb080b3292d8f988ffc2c1f74ac2ae4e8f68bdae21210090d23426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941371, "uuid": "963d0228-dbe4-421d-8a94-d70b2a680623", "comment": "Malware payload (Snojan)", "value": "8b24baf203adac318647189b6735eae025735cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941371, "uuid": "143fada9-8de9-4a36-bda3-d1ade6d1c6e1", "comment": "Malware payload (Snojan)", "value": "f34af7f74bc91f99b891b744e3c0c82732a63825640e7df600c58078ba192f4c9cc0d24db4a433f6af9f437e66a4a630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941371, "uuid": "89c6abbc-049f-4baf-8aeb-cf0c3aa932ef", "value": "T1D125222471C0C4B3E46B503544C9CA76AA76B072477E89DBBBED63E5AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941371, "uuid": "7518f0df-524a-4ff2-ac03-75b6a35e01d3", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941371, "uuid": "9ca2cffd-c14a-490b-ac95-b5d5cb2752ef", "value": "24576:/Y+Jk70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOq:HkQTAKYS/v6h3+1uhZcT2NnvOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941371, "uuid": "86c763cc-6425-40f7-a756-daa3b84725ef", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941371, "uuid": "14aa06a2-9427-4789-8f94-f620dd806df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941371, "uuid": "ff8e817c-dde9-414d-8ffc-d13551a8389d", "value": "dvkoWnkBoQU8JZ0x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e01f8c-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780908107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908107, "uuid": "9a996405-9f7a-4042-9533-72efefa7deb5", "comment": "Malware payload (Formbook)", "value": "21741c7e1d25e881e6444a32187c1c19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908107, "uuid": "f5ddfe49-2b9f-4a86-b827-8e046b70ec7b", "comment": "Malware payload (Formbook)", "value": "bb6416a96b5d05f4b20617165326091d1f13008031e9de208f5b9751ba806d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908107, "uuid": "654f3209-61b0-4743-b40c-f943b29b8333", "comment": "Malware payload (Formbook)", "value": "9be78d6e16407278ab2efc4eb9570c66d674e78d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908107, "uuid": "b5a8292e-3a8d-438d-a53c-9bf0407d6a32", "comment": "Malware payload (Formbook)", "value": "d835c9a9c1b63af761c3dd13e9447a2203c77535b5614e899df25825e989138ca6cc219d406cefa7cdb7f49e304bab79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908107, "uuid": "fd06ba7a-f3d2-42da-b0cb-4cb50e8b3aac", "value": "T104350200535FD906E4F687B84861E7B40678AE88B960D3038EF6BEEB78357869D553C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908107, "uuid": "dc5814f3-1124-423b-91c0-641e4c6ed62c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908107, "uuid": "96e7fe30-3504-4d25-9770-24fc3962c056", "value": "24576:SReCq6x+bJ4AFCmsHz1fbZWVXvTmmdPpbKcl:SgCSbJ4WtsHzJbZFuPpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908107, "uuid": "628f7a55-af51-43f5-b9e3-dd5b3677b08c", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908107, "uuid": "2db1e206-5450-4b50-8129-f434c6b83c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908107, "uuid": "52c0e956-ac9c-4ce2-958c-12c4f2655112", "value": "bb6416a96b5d05f4b20617165326091d1f13008031e9de208f5b9751ba806d89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5ee49d-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1780907481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907481, "uuid": "4a8f9783-813c-4719-bce4-75fb7fe700ea", "comment": "Malware payload (QuasarRAT)", "value": "3afb38bfad87cb9e00d81d90dd467cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907481, "uuid": "3b881227-71fb-436b-bd98-610fff873dbe", "comment": "Malware payload (QuasarRAT)", "value": "bbfb1b5542f73bfd598e587ccab52da52ff59ff120708900a0a15484deaa18fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907481, "uuid": "857a26a4-efad-4924-820b-5ad27ed7112c", "comment": "Malware payload (QuasarRAT)", "value": "31f2781d576ccff91f32952f3a93a3ea001831b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907481, "uuid": "cd00eec0-b32c-4c96-b5fa-4e865a410a87", "comment": "Malware payload (QuasarRAT)", "value": "7722fd1c4aa796bb26e0a27f5d61f5d2c08b0ac18e4f753efe3706fe52ec08381b6e40cbd2f7a049e67b51c87c3a9a78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907481, "uuid": "03acf7c6-c88a-4daa-83bf-dc8e8b3aa256", "value": "T19B050289A7C08E35D90A5D34C4301E7842379F0A7E55F285EE28BD7337B3ADB189199B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907481, "uuid": "361dd828-f8b8-4cbc-aebf-df8b2e04b2af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907481, "uuid": "1a4151ef-e7cb-4c92-8ff0-bfdd7bc348c4", "value": "24576:m+1SHvhthpBqs/F/uwn+cshmk8/upcUjI:xchp0i9n+uGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907481, "uuid": "940db045-cc54-405a-b970-96149ccf6413", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907481, "uuid": "8d529019-559c-42c4-8ce1-02961cdeba67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907481, "uuid": "131c2475-109a-4112-86f0-0a49a5717c06", "value": "bbfb1b5542f73bfd598e587ccab52da52ff59ff120708900a0a15484deaa18fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c055ba36-6363-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1780941550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941550, "uuid": "44ffdce0-e195-49b5-9ee3-607783d1e8ec", "comment": "Malware payload (Snojan)", "value": "2b7bedc39ea899f8c3a2a7d9fe24024e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941550, "uuid": "3d7b4dfd-2b4a-4cb3-a6e6-bf532ed700a4", "comment": "Malware payload (Snojan)", "value": "bc7db24d53aa9f34dd9746faad3b7ef033d0b7a3c9f8960086bb206f0ee4fb7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941550, "uuid": "d3e5e228-2fc7-4b57-b10b-ce654251555c", "comment": "Malware payload (Snojan)", "value": "d936493d9a3741eaa22c3fd8d6791cb1324dbfda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780941550, "uuid": "d0f86bb5-93a9-48cc-ab72-e60491b922fc", "comment": "Malware payload (Snojan)", "value": "28d851c089ad7d46b297def05530cc7cd2a6755a87948dadc7c88bda09146ad8d64948b9d8cc5a97cb63766a1ff99837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941550, "uuid": "52499a44-8410-4356-a04f-4f8d6452a575", "value": "T1FD35222471C0C4B7E46B403544C9CA76AA76707247BE89DBBBDD63E9AF203E163352C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941550, "uuid": "33ee85cf-11a4-4dcc-a436-be777a313a20", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941550, "uuid": "61301525-25fd-4170-9bf8-96dbd72a54c4", "value": "24576:/Y+ik70Trc18BSnLW2CRBKViu99LK1Rad6yZcT29fhducOyT:8kQTAKYS/v6h3+1uhZcT2NnvOyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780941550, "uuid": "70d63dd5-fc54-4b9f-b05c-b62a9b18d6db", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780941550, "uuid": "2ae65e58-9f69-43d2-8233-067928243989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780941550, "uuid": "0ad37d4d-68ff-47a1-8890-45725b37a809", "value": "IKtcD2ctkP6ZwuMS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c534daf5-6315-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1780908057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908057, "uuid": "ff3f7c43-c482-466c-965c-efb17ff49ff8", "comment": "Malware payload (AgentTesla)", "value": "614ea2278c5b8df8efa0a3d3a6044ecb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908057, "uuid": "848754f2-c3c3-41e2-8ace-d9ca6ce8a43d", "comment": "Malware payload (AgentTesla)", "value": "bc82c7456057b8785d9781eca9a34d809432857cc58dd80e7f54cf079ffac60f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908057, "uuid": "e96259e5-76ef-40a3-a456-f2f32757823e", "comment": "Malware payload (AgentTesla)", "value": "1a0e3fe084c673ad1544c0de82bbc1a58025be97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908057, "uuid": "1384ce07-a27c-4b99-b5c0-180adf232d0e", "comment": "Malware payload (AgentTesla)", "value": "f2adbfb8c413b2823e52af2a670df6828f8c4b7428d53590a465e34d156af69457fbf5c9a9001a06b29d2152dccb44f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908057, "uuid": "9123855a-1062-46c5-9f39-6563fe402f3b", "value": "T1FC250114321EDD06D4B79BB948B0E7B407B46E44B931D2039EE9BEEB783A7915C183D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908057, "uuid": "e9563d63-2ada-4df6-9f59-c62e3d117e22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908057, "uuid": "0a22d462-1dd4-4a9d-911b-69dd270fd95c", "value": "24576:VnbgoHa7ewG3O1MOj6NUB+hKvquTwMsquomJhiR:Vge3+N6Q+hKyqwMVubTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908057, "uuid": "a9a5385c-f980-4c90-95be-a7417b366dde", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908057, "uuid": "5dea058d-300e-425d-9f2a-0d24f88b7079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908057, "uuid": "88636180-c7c4-4543-a70b-1dc9bb5fa617", "value": "bc82c7456057b8785d9781eca9a34d809432857cc58dd80e7f54cf079ffac60f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e450745-631a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1780910032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910032, "uuid": "45ab0789-fa2e-40a5-aeaf-c5c98c37f71a", "comment": "Malware