{ "Event": { "published": true, "date": "2023-09-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-05", "timestamp": 1693958582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f6ccafd7-9939-4b14-877a-87bb2eb5909d", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4ca13b-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693915141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915141, "uuid": "4bec10c2-95df-4d7e-85e4-ab4ca20a5627", "comment": "Malware payload", "value": "4f55454d161e9b794f7482c4b5378ea8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915141, "uuid": "4ea17c6a-c9cc-4204-a0ec-ea4482d4f84c", "comment": "Malware payload", "value": "00281a9e4bd0e85813410d7122e8aecf8a038f6297d4f8d7dee6b8b30021b722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915141, "uuid": "1d7e1281-a6df-4cc3-95de-96a2db8f4cf8", "comment": "Malware payload", "value": "dd4b96f88de09d6a06fcca9d44611e6ab5cbbd0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915141, "uuid": "7022a15c-803c-417f-ae08-ff5532ab8258", "comment": "Malware payload", "value": "2c19d449d56ca159f2b396eec8325f6ae8808db70b5315e38bb00f6fa5813dd71211d4118afc86227d42b35422fd388c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915141, "uuid": "f760e50e-4f4d-4787-8b33-dbccc6886ee1", "value": "T1DFA4B002BE8147B3D5B3C6311939B681F13DBC343F2A9A0A73A8F25C5736150D67EA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915141, "uuid": "e3c5bc8f-2899-4ee8-aeb7-330b0e9f028a", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915141, "uuid": "0af8b5fc-c073-4ae8-beb7-04813f2bc43a", "value": "12288:NcrNS33L10QdrXj6DnlDCoQ4m/oE3HfandBF9xtPBC8:wNA3R5drXmDRcXindBRtc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915141, "uuid": "fc80d8ce-ab02-4a49-b90f-e0152d703c09", "value": 482397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915141, "uuid": "5eed25dd-1af0-4889-85d5-b440f5f9a49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915141, "uuid": "15e132f6-8144-4469-9b5e-b8005075c3d2", "value": "rcomprobante.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc24c39-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891336, "uuid": "a30a788a-4a8e-4780-b0c1-12cbc67f6948", "comment": "Malware payload", "value": "b0c0fa950db81cef7610239c757b59d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891336, "uuid": "30a9bba5-ff8f-480e-a2ae-421e33bdb11b", "comment": "Malware payload", "value": "01b1cd39980e71a0bd68e09135579fdee57b6b8680655cbcbee256fcc0ac44a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891336, "uuid": "952a7414-7700-468b-8205-1cb606885ab8", "comment": "Malware payload", "value": "3ed1ef90b3fa8d1977e568798d50688ff77985a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891336, "uuid": "736e31e4-6b14-4b56-a233-71afcfc046d6", "comment": "Malware payload", "value": "b749cabbeac0a8bd8a0bd6f2108a6c5c51124177450e3724b94cfd5ae79f2a9f2b88933f22626a10e02cf455162b074f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891336, "uuid": "10c39827-c114-49c9-8ace-4fe09987637e", "value": "T1FBC523027AC58532C26314369A767F35AE3CBD200F758ADB63A45D5E9F326C0D632B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891336, "uuid": "b62f2e49-25fa-4534-87fb-8a3d035c6870", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891336, "uuid": "c99ec995-861e-444f-a0fd-e145579ee5ad", "value": "49152:Paqb7rHc+iN2ZprQlw55HMnMfAR7YcecykV1OjTdlPdWnZbvqLgW:P5HcTMZpcS5HMM28HkqPdlPdWtrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891336, "uuid": "e7181fef-c298-4e68-838d-8b19ad6fd667", "value": 2521731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891336, "uuid": "e8720c7f-bf4d-4605-afec-9ba28383f11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891336, "uuid": "cb62ce48-5543-4223-bf84-c48b1e4701dd", "value": "b0c0fa950db81cef7610239c757b59d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416f9a1e-4b7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693872042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872042, "uuid": "42994622-2e5b-4999-b532-11a2bc6ec903", "comment": "Malware payload", "value": "fe1d4c8f44472a384fe096d15965f607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872042, "uuid": "98c85f80-ec96-40c0-b972-786d0c317916", "comment": "Malware payload", "value": "021845329a180f62f3077fbe11a8dc39fa7325dd67aaeb110666a89998171b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872042, "uuid": "b8a77af7-0356-4c1b-86cb-7b164d525040", "comment": "Malware payload", "value": "6cefc6e9d21b3ac9a607067c73db98f18080ef2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872042, "uuid": "2f4389a6-9e35-4d95-9551-e12d2613f439", "comment": "Malware payload", "value": "3ddc09dd7c562a805d8691632fac0aa7076d16dfcb2bf421b76aec9975b4b75f4547954a96412f34f86dca7e16e12558", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872042, "uuid": "c8f38588-0dd5-4e78-8827-a6ce124c23ec", "value": "T165F4123629428605D7F4717A8FB1C1B807776D6CAC8ADA1C5AE03E1F75FE2238B1189D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872042, "uuid": "9a4eec14-7d6f-4da9-93cb-419e7516fb66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872042, "uuid": "a7534e69-623f-4b19-927a-fd7befe65f81", "value": "12288:GXtPuqfdUZH/ku40yx8QeERxzae0jpkqo0fVBwpTbMJr+teL9/U:GXd/fmZH/HyeT/e+p7PtGpTbU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693872042, "uuid": "a485c30a-3e58-42c1-91ed-69e4dbcdb9a7", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693872042, "uuid": "c125aa41-c459-4f75-bb4e-07f95c5f59e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872042, "uuid": "2336b332-2251-44fd-891a-8da0cd6ce284", "value": "ZnSZjcxrk6BT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6330c2-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693910123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910123, "uuid": "42278e84-f42e-449f-8563-aa06798fe180", "comment": "Malware payload (DCRat)", "value": "b1e5c2a8736da4cdffc93024cbaada44", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910123, "uuid": "5512d5e0-b1b7-452e-8438-f88fe627d36c", "comment": "Malware payload (DCRat)", "value": "02fd596df84f872eb819cdb0c280f16a626fdfda985060c9cf69d1250da3a74f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910123, "uuid": "35d7a8dc-fb35-409b-9b06-b636c9176b56", "comment": "Malware payload (DCRat)", "value": "022cda76da05098f91272d82c75cee1924fac426", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910123, "uuid": "f25410ba-27c7-4860-ab6b-d883c5209b19", "comment": "Malware payload (DCRat)", "value": "db318baf5500367cd7e99ddd64e3b7e3ad1c0b2b605229b5e4e13f5fd693701864f11e46543f788b1b784c1c449a8bc2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910123, "uuid": "78e5f73c-c0fb-4d7f-b721-9fdf5e5456bc", "value": "T1E0556B027F64CA01F5082237E2EF854847B4E85166AAE32B7DBE376D55123A73D0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910123, "uuid": "d02c8655-5110-4b4c-81fb-660a09177848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910123, "uuid": "35a7e160-8977-4f74-93a8-206d71894d07", "value": "24576:G9ObV4Fo+e5xO/k3wiqV2lsdYLQLK2T7qcPGmfCK:KOR4Fow/geeAlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910123, "uuid": "deb96e1c-6eb0-4455-962e-c86c16baf6a7", "value": 1337856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910123, "uuid": "30694ec9-8d03-4add-89f7-06be76d21ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910123, "uuid": "6d01a972-b8c4-48bf-8496-136b691aa050", "value": "b1e5c2a8736da4cdffc93024cbaada44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b353fd-4c16-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693936880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936880, "uuid": "458d0fe5-daf6-40e4-83f1-0af9c8e108cb", "comment": "Malware payload (RedLineStealer)", "value": "1e278fbd24eb59d162a496feb4df327d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936880, "uuid": "d7589455-7ed7-4c38-8d9a-ff120e6410a1", "comment": "Malware payload (RedLineStealer)", "value": "06d9acb27b11a54f1e2173d66280a45b5f2ced838c6bc0c9893fd6970717025d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936880, "uuid": "785f8fc9-cd6d-4426-b545-11b204f0c945", "comment": "Malware payload (RedLineStealer)", "value": "cd389dbd1e0c9c613336284840bed690e23c74fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936880, "uuid": "78346f6d-7cdb-48fb-8090-97e0a0c6b4b8", "comment": "Malware payload (RedLineStealer)", "value": "73f55200c5dcc5d4bcd403b3ff75b7dc9eee0e6be93e506b3f45879d3643dbade2c0dc5dad7e0c63f803cfb5a79bddfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693936880, "uuid": "57190b9b-eda6-44ce-9161-63baa5dd9fff", "value": "T197F41206A6E88033D9F4677259F207D31A3A7DE39820833F2715BD9B0D32A44A57677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693936880, "uuid": "cd0a34bb-9320-4d2b-9ec5-ecd3a8d7dea1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693936880, "uuid": "f1722ce6-ef57-4492-8521-86067a794a3c", "value": "12288:rMrEy90eebGCLTjN7f34MrjMSM8IWhOAx/DlyHHMLSEHuw7jMf0DMfhDtY:fyHebGC7N7fo0j28Dh//DlpMw7ofhhDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693936880, "uuid": "1ae36460-0a83-47a4-8e7f-68918eb3840f", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693936880, "uuid": "548fd2ec-6f80-4fa7-a2ed-aea77585213e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693936880, "uuid": "86239949-e46e-4b7f-b9e1-a0eaf45b2520", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdecb1e8-4bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693895551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895551, "uuid": "78095d73-b279-48aa-ba87-e78f359f96e9", "comment": "Malware payload (AgentTesla)", "value": "84002f5aa1b3b3fe8611666657d71fc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895551, "uuid": "558c78b4-2665-4335-80d9-580a30049dc5", "comment": "Malware payload (AgentTesla)", "value": "08d76dc0333ccb04c7d58c27c319a6dfbcb0f6c91e232b6205e893272574eac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895551, "uuid": "8dc20873-a0bb-4cfd-b4f2-6b37f70e3b96", "comment": "Malware payload (AgentTesla)", "value": "7c46d09aa859fd5df51fd7469b2732788fc1d73b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895551, "uuid": "2bc54bf6-e135-4e2a-b445-4ce69e3f2de5", "comment": "Malware payload (AgentTesla)", "value": "7513c14f6134143416134411cd4b7a30ed8511f4b8ff5f25ac81a1811125da0e344157d4a37ab90c6b6d80aae7526d98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895551, "uuid": "0da70d31-4398-4ca7-9320-7c20132ba9da", "value": "T1B5E40284B2A88F17D77F9BF6481461A407FB585B1532F3484CE7A4DB36A1BE14A00B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895551, "uuid": "368e4e13-727d-4ece-8b36-1c848ff21f6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895551, "uuid": "af100d41-3bcf-4630-96a9-6c2fbe6cc189", "value": "12288:QoQevB5bcvsCflR+mfNA3GlgElgoTWgME1lQvWRW24DGBFEOoFJnkDwMD8H:QoskCflAysGTfPHRW20GzEOQJnkDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895551, "uuid": "a958efd1-f005-49bd-a0f7-329bc7e63e0d", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895551, "uuid": "43c9c312-7358-4d11-a72f-62126e68506f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895551, "uuid": "4172a81d-9329-4161-8ce5-480298f06759", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29383.6611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bf52e6-4c46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693957813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957813, "uuid": "fd279ce8-09ed-4c5f-b03e-185f6a5f1594", "comment": "Malware payload (Stealc)", "value": "604f05cb822d6ca868c76db28d48d932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957813, "uuid": "eb9c632c-ec35-421a-b4a0-eeaa61978a7c", "comment": "Malware payload (Stealc)", "value": "0a7e1a7c885b3a1b837b26b445f83a81c26f7b554b43d1496c04340c1cda89db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957813, "uuid": "5d3f02fc-b3f7-47ec-bfc6-f00f892e91f1", "comment": "Malware payload (Stealc)", "value": "59631fa3c301ffb3c6fcdc3d54e7e5635c302210", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957813, "uuid": "697a4e12-187b-4a0f-8042-592c499a97f0", "comment": "Malware payload (Stealc)", "value": "e0da67c4537df49804bfa80188907aba1fe3a0e43652555dfa38ea3f1817baf20f40de4fb99cf5cfab18a9fd28e8bb2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957813, "uuid": "ca37ed7a-0249-4159-86f5-183addbef9c1", "value": "T11F544AB3A2D0BC63D51647319E1EC6F8771FB8518E496B96A218EF1F18793B2D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957813, "uuid": "f780adff-4400-4d74-b865-846d9cb19bed", "value": "b4063692f94e7d5a4ef3c227197b9a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957813, "uuid": "f11c1e90-56f8-4f43-b411-1d2abbbb946f", "value": "3072:keRU7Rvb10CLyAaj7aPtGUmv8i8x/twxoBl1I51Bta0kTql:f60CLyAIp91m/6sl+Paml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693957813, "uuid": "7d0b56f3-877e-4ea4-a264-637bb2c42bdf", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693957813, "uuid": "2cd158e6-bb92-438c-b0c9-33ad50ed8ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957813, "uuid": "3b3c7790-51ce-4231-9930-59f43bb0b31b", "value": "604f05cb822d6ca868c76db28d48d932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf9f51f-4bf1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921185, "uuid": "05a27848-4218-4051-a449-0f9dd4b98a60", "comment": "Malware payload (AgentTesla)", "value": "9d6b02962be17b83e8fa040069513e75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921185, "uuid": "c7e34663-dbc5-4e39-87cb-d6f0299639a4", "comment": "Malware payload (AgentTesla)", "value": "0b63a684272c378e1bbe16347d8b3d3c2b74d5568290aa2e647cec956a29da9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921185, "uuid": "10b23c64-40b5-47b7-8c3d-895233e1b387", "comment": "Malware payload (AgentTesla)", "value": "06a9cbc149bd50ebe879618bcadbaa0fd7a1fa9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921185, "uuid": "0ae56831-532d-4c03-b728-a155caabdb3a", "comment": "Malware payload (AgentTesla)", "value": "25f0a6c679fa2deb8ddd27935cc1a8cff8bf66ff8ad2d22582b19311d3a47fca7f36e209b7dcd28084a4ce2cd34cda38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921185, "uuid": "1d241fbc-b57b-455e-a804-ad7b52843c1c", "value": "T170252C6CFA45DE3FD38C8C3950F9DB2B69B99BADD0E1A3A1C01051B518E6CAD0D76063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921185, "uuid": "3d1ac33f-f674-48f4-b4bd-f9f585081929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921185, "uuid": "8267a1c5-8674-4260-82e8-28e12af7f043", "value": "12288:FH41ItaBXDx1SWr3A+lgClndhUZtG3kOoM6bCCQ58+:167dh8takfMQXQ59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921185, "uuid": "4df555ff-c09d-4765-9a14-357c65905421", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921185, "uuid": "29a70f80-6413-4631-a377-dd7bfae550cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921185, "uuid": "95193e7f-a94c-4319-9b18-d0e5a38f2563", "value": "0b63a684272c378e1bbe16347d8b3d3c2b74d5568290aa2e647cec956a29da9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b7b771-4bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693902616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902616, "uuid": "fddd37e0-94f0-4311-adbe-9c8c2d77e78c", "comment": "Malware payload (AgentTesla)", "value": "10932e68088f951a36ca18a945629ead", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902616, "uuid": "ff562ce4-c0a2-439e-a92b-a91a69a5728f", "comment": "Malware payload (AgentTesla)", "value": "0bdf71b39c8888afd7c4f7c6becf507d36ca050125fed1bc29241c008b3f4b0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902616, "uuid": "ad26c59c-a0b2-49df-ad7e-d4a343f7cbcd", "comment": "Malware payload (AgentTesla)", "value": "84d5a39db71fc19c191a79f351e047391f9dcb09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902616, "uuid": "691e759e-a984-4c8e-8479-313cd5e6ccd1", "comment": "Malware payload (AgentTesla)", "value": "707c90f75301b7bcf86a78b2843728a1016d8acc022771cf37980682089b1fc982342c9f453505c8a288625ee8e56223", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902616, "uuid": "59811afd-f6d7-4803-85bc-11d4771f58f5", "value": "T18DE40280B2F88F17DBBF9BF69464259407B5591B6032E7580CD7F0EB25A1BA04A41F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902616, "uuid": "0494a86a-d51d-4b87-b6ba-1b299c5a9113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902616, "uuid": "1a2e3f59-361b-4052-8ec1-74b2ab18be22", "value": "12288:toVPdo0s30Yyf0dPjK/jnbhyGKzEB1nEhufYkkDwMD8H:to/oNZEVLnbkZETfLkDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902616, "uuid": "79d37d24-c08c-4175-aa8c-6cc134c7fc93", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902616, "uuid": "17d0be43-c926-45ca-8d68-750064dd80b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902616, "uuid": "2c2e63f8-a048-466e-949e-0a1fca7f85bc", "value": "btObqnr9W0Yyj48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d231ab-4c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693928639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928639, "uuid": "883c9807-4cf7-4216-8de3-5c1ad5a10cea", "comment": "Malware payload", "value": "afc614cde5cdd857dd00ae1c249030c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928639, "uuid": "148ec364-b654-4e0d-95b9-305f1789ea32", "comment": "Malware payload", "value": "0ca89e45cb7326b579733ba6d787770fa2e1fb854d7cd95e40fc349a4f97b815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928639, "uuid": "c9068d68-30d4-4238-9dce-baeb7b3a5a6f", "comment": "Malware payload", "value": "a2b742e61e626cc78319137a390fe3811b7dc349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928639, "uuid": "663591e2-fe8d-4e70-a90e-6f7a14d88a8b", "comment": "Malware