payload", "value": "b9239601ac905789220113c273d15699", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910032, "uuid": "16dc772b-b13c-4179-bd22-61619bee43ae", "comment": "Malware payload", "value": "bc84425e91709166a5dfbd93ace6b3ad24db1eae82da1b78282b55de277e3482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910032, "uuid": "6cfa5d0d-c9fc-437d-a1b2-65624ec1fb7c", "comment": "Malware payload", "value": "3e9acbe6cd8d9986d95e2686e0dd16392a70d624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780910032, "uuid": "58536e3a-bb2d-4f44-a6a4-2acf501d1d9c", "comment": "Malware payload", "value": "e744226dfcf5e763a71da33d40d69ee84c3a9365c91e7290d6650b5b28a619875eb8c5484d7518e89ced78231b3b3c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910032, "uuid": "54fc329f-a2b0-4bd2-be8a-a9b4494b513a", "value": "T15B85CF0573A442DDFEABE1768A13C507C7B1BC450637861F06A4BA766F33B716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910032, "uuid": "33777115-eadf-4da3-8fbf-f2f1ad1a7e7e", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910032, "uuid": "876c6fbe-20d2-4da9-9eb6-1d4c1f65d527", "value": "24576:DCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrPOAas1cNUtwLID0Lpu8XcWJ8Y9ivd1:01H4jR2TYrQbDTrPuO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780910032, "uuid": "37b2d7ac-6d06-489d-bfb0-d1ed7be3424a", "value": 1852928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780910032, "uuid": "2ba14cc9-00ae-4961-8beb-c81665f69c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780910032, "uuid": "52041d90-e0f6-47c3-90c5-5bf062b40234", "value": "bc84425e91709166a5dfbd93ace6b3ad24db1eae82da1b78282b55de277e3482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b6a822-631d-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780911333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911333, "uuid": "7a6bf8d0-499e-46f5-9700-dd063e782fec", "comment": "Malware payload (AsyncRAT)", "value": "66cee96441c582a9629a7e67aae59505", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911333, "uuid": "2f67664b-760b-4e19-914f-a2a5d5989a22", "comment": "Malware payload (AsyncRAT)", "value": "bc8945df003a0b75249e4a7fb08c1d734ebeb81f4e215c0d7df539a534e8edad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911333, "uuid": "ffa8e89f-9ebd-4428-99d0-f429da07dc89", "comment": "Malware payload (AsyncRAT)", "value": "165765d55db5f00afda6a70ee363803020892695", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911333, "uuid": "ca6eed6d-4886-4f81-a710-6c772bb0e4e1", "comment": "Malware payload (AsyncRAT)", "value": "7fd90e44bde59d34c0951b3c604184fb2c2cb4f5c5dd3fd25469afb46a2029927c48643155fd48b60d31251337ec7ed2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911333, "uuid": "ba90b770-934c-46c6-8b5b-80d044f4759b", "value": "T182F402186A6AD913C96643351A71F37467AD1EDEF402E3179FE87DDBB93AB110C08283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911333, "uuid": "24811f0f-20bc-40ba-8629-fd5a1922002b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911333, "uuid": "3cda3907-abcb-4a15-964d-ca4167c1c78c", "value": "12288:cxiO84xMszR4egE04lcp+kDkqd3hzVT5mab8R2SwXLyEmp6NZSoRkOZYuEZIrK:wMs9Fg314kDPfBkkXLyGDS5OWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911333, "uuid": "344c2531-414c-466c-9fd8-31970a8df153", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911333, "uuid": "a0edb332-47fb-42d5-a68b-93b972e4bd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911333, "uuid": "d4b404a6-3d69-4d41-a8a6-19ad50755bc3", "value": "bc8945df003a0b75249e4a7fb08c1d734ebeb81f4e215c0d7df539a534e8edad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae288b2-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780911637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911637, "uuid": "568daf99-b89e-46f6-95ed-57cf64974e18", "comment": "Malware payload (a310Logger)", "value": "eeea3e3aa38496e3dee89445cf26f7dd", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911637, "uuid": "42a10805-1da5-4383-ac12-e38f57b7ba2e", "comment": "Malware payload (a310Logger)", "value": "bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911637, "uuid": "8e7f0964-ca8c-4907-8beb-15f263cdfadb", "comment": "Malware payload (a310Logger)", "value": "491abfbda36ee0f1ef4301d1cb6565ef56a8305c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911637, "uuid": "91069977-4f65-450b-a851-0d8fd08c1144", "comment": "Malware payload (a310Logger)", "value": "ef1cc28d929da8218b9da5a69e4d5f7e61ae8a0bad967cba9fb4f1adda97ddd35b91dd7ea4890e4d765cc7e218c3cee2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911637, "uuid": "0901b3ce-3b8a-45d2-acf0-8c2104cb0823", "value": "T1D3452368AA46E613DAC51B364E71F3B517AD5EDDA801D317CFE8BEEB7863B044C01182", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911637, "uuid": "e4f863fc-5820-4970-a834-5310cf62d7cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911637, "uuid": "ecd09d2e-8dfe-4173-8622-b52cad8f1062", "value": "24576:hp+7lD2kGm9OUZ+pMCC37ExifTSQGc09VBfX:hpohEJEUSf2dcih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911637, "uuid": "2550e0b4-d2a7-4fde-9ded-a7b439dbf384", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911637, "uuid": "1393cc01-664e-4bff-a351-53151c070133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911637, "uuid": "e3cf71d9-1ccd-4eb2-980e-0bcb50298b09", "value": "bd0d1f8cbc892d1ca6853739c7d2e6938f78b6ea8d07e517da318dd96a143d8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6457922e-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780908324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908324, "uuid": "495ec86f-5db1-42a3-ac29-71e0b1fc575e", "comment": "Malware payload (RemcosRAT)", "value": "0037c3cf88bb900da2a4de9b5ba91ea9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908324, "uuid": "55e66040-6de7-4228-84bf-563e572c7ede", "comment": "Malware payload (RemcosRAT)", "value": "bd34f9019cdc446b263f2a0eee5dcdb9646fd2d6fe37ac90243982705d44b0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908324, "uuid": "4c54b5d5-8059-4c00-9f00-b13534a0954b", "comment": "Malware payload (RemcosRAT)", "value": "319e1d181f7cfbbd60af7d0bbe55ddb6b8987a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908324, "uuid": "b04bceb4-e645-4691-bbec-4f5c6d4fee5d", "comment": "Malware payload (RemcosRAT)", "value": "fdfc229054e119a4661233a74dd7b39bfce8c78e36f7ffa945f054bf8b3621d68beab14aebc5a05cfd2236dac7bac2a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908324, "uuid": "407db1f1-2437-405c-96fe-975fbdbaf0db", "value": "T16F651254670BD912C8860FB40D71E3F8A6645E84D831D31B9FEFBE9BB9BF5601816382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908324, "uuid": "82a7dfdd-d003-496e-9c61-f67761c68a2b", "value": "24576:0YAEFT0DAGozKtB/Ev9KEOg09Qmq1rAY7C2FYhiL9yUZuDYKzsDa+ADQcmkaCwCN:x3FQsG/tBsvYEOc1rAY7bSCZKzsDMDQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908324, "uuid": "b4525333-3492-4dc1-9a94-1594d9986fb4", "value": 1442304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908324, "uuid": "80b67879-5fb4-4604-b38d-0cbb2a4af3a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908324, "uuid": "e1ffd32d-763a-4608-8e31-60c5ce749988", "value": "bd34f9019cdc446b263f2a0eee5dcdb9646fd2d6fe37ac90243982705d44b0fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3d3d24-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1780908556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908556, "uuid": "169b1ebc-91a6-422d-a64c-715ef8e30e78", "comment": "Malware payload (RemcosRAT)", "value": "8b639ca3a9a497149ceca89dce487b34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908556, "uuid": "ba2eff6d-73dd-4a6b-b082-cc41d729c62c", "comment": "Malware payload (RemcosRAT)", "value": "bd50edeb1a22147c2d478e6b784a9198bdc6d0276308c0d31212417b91541c86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908556, "uuid": "a252d9d7-a824-4d0c-8b3e-7b3a318029c8", "comment": "Malware payload (RemcosRAT)", "value": "fc69434fdc538269696985a70a29dadbceaec0e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908556, "uuid": "3798ba00-7f23-4ebb-8120-9be01b542463", "comment": "Malware payload (RemcosRAT)", "value": "7a0ee91c0e2f05b286b4bce1c4968a929068cafcb9f27d15bb689aa80ed5b70b380986f45f8ef562886890b5a0ecb7b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908556, "uuid": "07891ec5-60f6-438c-bf5e-d77e560790a5", "value": "T11A551254270EC902D4A68FF42E60E2F513B45F98E921D2139FEABDEFB8793406915387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908556, "uuid": "fc196500-bc40-497d-8703-ea3760f0588b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908556, "uuid": "148eca29-2ac1-4255-9ae7-f85b30b6ce4b", "value": "24576:MZLldsAEFT0DkddRZycnXISs1iQ/v0y6DmFY7Mq3BAwMs+7RRxC91XOVVI7m:MZLk3FQodbTnnkiqvywY7MwBA1rC9JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908556, "uuid": "16d95ed0-6def-4115-81c1-9ebd6f9f21eb", "value": 