payload", "value": "90a18b1f9b8535b3812c2080fa3e445c64784bf4eafb06d258e14719c8c91a891696191a19987d5f66ab33e879d5a24b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928639, "uuid": "afcbfc01-cf14-4fa7-a70e-3a5f57c7b54e", "value": "T1F6544AD3A2D0BC61D5278B318FEEC6EC771DB9508E49679AA2186F2F18750B2D16F310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928639, "uuid": "89418c82-3d4d-47af-88e7-4e01008ae34b", "value": "a5090fe27b113adbae2a8696a75fe6c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928639, "uuid": "43f96fde-9e3f-4ade-afba-356792d50caa", "value": "3072:qnEEvpxj3kKLdDFr+kxOsQnYbbctKeqDIIeBCNbrs51DKna0kT:qEiXkKLdDFrdOUctK5XiyEEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928639, "uuid": "252a2fd5-a2e2-45f8-acbe-b99bcc1ef685", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928639, "uuid": "15cfc201-75bd-4434-9513-a92f966d414f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928639, "uuid": "de709b51-b3d3-47fd-a502-a688df6cbb04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f03745-4b97-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693882435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693882435, "uuid": "f4f0b85b-480b-472e-aa2c-a581545fd43c", "comment": "Malware payload (LummaStealer)", "value": "bb115dccc24769565832379a2029f709", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693882435, "uuid": "037643ca-ecb6-4f42-8179-4aa5c662e815", "comment": "Malware payload (LummaStealer)", "value": "0dbde9f9147ace2898ded2819edb2c6ad460cbbfaf6f82f15313c011634d602a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693882435, "uuid": "6832f9bf-d257-47ca-af2b-6f4bb204f9ed", "comment": "Malware payload (LummaStealer)", "value": "fee2c45c8d2b14e87da81baf041adf6258519114", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693882435, "uuid": "b9c312cc-f105-4e87-9499-50a9179cc6f3", "comment": "Malware payload (LummaStealer)", "value": "d1e4a0404bfcc4b8be6328c6beeaf9684c7095abfc2ce6aa68a077b5d6cf4ba734e950bb706dd51fb6131460ec9b3767", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693882435, "uuid": "8d71db31-2e07-44d3-ab7a-9498dffa8c38", "value": "T17FE4AD4237E0D221E7D5B87E8DA08BFC0B3434B145E4BE5F4AB45A588AB33B17C35966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693882435, "uuid": "10f894e4-d290-44d7-9425-77ac426cb903", "value": "4aa9a5948189d716b06a5f75753573d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693882435, "uuid": "bb4d1c8e-eaa3-4a93-9cb8-86d76ab05881", "value": "12288:68eTIpRD6ScVTJU2Dt8sbl40qZBM2Jz23nWa3bOnwOSNrQ7jQF+S:eG56S6pDtbIBMWGnRrOnZjQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693882435, "uuid": "fd335a7b-b800-4873-b8aa-a537b33e976d", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693882435, "uuid": "b52c67ca-cf93-4b3f-8d3f-a2cb7d3cbffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693882435, "uuid": "531c3f7f-243e-46b8-a8b9-d9b5e5494162", "value": "bb115dccc24769565832379a2029f709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8051a8c-4bfa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693925069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925069, "uuid": "87bd27b2-6a0f-4bcb-83ed-178e25a06a96", "comment": "Malware payload", "value": "b9a4b294dcb839b10fada97ca1fb27a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925069, "uuid": "bc9b37c0-8dbe-438d-a97c-1f4df8667d0d", "comment": "Malware payload", "value": "0f1b064c3f497db73a18166da367b5c3c2900aa9b00812faf97d04d3f5109919", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925069, "uuid": "57acac7a-d826-4b24-bfdc-726c5ee2772f", "comment": "Malware payload", "value": "15d1431230601e275414337e184999c0f6a75a26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925069, "uuid": "448e4d17-1558-4692-b385-c16821008416", "comment": "Malware payload", "value": "5aba6ee5cb15571599e78e35d77277f299e0bf90c83a5f7fe41b73ab9fbfeaa6547c006c1d860ba4c93b10eb71fd1343", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925069, "uuid": "d8b49cd1-29f7-436d-bdd2-2fd4b316c6fb", "value": "T131F43B4DE20D3802F986F2BCEF9D83B2B62778CED719C1A5B8220148F6C75E4C6B6555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925069, "uuid": "808cce4d-95fb-4670-92ca-4a6bbd262b8d", "value": "12288:efi1MBTLNH581gonviUPD63cA21ZlE50SiqH68igwvmx:efMMBy/ZrkLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693925069, "uuid": "788520bb-c368-4e9e-a5c7-9746ca601fe0", "value": 752854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693925069, "uuid": "47275ccc-bbb9-4322-829a-e86fb3921b52", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925069, "uuid": "b0133064-5262-4dce-8405-38b4194cfacb", "value": "0f1b064c3f497db73a18166da367b5c3c2900aa9b00812faf97d04d3f5109919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f6e526-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884255, "uuid": "5ebc194a-8205-440e-b8b8-59511ee267b5", "comment": "Malware payload (Mirai)", "value": "2bf3a09eb278567ced8072563ea14be5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884255, "uuid": "c2773f9c-edbe-4e17-8afa-ff640049bd6a", "comment": "Malware payload (Mirai)", "value": "1007c0326c407ec9a9d5c6c2df255829b5a84a9c17a6b1059e0ced9033376135", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884255, "uuid": "a4ca5253-cb4a-4f47-82b1-34407884ce7b", "comment": "Malware payload (Mirai)", "value": "21dbe21b521fcc0461966432b676a21cae5bcb42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884255, "uuid": "bd464424-24d3-466e-a404-2632b32fe93c", "comment": "Malware payload (Mirai)", "value": "dfa5debff653962ca45411e8d006c8b816f47dd4476707c3e0d66b9dcbaaf6659516c853183aa597ee3927da4ae2650e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884255, "uuid": "4bde2fea-9fef-4093-b8a3-b318a61296f3", "value": "T1E8F3A95E6F338F6EF668873147B74925975923DA22E1D684E2ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884255, "uuid": "d18346f3-2c49-45ae-a56a-350a3454e035", "value": "1536:9MXVed89OdSAZTZtZd9BG9rc0eNsIlPBz2TfNYoDFQjkmCZaAK:9MwdhZtv9BercxsIPcYo5QjPCZaAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884255, "uuid": "ddcf6e5f-31e1-4cf2-b300-56d467f2d50f", "value": 161416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884255, "uuid": "d7822238-7e8d-495c-a52e-4448c20ce8ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884255, "uuid": "8efb7510-4004-483c-9fc8-5155dda4612e", "value": "cundi.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f71835-4bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693902645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "d5a04989-47c5-4cdb-a8d6-6ce56569f0d8", "comment": "Malware payload (Formbook)", "value": "159258ef86fa84534a1975c097304c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "7edf1aa5-91b6-4641-bd7f-6c25fb7711a5", "comment": "Malware payload (Formbook)", "value": "105fef1d5e42006e1a9da8c9dab3cabc11909658755c931db357ef6743ed15dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "471fde98-12f7-4a98-b708-7fc2e38b80d0", "comment": "Malware payload (Formbook)", "value": "f9ab6922b662ffb73dea823eb5d55643a904bd88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "e66131bd-e362-4435-b419-9af8846973a1", "comment": "Malware payload (Formbook)", "value": "2de706c5dcf670ed4056625147a75b46f76a8674c3d5464bea7d8247b8584a974a5e45f654cb1c1c5046b2ce0bcd2c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "c6221558-fdfc-41f6-b41c-f964067dabf1", "value": "T145B49DE2E6C84DE5D82567B19C36AC012267BCAE6871DE8C6C97B1664B737930073D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "3ddce585-984b-4ce9-b217-da27ada1c4b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "3f8ed6a7-2a3d-446c-967a-13b1065af29c", "value": "6144:ili+dx55UGOiS0bmBhMxfBEPtifpwvwVO2/eTrn/+vsriGObdqNSf32r5:iTjUJiVKBhMgliawVh/en/kXE0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902645, "uuid": "535354a8-a5f8-41ee-b5a6-3d6f52c8fa9f", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902645, "uuid": "a45c8942-fecc-49c6-a6c5-70999fdd4694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "90fd6ff9-e9a1-4554-8b1e-e959ef49c211", "value": "SecuriteInfo.com.Win32.RATX-gen.5153.26657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437bd53d-4bb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693895668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895668, "uuid": "16c9232b-9642-4bc9-93e0-f74d07fbae9d", "comment": "Malware payload (AgentTesla)", "value": "b562a8a9f4fb47eaca9eaa24e1667814", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895668, "uuid": "b0dd7b62-c891-4e2d-9ff1-57bf9462e050", "comment": "Malware payload (AgentTesla)", "value": "1182ef3f55a149c1a676f27653cc1a8ec6589e56c9dfa450f2f7731cd63c61a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895668, "uuid": "ca5393bb-06d1-4e6b-98ad-efc10444ddc1", "comment": "Malware payload (AgentTesla)", "value": "2c200c7ca4db5387ca2f6f89b891ad27c6e9596b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895668, "uuid": "49bfd5af-c7c1-413d-8206-01681fa9df79", "comment": "Malware payload (AgentTesla)", "value": "47402d39d8449bf86245740d91984b4ada20b713f36a64904a5b7fb42132b532ef58defa9cf722d0907af54ba9eeaf55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895668, "uuid": "db8c3d5d-d321-4e77-bc07-78f26c570709", "value": "T162E40140B2F88F1BEBBB67F25414265007B65D576032FB984DD3B0DB26A1BE10A41B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895668, "uuid": "6118055e-38f2-4b58-9bb1-683b1fbfb446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895668, "uuid": "f6c0473b-4dcb-4239-9997-ba97bdac9975", "value": "12288:toXkXbqQo5MuwBGbycEhELg7nc6sf3nSb97ZnkDwMD8HQX:toXamhwDc/LgcSb9dnkDV8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895668, "uuid": "c7483b14-a96f-4abd-8ca1-144a027aafc6", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895668, "uuid": "b8f1af2f-b2ea-486a-ab15-bd4aeeaab55d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895668, "uuid": "fdb75f9e-e0a1-47c5-9f76-dff1f6359076", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288de82a-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885744, "uuid": "b7b3b12c-78a3-4cb3-947f-05d62d793c37", "comment": "Malware payload (Mirai)", "value": "a65573322c007ec2bca14e0cbf582055", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885744, "uuid": "c2be9082-d2ae-4764-8324-26c0c1ce5b69", "comment": "Malware payload (Mirai)", "value": "11972c06bfad76ae7b549d03f778d07de751be9973b285688acd7b1c84b0612b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885744, "uuid": "f175d5d0-68c3-4ff0-b5d6-a74ee845a7f5", "comment": "Malware payload (Mirai)", "value": "3491a9967bd2876065e1f43838cf6fbffc8ab82a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885744, "uuid": "4a54ff42-1839-41ad-bcb9-ec412e484164", "comment": "Malware payload (Mirai)", "value": "6ecce273404362eebf763081792abbf628065c67d7fd4b8982039c70c2e2e2ba8ff4b4d78a9adefeff356df8b0a5d830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885744, "uuid": "389bfe67-8e5a-46f0-97f4-26b9db56c4e7", "value": "T1B8A2D073878522A3CB710C72D8AD43919B0A94A8D2531120386C175DFFE781275BF7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885744, "uuid": "31370ca3-f2de-4e58-884f-d4d749a82515", "value": "384:cSwZfBW+Ggi3r5ZBeA4D8fExHXCQsM22JXkIRufWEw5/vE0F8pmdGU5E//4:nwZpgr5zerD8fGXCjM9+QgWx5/pe3Ucw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885744, "uuid": "2de2cc0a-23d3-4326-ad2d-40dc4c458baf", "value": 21824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885744, "uuid": "c6ebdd5f-9056-4c8c-8154-b1bc1654f919", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885744, "uuid": "5f7ee771-ec00-4414-b09a-043cee6f298c", "value": "a65573322c007ec2bca14e0cbf582055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606762de-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891421, "uuid": "37a50546-5e0c-4d5b-bf00-8b1e4715d63d", "comment": "Malware payload", "value": "3bd049bf5a32aff3c21b726269c848d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891421, "uuid": "239c0dda-e5d0-4720-9a07-9098ef6ef0dd", "comment": "Malware payload", "value": "11f52163f4d22333963f0bc9512c632e0763bd9f66e08171acfcc142c508e5d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891421, "uuid": "3c83785d-07be-4c3a-a591-12597c7ea883", "comment": "Malware payload", "value": "b631f1f098b19e5cef4f1671d7af36de95b60309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891421, "uuid": "9d0896d2-47b7-48a0-9c31-b1cbe0c0c8d5", "comment": "Malware payload", "value": "b1886c8b98fb81f49b4aaafc99c9638ed19d686e4ee845dfa5e081fd0d35adc0cba629d9f754936267be7be93e949bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891421, "uuid": "39780972-b600-4a89-b49c-7fcf1a3eb512", "value": "T1664648DA1623EA80CDE348FDAC8E44C2C760952903E199EFF1D551B826179F82675FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891421, "uuid": "c0967b83-508d-4e4d-a237-33168f652005", "value": "48246eb64cb05f56f073f843df37a04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891421, "uuid": "81dabe26-9c80-40f8-9054-c3146f67b922", "value": "49152:JAfQy0NJQUoczvWS+WlYpmpUguOFqwYkocx5r/Jwoim13xNOqExTdjPTC0aALqyF:qf4LhjZXlYpm4Ocwnocx5aYPXdm/Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891421, "uuid": "1683a818-08fd-44ba-9aca-7e0045b7b3e6", "value": 5638128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891421, "uuid": "50b44777-9ce5-4304-b743-ea562408799f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891421, "uuid": "722e373f-3af0-4bf4-bcd5-90d63ef3a565", "value": "3bd049bf5a32aff3c21b726269c848d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e141cb4-4bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693899873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899873, "uuid": "5beb31f1-3353-4809-a233-65ba0493663f", "comment": "Malware payload (Smoke Loader)", "value": "806c50059939915d54efab3c88c0cd55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899873, "uuid": "2a6bc4b2-6a68-4596-84d8-0d0874839605", "comment": "Malware payload (Smoke Loader)", "value": "124ebe9548272122b27ab21e5b62f9e8e1b8bac6d45a4e3758b83112d3454dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899873, "uuid": "7dd43655-566b-4098-934f-25aaa1084f40", "comment": "Malware payload (Smoke Loader)", "value": "4a4b7463cfdb48d553143ce8dc906d52a63e73e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899873, "uuid": "64cf99ec-dde5-4a68-bad3-16048e7728ac", "comment": "Malware payload (Smoke Loader)", "value": "3dfab85e985f99283ca063104f45ba43baf4b60454ab79802bf76e6b591190ecd0ec0945af64b87255c4fabc32db30ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899873, "uuid": "9bc95957-ea2f-4db8-b377-d488aab29fef", "value": "T1A4543793B5D0FC61D51247348F2ED6EC772DB8A29E596B4736583F2B28322B2E617310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899873, "uuid": "53926bf9-bf86-46b4-8234-fa2c0fd4af2c", "value": "2ecd68902b681b798a1768b60fb38fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899873, "uuid": "3e46f3ee-9511-4e91-ae1f-5f20b7fac4cf", "value": "3072:QCNBB8IRLiFHXQyrd78aUOIgVtXIFMDR8vGj5x5BspTLhaV:jNYIRLkH3rd7UOIg/4McGfDspTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693899873, "uuid": "2b0d7efa-3643-40e9-973d-1117e2fd102f", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693899873, "uuid": "8c06260e-60f2-47cd-9b41-1d6bbc227d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899873, "uuid": "66c0715e-9537-405a-ae20-de74b6a0d12b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7550d392-4bf5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693922810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922810, "uuid": "48914759-645f-496e-ae99-c0929d7a857f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4ed8c4a66c92f63a18ab77836ee00837", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922810, "uuid": "d762a1af-62b1-4d4c-9ebc-fac395ee5b1b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1357aed783ad4b524540bcf99d980eaeac3aa21357b696b32c412ee44b925eab", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922810, "uuid": "37f3471d-6ef1-4376-99e7-41012b0e9cd7", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "09e8eb7319292374806471dbcd616a1c0044b00d", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922810, "uuid": "5c5de6a8-f3f0-4d12-86b2-09ec8403ca25", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2df557463f5f35cba9681f6cced3ae998c104909079a7a5fbdf8dc586083cf0ed27bc5e31ff497b9ea4fc1a941cdf118", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922810, "uuid": "1671a257-854b-4083-b937-53c8da4b47e6", "value": "T162653393E5B5047EC0A6D8B02C36DB96423735831938641BB78E1F9C1E17FF5A19B34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922810, "uuid": "f2c28339-d6cc-4b2d-a00f-5af38446fe4e", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922810, "uuid": "27352fef-fee8-4815-a379-015de135cdba", "value": "24576:CI39dW56P+PmyHRZ935Zq9h8lgM0DY4zbtHrkSOOqi/QzryFV/uN4vxt:C6dW5+AjxZ9JZp0EkbtHrkSOOqguCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693922810, "uuid": "48eea3c2-399b-407c-9e9c-cb86e15b1225", "value": 1414598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693922810, "uuid": "7b55ce24-cf24-44e2-9593-3fe0b942fdf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922810, "uuid": "aa601674-7d38-4d09-a010-3d782103d6fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495ec902-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891383, "uuid": "90cf2437-a0ce-4c58-a700-c6d2f4039b9a", "comment": "Malware payload", "value": "77c6b81d2129b819715362f91c198d6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891383, "uuid": "748106cc-9fb6-4851-a8bc-14f757ab4a0d", "comment": "Malware payload", "value": "1456d74470f5f6c040b50195ae3e263ea704b7cb13c6c1af171b8d78fb25b474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891383, "uuid": "696b9fb5-3517-41a9-9b1b-c9a1002fb9c8", "comment": "Malware payload", "value": "cb49945a594aba2eb64ddf04bacd7e183f09da64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891383, "uuid": "0e352714-75bf-4091-bdee-f0d139e3f648", "comment": "Malware payload", "value": "782f55a8b5404dbdbdb9e14175df38fcb56f2f3fc9c80688fea7118f957c8850946a145993b65d81d6ffa5099d7233ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891383, "uuid": "3c659923-4868-4a5f-bee4-25d4e9843db9", "value": "T10F653342D1C6D837E27299B41CE9EE42923BF4962B3860155BEE1FCD1B3ED7086153A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891383, "uuid": "0d865315-cb6d-488a-9a42-a58b76e4c1f7", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891383, "uuid": "d80bf883-ed22-4bbc-9d5d-aa642a153c5c", "value": "24576:zI39dgOp7RataUAfQwxF6uaqfhr6hip5fCNikRI78khDTq1z5yFV/uN4vxt:z6dg+ua3Qw/6xqfhr6AzNku7Dpq1cuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891383, "uuid": "bd64b554-e3c5-4f50-9381-cfd2b156e845", "value": 1442253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891383, "uuid": "c8205dd9-bef3-4755-b6d5-c41313ba0318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891383, "uuid": "4d17c486-babf-45bf-b4b0-550ee82557ea", "value": "77c6b81d2129b819715362f91c198d6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb031431-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1693920887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920887, "uuid": "ae3183d6-8a51-4d34-943e-932f000a0d29", "comment": "Malware payload (ConnectWise)", "value": "7d377dcab25fb05f3b1bf8b4f9eb4fc8", "object_relation": "md5", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920887, "uuid": "6a7f95b4-1355-4017-a0cc-23f2f239d4b9", "comment": "Malware payload (ConnectWise)", "value": "148200bc7a4592fb6577f5e653067484693f5569e0e0aa3e717a7c84a5a0192c", "object_relation": "sha256", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920887, "uuid": "fc2a25a6-269e-4bb3-a143-99f957dc2af0", "comment": "Malware payload (ConnectWise)", "value": "d1cb448646c8218a046116397dea8e7667b0223e", "object_relation": "sha1", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920887, "uuid": "91450e89-341f-45fc-866d-3294cfabb27f", "comment": "Malware payload (ConnectWise)", "value": "075c2f78921908a71fea4d59d78ce03c7c5d0a7764e05d0f47c3b8951dcbcbf6d892330e44e63a466d53f7800d2909c7", "object_relation": "sha3-384", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920887, "uuid": "932d406c-23e1-48fd-b776-09258f01a812", "value": "T124837C03B5D19C71E9725D3124B0C9615A3FBA211E348EBB639802AE5F341D1AE35FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920887, "uuid": "87b9f781-7f3b-4677-a0d1-9cdf444b8fea", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920887, "uuid": "e6bcf9c3-2f85-40ea-b44e-738856978cd5", "value": "1536:9Xn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWl6q:dE3x5KBDYiKWm/iSw0fRMvyg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920887, "uuid": "4e0f89f6-b7c3-48fe-b819-264733603730", "value": 86608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920887, "uuid": "eeb142e9-efea-4e06-83c6-76bf865295ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920887, "uuid": "968b08fb-ce09-4bab-b011-e03093ea6f1b", "value": "Support.Client.