1305088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908556, "uuid": "7f923e39-af0a-498d-897e-9260813e22fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908556, "uuid": "c803d6b3-0fb0-42a6-8ccd-2a7576f2c034", "value": "bd50edeb1a22147c2d478e6b784a9198bdc6d0276308c0d31212417b91541c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefb2db4-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1780911993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911993, "uuid": "b3cb0cd2-3d6c-4a83-ba8b-2fe343e27cca", "comment": "Malware payload (AsyncRAT)", "value": "3e640a4fe51510c4e80c779410593179", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911993, "uuid": "420bf4ff-b807-4d44-81c1-78be5fadf224", "comment": "Malware payload (AsyncRAT)", "value": "bdac3f57e23880573ef7aa755028383d5c6a7d2fc5bca21be8815388c1d6185a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911993, "uuid": "bf5b972b-f67b-4f8f-9ba7-a695fb09cd62", "comment": "Malware payload (AsyncRAT)", "value": "e1c5ae8c9543c835d0e3e4717cea3123b0a60e95", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911993, "uuid": "3bc38783-aa6e-4e03-b6f9-5e2fc52c8f4f", "comment": "Malware payload (AsyncRAT)", "value": "b937ec05cc5e1d02b37507d07d7a9cc3fed912488d484e004f77b2427939dff66dbb8edd661c95519d8a8afa940165cf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911993, "uuid": "4e0f1ea9-8dd3-448c-9603-d2e89d4235a4", "value": "T18F258C19E38D11E8D227D534CBE26232E7B6745A0761BADF079AC2152F73AD02F7A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911993, "uuid": "d98b17b4-dd57-437c-a869-adfe37d307df", "value": "3e3cc0d07e80f21ad4fda2de97dc2a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911993, "uuid": "c195ff3b-ff50-47cd-926b-f3accd6b2def", "value": "24576:vh3k7harZP7322uzZcPeJ1YmUrZi4Jjz7Q2A:vh3KUn+ZcPeJ1Ym4iK78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911993, "uuid": "a067f020-8ad9-4a26-b9b9-9a1067662b34", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911993, "uuid": "57bf7fb9-066e-412c-b19d-ea86a6f6ba2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911993, "uuid": "d992fa1e-8d70-4607-8329-8ade4223ccce", "value": "bdac3f57e23880573ef7aa755028383d5c6a7d2fc5bca21be8815388c1d6185a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ec0e74-631c-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1780911018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911018, "uuid": "696bb8a3-3fca-44a2-88be-0de18b45ed20", "comment": "Malware payload (GuLoader)", "value": "24affdc190f0ad8bb3bd9e01be43f605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911018, "uuid": "7a54191c-7289-4946-98a6-972e05f6d337", "comment": "Malware payload (GuLoader)", "value": "bdf381ab485d9bb8aaf0e7a29a36c86169cbbbd45e2de3da745210c8c3c4c011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911018, "uuid": "a4ea1ef9-1c05-4e53-b182-d303f9f578a8", "comment": "Malware payload (GuLoader)", "value": "eebdffffeb769898430e22aa114eda1fbb3990ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911018, "uuid": "10beda62-e33c-41ed-b6e5-f6e0a8dd128a", "comment": "Malware payload (GuLoader)", "value": "7b91eb78a3e30420a5eae03419958ed7efb6039b39bb2812e8322d7e9e417361c27c6b554e9448e7da3e6b7bbbcd725f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911018, "uuid": "1d6c8c0e-558d-4757-b264-5200dc19a8e9", "value": "T133341210F291C577F9E1CA326C3757BE9F9A8D111001BF4B1341AA6874776E2A93FB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911018, "uuid": "92d05bd8-6c33-461f-855f-4a119fe0df63", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911018, "uuid": "2a684621-d491-4a11-b592-45bf4eea3193", "value": "6144:ymGIhxAI6wc2Xy6Hc9GWq75BULNrue1XY4qcssCJ+gL1fQ6:l1AIE0HAa41InQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911018, "uuid": "8b3857b2-e7b8-4fc9-b19d-9eae638ef44b", "value": 252419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911018, "uuid": "273b5480-a32c-41bd-9a21-e046706a137f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911018, "uuid": "e1684209-b07c-4b0f-93dc-1c50092d0b74", "value": "bdf381ab485d9bb8aaf0e7a29a36c86169cbbbd45e2de3da745210c8c3c4c011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56b3c0d-631e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780911923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911923, "uuid": "5b48a91b-c1d7-4859-8c34-646e96656db4", "comment": "Malware payload (DarkTortilla)", "value": "cc43c5d12968dada4f2aab70df53a47e", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911923, "uuid": "63d24faa-afb2-409f-a81c-e9d094ee3585", "comment": "Malware payload (DarkTortilla)", "value": "bdfaa1ccbe62c605f48414b18242b8419e88540a58e962690c750e774edcf90c", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911923, "uuid": "fbb345b0-ec17-455e-abb8-9d17f36d4858", "comment": "Malware payload (DarkTortilla)", "value": "49e196d36fe36addd6fc6e4f61aeb95b29ef120e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780911923, "uuid": "2d77f101-6f75-4ea4-8c3a-268a2a7bf5cd", "comment": "Malware payload (DarkTortilla)", "value": "f64663c9e602015328bb6853642fcc453a4547094f186206ff5a6bb43e9f6d5fe817034eced08e23303249f683f8d8c0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911923, "uuid": "4acfd9d7-e561-4e7f-86a1-1134db7d3455", "value": "T1A155E1161CC326A5C1FA4F78D36904A863F08A2B9752E7B72EDC02F5DE5378AD813572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911923, "uuid": "4a8c2a69-8064-4c06-8d1a-ad7043425474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911923, "uuid": "9dcb5b70-66bc-4739-be1b-6e40c7ae7e02", "value": "24576:tzOix75fOBWGt8AXdGjTXzIGebwYp8sAOPmIMP:tz3fOkGe0HGnL3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780911923, "uuid": "6378e8a0-4eb1-49b0-92ff-1cabd2535bf4", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780911923, "uuid": "1e8b4a1d-55c3-468e-92da-f5d4fe721dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780911923, "uuid": "168f4188-bdd8-4d2a-a6f2-8969e6dc2341", "value": "bdfaa1ccbe62c605f48414b18242b8419e88540a58e962690c750e774edcf90c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c25d2a7-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780907505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907505, "uuid": "52f176ed-b9f1-4ba4-a2d5-4394ecba3354", "comment": "Malware payload (Formbook)", "value": "14653c1f05104d6e5d2ae8c777535eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907505, "uuid": "f0c12daa-f8b4-4d09-9995-fafd2341cc6e", "comment": "Malware payload (Formbook)", "value": "be3f375e256ef03dad18337bc635099e24290501d3fa86509686f3aa351a8d13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907505, "uuid": "c8f4adae-8523-4312-8747-46b55a2b94fd", "comment": "Malware payload (Formbook)", "value": "52928ea05ecbc8222a6ba4b71b2da4582b5c10ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907505, "uuid": "755d7a1b-1299-4921-8123-18a824a035e2", "comment": "Malware payload (Formbook)", "value": "94c867dc1d606ff8a9e89a8d617b9514d3ed61e9e29afdebf72653ce1e38ff01ba52dd19b99a015891318458da88f70b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907505, "uuid": "a1757a8d-a209-4145-abf8-cea6e3fba819", "value": "T1FE251205734EE813D0A65EB04D72C1F51AB8AE98ED31C2079FDA3FAFB47A1641867346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907505, "uuid": "4e692d97-8eba-44dc-a881-10fd67fb1fef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907505, "uuid": "5ad70bbf-52c1-4030-b2ad-cfb33d47dcb7", "value": "24576:OzhwZtCBDH/NIk93TuXLt0fatjvdVk/z/DD2:O9wSBrh9CRiatjvdK/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780907505, "uuid": "cfed3556-ede3-4f58-94d5-572ae4267f4a", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780907505, "uuid": "cdd73c7f-f92c-4d2d-973f-80ce7e9930a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780907505, "uuid": "5f99e78a-b183-4c28-87ff-0cc82254b7b7", "value": "be3f375e256ef03dad18337bc635099e24290501d3fa86509686f3aa351a8d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953d4306-6316-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1780908406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908406, "uuid": "6a9b0cc7-7007-4240-b833-e9b1ada79d73", "comment": "Malware payload (DarkCloud)", "value": "c3d7de2229127bee2e04d90be4181147", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908406, "uuid": "b7af0c9c-2abc-41ad-8a10-86ff83c7f779", "comment": "Malware payload (DarkCloud)", "value": "be5c9e60c897f68b3d7adedb1ab4601728d6dc4485969efbb9623fdffc951ed5", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908406, "uuid": "f5e544ce-0fd7-43d6-ba09-ed291c9e309a", "comment": "Malware payload (DarkCloud)", "value": "7fdef15e88f44f18377bde35fbbb626e9d7f6a5c", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780908406, "uuid": "7139ea3b-9689-4e43-a501-8d686aee736e", "comment": "Malware