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90fcc62-4bea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693918172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918172, "uuid": "a1b5153e-e647-4265-bb29-eab61743f206", "comment": "Malware payload (AgentTesla)", "value": "e32188a9fc5f2ca39c9aa909117b8d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918172, "uuid": "1a1317b1-8782-4e28-bb6a-0f7389113833", "comment": "Malware payload (AgentTesla)", "value": "153fa7b007d6f37d5742d2c966c5811df198f2f21514363530b6242d99e7b421", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918172, "uuid": "1e6e322b-f879-4721-b829-bb735f24c53b", "comment": "Malware payload (AgentTesla)", "value": "19775956326c0d5154319de8d783360042340777", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918172, "uuid": "558c090e-7c68-438a-a071-c385399857ec", "comment": "Malware payload (AgentTesla)", "value": "d542789675c3b9bb13ac7f8694e7c088bd8c1e807b04e1860ed5cc247e6447e8e1bdb5e5a6e708a86dd689f2b5197d60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693918172, "uuid": "8184caca-7c9b-4f48-b085-032342c3c988", "value": "T11DD412376D8AEB72CD2A07359060238077F1C541A377E3AB1CC911F845E6BCE9B5E652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693918172, "uuid": "277c926e-1031-4d0e-8d22-9000c2fe32c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693918172, "uuid": "c90a7e67-8a47-4964-b5cc-de5277848c0d", "value": "6144:nHy2RoB3wQTn00/yKjXrsEUh6edPFECBblRQzcDeQldiYNdSDFAoyFvB5LVHUW7g:nHmB3W8l1UQedPFpBzUJYPNoQpUG9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693918172, "uuid": "9d37f3b0-bca1-4089-99ec-43df07b2efdb", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693918172, "uuid": "49b4042b-8770-4c9d-a727-be0492c79697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693918172, "uuid": "e16edc3c-4ea4-41ba-86d6-d00cbca548a8", "value": "153fa7b007d6f37d5742d2c966c5811df198f2f21514363530b6242d99e7b421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e7dc30-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885768, "uuid": "785f3230-7b24-44bd-91ca-52c41c1779cf", "comment": "Malware payload (Mirai)", "value": "c06dfaf9ae385cb24ea7f0ac9e8053da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885768, "uuid": "af5fb2df-8141-488e-ac92-35e6b8a5ba8d", "comment": "Malware payload (Mirai)", "value": "16af1ae89462355d62434d1c663584894e79bd832dc5632dbb10d1a9530e3781", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885768, "uuid": "e27dc0a2-ff10-4fa9-ae18-62415d7b090c", "comment": "Malware payload (Mirai)", "value": "d02e58a3d1d2517e680da604443afcf9222d517c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885768, "uuid": "ac5a23f5-d0fb-4042-bd49-bf705aed6b28", "comment": "Malware payload (Mirai)", "value": "b59e8edcd44532e0fbdd28e52883f0f85ccaea4b9ae50b2beef3f562e34d57b04a1aade12657030d302827eeef4df1b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885768, "uuid": "0f449b27-a442-4b5f-86ee-46eff9b2a520", "value": "T12423F222F4D819A1C5E4AC34E8FC9F0532952ED4A24CB560633292D5D9D79C372BA4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885768, "uuid": "66e5eebe-b002-4098-9f0c-88153ff5efdd", "value": "768:XqPb4YOTeTx9krjuxxu0BszWd2FFq2oKeWyEq3UIaT2UemnahFIS0BWOPW9+Y:1TeNCCxjBjd2FA2FenrbhU8t085T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885768, "uuid": "df077822-0c83-4c5f-aa4b-fbe454826c05", "value": 48540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885768, "uuid": "c74feece-55cd-43bf-8a2e-add8105823de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885768, "uuid": "2478777c-7b73-438d-ba46-9c2745e2b301", "value": "c06dfaf9ae385cb24ea7f0ac9e8053da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4629c095-4c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693932609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932609, "uuid": "4c22dca4-ea0a-4716-83e3-55013579f3bb", "comment": "Malware payload (Mirai)", "value": "febf7c766222415bd2e6da87d727ac96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932609, "uuid": "dcff0a5b-128f-4e37-82fb-b9c90dd0f083", "comment": "Malware payload (Mirai)", "value": "16d70fdf3202f4c54ae522c24c7d0d3b60bf23587b9dfd12a220f31bce07c3ba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932609, "uuid": "d3b23e0e-6368-4632-9667-3f0035f96e68", "comment": "Malware payload (Mirai)", "value": "1929bedade66fbc1a1fe7cfb6affd8c333fa97bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932609, "uuid": "0f37d0a1-150f-4791-8ac2-8daf578f9f4e", "comment": "Malware payload (Mirai)", "value": "6b732ebcefcef2240f7884b340fcb73e07563deabc2a4b04cb452b874509b80734cb238c869938f6c92087797c2b3fe2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932609, "uuid": "68de5e59-8ebe-4ade-97e5-73e8861b8366", "value": "T1D9632851BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932609, "uuid": "1c3d8d81-bb64-4ac5-b550-400d40d665df", "value": "1536:ONKlxkmiig51kRmO//kW0zXUiAsDwY8rNRuVAvvW9:ONDWzkl7UiAsDHaJvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693932609, "uuid": "56cc3a8b-22d5-4652-b60f-e9317083b8af", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693932609, "uuid": "c587a7fd-a844-46e2-8c09-a9b04f74bef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932609, "uuid": "8f0e4304-a56a-41bb-84e1-21181e2c808e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c197193-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926928, "uuid": "10861412-4804-4f28-99b6-b147e7db9dd8", "comment": "Malware payload", "value": "697e54b06e75b392bcc555065714da68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926928, "uuid": "53db6db4-373c-4e81-a643-b0a735a0012c", "comment": "Malware payload", "value": "16e09592a9e85cd67530ec365ac2c50e48e873335c1ad0f984e3daaefc8a57b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926928, "uuid": "d6e855ea-6578-44a2-91a9-5df171ca4773", "comment": "Malware payload", "value": "15eb7376eb0697e19956a9b5a72cbe1d7797ed8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926928, "uuid": "dc4eb2c6-feeb-4ead-8265-77f353778580", "comment": "Malware payload", "value": "31688d3572509693b3a366b5e177d6a27d8a2d8bb8deb23ebd42933ff473ff518cc2ddf874fc8525ae007074ae21112e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926928, "uuid": "b8881f4a-a842-431e-80a6-2068abb0e5c0", "value": "T120E0978B1A0040B2C52847382704CD1C2BA280218E8382474B20AE2A0D3B624CC508A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926928, "uuid": "46be8fac-9963-4e7b-8bae-810d1e10c4c2", "value": "6:BnX//In8/r1Is/a//ARexooEE2ukbzWos+6I0KikR5qqQSC8XV9b6+:BvwncrUX7jL/0z96bKX5jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926928, "uuid": "412415bd-4670-4bbd-be4c-ee2803bbaf72", "value": 309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926928, "uuid": "6204bcdf-e5a7-4e4c-919d-927a0b644c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926928, "uuid": "53a8d988-4905-4bcd-84d4-bbb71171ef0d", "value": "16e09592a9e85cd67530ec365ac2c50e48e873335c1ad0f984e3daaefc8a57b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3dd614f-4be5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693916123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916123, "uuid": "882b1c92-55f9-41d3-b1da-a87f7998bad0", "comment": "Malware payload (DCRat)", "value": "b61cbf6cf1c3daa3b81c2241a943d344", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916123, "uuid": "2182915e-9a55-48aa-8a25-98b6e2861f5f", "comment": "Malware payload (DCRat)", "value": "18c0eddd43369a87e3d38b87513db8549b1b76b7fdcf584a1525037e0660f9a3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916123, "uuid": "5d12c8d0-b752-4d6b-823b-b9a9b6b8b997", "comment": "Malware payload (DCRat)", "value": "c43ee9a452218d2174625f36e7792662190e32a9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916123, "uuid": "60486d47-94e3-498a-84cb-ed59b924c184", "comment": "Malware payload (DCRat)", "value": "836ea25f21a73242c4db35d1a63e3d69978edcacea6f3ae024c18bef4dde2250b20bf03d8d4d460e5037171bb6999aa5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916123, "uuid": "d462c42d-749e-4f0f-9b0e-6e082bf6212a", "value": "T1BF05E6027E48CE11F0191233C6EF454847B0A9556AE6EB2B7DBA376E59123A73C0DDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916123, "uuid": "774fa2c2-3cd7-4fd4-81bd-b947d04586a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916123, "uuid": "4db9305d-65ff-4c5c-8bcd-ec2c8b1d4994", "value": "12288:lfs3nQvnFVJPmF+ycHZ+d1bBa7oG93Gblnbuyc9RFeMJ0:ynKnFb2+yc51l3GblKhRYMJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916123, "uuid": "7b3764ee-73e9-41ed-8a6f-9192ee5a43c3", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916123, "uuid": "f8046ce2-4834-4fcd-9b19-cd1891db22cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916123, "uuid": "41382826-965e-48f7-a040-2a94936db26e", "value": "b61cbf6cf1c3daa3b81c2241a943d344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647350a3-4b9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693884556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884556, "uuid": "5cb6c73a-ea0a-44dc-8482-e2e3afbe72c6", "comment": "Malware payload", "value": "885d9f6b5e3085fa639ffed43aefde24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884556, "uuid": "fcea6d19-ec00-4abd-a990-c0207eb6717d", "comment": "Malware payload", "value": "19973b1a37f7c1667fa424dddaba182fcc3eff26d02cc33ae89099f0ecd3be2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884556, "uuid": "ab73b4ea-22e7-4216-81d9-c4ffbf179aad", "comment": "Malware payload", "value": "8e16f20bddb67f7f5cf24d0f163c15f010d7a9e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884556, "uuid": "a9e55861-a5b2-42ab-a0a4-7b339cbe5975", "comment": "Malware payload", "value": "d1c3ef812647a7d63ca36b8e1a2a1267c16f0be059963de92728e81c99dd27b98ecbd0e2a86005a46f8fd988a3f3ef29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884556, "uuid": "72d9b33a-2ca6-44ea-acb0-9fdf93a80bd7", "value": "T109B5234174C945B2C0B224321A394FA1BA3E7D205F35DDEBA36999AECD160C1DB38B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884556, "uuid": "d45b35f7-8480-4ea1-b291-d26246799562", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884556, "uuid": "4e123248-ab9e-4ab4-9cb9-9384a5930d78", "value": "49152:rLL6ygW0dd+VfFU7fVs6T6+3FIw+6sVqGRWoJ3F:rSEU7fpleoKJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884556, "uuid": "0c0678ab-36ef-40f1-81e5-f9a63e58b537", "value": 2488075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884556, "uuid": "97801ced-3a9f-4f14-a564-4717ffc81f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884556, "uuid": "cb081f7c-735f-4dbd-8e64-c8b2cf225180", "value": "SecuriteInfo.com.Win32.InjectorX-gen.15310.20352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de17ee1a-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "e41e44eb-fa8a-4a93-ac42-1529da07ade3", "comment": "Malware payload (AgentTesla)", "value": "60ff914a33692e74d695ed4dc4beeab0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "7fe97d3d-ebcf-4e84-86d2-b8c305308ccd", "comment": "Malware payload (AgentTesla)", "value": "19e89f24c9d0a5e0aa13b90ecdfe43e715728a549dcdf1f2eb33c3fd7eda8cd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "93ac5f0e-de8d-44ce-81e5-02a64c61b18e", "comment": "Malware payload (AgentTesla)", "value": "8ccfacf9e4a08187886591c2dac4f526bfe46b58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "72ad852c-b295-4d4d-8ba0-d2c5502f15c4", "comment": "Malware payload (AgentTesla)", "value": "d6eb69df80059d67ba9bfa8dbb87ed87d4e87a7dcb0656686096f52d51d74848ce519a24900efb039cbdf0bb82d055a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913966, "uuid": "4fedd603-b56a-49fb-ad46-29f98c122591", "value": "T1C4157403BA4786E2C148177AC59B0E3613A5D7816633F71A794E337948437BE6ECDA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913966, "uuid": "5ed4d6ed-901c-420e-9772-144f04fce450", "value": "12288:Zd3do3rsI7owA4LxCcFqVNrqzdtfOwOq4UuX+iCr9f14:Zd3do3rsIMwzxCcFWSdtfOwOq4v+96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913966, "uuid": "0e9b6068-9b47-403e-a5e2-e8b68cf642a6", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913966, "uuid": "754e74cb-7e78-4241-8705-29994958e348", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913966, "uuid": "6bab6794-fa0a-4844-8d9c-23185e9d709d", "value": "rEjmtyjjlg.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9d4961-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891445, "uuid": "316f039c-f744-4521-83a7-62637daaf5cb", "comment": "Malware payload", "value": "aaee0c5f9e04057f4e79cfadedf59713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891445, "uuid": "48bcab96-0919-4763-9ddd-a548eb515da0", "comment": "Malware payload", "value": "1aacf38341092dc9d3677a1f1bb703cb293a8c8c7129ba2a21e754d8fe4fd6bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891445, "uuid": "539e3dab-0b6a-48e4-b303-886ba82e8a25", "comment": "Malware payload", "value": "e3a6049809ec224f5d7388a78898cc144f1b4539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891445, "uuid": "1b408c22-ab20-4530-9465-5f1ca4f53a8b", "comment": "Malware payload", "value": "b38fb5482680aa31f319983f5bc922ab4a311c31c642a81b64e10b148e9ffec3dd0f757834c25cc308b6103ae0f374aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891445, "uuid": "a39e5923-63b7-4331-b546-65be6f5a2d64", "value": "T12665330B5B55C8B9D07B5DF04CFA49A4943B3C2D01B8940AB6CDAD8E6E33690E9D07E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891445, "uuid": "cc839858-9c50-4281-a2c1-5e5ff6f554f0", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891445, "uuid": "3ff3a4b7-737a-4704-8b33-d5c2ca576c9b", "value": "24576:3I39d4r4/DxkhSycvXEQLATQjjmgV15R2GjQKionv8C3xSEDeF/61Vm0NOuyQyF5:36dReEyCXcTQjjFzL3ionbPDeBqLNOu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891445, "uuid": "d5fc5acf-af6f-423d-b920-333c4248fd87", "value": 1458368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891445, "uuid": "e0d7390a-192a-4066-809f-de7bb4d6361d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891445, "uuid": "08179998-33af-4699-993e-ccb8740b3b93", "value": "aaee0c5f9e04057f4e79cfadedf59713.