payload (DarkCloud)", "value": "fb290425f9794f88cf36264dfafa8149d4f48967cb1a2417a9d53985bf0baee5fcc021c39b4eced0be4f28c6e1944bdb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908406, "uuid": "d8135b19-edf9-41f8-9479-df1cb5ecbe1c", "value": "T1D96501242209CF02D4AF4BB85560E2B417B75D9DAD11D383AFD1BFEBB87A7602D00693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908406, "uuid": "2c629525-37e9-4ac4-b560-45ebd2ac089a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908406, "uuid": "49934227-0929-4cd9-8846-523a9c201f42", "value": "24576:oX3ZAEFT0D81SRX69DtVsWLCjUZ6d2ZVKigBDMEp+fBzOwWLeg1cOJbLeQWV:YZ3FQmSRK1fZ9Ki+YLB7cT1ttyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780908406, "uuid": "d490bf8a-af95-424b-9c0a-73c35ca56f35", "value": 1437184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780908406, "uuid": "9754ef9c-4dfb-48eb-87da-5b6babf71ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780908406, "uuid": "8bff012c-c08d-4f4f-9131-0f07998d59ef", "value": "be5c9e60c897f68b3d7adedb1ab4601728d6dc4485969efbb9623fdffc951ed5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5234dcde-6321-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1780913018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913018, "uuid": "5296fb28-8b00-46bf-a36e-59920d8b7090", "comment": "Malware payload (DarkTortilla)", "value": "2d63b8eca3e0e8dadc08a15f4f3bc5be", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913018, "uuid": "90c73c62-b46c-400f-b666-11387d73a7da", "comment": "Malware payload (DarkTortilla)", "value": "be98f0a2f2106767ec871e40a13d6331dd84695c66f0afab2a57ed40e126a790", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913018, "uuid": "b417480c-736f-4e0f-a94d-2d57a46eb5b8", "comment": "Malware payload (DarkTortilla)", "value": "dc972c749c9469f917fff41dd2ff8b6341c9c68e", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780913018, "uuid": "aea19c4e-bd5b-42f2-b10f-aec9d33ba4b7", "comment": "Malware payload (DarkTortilla)", "value": "538cb5c791eae7384c8faeacae6fc7fe6ae48406ebe00d4540ce3ae804f0b3e6530a5ca2fbe8d51efd56bdd8ff22c0ab", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913018, "uuid": "2b9284d0-83bd-443c-8917-9385f857c2c6", "value": "T11455E0050DC71FA4D5EA0B3CD2A600A8B3F0C65B5295EBAB6EDD01F4DF57B46E90A0D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913018, "uuid": "6f27886a-de0a-4476-b0f4-fd3285835c94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913018, "uuid": "3a9c4a07-5e97-421b-b3fa-27c52f4faac1", "value": "24576:60+/FEhFMxO+Nm5olKEKUIXdbc3aGVgpd4dAOPmPK:IyhFMXNSooTF7VL4SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780913018, "uuid": "ee1cb117-6f2b-4f50-88f7-56439fdda5b2", "value": 1367040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780913018, "uuid": "38d93805-d3a1-4788-9d20-3463d1330924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780913018, "uuid": "1d52041e-1cb3-45bd-b2a4-d13ca209e1d7", "value": "be98f0a2f2106767ec871e40a13d6331dd84695c66f0afab2a57ed40e126a790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b2cb0d-630e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1780904924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904924, "uuid": "1f7f96fd-78c8-491d-9959-fd4afcfaf06c", "comment": "Malware payload (Mirai)", "value": "e84c8abfe8b7fb89433962bcf14c442d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904924, "uuid": "ca75e2ce-1d55-4ec3-a700-40ed08dca23e", "comment": "Malware payload (Mirai)", "value": "beb44438f46bff558235db3a3084e7a387b740ac9ffa05aee46ea2fec7193d60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904924, "uuid": "261af39e-0c46-4d47-9a35-7a6df9cc9215", "comment": "Malware payload (Mirai)", "value": "a3c3481ef5f65c8ea94c563c158eb58aa3d4add6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780904924, "uuid": "9baa8f9e-75a2-4ded-a6d6-85acdaa7c8ca", "comment": "Malware payload (Mirai)", "value": "e06fb9874e8bbbfcdb1943ccdbb69897e97d3259b78d33f679dda87c6f8eca9f917b9c540103558d70e118b17f9cca69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904924, "uuid": "5faa381c-0f1c-4449-ab92-d533fab853a1", "value": "T19FD34A63DE26AF4AC126E0F0B1B28E741B53BD2949470EFAA576EAE44143DCDF105378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904924, "uuid": "8f146824-009d-4481-9ec8-c69a9196a67e", "value": "1536:TE46pMDVBngJCzLnxCV7Cj0CwKZW6c/m6+DkxPIWICE3uxU/Bi7zNm:TEbp8n+YLxEmj0qZN6+YPIWZEe8Bi7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780904924, "uuid": "f73c415e-9ee1-40d6-b86d-3a8de7b9bb61", "value": 142812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780904924, "uuid": "7485846f-b707-453c-99ec-337611b3f34b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780904924, "uuid": "e3c44e7f-f16d-4ef5-91f6-fded91ca9ebd", "value": "nova.