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb1e296-4b8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693878614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878614, "uuid": "8f13ad81-2194-4a4a-b656-6618dfe03177", "comment": "Malware payload (RedLineStealer)", "value": "f4a739361b615ed32565ec88ba123d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878614, "uuid": "13da120a-1dd7-4f49-bfd2-a3d2f411d42a", "comment": "Malware payload (RedLineStealer)", "value": "1ae1495528bec6d1c8538bef8ca5363ea94500caa6f0239b1d95cd6a5436cf15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878614, "uuid": "be51ab6a-249d-4276-8420-4ae5e34ada47", "comment": "Malware payload (RedLineStealer)", "value": "a6984605474720def05a6586f7800c3574b5c8ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878614, "uuid": "3c56de32-2ba5-4511-bb3a-4b83eba5d3e5", "comment": "Malware payload (RedLineStealer)", "value": "bc083ade4b56275513cc0b3e00d8a972479202c566b2e579dc71069ecda6df3b570e310acea93b88b803fa7fa83a09fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878614, "uuid": "61fa154d-9e9f-4ae8-ab91-99e74a765c82", "value": "T1AB84013177D1D435E59B457051A0C6F05D7B78A21BBA49CB33880A7E0EB03D0AEEBB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878614, "uuid": "f940fd29-8958-4ccf-b9e5-8cab5c3fe77e", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878614, "uuid": "37976e69-aade-41d3-acd0-6117e6fb00e8", "value": "6144:91OhnrhwzxL5pWPlAXbf1UhqkBicbh9Xjnd/13P/KNryR3lU8cnEL:9ohrhw9ilAzTM9FNWw3lFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693878614, "uuid": "0f759274-83b2-467f-8e77-6af03dfa113e", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693878614, "uuid": "5075fc50-f2c7-49b1-a614-27c396f28203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878614, "uuid": "e03d7b00-f2ca-4f69-aabf-20284aa6f7d6", "value": "f4a739361b615ed32565ec88ba123d07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f92436-4b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693876422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876422, "uuid": "86cbd1ef-a6a7-4894-abd9-21f850d8690d", "comment": "Malware payload (Formbook)", "value": "b8e7041651b0e6d50a5343b31d1edf9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876422, "uuid": "02a9fa27-16c4-4534-998b-11bb0829e669", "comment": "Malware payload (Formbook)", "value": "1b29005d1fa110dfb5b924c879e64d7d4cce8af163f9e6853e4bbda2c298acf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876422, "uuid": "71b2d8df-8df4-4f80-bcd5-0def24f8589a", "comment": "Malware payload (Formbook)", "value": "decfa0a35fff7ed61d75598dbc8a9cebc2220297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876422, "uuid": "5fc4cdfa-64ca-4cfa-baee-12071d98b82a", "comment": "Malware payload (Formbook)", "value": "b1c757fdbec0619008b57140ad3ee5f71c7fee76b444adde5aa2a794ad65e71e184dd64d844417819864ccde7246f3d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876422, "uuid": "f823ddfa-d4fd-48c3-a4ab-9e8fc09e8fc6", "value": "T18184124EB694CDE2D5A113323E36A3869FADFB31B414055F2390BE4CB876542DE2F261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876422, "uuid": "5051abe3-f08e-40bf-9af3-c26d4089364d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876422, "uuid": "027dbca8-c00b-4a62-be2f-9cbc8edd88c1", "value": "12288:/Y1+C7K+7kGPPtDQmPxgmXGVe7glP+w7Ki:/Y1+V+n3BQRwGVWglmw7Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693876422, "uuid": "15ab6ce7-9115-451c-b7ae-6146caf378f8", "value": 401675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693876422, "uuid": "d2d06f92-2bda-40da-9431-344b1ec18dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876422, "uuid": "cade767a-dc2a-4d51-a8d0-0fb556da8089", "value": "AA-021 market research.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d436289b-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921680, "uuid": "032eab56-ec57-48e9-9285-b0d8b7e49e92", "comment": "Malware payload (AgentTesla)", "value": "4e96819623900cd4dedf73294ef25ae2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921680, "uuid": "fb909c0a-888d-45ea-a287-0dc2230a286d", "comment": "Malware payload (AgentTesla)", "value": "1cc5b6a023324f19a38a276365de0e823d80d44bde2bcdf5632556b4f50db101", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921680, "uuid": "d8666e35-8e82-45b2-ae5e-2a6b231168f6", "comment": "Malware payload (AgentTesla)", "value": "042b022a94cbc7e6de34bd955a8c1b21e837eb71", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921680, "uuid": "28291e8a-018f-40d7-a352-4e7ad537a2e8", "comment": "Malware payload (AgentTesla)", "value": "f3e628255e0c8923e997d9eca771eec03f69bec1efcb9d4afd7684522fc393c42cca77e87242346b2b8142c6cb39a848", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921680, "uuid": "4ec22c96-bf54-42db-ab30-c8ad31b2ccb3", "value": "T1FA44B95EE8037F49C331D4AF0ACE99343CAB02BF9E929F17752669539FC098A702545B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921680, "uuid": "3fd88b75-ece0-4155-bc4d-36e785e418be", "value": "3072:lLFJ33PJLVXmsrZB7IQ0SBMGXQ7kkqhXHHridVcp+84C2+AQ65h3:lLFJnxVXmWIQbrAobLiEUJ+65h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921680, "uuid": "e9559ecf-e983-4a66-a559-85aea343a77f", "value": 259928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921680, "uuid": "a613db15-36a2-4b55-a9c9-4a2fa5650e29", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921680, "uuid": "63b95dd8-9bb4-4aae-bf49-47649dac4991", "value": "Hesap_Hareketleri_04092023,DOC.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa81a30d-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890391, "uuid": "d8044703-f62d-4025-907e-2cec6ff75f5e", "comment": "Malware payload (AgentTesla)", "value": "90d97d60ab79f0d3ecf467a23147b5f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890391, "uuid": "aeab164c-9c38-4808-b873-2c5016d3d71e", "comment": "Malware payload (AgentTesla)", "value": "1d764be70840124eb68ad9bbdccb996bc56ccea2d4bd804ebf99141629dd0b0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890391, "uuid": "e7340454-76bd-4cad-b05a-0e8564c28884", "comment": "Malware payload (AgentTesla)", "value": "dd2015462058fb50eb93f058e4792d76871d8b12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890391, "uuid": "9657730d-4eec-403a-b05f-97832117f9d0", "comment": "Malware payload (AgentTesla)", "value": "d282f8cd0f7aec8769abe0fc99cd07b1468d7522ce4a17d6544db8fd3695dc19e81d55024ab84843419292d0721691a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890391, "uuid": "105c764e-ea38-4f54-aaac-544bd8aad6df", "value": "T1F5E40240A3F85F23DB7E97F65458615407B65C9F1632E3480CCBF5DB26A0B910A42BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890391, "uuid": "32d33579-9ef7-434e-8368-c2cadf549499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890391, "uuid": "05c611dd-0bf8-4b03-81f0-662ef580dd87", "value": "12288:AoRAqYAsmFW62MCoHc811wUr6vM53VnMktxUUUtVaxWDYYRvkDwMD8H:AoyAsmo62Bo84wUrCM1VM+xwmxstkDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890391, "uuid": "4cecee03-21af-456b-9e3c-78ac3a3a8f9d", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890391, "uuid": "d7d767cc-5131-4946-ac7a-62609d613a61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890391, "uuid": "99484774-40e6-4296-868f-c364ff583308", "value": "PO 239001-48LF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98491e64-4c45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1693957228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957228, "uuid": "dbc1e57d-19ce-4a3a-9879-c7a601b999cd", "comment": "Malware payload (WSHRAT)", "value": "a577b3a40efbcfb8b749ac033f1a7a71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957228, "uuid": "37311a0f-3529-4bec-be13-1bafc2fd717c", "comment": "Malware payload (WSHRAT)", "value": "1d96c9a57ad378deea20d2e275d5cc70692e2fb673d311ff3e101e695cf979eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957228, "uuid": "99de4868-9b89-4e47-830e-786db0691b37", "comment": "Malware payload (WSHRAT)", "value": "2dd22a217b5faec549b6a948a6d1f75c5114c485", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957228, "uuid": "9c402947-c9ea-4384-bc9c-95fa7143b851", "comment": "Malware payload (WSHRAT)", "value": "b01ce1c913b8a154d440d5f9662658a2c43125220f1b98c6488c089e7ba7d3dbb8105a3d093674214623e8e781fe47e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957228, "uuid": "db731b96-505c-4d7a-bbf3-183677be4f1b", "value": "T1E3255B822AF4211E93E3E61CC715E227AD25F9272D9729D6BCD47F0DAD78C0C158EB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957228, "uuid": "900da378-4b7e-4fdb-8f3e-b9521e2f24d3", "value": "6144:MQSBV1i/yLD9YI1kBs8WL5y6P3uXjRAE2CGMNygiAN2nKrptY/Q0H+kIM4TdwQbW:Xz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693957228, "uuid": "db800d9f-bf33-4358-b84d-2e3b0988eb57", "value": 986584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693957228, "uuid": "933f9c20-ae51-4682-b99e-78516e9b32cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957228, "uuid": "deb479da-d6be-451f-a458-861cfee324fd", "value": "Sdk283724711.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1601b0-4bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693910394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910394, "uuid": "8a1c118a-73e1-4a79-9010-11587c138046", "comment": "Malware payload (RedLineStealer)", "value": "1d885662742993bef8092e3f32a814f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910394, "uuid": "c6d08456-4b6c-467c-998c-e2925ebb3503", "comment": "Malware payload (RedLineStealer)", "value": "1df42da7530d6f30ae388b7c21ecb2812b935d562b98d37af4e9e09533abadc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910394, "uuid": "824a7b6b-78cb-4fab-baee-7b86bd7df125", "comment": "Malware payload (RedLineStealer)", "value": "a0d4a6561759297374190a425cc9ac836c500b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910394, "uuid": "bdddb074-ab50-4212-9b8a-229f6d301d71", "comment": "Malware payload (RedLineStealer)", "value": "dc4aea503ac3e5e2b5a187fe4de9bb0d6c062ebfffcd0cdb791ccbdc2ad913b458e898fc87d19da25f0f8fe959b5ecaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910394, "uuid": "7ff5a697-914b-4d2c-8193-e4f90ecbcf5d", "value": "T18D647E566D884D2DDCECC5328528A19B8538B4AD34D08AFFE27BD074BF35681B71A83D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910394, "uuid": "4a1dca7f-3f48-4455-8ed9-8a9bf5dd25a0", "value": "59e9016f955a6d31d640ba2784453b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910394, "uuid": "e4155483-34e9-440f-a294-29f83dbb1003", "value": "6144:3X/L1istcmZvD8DtQCJpXm42vWzeZbxgxCb9L5o:H/L1i/DLHXmNbPL5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910394, "uuid": "d3dd6e23-1414-4a92-8cc4-0f4a531931ed", "value": 318192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910394, "uuid": "e37ac077-f89e-4730-ad77-fd19b163a9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910394, "uuid": "9212fc3f-d214-4856-9b40-5cf64b75c6a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f491fcf2-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693921735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921735, "uuid": "09644011-e471-4bcb-a72f-fe388b717e53", "comment": "Malware payload (Formbook)", "value": "6ebd5318dc7665cc9eb98f3e86f540aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921735, "uuid": "4049c71c-52db-471f-aa7c-2d97ef506dd1", "comment": "Malware payload (Formbook)", "value": "1e67c1de9ab794fd43370d342aed12592832c1a71658c357e9f6ee43097a8ff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921735, "uuid": "71dfbec1-7ba9-40e7-a0c0-77f791d3611d", "comment": "Malware payload (Formbook)", "value": "b40272e972ef9369bd84861e1a8f4ad3d1f7698b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921735, "uuid": "9f128bb3-d48a-4c8d-9af6-144ee273f61e", "comment": "Malware payload (Formbook)", "value": "b084be68d492da23cda7da00f3cbd134e8cd186072d93f9cb00c9e1da4d2294e5b9f6249cadfe99da866848b3daf3be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921735, "uuid": "981351d2-a97d-41b7-8ac4-90c7d33f803b", "value": "T12B454E1CFA49DA3FD29C9C3950F9DB2B29B99FAAD0F1E351C010527518E6CAD0DB6123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921735, "uuid": "16d6077d-1685-4db2-9cf5-d2307bda53a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921735, "uuid": "6427eeac-37f2-4517-8994-259159d0fd47", "value": "12288:ZdX6cWaxTqSWrOGJTouK/XiqLKyv6zs3Y2PbSgXfxHxf4DsIwb:GTQr6vTDKPi1yCzmPtfJh44Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921735, "uuid": "4097d111-30d6-4fe4-9eeb-380b718d37f9", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921735, "uuid": "5d6e81d2-43bc-4f6c-95d9-2609e43ecf71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921735, "uuid": "c369e38f-4acf-4324-9359-17abdfe1d117", "value": "1e67c1de9ab794fd43370d342aed12592832c1a71658c357e9f6ee43097a8ff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fadcb21-4bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693893004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "11a8530c-a1a0-4cdd-8467-85cb0bd86ccb", "comment": "Malware payload (Mirai)", "value": "24c470f2b16c6b6dda2c79b5b10b9c24", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "03ba85b4-6583-43b0-add1-e304c415dbf5", "comment": "Malware payload (Mirai)", "value": "1ebeeec32f6049fa059a1eff2e7dc8cae61b957e8cc2df8295ee6c5d44cf0266", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "d70a5c26-9fc9-48a1-adbd-3fa57c1a8413", "comment": "Malware payload (Mirai)", "value": "23f9b60583c25a20a43073937d473dc58fa860f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "94c86cf9-04a3-4968-8b31-f5aab3a61fc1", "comment": "Malware payload (Mirai)", "value": "0e6c5a27b9a7e56c08704d9b5add65bf67226e6a474f4583faf9f9399682e35bd562f0f5a011f905bc67c12356e0cf02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893004, "uuid": "3271e678-2c1e-4c6d-ab59-884ebc77e7b7", "value": "T1A6F2F165796C6B05EF5E12344CFA3902A480D42929FEC5F79BC0B2BB9825F5E2E141E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893004, "uuid": "f37683c1-a799-4e72-b2c1-0841e8cb1071", "value": "768:Nlb23Io3tUggD6NjDdbS/qrs+FCoTxDbtSf+wjyTf6znbcuyD7UHQRjK:NlbYTgy1bLs+JxSp+T8nouy8Hy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693893004, "uuid": "d72b12a2-6050-47d2-96b2-9c9eb5a37612", "value": 35064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693893004, "uuid": "8050dc78-c475-4145-8740-f57f24c98781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893004, "uuid": "a3f09ff2-34ba-4257-8221-fd2affefde6f", "value": "dark.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76d20d7-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693920854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920854, "uuid": "c69cb769-89f2-49b4-90e6-09d139e58911", "comment": "Malware payload (SnakeKeylogger)", "value": "01f2c28fde958cdff35b38b3996006af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920854, "uuid": "3f8c28eb-a31a-4473-b762-374b6b8f2f06", "comment": "Malware payload (SnakeKeylogger)", "value": "1f053050006198f3627f81d69994d0f21f62a41175c718ee50b3ce347d5d8790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920854, "uuid": "64db8097-543c-4e49-9047-da267721fd94", "comment": "Malware payload (SnakeKeylogger)", "value": "ec2293148316f2f13006405e825583be92298c8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920854, "uuid": "eac06fdd-a6a1-4518-8e53-b3f3713976d5", "comment": "Malware payload (SnakeKeylogger)", "value": "f19a1b21b3d0fb0a5ad46d98ce9e28f550e82708a2670863c29170a968ae375cc5da6ff4b4a50d52de1e459a6e38beee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920854, "uuid": "16ade76d-c43c-4790-9e4a-9f2826a1ae79", "value": "T197D40280B394BF27D83A43F1941295000BB65C2E3962FB544DD670EB2B36FE25A51E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920854, "uuid": "ac1251e6-c109-4e3c-bfee-a7f53a38be7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920854, "uuid": "44116c34-390f-4dd3-9ce8-e8cc05479ec1", "value": "12288:EHm8kDwMD842n4g1gDX8lWFmGrH6iLtAE97Sf:WkDV8X4g1g7jrH6i6E97S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920854, "uuid": "653c7acb-349c-4645-97f9-d25349637e62", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920854, "uuid": "ef182ffa-c2b9-49d4-97ed-d21c4b61f800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920854, "uuid": "8d613bd4-7689-42e7-a298-b58556709d17", "value": "Bank slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022110f5-4b82-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693873224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873224, "uuid": "baa6f32c-2349-47f0-b99c-d3b6258dddee", "comment": "Malware payload (RedLineStealer)", "value": "07d43df44327c5c736ee5cfd27f18211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873224, "uuid": "8955d6e8-01f9-454a-a785-806b35b08f7a", "comment": "Malware payload (RedLineStealer)", "value": "1fd75b5d4c9877f1060a20dc1b0ff3116e43d61024ccf0c290a815a9ba8f9eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873224, "uuid": "a356fd23-9880-415a-bf2d-95c8cf5f72ea", "comment": "Malware payload (RedLineStealer)", "value": "f2f83940118bdb1c737280102f5904ac77186c47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873224, "uuid": "1b150d16-2ea8-4caa-877f-70d54417dc35", "comment": "Malware payload (RedLineStealer)", "value": "a868692fc5fbcfc9f57bfb85bf3bc1c0fd37a79f1372d58392a10da3952a001f893c4b1e58153f8e66b91c8cadf27dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873224, "uuid": "b98aa4f6-b207-4fad-8c04-6cf7fe324ce0", "value": "T135649EE174C1A933D971143905E9977ABF3EB8631DB11DEF53E4263B0F606809322E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873224, "uuid": "91eac96a-38f7-4cb1-8f28-37b6320db40d", "value": "e88a529caf2666acedc4a4b0f2baa386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873224, "uuid": "07756f92-3ef8-4d07-951e-8fd3ee56340a", "value": "6144:wpEwlZIY/Nff6612b6hAOu2lx8ucLhA2a1xhh8L:qEwlOYNN1XhPlKuctA2e8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693873224, "uuid": "846740ea-6481-4b46-af03-f5333334a634", "value": 311605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693873224, "uuid": "d6f1169f-c992-4056-9574-f86727fcbd05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873224, "uuid": "6c3a7019-fcb2-4ec2-a3d5-6d0d926a1606", "value": "07d43df44327c5c736ee5cfd27f18211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb8c00c-4bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693902663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902663, "uuid": "e832a23f-eba6-4cd2-aede-8c6843abb267", "comment": "Malware payload (Formbook)", "value": "6f946948ff96eea3a6800a86040e28be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902663, "uuid": "ab0a1411-b686-4d6c-87ed-90e3e1850e2d", "comment": "Malware payload (Formbook)", "value": "20174c141584b7674b7b97ab3afdfa6bbcd8b01e868ddae97fd080f8a6c904c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902663, "uuid": "e6c95ac2-36ce-4a30-a66d-15a942246fee", "comment": "Malware payload (Formbook)", "value": "21a6d0697f46b7d6dd83efa109dd642e5fa21949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902663, "uuid": "06d2398a-53c9-4044-a14b-df78618cdb82", "comment": "Malware payload (Formbook)", "value": "f45fa76b8200ddcc2722c229d78647800b3ebbb6833b14cc977f634312fde41c81517c51a1e6b4716622695406a4a0d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902663, "uuid": "39c2ac37-b591-4149-b246-c54b46062f84", "value": "T143842215B729CDF9E8860DF11F39D2663AF1F45180B043138B244BADBA39293BE59B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902663, "uuid": "b7b2648b-b3df-4be8-a63f-5bd387686158", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902663, "uuid": "7bba74e6-8a0b-47da-a23c-63a818191baa", "value": "6144:vYa6y91ieURFbIAOOuwganC2I5Pj7LdRC6jfuH8ROJAq0A8R9K2:vYk9gL/BHu/aJI5HRTrxSAq0A8RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902663, "uuid": "992619bd-7b23-4de1-ba4a-fa8d3eaf3b80", "value": 388927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902663, "uuid": "f4e0fe5b-526a-4eff-934a-575dffc8cbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902663, "uuid": "0c5ac07a-e8c4-445e-a832-8624364b1448", "value": "design and measument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b310ddd9-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905304, "uuid": "0609198e-ba14-4b23-aef6-eaa5db4ae0aa", "comment": "Malware payload (Mirai)", "value": "8235f88c20fcd11e78db523cff1b5fe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905304, "uuid": "2c5a83ba-53eb-4392-b08e-2b82b642f95a", "comment": "Malware payload (Mirai)", "value": "2164057ce1b86ff45baaa487b13d0dbd20867aef1f00746f350587135e415691", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905304, "uuid": "5510a41d-3d73-4abd-ae7e-dc42971a8ab7", "comment": "Malware payload (Mirai)", "value": "735ae7c32ccc274113f3d3a5c4a85486288f5597", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905304, "uuid": "b63355c6-f3fa-458d-9a33-ef0ab7942769", "comment": "Malware payload (Mirai)", "value": "d9d3ae862924e4757b8301372c4c5f3c77df7ccb1ae6f5ac197160e51ff67914a48cce9b1820e98f1c5a42652a8e2a91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905304, "uuid": "3ccb6b65-affa-438e-be8c-135d0d856d03", "value": "T18DD2E1483AD253FACCC9C9BEB65F4035309A34A9A6B29373B346D5530736180F651E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905304, "uuid": "e597fea3-22f3-4ad2-895f-81c3e815fcdc", "value": "384:MPd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKAjLuEYNyn:0lxKd29WcxEns+V6IHE4RlY990nBtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905304, "uuid": "26a2aa83-ba4d-49e5-b6ce-54165472bbc9", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905304, "uuid": "2681b1c4-b8ee-4057-9ff5-d65af77131e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905304, "uuid": "8124dfab-5a2c-4b77-a9b8-31e9be0371ff", "value": "8235f88c20fcd11e78db523cff1b5fe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88baa989-4be6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693916400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916400, "uuid": "f13d78bd-8f55-4255-b820-5db36357c025", "comment": "Malware payload (RedLineStealer)", "value": "4e9b5344b71b56b8c5c4efe9a8dd88a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916400, "uuid": "463e5699-1844-4141-be65-0532d72bb25a", "comment": "Malware payload (RedLineStealer)", "value": "22a1c9382690cbdba4b862fdc47836456ceafa75184a74f0acbc20603dc5c125", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916400, "uuid": "714039bf-b78e-40f9-8d5c-2ca9829d8bc1", "comment": "Malware payload (RedLineStealer)", "value": "546901352d6819826f88b6660e490ec1c60cde32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916400, "uuid": "bf78ca69-704e-4b29-9e57-f1136d55ea25", "comment": "Malware payload (RedLineStealer)", "value": "42d72d31b51e9089243b70068e49265249752d425b2a93986be3c4d5982e27806ce6c8b716c43f316680fc225ac1d521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916400, "uuid": "dacb91e6-3da1-4b2a-abc8-4204f4639f30", "value": "T14DB46C032BDB41EBD21159330AB117614EDC5C7A4AC9BFAB9F459FFA2A103913B9B350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916400, "uuid": "732cb87c-51bb-4cb4-8d88-eb1e175db692", "value": "e88a529caf2666acedc4a4b0f2baa386", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916400, "uuid": "e5a620cf-be5b-4b36-a0ec-f2b388a94a3d", "value": "12288:LcyFPwD4lZ6X/uz8lnt7FTe64KpCe5QANZPIVRBLFUjxJwrkbQePEacrqIrc:p5D0u4t7FTiAbPIVRBLFUjxJwrkbQePl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916400, "uuid": "b3b1ea03-eed8-4eaf-a0e3-4df4504627cc", "value": 542048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916400, "uuid": "f160c61e-8d62-48b0-a83b-f3152210ce11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916400, "uuid": "6ed38c88-8d7f-4086-b1ae-b574e96e8b6e", "value": "22a1c9382690cbdba4b862fdc47836456ceafa75184a74f0acbc20603dc5c125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f5e932-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885763, "uuid": "b4561bb8-e195-46c7-8521-b487d3b59370", "comment": "Malware payload (Mirai)", "value": "8b010e54aa7ca369913867247c3a022b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885763, "uuid": "35036c66-9528-4f64-a7ca-4428236079bc", "comment": "Malware payload (Mirai)", "value": "2334cceac1532f3813fa6a634089ba7de358c077d4722e84a0f31aa3ff3a247d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885763, "uuid": "fbf02e5b-fb04-4ddb-893e-34095305475d", "comment": "Malware payload (Mirai)", "value": "54f2e96c3bee641354a3a15aeb333b7be7f6f844", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885763, "uuid": "99ff7601-c8e1-4aae-8683-53f8c1fefa88", "comment": "Malware payload (Mirai)", "value": "bf9fba88d5310db53efd4c4ea36096df18fb80cbd5640fd621cc991e1f0f168536fc6c0e64e3dbe2d642c39487b2eabe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885763, "uuid": "51da45a4-35d1-4584-9fc2-fd5c253ff0e7", "value": "T104531B89B4019E3CF84BE6BE84320E09FB35735525A30B2776A7FDD35D721684E86B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885763, "uuid": "f59969c8-97fc-4426-a3b2-e52d2e479bef", "value": "1536:ShyW98iXe9Y2MY+VkkTLUOQZe48vv0Pw28uwhaNqHi8Oaf3:Sh5ToOSj8EY1xiBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885763, "uuid": "bd7e3ac8-6c57-4c0f-912b-fee835b38049", "value": 60892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885763, "uuid": "57bd78c6-0a40-4a38-baaa-8771b697536d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885763, "uuid": "68c55fde-c370-4d9d-9a41-fe6113a08b0b", "value": "8b010e54aa7ca369913867247c3a022b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a7129d-4bde-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693913123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913123, "uuid": "42444b6a-8883-42a4-bc0f-d848ad062fad", "comment": "Malware payload (Amadey)", "value": "806c5dc2a6f886c12d877c8db78ae212", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913123, "uuid": "d8a86f10-1156-4b30-af66-8a2f7e9fb4f1", "comment": "Malware payload (Amadey)", "value": "24208f7d5f3beaa61956ee4edbbdc77236d07b8eddef3cf77e24201428b8edd9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913123, "uuid": "e98f0693-d31c-4428-bd9b-cb55cf0a57a0", "comment": "Malware payload (Amadey)", "value": "b0156da2d4b32029d2efcaf7a276c528fb3281e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913123, "uuid": "0968afb1-5c94-4834-97c2-8bb754d09640", "comment": "Malware payload (Amadey)", "value": "3da3397ca263c73c04324d98a248711c10c213ccfd68a361d6ba661182e48345ddaba8c16128077e8280f366d82c7b01", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913123, "uuid": "78b86c7d-ab64-4c7f-928c-95b3272bd36c", "value": "T13476232363510355E4DA4C3895277EF436FB4B768B85B4B6A1EABEC63D33910F612A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913123, "uuid": "107231d8-d6ea-46bb-afba-b4643b9603f2", "value": "57d103a83094fa82108ae551b7df13b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913123, "uuid": "472ea5d1-a11e-4165-8a34-5b17862ba40b", "value": "196608:hJpjlSfrD+EO8aNQRYulyx8Cr6HTkj2Xrlug:hJppAr3O8a88G66Hc2XrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913123, "uuid": "6c243a94-96c3-47a8-8500-428f91c32884", "value": 7319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913123, "uuid": "949b76ce-e2cc-4bbc-bcb5-21a5f6e48db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913123, "uuid": "bcceb834-45dd-4640-abb4-9568a74b6c5e", "value": "24208f7d5f3beaa61956ee4edbbdc77236d07b8eddef3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70739d3-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905337, "uuid": "372bbb3b-023f-44c6-b27e-bec09976f532", "comment": "Malware payload (Mirai)", "value": "6af651727ef7581f42f4692ad235d065", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905337, "uuid": "d8f29e78-201a-4dd2-98d4-3420167e0a19", "comment": "Malware payload (Mirai)", "value": "247ae5158b6a34148c244755e9aa2bb6fd7727719af000e8d7543b73dc87759d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905337, "uuid": "44bb280c-4ad1-4086-8188-d08b6439de06", "comment": "Malware payload (Mirai)", "value": "f3322177110ecbc613942cffc967f66171a66257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905337, "uuid": "ca65298f-e49a-44b9-a233-bf8e5ac7ab81", "comment": "Malware payload (Mirai)", "value": "cc3b1fc69591f71fff86db97966ea338e80dd1ed39a580b288fd4e51999d9fda5656b353ba11f75021fac8bcbc440d4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905337, "uuid": "67d945eb-4cfc-4392-996d-92d7a66f6f7f", "value": "T1D7539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905337, "uuid": "d7f9f20b-3640-4d98-bce5-2c1053d4f9c5", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7o:P/tVz1eUUfwN0T0f+whWONEJ7JX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905337, "uuid": "7a460b39-d6c7-482a-b465-9d9327dcc2fe", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905337, "uuid": "040e094a-d32b-4762-8d41-1e8d496a75b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905337, "uuid": "b96d9207-6b99-4034-a166-96c804a04fe3", "value": "6af651727ef7581f42f4692ad235d065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cce89c3-4bc2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693900784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900784, "uuid": "96fe35e4-317e-45d1-8f38-fc941c38f46c", "comment": "Malware payload", "value": "19c2ae99396fcefd1bce392d9db76baa", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "trojan.js", "colour": "#CD3CC5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900784, "uuid": "3df367ec-a702-4548-8b75-8e1e98cd8568", "comment": "Malware payload", "value": "24973e2b5d954a1afd1af6a2c0e7dd80ef44d1dc52a2af86ffecdce400ad2710", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "trojan.js", "colour": "#CD3CC5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900784, "uuid": "2957ff66-3c3f-48cf-9044-070830db3456", "comment": "Malware payload", "value": "9516851de05e22b834c617c8e1bea2cd8cae778b", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "trojan.js", "colour": "#CD3CC5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900784, "uuid": "c0d0c694-1eaa-40c0-aec1-73959965ecf1", "comment": "Malware payload", "value": "0f05004c5888c2c491c5eae6d1009b38f2b80d1de522dbdb10f5d3636999b2bf5d9d79f96fd6ac093dc0de929e3dacad", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "trojan.js", "colour": "#CD3CC5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900784, "uuid": "1b07cb12-3eae-481f-8da1-1670453d0530", "value": "T15DC37D7886770C57DA63223AFC0B37DDC3286EE7A0FC2966E45C53E53B90489944793A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900784, "uuid": "a1551ba1-dc60-4241-81a9-85a7c9ad816d", "value": "3072:FxAskOAdGLQvID5QYn/sBQJvznMMl4GT31W/4pRKj0:FxoCQvID5QYn/qQJvwj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693900784, "uuid": "93df0cd1-d0b4-4b11-be0c-d2f8d94f30ad", "value": 122896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693900784, "uuid": "c812c4f3-600b-460b-a451-bc479910a68a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900784, "uuid": "c16dcb4b-1234-4ef2-ac17-f5761e74a0e5", "value": "ACH payment confirmation vijay@panaceainfosec.com .HTML", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac698b27-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884247, "uuid": "220ea2d6-5c84-4ede-94fa-0a6a43f6035e", "comment": "Malware payload (Mirai)", "value": "63e590f67bbb96d95fdbe3c38ed97235", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884247, "uuid": "7ee07914-ad30-4402-be8a-ed4456c18723", "comment": "Malware payload (Mirai)", "value": "2508193bc36fa917dc9897cd47385e72901d4a6bf94cfaabaabcad5d4f92ea9c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884247, "uuid": "9b01b2f2-e581-4aa9-8700-b3a2d98b6fc4", "comment": "Malware payload (Mirai)", "value": "a667cf338a33d0c209aced11ea71088de1b37bff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884247, "uuid": "e19d61c1-c71b-4443-b073-6aede0ca5ce4", "comment": "Malware payload (Mirai)", "value": "91d74050b719fe506bb5eb531f448bef81df0fae29086bc9e833852f61cdd7d041acdec9b159bc43303760e6a1edaa7b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884247, "uuid": "a9d2df69-ac18-4a59-b2a1-04a96be2a556", "value": "T138D3F846F8819B12D5C151BAFE1E124E37131B7CE2DE7302AD246F647B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884247, "uuid": "0291f83e-a318-4907-9bbc-08fdcb5600f8", "value": "1536:sQnYP+KhsoikefUl5h637gMCpXy7tSKL2YguaJIaiciaiomBXzG5ECR1E0w0m0t5:H3UBc85pXnKSYguaJVmBXaaCR1A5sX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884247, "uuid": "889b34b1-699f-4c54-b496-1067dd794ea5", "value": 131932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884247, "uuid": "676ddab3-d61a-4937-ad80-4c15a0c49d70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884247, "uuid": "e8998ee8-ad93-417b-a2aa-6da05fb0ad14", "value": "cundi.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e23bc8-4be7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693916670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916670, "uuid": "b3384341-3ec9-49b4-a1dd-deb6f104c5f0", "comment": "Malware payload (AgentTesla)", "value": "864d635b9081667360dd0daa6d955f3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916670, "uuid": "105b9de9-42ea-4f54-b406-bc39d13f099a", "comment": "Malware payload (AgentTesla)", "value": "2520f9055491bd695611211c085de117330799bbff90ac78857b005d230eb359", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916670, "uuid": "6c04cc50-bb69-4567-8587-9fb5c13605a8", "comment": "Malware payload (AgentTesla)", "value": "b99c05039efa94c6292093369948ad200304a065", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916670, "uuid": "029ca2b3-d951-4056-8a4d-df9de0b8d0e9", "comment": "Malware payload (AgentTesla)", "value": "19bf428eee5d0d86dbd52437f19b32939d123992d9b69a48b4341374ff505054e1691376f8be59ce4d8d07ae66f395f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916670, "uuid": "8ec547c7-f6db-427f-a4c3-9e693d0098d2", "value": "T156C412101FF82765C2AC8BF8E95201149BB059E704BEBF6F8EA815D179DB70217636B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916670, "uuid": "993a7473-6a78-4866-9e11-5ce11b0babfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916670, "uuid": "8bed4c16-f306-44e0-94bd-5f5377e8d6c5", "value": "12288:h9/Xg3npbhu7FkzWxKW4lgc9Bj4c69s7EoXeFz:v/Xg5c7FQ2KZR9px693oXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916670, "uuid": "d3556f10-3746-4e3f-8ec4-ef0436275c37", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916670, "uuid": "158c8178-e0b1-4991-bd0a-b01c3969f467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916670, "uuid": "f709b2cb-93fc-40cc-988b-7e53f45a10dc", "value": "SC_TR11670000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f284085-4bc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1693901271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901271, "uuid": "c61f69ac-cdca-4ed7-b4db-6898727f4d53", "comment": "Malware payload (Heodo)", "value": "7351ba8b706dd879762f93fc69b9b0c7", "object_relation": "md5", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901271, "uuid": "8a48de40-5a2f-4215-9011-ef443f367c01", "comment": "Malware payload (Heodo)", "value": "2529d502cf503a0bae7e810151fd215385a26ed5cb513fd082ca52770a05e6d5", "object_relation": "sha256", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901271, "uuid": "80442bc4-0c5e-44ea-ad19-a9a21dd1a78e", "comment": "Malware payload (Heodo)", "value": "a4e19ef88107f8c2f075cd5a9d753b52188d8cbc", "object_relation": "sha1", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901271, "uuid": "55dde70b-3de1-4e34-82aa-74243134f4b1", "comment": "Malware payload (Heodo)", "value": "a6384445bd6c93e320fe3d1b53d358908125d7c920dcb60ec2dce5538e1f77344b47b81774b73368f7b1b51df6aa67b6", "object_relation": "sha3-384", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693901271, "uuid": "c0725410-5b9f-4a5f-9e94-b8545ed5b790", "value": "T125E5121136F9427AF6FB2B34BD3E91616D3ABC691E20C11E5354750E0E72A80CAB6773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693901271, "uuid": "80be0696-64b6-46ca-b018-6cc2d65fbb25", "value": "49152:otzP/DQtSwBLlw6f4H7GxIcrq6x4dYdJSAG6Kk2f2gZgBZgQfpN31gEF:M3nWn4bGbq6adYdsAGLPygQfpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693901271, "uuid": "a9418c20-ec9f-4bd5-a3a9-b6fad5a846c4", "value": 3170304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693901271, "uuid": "dedaab29-850c-44fe-b7bb-cf80b612646d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693901271, "uuid": "8d2bee5e-524f-4bbc-8978-ae95cfb51017", "value": "setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afdbd02-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885748, "uuid": "6aeffd84-b730-4a37-b9b0-eab0bc076c97", "comment": "Malware payload (Mirai)", "value": "3ad78747b22978d43218ccc9597eafe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885748, "uuid": "7a0a001e-611b-48cd-b5b6-1b9baad1fa6f", "comment": "Malware payload (Mirai)", "value": "25372fb4631719df0dac259bbde7423136dabd0cd7ec6b6298ce323b3374e135", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885748, "uuid": "1e4d92c8-91a1-46df-a948-c305ce302530", "comment": "Malware payload (Mirai)", "value": "9a75e3cbe7c4ece2689fd76979eb6ae6e5fc2d34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885748, "uuid": "e993f379-f483-4cf3-a08e-348c73dba60b", "comment": "Malware payload (Mirai)", "value": "775300cb4618f65f2ad184301e387c12435e6d3bad67802131abb7053878a924c639a700b8b4d5c59e2656253769a2d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885748, "uuid": "410646b9-45b6-4032-8cff-563ab3b9712e", "value": "T1C9C33B05B30C0947D2633EF43B3B67D1D3EF9A8121E4F640255FAA8A92B1E325546DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885748, "uuid": "85ab66c4-345a-4706-b294-87d7ed372b2e", "value": "1536:cM/a2HDxRLwccxpZvT1N62lXV7gc/dbMFhvArIVP+NWDkXqV/9kinwXy:qeuccxH71VrgcFbM4rLinwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885748, "uuid": "d2a8ff79-bdcd-40b9-a5c3-f72731d2db94", "value": 