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc263a2-631f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1780912256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912256, "uuid": "1ccf1817-71f8-46e4-ab4d-d12c531fd940", "comment": "Malware payload (Formbook)", "value": "1fa987df5998660a14666ade37a00851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912256, "uuid": "d73c5a35-a090-4804-aa94-9f354d15359f", "comment": "Malware payload (Formbook)", "value": "beba443732567d81bdec4eb6b54321f535fa815917159a8e1deaf916c1c70a29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912256, "uuid": "21dd945b-da4b-42ef-8fda-bf5ab22d6971", "comment": "Malware payload (Formbook)", "value": "70403883b93fc78f8a5bd92c1fd55ba1701e1a4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912256, "uuid": "0f895f8d-e8c8-4234-a342-bc38b8569cfb", "comment": "Malware payload (Formbook)", "value": "b2dbc6eea96d3cceba9d0a52af6ce64172f80a83599d0159ee41e2b18bff43b911fab68ef17683bf94ec4bb4c038e38f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912256, "uuid": "215331e4-46e2-43f9-beb2-bef08acca80c", "value": "T16B35E0F0A780C426D86786788437D6B36523AE5DDC68860E2ED5FF9B3C72347402799B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912256, "uuid": "d0db4fb4-feff-45ff-a1d9-1fa643cd39a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912256, "uuid": "9fbf097a-4e98-4bbf-94a9-d773bcfa227e", "value": "24576:qIwSPILPCsM1ilpZS80ssu63iQC6ds1HJ9EXAA:GUITCs9R2sXwiQC6ds10XAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912256, "uuid": "5dd21040-541d-412e-b5b3-3bc4a83bde87", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912256, "uuid": "0cd660e2-9dcd-457e-94b2-9d5c44cd6f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912256, "uuid": "a4e239bf-1cc1-44af-b21a-3fd52c0eec64", "value": "beba443732567d81bdec4eb6b54321f535fa815917159a8e1deaf916c1c70a29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d33293a-6320-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1780912500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912500, "uuid": "c6fc8c31-540c-4ef7-b16a-92721135368b", "comment": "Malware payload (a310Logger)", "value": "72d9bc0104cc6246f995f06f21db71bd", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912500, "uuid": "e56c5166-61cb-4c0c-a31c-980a142abc09", "comment": "Malware payload (a310Logger)", "value": "bed8a5eec3684ac05697d18206aafdd9150e48a71449a70b9005a0d0abbd30d0", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912500, "uuid": "278b05d6-7c20-4ac3-94b8-00712ce5abe6", "comment": "Malware payload (a310Logger)", "value": "64e9c22bd1366b413b6ea6962282bf5092af73df", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1780912500, "uuid": "7899fd8e-0349-416c-856d-0e0b51ec3d11", "comment": "Malware payload (a310Logger)", "value": "f8eca6ee95427d41642c1adbd06af31c01f1c14f4172a7c37454448ec93330d69722c8887e4639bb49a55b52ce354ece", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912500, "uuid": "01a7e501-67f3-4c11-be51-87bdc5a748dd", "value": "T1C1944B13EB60A11EF1A389F1A8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912500, "uuid": "ef8b7588-ac65-4727-afa1-40c465e95cd7", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912500, "uuid": "9f3f2d29-19f5-47a7-8c03-72d231aa8e80", "value": "6144:RK8d1/w5KA81IJ8GpF6nuTmOOUiBUrjD3VFVA9LWS+tvpPBLky5z1eccNg:R5jYKkJj6GmZUiqrVwWhNky5z1rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1780912500, "uuid": "ab6683e8-92df-4aa4-9aec-792cab6252ee", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1780912500, "uuid": "de79144b-b110-4ec9-a68e-c97ce2041bb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1780912500, "uuid": "456bc7c9-f54e-4064-99d1-9c1e6d9c2764", "value": "bed8a5eec3684ac05697d18206aafdd9150e48a71449a70b9005a0d0abbd30d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3413b926-6314-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1780907384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1780907384, "uuid": "9d7bca15-e259-4803-9953-029d0118cd36", "comment": "Malware payload (PureCrypter)", "value": "820753177cd908cd62faee980d234b5b", "object_relation": "md5", "Tag": [