121720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885748, "uuid": "63275cb4-9bb8-456d-9a01-5419b3f07d3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885748, "uuid": "78ba5f29-24b8-4ba7-a644-2ef295aace3c", "value": "3ad78747b22978d43218ccc9597eafe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fd3f97-4be4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693915642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915642, "uuid": "98d3cd43-7796-4fd4-93e8-2ab9f1c5f125", "comment": "Malware payload (njrat)", "value": "7157d4efb87df7af40d3fdb950dbda62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915642, "uuid": "ff5d45c1-8218-4665-87d6-80945ed55747", "comment": "Malware payload (njrat)", "value": "25dc0059d6af20a87dd34f08184da79a228c1858ceb720c9710b57bf46eafdd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915642, "uuid": "7fab1f21-fbdf-4e1a-b88b-25526b08a4cb", "comment": "Malware payload (njrat)", "value": "e5391710f5da127161470fd30020e86ea4b6f93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915642, "uuid": "f2064b1d-89ed-40c3-9b46-8ca7117912ff", "comment": "Malware payload (njrat)", "value": "7b4277c1a1bca385f0112bf7e8a81c492a743c37004faa5fe67b2a00b8719fa6c06a6e017372ab19d4706cc024a6459c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915642, "uuid": "297aa97f-1a66-454b-96d3-895bedbdc18a", "value": "T17CE2080A7BA54129D6BC26FC8CB313150772E3478432EBAF5CDC88CA4B676D44245EEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915642, "uuid": "70f0949d-c657-48cd-8165-23a90cd60120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915642, "uuid": "9050ea02-1f7a-441b-85bd-a273fad847ee", "value": "384:E0bUe5XB4e0X+OPCNfSLujLKWTltTUFQqz9qZObbT:BT9BudaZSLunJvebT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915642, "uuid": "26325c01-5ee5-41a1-b37c-a0ec504a2b0b", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915642, "uuid": "5f9ebc17-02a3-4911-81d3-d4427e36a625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915642, "uuid": "d578b6c4-f62b-456d-8246-551a53d2281f", "value": "bP0B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe3215a-4bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693910500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910500, "uuid": "7ebac196-b0c4-4cd3-9d57-8e9a8785cb54", "comment": "Malware payload (LummaStealer)", "value": "23e79a3332967dcde843ab843f9041f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910500, "uuid": "550b8b54-0bc4-4358-bba0-9bcdff353a44", "comment": "Malware payload (LummaStealer)", "value": "265aa01e804dd1bda8e2f711aa9e80bfa08d0e7e481911e2cf9d2dbc66f2dc7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910500, "uuid": "ce6cdbb7-df17-4171-ab3b-117487d4e6ff", "comment": "Malware payload (LummaStealer)", "value": "920d64b00d61fccfd5612c332cb3fb314140797c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910500, "uuid": "2617b151-69d2-4860-b912-e6fa8f4c1093", "comment": "Malware payload (LummaStealer)", "value": "43f8eca1eddea49f3e39b01b4e5b4ca0d9c6b5b2770ee84f285e0bdbf38adac061b5c68e1952c39eae59188df2bced66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910500, "uuid": "e2dfe9ea-9b83-46e2-bef4-373bdccd7516", "value": "T1EE45F11077E8C205F3EB45B4A4F3C9084736F6453B3BE98E6EBD06DE25A57A84991383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910500, "uuid": "d338872e-666d-482b-a4d6-596b2ec4ea68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910500, "uuid": "a0e42f92-5cc7-4b2a-bf0f-391b9c32312f", "value": "24576:GUPo53l4qFhzttKK4tDevkqkt67YnzgQQ10gBg3oq:G75VBt/4t6vIA7YnzgnBqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910500, "uuid": "b4e7b1a5-6d30-41f2-9c2f-08d8c64193f6", "value": 1277440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910500, "uuid": "e74d4d20-824c-49a6-82f3-f8ca6e7c810d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910500, "uuid": "0aa7f4a3-7793-4a3a-9c1c-99fbfb64945e", "value": "265aa01e804dd1bda8e2f711aa9e80bfa08d0e7e481911e2cf9d2dbc66f2dc7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ab5a7f-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890216, "uuid": "11588d5d-e403-4b44-a190-4e175fb61bf0", "comment": "Malware payload (AgentTesla)", "value": "f878467d428f71698b107b1525c6a42f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890216, "uuid": "d6627e8f-de78-4d7c-b9dc-230b3c9319e2", "comment": "Malware payload (AgentTesla)", "value": "2697795abaa5ab922bfa04bb730b2fd704fcb5084c70debecbdf81f689601ca3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890216, "uuid": "7b91baea-ff4c-43df-9836-044c7a02ee84", "comment": "Malware payload (AgentTesla)", "value": "329f1bb20ed3cf15548543c439473828bf71e79b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890216, "uuid": "6d676ae3-d97d-483b-9787-a5ae67257d74", "comment": "Malware payload (AgentTesla)", "value": "9d97de49d0a32d00095a40acfac5b061610a08bdb95f51c22ba27761d48e5ceddf8ef191056c791f699e43b652e5565c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890216, "uuid": "e707e19a-536b-4839-ad22-baaf2b3c92fc", "value": "T1C4F433653B55C37611F93AAF02777F14CC260913A9CA7C672C82F5E83664FD8832598B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890216, "uuid": "ac49d95e-3f4e-47a6-bfb4-e83ad2a48ce6", "value": "12288:fGSEFd4jWEioGD6Q2iYfydNbtjYoiE3XZ9Baj05K9I8oyxus5G1dO:X+Cj8oM6QSf4NbtrZdkIuxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890216, "uuid": "873362aa-697a-462c-8cd4-c159ea4485b2", "value": 731784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890216, "uuid": "d573b964-f635-4270-bfaf-9f4185af1627", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890216, "uuid": "c1573e3a-78e3-40ef-ab89-fe6dc3df7e52", "value": "NEW ORDER PO-22598 .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6182f7-4b8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693876978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876978, "uuid": "fe749cbe-27e8-446f-b209-8f6af32f1c6a", "comment": "Malware payload", "value": "68a7d5caa4c7bfbf0bcde05f58d2f0f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876978, "uuid": "86e34894-dfcc-46f4-b1a5-d5a2da171187", "comment": "Malware payload", "value": "276cdb84c5db9d081f107c821a4b28e3b7749a0924a8445d0c021de6fbac72a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876978, "uuid": "112dc469-78e2-4f43-8208-64f46520d22f", "comment": "Malware payload", "value": "5af3b1b149cf82bbd464841fbf250732736ea7c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876978, "uuid": "06e3802f-db87-4b23-8045-00f438fef5a5", "comment": "Malware payload", "value": "11ace8c157c2acb80d74668b60d893f17d17d855a22e1636abc8ce63cac1b57da43e732b43844aaa62319ed4385e114c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876978, "uuid": "a4454413-55f2-40f0-8f71-dc0a1ec2377d", "value": "T181321A1577D41728D1FE8BB98CF362509633FA878421DFAE1CC8502B99627C44A51FF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876978, "uuid": "7f545cf6-5f26-42f8-9f6d-3eb8ef4aa4e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876978, "uuid": "b417970b-b12b-4028-b4f4-17b486c1a21f", "value": "192:AF1NaH28E0w8w/Fg1xCYrMjbC67O2nwVNfiLC2Z0mICRALbCXBIKTl2m:Az4H2T8w/FgJIjbCKIVNfiLd0MALbCXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693876978, "uuid": "9a3567c0-c00c-4ca1-8311-649df988bc82", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693876978, "uuid": "ccc6a97a-8c5e-4617-934e-4e38da681d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876978, "uuid": "54cb1771-0676-445c-8a5f-86068c4d7363", "value": "276cdb84c5db9d081f107c821a4b28e3b7749a0924a8445d0c021de6fbac72a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc28c47e-4b8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693879227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879227, "uuid": "6d32715b-1675-4a83-a96d-bab64440d000", "comment": "Malware payload (Stealc)", "value": "1ad3de2066ec735f473cf4a488089006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879227, "uuid": "e8a6a323-d88e-429e-8a2f-54cdb69737cf", "comment": "Malware payload (Stealc)", "value": "2871daa4540aa3a817dc50993816c1d653c7ec1ee74d721f8963201f3f6ac63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879227, "uuid": "62bd90aa-7591-4963-9f62-2947e39c6440", "comment": "Malware payload (Stealc)", "value": "d12da7e1ac1892fce7d720a4b1873872e8e32570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879227, "uuid": "d4bced1e-37be-4cc8-861c-7aaed1bb4848", "comment": "Malware payload (Stealc)", "value": "970469f9a420a2676294420e2caf4b785aa02a40b1d9f3fe1c9f7228e0a9ac141f3c2e81712a9d7e9ad375edf1758faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879227, "uuid": "d864955f-686e-4f10-889f-4738b0a31970", "value": "T1B7446C1373E07852E5228A329E2EC6F87B1EF5254E59775A132BAF2F0BB01E1C563741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879227, "uuid": "a08986be-a0d0-4fc7-a780-360ca3441579", "value": "9d608900baedff6c1407537712c386a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879227, "uuid": "c006ca70-53d6-4a62-9c06-ed3d2c2399fb", "value": "3072:lmeSLcfQnkmTu2/H8QFCmWjQ7pjMPl7x970grH76nou6v3QcSMafEFY:5RfQju88QFUj8MPl7n7Xf6CQJfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693879227, "uuid": "eba5ae29-28e6-4fa6-a4fe-58149ae88547", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693879227, "uuid": "c00de615-c148-4977-80d4-2c1650858afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879227, "uuid": "d6113613-6dd8-40a2-b538-99f7e338df8b", "value": "1ad3de2066ec735f473cf4a488089006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194ac711-4bcf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693906334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906334, "uuid": "9a4e8cf2-0366-412f-96f3-dee59a0320b6", "comment": "Malware payload (RemcosRAT)", "value": "5d34846b89bf43502e2be0d4fd004618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906334, "uuid": "142ad650-d0c6-445e-9fa8-56f1ffd5e70a", "comment": "Malware payload (RemcosRAT)", "value": "287a8c784bc439337cd063735d6941eb0a40f2a9137b085bb86dd8d4aa14fcc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906334, "uuid": "000acda7-d264-486f-b45f-faf677863561", "comment": "Malware payload (RemcosRAT)", "value": "b0ff73e01fd0156facba2f9a4bf8cb319e1e3dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906334, "uuid": "ff228102-abb3-4da2-8706-c506361986bd", "comment": "Malware payload (RemcosRAT)", "value": "f66920621000747a0377b2f8fcab04d859e5bf043fdce59bd196084272e881a15fc1cff4f07eb5117a647e1a840e50fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906334, "uuid": "037e1c59-5643-431d-b3c8-f648ae9b5836", "value": "T111456CE2A254DC72F06A3579CC89B2D0396B7CED6D3A5C8D166C394A1A73761392C03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906334, "uuid": "b53ad38f-1a69-4dde-990a-166ca40ad269", "value": "beefa6546dd4570bf21020f1082d8b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906334, "uuid": "1704d1cc-59f7-4e38-9ad8-0240b856be2e", "value": "24576:ORTaL+A2f8Zhp8bYm1EnyWjkf0eFuPD+4m:gTaKsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693906334, "uuid": "a702d841-17c4-49a8-a254-68682f1c69f7", "value": 1243648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693906334, "uuid": "ef5d3e6d-14a9-48ba-9c3c-e6bbb4f6d4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906334, "uuid": "1a13fe6f-ce1c-46fb-ba7e-7ac3cb33426d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29314.2446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99d8043-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905315, "uuid": "5ccd18dc-3b1d-4a5c-ad7c-6e8307bc43db", "comment": "Malware payload (Mirai)", "value": "3503c4b7c34f2b36f5d5e12a1695d8a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905315, "uuid": "59ac130c-79a0-4cfb-ae73-40a17f33fec0", "comment": "Malware payload (Mirai)", "value": "2b80d927771a7311165a27dbf92bc66f7360e892b2374d8dbb19ef8e43e591a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905315, "uuid": "8c368c21-9daa-40d8-9001-26715e9e9760", "comment": "Malware payload (Mirai)", "value": "d02c23dd81d030552fccb500f968d88589be32d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905315, "uuid": "57424b6e-6a01-44ee-8007-ec026daf6124", "comment": "Malware payload (Mirai)", "value": "b81ee242794632941c098252a053ad1b7c25684567387224fac8bf345cc3d8a093a1af96944514f0adbb7c07971b1549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905315, "uuid": "adcecf63-c8f0-4b05-82aa-a4d83d33cef9", "value": "T164C2E084F1818F01DFFA68B03E84CADBFBA02F1F5A528E9022A053D15B5C2634346ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905315, "uuid": "26815fde-3046-488b-8cfe-02c0c01bf3e0", "value": "768:vVdafO76jpmNJJKehmA7trpfIX9KeA7P2ndF0i4uVcqgw09t:bam+AnKehPRa9auF0i4u+qgw09t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905315, "uuid": "aaa3ecdf-b003-4d87-b59b-78a43049f46a", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905315, "uuid": "7585a89c-852d-4d93-9b9e-bbf84655763b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905315, "uuid": "5967deef-b940-4467-90be-888a314a06b7", "value": "3503c4b7c34f2b36f5d5e12a1695d8a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879e87d9-4bb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693896641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896641, "uuid": "f5b82a7b-0b7a-4a72-93d3-50dacfb84bce", "comment": "Malware payload (SnakeKeylogger)", "value": "3126577b04c59f6d075033c23ebbe02e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896641, "uuid": "e051b215-5b2f-46af-8ecd-054d94b42c86", "comment": "Malware payload (SnakeKeylogger)", "value": "2bedf08308b72618df4599d23bc1c9e54311a4f7557c130cef8771abfb135d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896641, "uuid": "cc456c5f-492c-45e6-859d-7d84e81064bd", "comment": "Malware payload (SnakeKeylogger)", "value": "1a85f8bef1668c4171061ef71bc154a5231564fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896641, "uuid": "11272a73-62be-4f30-b15c-72d0e8b629d8", "comment": "Malware payload (SnakeKeylogger)", "value": "6cd2339a307f2fd2205088c02a48d0c3b520b242c0d989cebd3bbbc3396ea8aaaffd0e521380224031d7a7fae7450e66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896641, "uuid": "2d3b0b11-ef6f-4cf8-9226-d440ec7ec3ca", "value": "T11EA229C1EB845626DE540BB0A22B8E201779BF1B87222B4F27C5735B3D47942632F95A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896641, "uuid": "c21b1cb0-3255-4967-baca-6a867227a4b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896641, "uuid": "64d99620-49ca-4a03-b058-fca513974550", "value": "384:TEYhPvlWJJbsNPnbn+b/AeH9F9wGjEnAtNCSGFqU3P+:TnAJOPbn+rLXiiEnuCLFqU3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693896641, "uuid": "1c2ec903-c518-4c89-8128-ba02f8f6a133", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693896641, "uuid": "d24c084d-f28c-4869-967c-04dc37be13ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896641, "uuid": "d28a3dfb-017e-4ca3-8e52-5aba9fe75aca", "value": "Znnxzwv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b915c95e-4bb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693896724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896724, "uuid": "c6865880-ac1b-4f45-afa9-ea85448a39bf", "comment": "Malware payload (AgentTesla)", "value": "a985e76b70c2e4b588601d79515bfd2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896724, "uuid": "ecfc8aa1-8fbc-4348-b524-14022de537f1", "comment": "Malware payload (AgentTesla)", "value": "2c8542f1dae0737a5debe8ff4297ad6bddd44a7742bed0845cc2862ba6fe842e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896724, "uuid": "ace5da36-fba8-4241-9948-f4b782f8096f", "comment": "Malware payload (AgentTesla)", "value": "a151db5acdd23775fcc73c0895c50a7fd0dc8f9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896724, "uuid": "4fe1c565-1ee4-4133-bf6a-a7c596e4f8a7", "comment": "Malware payload (AgentTesla)", "value": "5977962a721d9e73ce40630333cc3a6d3410f1fb3c9460974da460949206d6e22ff1676ba78c85a62d4273729c67317c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896724, "uuid": "71bd2346-71fc-4aba-b189-7892fee98ff8", "value": "T11F2563F3FB442FE284C24DACB9E8D133A9D406807551F67BBF6AA945401543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896724, "uuid": "6550e5d0-ce79-4a08-a0ea-cb56240546c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896724, "uuid": "ce310230-b7ba-4ad8-8ec8-a2d5e7d6ce1e", "value": "12288:KBGQ7YTVjVZlzrDc9NUPQKu8P0EcGnzTYjrlCfv30U8W:KBHaVjVZlfY9NMu00EnqZCfRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693896724, "uuid": "7fbac267-4b6b-4c99-acec-99c35782a024", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693896724, "uuid": "15a797f3-6573-4ffa-bc74-db8430471fac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896724, "uuid": "054a3e87-82a8-4965-99b0-7945c8500d38", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fe479e-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890386, "uuid": "59a3e7bd-2513-4266-8033-5de87e5dc57a", "comment": "Malware payload (AgentTesla)", "value": "348408ffc9100a95c0ec107ff24ab0d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890386, "uuid": "97e679db-d601-44d9-8b63-0f53d0ac640c", "comment": "Malware payload (AgentTesla)", "value": "2cdb2516668f9e2de961b06690ab2837f1aead1ce8fa9596cf6bbffda583c9ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890386, "uuid": "620b2424-1483-42db-ab47-52117bdf2a24", "comment": "Malware payload (AgentTesla)", "value": "d8af2d759942a76bfaeec6fc488c3703c0a87f5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890386, "uuid": "20ff9d12-bd32-4341-8a71-f60271614d4d", "comment": "Malware payload (AgentTesla)", "value": "6b3743237fe3149789704b30831ace13c2cf2801561e1f61d92651e1aeb10dd69e37773851897f79fa55ef089f877242", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890386, "uuid": "c4868a7c-2d21-4e1a-ad57-59f5e08d9502", "value": "T17585AFB876047DE6266F536BDA96ACDD03B616639ACBA4CC80747BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890386, "uuid": "1c0a3b09-f13d-4874-9049-5f8d761c9f6c", "value": "24576:sGAQSGBaP0jUO2Ok002YFl8Jsevm73YtMDoKl/dN7is8xmvnbBdofjSYDAcrHQPW:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890386, "uuid": "cf23c3b9-97ca-4ccd-a217-b6ce42eb6766", "value": 1837536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890386, "uuid": "f5f42553-0589-43de-bb0f-bbc1134d48a7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890386, "uuid": "6d2ca922-50c2-415f-b401-a64461cc1ffd", "value": "PO 006543678.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45acdf2-4bd3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693908339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908339, "uuid": "479c142c-ec15-441a-a033-aecc303377c9", "comment": "Malware payload (Mirai)", "value": "2e91a5b13776be6dbfe2efd75b7c2fe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908339, "uuid": "28124356-4b74-49ae-bced-b12d51f83849", "comment": "Malware payload (Mirai)", "value": "2d1a238467edfb03fae8122510835697d423319cc5ccb022b1b0ed4175724499", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908339, "uuid": "a63e5f81-3001-458f-ba45-16bac2bf4b6d", "comment": "Malware payload (Mirai)", "value": "7e67a9cfdf53f78b9e9f012aff2e6790a0b83980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908339, "uuid": "f8c64144-7bc7-4211-863f-0938c2d41960", "comment": "Malware payload (Mirai)", "value": "6d9a7c82ff4337bf23b044575c9d97693513d44f8b0650b3d7489cbb313c2472f0a20fa958b6ef8311ad919763001e80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693908339, "uuid": "63e5828a-ebfc-44bd-98e2-7804f94e5c5e", "value": "T163735D24A9792E26C0D4A17B61FB8361F2F6230E25B0D65D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693908339, "uuid": "5c9fd608-b3cd-403b-bb3e-96307632d251", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8g1:YwfdNu4cmZvFqI3w7g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693908339, "uuid": "e2855862-401a-4ae9-ab2c-3bedeea4746e", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693908339, "uuid": "7a76bc88-c465-4c78-b53e-dc200dce9810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693908339, "uuid": "924dfad6-d5c9-4fc0-a12f-844d9bf52dea", "value": "2e91a5b13776be6dbfe2efd75b7c2fe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6caeca94-4bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693902609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902609, "uuid": "b1bc22f3-e70e-4897-b50b-24714f64d904", "comment": "Malware payload (RedLineStealer)", "value": "a7b1c750dd207b00798591b38d82427e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902609, "uuid": "3bb8021a-a3c7-49f6-94ca-e0d28ee893e6", "comment": "Malware payload (RedLineStealer)", "value": "2e4257425e3384411ddb60d32737be47a3e78001b332de742cbc1ec4870bfab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902609, "uuid": "9751f533-74ea-4021-80e1-13cc9384b3b4", "comment": "Malware payload (RedLineStealer)", "value": "0be9d3ed2719dc68d3361dc87373136504ee65bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902609, "uuid": "665904fb-6054-4957-b863-ed5c1d16f46e", "comment": "Malware payload (RedLineStealer)", "value": "9a80f45c3843623f26287fba87b337311e17eb5526208dc8f5089b6933cc7312fb403b26a585e038ce61f1969ade1a36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902609, "uuid": "494b8721-2ea8-4d80-ab98-5182ba2eae17", "value": "T1EB948BA365C0FC62C91543318F2ED6EF772DB8528D29EB4726186E6B29711B2EF13710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902609, "uuid": "8a65b039-4519-4b10-9037-5250e24400aa", "value": "2ecd68902b681b798a1768b60fb38fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902609, "uuid": "07f8cb18-3dc6-4c9c-bfb8-b2b5f2db0e03", "value": "6144:kN+lGL+m3ZB4VxrpZZjUwEcUgck1CTjj6B3+OjWspT9:kN+lGyfjr5oocTTj+V+OSsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902609, "uuid": "1304276d-e14d-42e5-8350-3ba6ebb41cfc", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902609, "uuid": "0db82043-3b63-469e-bdf1-8cb438c4a6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902609, "uuid": "5b16ca7e-54f7-4e9d-9ae4-825d23938993", "value": "a7b1c750dd207b00798591b38d82427e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8295ecb-4bab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693891247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891247, "uuid": "33907415-a84d-49a2-87e5-96ff9453bdf1", "comment": "Malware payload (AgentTesla)", "value": "f8714a5169debbd07cacc5cd529f117a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891247, "uuid": "d9fe6b90-99a9-402c-87d9-06bf0a231c3a", "comment": "Malware payload (AgentTesla)", "value": "2edff05ec390a6401bd10b06cdf197a69c7c4deebf0df4d9ef667eb6e68c667a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891247, "uuid": "b4ef2eda-42d1-4bf4-8ee9-09def98fd961", "comment": "Malware payload (AgentTesla)", "value": "4f0eae43f2e65a5996aa2851c4a847b4efd815f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891247, "uuid": "0a6ab146-d084-4e00-89fd-845c7618d217", "comment": "Malware payload (AgentTesla)", "value": "1701ddd0e2e0187f5cb7a5361195f8cfbf2da8958f7aed3790e3cbd54870793514d9d75914997c436589e331411c4572", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891247, "uuid": "4536f419-8f47-4a68-b038-2e97beabe300", "value": "T13C34FE12BF48EB15D6983D37D3DF6D1853F2A0C716739A0BAF48AE6529412436C6E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891247, "uuid": "1251d9a4-6eb5-4ff4-a133-c23302c83494", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891247, "uuid": "3b27d558-b8af-4106-8063-b49ed23672ff", "value": "6144:4qvUGpTGiEg9ZOQ5k8bfZ/Rr9xXXuyWL6YEhqXg:o6LPQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891247, "uuid": "7e74c0cd-225b-40e8-a94a-ed99103635d9", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891247, "uuid": "c8c8d56f-f495-4808-a3ad-5601005bae88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891247, "uuid": "bd025909-e343-4101-8869-074c907d7ea8", "value": "f8714a5169debbd07cacc5cd529f117a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be062991-4c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693928515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928515, "uuid": "06c067bc-72c5-408c-a89e-0bb414836fac", "comment": "Malware payload", "value": "4d43e46adcc0be717559c18ec2fdb0b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928515, "uuid": "61051192-5703-4139-80ce-dd0c2d2a8d1c", "comment": "Malware payload", "value": "2f0b2160470e2253dc6a5c9cf950962c5999ee209d0eb0db237a4c630cb34e7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928515, "uuid": "005000a5-e3cf-4189-9d3b-8ff92367b705", "comment": "Malware payload", "value": "d330ce845bd3a4ca9e0ec8ab6960716a6a5d73d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928515, "uuid": "0a65f38f-049a-4c44-856d-771ebc95a0a9", "comment": "Malware payload", "value": "81cb92fba68609ec0d54d9bbc2758dd7204cac2cb156c930d796109ce1458471f4be0439b7d27115c2e64258887f39d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928515, "uuid": "8af5b496-6d29-4e87-9417-e994d873433e", "value": "T1F0A44D4AB66555BDC0E6CA36866FC17268703CD84332693B7380E6311ED5E219F2FF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928515, "uuid": "d757bce0-6302-4c4d-b4fa-ac5167e637ab", "value": "6144:zqEF33NzU/MUqqWMJwfQItY2R38FcMrv/OTJaG0ii+htW3Qx7D2v76C8QKXE:z7dU/MhKwfuksFcM7/O70m7SzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928515, "uuid": "46dad992-15ec-403b-97b0-8ab8d22d011d", "value": 481986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928515, "uuid": "c26d5fae-6fe1-4d2f-bcec-3ca0e3d109ce", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928515, "uuid": "f63b2741-1060-48b2-8c80-1c6cba4a725f", "value": "2f0b2160470e2253dc6a5c9cf950962c5999ee209d0eb0db237a4c630cb34e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312889a0-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (QuasarRAT)", "timestamp": 1693891342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891342, "uuid": "ea3f6fae-d62f-4fea-b8d8-14d7c8af169c", "comment": "Malware payload (QuasarRAT)", "value": "4dd0e1166551875cb05f7e0b527e9f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891342, "uuid": "e8b39828-63b0-4488-bfd6-9429a82cbcbe", "comment": "Malware payload (QuasarRAT)", "value": "300511c3a97a5e97d592177d2625b57133b1a266856729cc6ab784d10d61ebf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891342, "uuid": "2c8deb0b-8b99-470e-a0df-5e3b2b25a732", "comment": "Malware payload (QuasarRAT)", "value": "aba739da546e583fee77aa15b863b9d717cbbdfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891342, "uuid": "809f6a1e-3da3-4088-a662-4b4366485cc6", "comment": "Malware payload (QuasarRAT)", "value": "0efc7d5261204222feb43da1b75faca0f51449ada545a9382437666972731783260060f6032e97e32fd8fb7715620040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891342, "uuid": "3c3607a2-21c8-4644-83be-e2f0928f2c2e", "value": "T18B65E04EFC022F55C331D87B0A8E9A203CAA12BF5F529F1772656987DF805C6B03566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891342, "uuid": "2ffe9288-413a-41b7-963a-3ff1f9619f47", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891342, "uuid": "5c810483-bc6c-480b-bbf4-4b5f543ef244", "value": "24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891342, "uuid": "2b49ea2c-3901-47f6-b66d-e009043bd1de", "value": 1456033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891342, "uuid": "61ac8b81-1026-4d2a-ad43-1d30c29dd924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891342, "uuid": "b7a82ed2-7b44-4144-b4bc-caa882749f88", "value": "4dd0e1166551875cb05f7e0b527e9f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deff45fb-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693910102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910102, "uuid": "507410e2-007a-405a-90a4-46f628c11a2c", "comment": "Malware payload (AgentTesla)", "value": "14e0fa699db10cdce66fa868ae67599c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910102, "uuid": "8119acb2-9f49-4c9c-bf11-f550aa083e66", "comment": "Malware payload (AgentTesla)", "value": "303c5c619ac8d872c403ee36652bf33c146e65364522e289dfa91df089a38b5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910102, "uuid": "d84a94f7-439e-4cba-9230-9c78fe4dfb61", "comment": "Malware payload (AgentTesla)", "value": "2ca23f90dbb7d3e0840274eef80a65a6bff7009f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910102, "uuid": "728a2729-2aa8-43e3-9dcd-3e7cd391591d", "comment": "Malware payload (AgentTesla)", "value": "d870116cbf983dbf65e99a9952bf85673851d381aa6e13a9563fa8824f37d7b068ac4a29a6c17c30342414d986906b37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910102, "uuid": "54c23070-67bf-4aef-9341-8b2ae5ea853b", "value": "T141A41D063748CF25C55F15B5C9A3C2F81727AE00DD1197CB71CDBE2A3AB32E96A61287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910102, "uuid": "f2cce5f7-5969-46b4-8ee3-81a6e3837c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910102, "uuid": "8f0c3fbf-c0a5-49f2-a2f8-3f17214ebbb8", "value": "1536:pyeQa2AmhobbJpeUdl5PAaZ/Sv93Q28FH6qSjpPxhQ:HQaXbbbpfhAP8t65FP7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910102, "uuid": "e04f6a73-0322-4135-b846-bf7251073697", "value": 459536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910102, "uuid": "2bb7bb6b-e739-46ca-b74e-ae9e41e4c7a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910102, "uuid": "91f94279-8443-4b95-9020-4575ab4814a7", "value": "303c5c619ac8d872c403ee36652bf33c146e65364522e289dfa91df089a38b5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8e793a-4be1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693914076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914076, "uuid": "9e2fdba9-3603-42b3-8b1a-ff25141024a8", "comment": "Malware payload (AgentTesla)", "value": "4d283743dc062262658c6ee818703d7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914076, "uuid": "1351abe7-0c78-4bf6-b598-44e29822d0d6", "comment": "Malware payload (AgentTesla)", "value": "306f969d18a0d1c339cbda8affd8192105710daba12a987fbe1c624c499308d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914076, "uuid": "26466ba4-3f0e-4c14-a7cd-7cfd2e560d63", "comment": "Malware payload (AgentTesla)", "value": "ec487a9ba15893755255c73f2755d432054fd23d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914076, "uuid": "4b90cb0b-fbf5-4cfe-a242-0c2cba76788f", "comment": "Malware payload (AgentTesla)", "value": "00fd05577f5162d0d30fcecd2388384d7f66f80e5670e328e70fc6a7d304edecd8263916c7b7a1e53dbb11b08ac3a011", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914076, "uuid": "ce50a8dc-76dc-416a-bd12-8eb2fb249870", "value": "T10BE40250B3BC5F27E67FA7F2051451A40BB7899B2131E7990CC7B4D72AA0BE04A11B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914076, "uuid": "4acf4982-99dd-475c-abf0-9d233fd93931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914076, "uuid": "4cf7376d-40f0-428e-8f9a-b70a25b45796", "value": "12288:5ohFL63LVgtl7Qpgb5a1wv1m7daq6hnDBR9LTW0nBKMLWrnEjFUkDwMD8H:5ov2af7L5a1wvrq6hBxzLWojukDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693914076, "uuid": "ca1d0f37-a848-4340-9a54-d2579793bf7e", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693914076, "uuid": "8de1b4f6-5cfd-467a-9e5b-4b5014433ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914076, "uuid": "3f1e2313-18ca-4f4d-beb6-f5e7585e498e", "value": "z2Swiftscan____.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9593afb3-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693927159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927159, "uuid": "6ff1faa4-09ac-4757-b8da-566399222b7a", "comment": "Malware payload", "value": "3c21e1d87279785dbe03d8eefd861ab9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927159, "uuid": "dac7c9f0-d3ed-40da-84cb-4ac560750a70", "comment": "Malware payload", "value": "30e4b9d23bf965f56b2f82b38a1301fb4d19f4cd79e65a0b3f3864bcf332ea92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927159, "uuid": "0bcb4c4f-68f8-4624-a122-ffc9566a7103", "comment": "Malware payload", "value": "16817e90546158713c9cde05c06f2cf5047502af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927159, "uuid": "b94af0f6-e572-4a92-9488-d21bd6c80cce", "comment": "Malware payload", "value": "51e13cdb802bddc71ac37d26796618d95f9d0f848490de105ba1519490cf3e0cee504459c16a9884f765c610b9383ce3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927159, "uuid": "7644c231-9992-46c8-ba1c-5ca57bc2a751", "value": "T17085237321E5122F78B6D531AA3459F686A23251375D386FFE2343C899F3BE1229D413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927159, "uuid": "cbcc10d1-d4e3-4e8f-ab67-291d5e4c8ae7", "value": "49152:3C5lcdHZNdw+NLwVLlBskK1NfcYoCXGHTmaYiLxEDdtqu6P3qr33Wo:3u2JZNl4O1lnXCmaYiiJouo3qr33Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927159, "uuid": "86db12b6-312a-43e5-b567-e80d6babe987", "value": 1746364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927159, "uuid": "632f1b41-3dc0-42dc-a75d-e20b1e501179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927159, "uuid": "cd9ad962-5247-40e8-a04f-c2eec27d38f8", "value": "30e4b9d23bf965f56b2f82b38a1301fb4d19f4cd79e65a0b3f3864bcf332ea92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa132e3-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884244, "uuid": "d660f831-c4b4-4bc3-b425-2166e4a7475f", "comment": "Malware payload (Mirai)", "value": "c61eba27b70a6f67aacdca7b5b94a279", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884244, "uuid": "11d155cd-0ee7-4634-aa6f-30e9de2ec76b", "comment": "Malware payload (Mirai)", "value": "315ac0472cc569d839b54aca4c9b61819cda49d45a27e6878a60c7628670b886", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884244, "uuid": "9a76f60c-8cca-4a78-916b-216ab809a554", "comment": "Malware payload (Mirai)", "value": "479cc4161879431189294910c8c726997dfecaf1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884244, "uuid": "958ccb7a-35bf-4ce5-be80-8e1dc3f2cfa2", "comment": "Malware payload (Mirai)", "value": "f1eee80c1385d9081bf9a981efcbc3e1e8fc5d325d5a286c7c772842ca5f57863e6729b82056cfdb500ea04483510d9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884244, "uuid": "a4e42d75-46a6-46c5-be35-66015413d174", "value": "T1FDF3C70AAF610EBBDCAFDD3706E9060139CCA51722A93B753674D528F50E54B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884244, "uuid": "04313bb2-1be2-4d1e-b8c0-668903352618", "value": "3072:wt8sJR0Aq4zDeLZDWnu7rpr/SLEnOAEM:wLRVzDeAnWrhKAncM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884244, "uuid": "c754f5f1-a22b-4dea-bda0-2a64bc262ae9", "value": 161512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884244, "uuid": "03c45259-bc8b-47fe-9915-895b869e8141", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884244, "uuid": "80284cb8-aa06-47dc-b2ed-56474ec903b2", "value": "cundi.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ebd64a-4c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693932607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932607, "uuid": "7ce2b8df-f85f-4b8d-a86a-c252659aa6fa", "comment": "Malware payload (Mirai)", "value": "47133cebf9622150b0350adf910e1404", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932607, "uuid": "93f85b05-03b1-4c34-bc4c-c3f8df1e6b34", "comment": "Malware payload (Mirai)", "value": "32b37a93594a7f4317f495c8857e1b8416f0335bf31dc534e7dcb07ccc8335d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932607, "uuid": "481054bb-8e2b-4046-9d3e-d5d64b767f1e", "comment": "Malware payload (Mirai)", "value": "398ebf1c04d4735f480bc134bc657c301c088a35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932607, "uuid": "f1443a1c-febc-4b56-824d-e076a943162d", "comment": "Malware payload (Mirai)", "value": "2c7a4459b4d2717a33c97f6bdbe4d98024e58597dc2db64dd65667c3bb97a13510a724ebf096d13bce187940ad44b268", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932607, "uuid": "b1e79aba-29b9-424b-aa0e-53b0427ea43b", "value": "T105436BC4F643D8F5EC8705702077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932607, "uuid": "2118e959-cb4b-4e01-86b3-30e63d91fe1b", "value": "1536:JeESt/basV2rcZhG6ygN7naKlSR9zWOIaEjrqM7:JeESt/basVTgk7naKQRVtXESI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693932607, "uuid": "a9dc3411-9da1-4d98-86fa-886529849676", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693932607, "uuid": "fcf15821-d14a-4e70-927f-dee6425d51db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932607, "uuid": "5db3c8b2-df31-4637-abd2-0c10d41f3c70", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade2d3c6-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884250, "uuid": "83cd59fe-7b23-45bc-afda-bb0751bf5cbc", "comment": "Malware payload (Mirai)", "value": "adacb4cb27f6a0e01e64d799db80fafc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884250, "uuid": "5bb74a0f-be13-4458-9429-99d5c79bd435", "comment": "Malware payload (Mirai)", "value": "3335ef6845744a8a225e33ca6d2bcbbcf5ca4f54b7e2412b42d2307a6a01bb3b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884250, "uuid": "88917414-45ca-4121-8e33-1bed34fe8454", "comment": "Malware payload (Mirai)", "value": "27db9a501aa042378f1b05c750747e74792f6b4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884250, "uuid": "dad4ffa8-9d38-4ec8-8916-041f2ba68b3f", "comment": "Malware payload (Mirai)", "value": "977d2ab644f8855efa243635daf47d7f1c78f6bf363284f72dac1da7a3606ba8c057acf02324e45056d69a768f66e190", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884250, "uuid": "f588ffdb-600e-48b0-a965-3100f4bb0ae4", "value": "T163F31A46EB418B13C0962BB5FADF434133239B5497EB7305A528ABF43F8679E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884250, "uuid": "f2efaaf6-6625-42b1-a3cc-1e92875c7365", "value": "3072:WVe+u5lHwkgamkUbJGhTcoK4k3X8rK/szDDohM/RNFpkUZ:iu51vgatUbJqTijQK/cshM/RN4UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884250, "uuid": "a556c48a-626e-4917-9262-ea3ba5252aac", "value": 168084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884250, "uuid": "a81a925c-5150-4678-9850-796522afd78a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884250, "uuid": "7a300888-a407-4653-9646-7ba7d9099db0", "value": "cundi.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca67d7e3-4bea-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693918228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918228, "uuid": "68b86ff7-c694-4887-9ae8-f48c95933ede", "comment": "Malware payload", "value": "da8947f86da80b4c619c6fdf8a99d8e9", "object_relation": "md5", "Tag": [ { "name": "89-96-196-150", "colour": "#A3BFCE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918228, "uuid": "b7638511-f779-4443-ba57-09e06d1b70b9", "comment": "Malware payload", "value": "339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5", "object_relation": "sha256", "Tag": [ { "name": "89-96-196-150", "colour": "#A3BFCE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918228, "uuid": "bed81c10-1295-4bd3-bdb2-43071b3e3ea4", "comment": "Malware payload", "value": "b789e7345edf110a5ac67456a34b409062f150cc", "object_relation": "sha1", "Tag": [ { "name": "89-96-196-150", "colour": "#A3BFCE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693918228, "uuid": "3d3d2956-28bb-46b7-8e3f-dd1f22566c8f", "comment": "Malware payload", "value": "b1afe375ecefc0718d97807803ce78c1b61e63ab00e7bb5d462e788cccd907110732a9083d74e8479af35e38e5d61f9f", "object_relation": "sha3-384", "Tag": [ { "name": "89-96-196-150", "colour": "#A3BFCE", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693918228, "uuid": "6d42a0cc-c9c3-49c8-b36e-54b520d6b259", "value": "T1BCF0A350142740ABC9D0FB4473174207FFFA21CE7C41D794B188825017AB447C26CAFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693918228, "uuid": "e31d05d0-1951-4ee4-833e-e8708bd13ce6", "value": "12:eWVjX/DKKLqm/aWVjX/DKKLqV/9rYfxxq7qgi:9VrDvVrDSrYxxOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693918228, "uuid": "e5b770c0-e27c-482b-abd3-40a3d68b9e90", "value": 448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693918228, "uuid": "a4001b77-a214-4523-b8df-d1eeaf451544", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693918228, "uuid": "cbcee062-7eeb-40d7-ae11-87a0168eabbc", "value": "35-2023_en.pdf .cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ceaea4-4be1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693914085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914085, "uuid": "c15a8956-4bb6-47dd-a9ed-38ca30eb4784", "comment": "Malware payload (AgentTesla)", "value": "26bb38f9f3240bd04c85c6581ee96a86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914085, "uuid": "ed4b6a83-7ce7-4abf-9d04-392e1eaea695", "comment": "Malware payload (AgentTesla)", "value": "345d2a727604ae1ed012e5d822356d0ed11dc3d5a5e37e55b44cd3592c1b93f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914085, "uuid": "edf326cd-597d-4dfb-9d24-ff198dae8cfb", "comment": "Malware payload (AgentTesla)", "value": "8971f9687f2e3cade2879f90ab1e4b3cb9b4e616", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914085, "uuid": "23b6c163-3b98-4eea-86d7-882b7e39d3bd", "comment": "Malware payload (AgentTesla)", "value": "41991d8a6f60caeb875e0328e19959ededf47f08658e3aa0534f5ebb203c6fd23f4ea77bb5a1e643095892b1e07060a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914085, "uuid": "2ea3b62e-1344-4eb3-b729-195f4d198dfc", "value": "T11FD423105A1D0B35F8B6EBBA24160425C7BA0AAB153EFF1DAD9B77C660C73824C016F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914085, "uuid": "336b9bc7-d207-4e43-86f6-bbaf87f4ef7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914085, "uuid": "4f4d5fbf-f026-4007-aae6-51eaebf9f2fe", "value": "12288:j9/X9HiHnQL6BkQPdhrl0v/Ym/Y90jvIqho:h/X9BL6uQVv0vwm/00Mv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693914085, "uuid": "1718b361-5bd8-4551-bd39-b30ebdb51962", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693914085, "uuid": "52dfff33-b50f-4e05-87b0-b7db605bba35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914085, "uuid": "24aa4446-1fdd-4fbd-9c7f-3c248023e876", "value": "z6CurriculumVitae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff5baee-4b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693875019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875019, "uuid": "b211b40d-a042-4212-be13-26693984ef11", "comment": "Malware payload", "value": "b5283844e39df60542478647f9f59fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875019, "uuid": "1d0b7a12-24b2-4b7f-bc4e-3931ed2c5d45", "comment": "Malware payload", "value": "3476601196502ae5aacb48ab2a6b0b1089100c0761f563c2cdb86861bc18798d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875019, "uuid": "174ccc24-8920-4436-b553-72b2362a89fa", "comment": "Malware payload", "value": "08418f35e43fe2bc1de757410a942e89ed97845f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875019, "uuid": "e4178829-72e8-4b3a-8687-e9f692d01a69", "comment": "Malware payload", "value": "2a423f9c42c027f716f1030e8cb9130cdb95830d0bfe780515ad9cb271ccac7c573c12a2b04d832bd205a18cfc92e46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875019, "uuid": "2ee81aed-6311-4cd9-8e5c-5fa2dca3bc74", "value": "T122653352F5B080B9E0A2CC383E66F1552577B084AB7413AA73DCCADD5B37E6A6C1C316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875019, "uuid": "b2376184-5d75-4594-a751-fcbb05c9b516", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875019, "uuid": "469cfe78-c5c4-473a-8a75-9c18015b8a75", "value": "24576:BI39dnOVPt90XE89xE0MBd11KR+aN8u6YURZBWFSxvQdbSnmDpvFH2FyFV/uN4vz:B6dnOVn4+d1ZLxSbS2ZxuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693875019, "uuid": "a6c22e16-94a9-4e63-8a0d-ab4dba61851d", "value": 1477014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693875019, "uuid": "4790f077-a6c0-451b-b061-d0b72f79ea0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875019, "uuid": "e3483153-bbca-4460-9c78-378dc7dda2da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65985bb9-4bf1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921065, "uuid": "15055142-0054-45db-a283-a0a458dffcf1", "comment": "Malware payload (AgentTesla)", "value": "0b64c655a35c8c20634104466f856980", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921065, "uuid": "2d0a4bb2-53a2-48bc-aaeb-45da5eb42ad1", "comment": "Malware payload (AgentTesla)", "value": "34989fbca948f494a774ca0a193420d12f8674cc300f2fea9b87d35caa16364f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921065, "uuid": "8be515c1-9c5b-4bb7-983d-4b1bfc8dffab", "comment": "Malware payload (AgentTesla)", "value": "6f86ecaa2c8a2d47f543501ad151f5a55288aaaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921065, "uuid": "3a4e5388-1114-40de-a92e-80b9f2ffbfc6", "comment": "Malware payload (AgentTesla)", "value": "317077e21134d6f78af11ce40c6962c8d24b61775c22c29d0d18d21bc652912fca4ce51afdfd3128206a6cbe4146fc27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921065, "uuid": "6828c4a1-5edf-44cf-bf55-e982217b3cd2", "value": "T19125FB6CFA45DE3FD38C8C3950F9DB2B69B99BADD0E1A391C01051B518E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921065, "uuid": "2386a06a-84d7-41d1-9eca-f88c6980af94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921065, "uuid": "62c25d86-8bbf-4eef-b9eb-ce4328bfe0e6", "value": "12288:IH41ItaBXgxaSWrAVlMox6WhkddLS1w9uyud3vyfX:O6iWOkddLS+kyud3vy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921065, "uuid": "a0cae551-a21f-4836-8847-b42e3048769a", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921065, "uuid": "0400b082-58da-4a7b-b1b1-466ed9516903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921065, "uuid": "79129d16-30c3-45f9-bb0a-5497326def83", "value": "34989fbca948f494a774ca0a193420d12f8674cc300f2fea9b87d35caa16364f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ab8299-4be4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693915407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915407, "uuid": "a4d6a0f2-0f63-43a1-957c-f5d88fbf2d5c", "comment": "Malware payload (AgentTesla)", "value": "b9361a6e8c8c0b856af408e1e0be4c9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915407, "uuid": "0dfb1a25-9a08-4002-bcf9-eb51f30c070c", "comment": "Malware payload (AgentTesla)", "value": "34c7bc3798ec17eb7d3d1ffaa4b94a851356c7873806aafa3110fa39d65344ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915407, "uuid": "d11ba5fc-d2c7-4c19-b2a0-83af78b1caa8", "comment": "Malware payload (AgentTesla)", "value": "774d726230e191d2122c2618a38a1dd3fe031f03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915407, "uuid": "f297834e-c133-4fa8-a33d-ef845a305c59", "comment": "Malware payload (AgentTesla)", "value": "7de43184617ff5ce0c58b11ca316bc692ac92d40c4022162d2c8b93e51fd19fbf7bd2929ed4c9b642aefd483778a2de9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915407, "uuid": "5954a2b8-da70-4c9e-a8ed-fa68438ac11e", "value": "T173D4123072B84329E8FD97FD40E3022553B2582A13AEEF9C9F9570CD7AF8B199944953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915407, "uuid": "b3b88be0-07e3-431b-8ba2-1cee29af42ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915407, "uuid": "659c1ae9-044f-46c1-8f2b-69da3e309bc1", "value": "12288:RVULXxE2f4etaEJYxPw0tEIaGlYQ2MgL8ceb51tRLmicuZbsRhA:MLxf3YxPjthx1jlFZNih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915407, "uuid": "2e0e1c50-8f04-4fbe-9ce2-a49b5a188815", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915407, "uuid": "bf6de313-6839-40a7-8e4b-331dad0ced54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915407, "uuid": "5b4565d2-684b-4b3a-bb8e-1001c2562b91", "value": "34c7bc3798ec17eb7d3d1ffaa4b94a851356c7873806aafa3110fa39d65344ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff72a11-4b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693876522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876522, "uuid": "5016f576-dc69-4fbe-9a82-3183a4636826", "comment": "Malware payload (RedLineStealer)", "value": "091efc6ab130a2533ced5769473b4eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876522, "uuid": "28ca24d0-fb8d-4e23-9941-23d270028b79", "comment": "Malware payload (RedLineStealer)", "value": "350be3905b617fd3c9797f4639ca8f1028638299866c16229779a5a97e226db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876522, "uuid": "28ac5b9c-a0ca-4ccd-94f0-a16c7736e794", "comment": "Malware payload (RedLineStealer)", "value": "9bf54beab944448ddbdd10ee9b33a6951597e836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876522, "uuid": "30e6e601-54da-4c1d-b5eb-5d4774e2b000", "comment": "Malware payload (RedLineStealer)", "value": "12861196cb42d815c64a0ce9226a976b546d9060e6a219e5b75679a3758f489b6cd8ed756625f01b6031ba5b796fc75b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876522, "uuid": "18707cda-bbed-4141-b407-cc3f716663f4", "value": "T1727418C03386B9CDCC4F8BF5616917648A60D442B697FB537C8BACF7385A3C5AA051E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876522, "uuid": "f3847d51-a2b5-4fca-98d9-a0c84fe49cb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876522, "uuid": "d936b28a-8375-4546-83cb-189a21910080", "value": "6144:z5B6qR/3pfT4YePctQWJAX1abSOSN1aTTi:KqF14gJM1abSOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693876522, "uuid": "7afa0c2f-19b4-40b2-a589-161e71caa9f6", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693876522, "uuid": "d5dfc89b-385f-44dc-ba1f-0f220065fde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876522, "uuid": "a1a53d14-e493-4bee-bdd0-fef465b4246b", "value": "091efc6ab130a2533ced5769473b4eb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b787276-4b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693877186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877186, "uuid": "eb9d131c-e64c-4dea-99c2-4a29a7f08dc5", "comment": "Malware payload (Mirai)", "value": "e37b2559cf7667b42edd3e3b8e58bf34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877186, "uuid": "fee647fe-9591-4688-bad3-84ece6017fad", "comment": "Malware payload (Mirai)", "value": "3567cd8197a5732d4881e5f3640e2f50881c7c9c9bc2426f35d9e9f78784d3e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877186, "uuid": "734af437-bde7-4d6b-bfa0-1c2571f5ba8b", "comment": "Malware payload (Mirai)", "value": "a726763e3c13261b415a2505af7e2950ad21dfe5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877186, "uuid": "dfd5d82d-92dc-488b-9781-b5f4164f18f6", "comment": "Malware payload (Mirai)", "value": "7aa5754093f74a5c3be5b0fc69d564e22a5545fb3e65d790feeb6e8a51cdf47bef5c14e847d8f83fadd6c9ad9d3657f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877186, "uuid": "a2db2235-5d76-463a-a8bb-2e3958f9dc9f", "value": "T186B31906B31C0947E2633EF43B3B67E0D3EF9A8121F4E640255FAA8A9271D325586DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877186, "uuid": "aaa46525-7374-4ad9-8a8d-07191c6f1e0b", "value": "1536:VpgX2D2sJ3pxtGvcpB4j1cuOIl6S+PltvA3GSXL9GKAQq8rVRySf1P:e0J3pxcUpiGIlR+P43vrTf1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877186, "uuid": "9a502187-776b-4e97-af80-9478001d6b9f", "value": 117440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877186, "uuid": "fdecf889-9706-4179-ad2e-9327144e724e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877186, "uuid": "cf65a53c-fc0b-433c-827e-6ac7a3334dcf", "value": "e37b2559cf7667b42edd3e3b8e58bf34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22f9059-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693920872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920872, "uuid": "794fb5c4-0e83-4deb-8877-50d88fbd85e8", "comment": "Malware payload", "value": "887a03e8eea6d69d8191ba1755bb83d9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920872, "uuid": "14a8eba1-eb41-445e-b63d-157dc3cffb44", "comment": "Malware payload", "value": "36187a12d7c1ecfa21aecc61434224ec977217961e85d29a6f15a2f4c32423fb", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920872, "uuid": "c49562fc-52f2-4d69-9561-bbe4e82983a8", "comment": "Malware payload", "value": "46f0e67a127ab61c667124e513bb038e09d82621", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920872, "uuid": "1bdf1f78-1134-4e01-b8d7-4d45236368e8", "comment": "Malware payload", "value": "245a1ebbae3cdb9191edded381bd8660a0ec350597a4593409ec3e90aa308db51c395c39ba8ea8ed9d6c9f2dffdf44ca", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920872, "uuid": "8e1ef96d-0ada-4604-ad7c-ad9a6fe210be", "value": "T1DB5549CA5CCCBB86C71942B7EB12F8FC0A7BFE4D968524963031FA4629331591CB61B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920872, "uuid": "21592fd7-1538-4f83-a93c-b8af37964455", "value": "24576:FWQmmav30xSZyHw6VH6NCAAZy7w6Va6NCclHCbNQsdIByyviw3x:EQmmQ30676Va6X6VbENjdRyK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920872, "uuid": "cc5ea5bc-185d-4b40-b05b-9fd76602c139", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920872, "uuid": "4fbc0c83-f1cf-41b0-94d1-46a276d92bc7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920872, "uuid": "f89dac62-acab-49fe-8d36-5237a3fe8fc2", "value": "Enquiry_952023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e8c45a-4bee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693919715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919715, "uuid": "c8458d44-61bb-4e89-b82d-c3685ee71323", "comment": "Malware payload (Stealc)", "value": "60cfab4134dbdb8f1b5e3450771ee49f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919715, "uuid": "1cd5f9de-fadf-4cc3-8188-7d251adb574e", "comment": "Malware payload (Stealc)", "value": "37297514a2a5af1e14981bac45ec19f91fb0de2a4914ec1fb4d85afd4ac5cb86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919715, "uuid": "a5b6a7f5-2e27-4ba7-a68a-e168a2badd84", "comment": "Malware payload (Stealc)", "value": "3bee5e67449c340ba0b4cd75cafcdfdffcd4247e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919715, "uuid": "9da07189-d05e-45fa-88eb-3ff340eb0bf0", "comment": "Malware payload (Stealc)", "value": "8eb78f04f15087ac7fa1c70e7f2e9cba508e0575bdbc880db3b3758a604958eafdaac9e626af7f53345672576e8e38bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919715, "uuid": "50aca551-3857-4073-862e-1e8700ef6c4c", "value": "T1DE545BC36ED0BC61D5168B398E1EC6EC771DB950CE59EB96A218EF1F18791B2D223310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919715, "uuid": "41a558b2-6d2c-4476-bb33-7b02e8c9b44d", "value": "cd74dd88bfa053259aaabed77401f3a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919715, "uuid": "388a4708-1a36-488e-a5df-fb918134cf4c", "value": "3072:owpPS0pJXPUk1Ep5L2ccqeNzBUzIGlU+J7Tgl7g9uJPbCcEuNVG5lqa0k87:BpPnPUk1EnL2ccpucqU+ZTW8EJPb6qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919715, "uuid": "b842c73f-9b3e-425a-aa81-d1a11d3e58de", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919715, "uuid": "810892bb-0dc6-4147-bf0f-75dcb2d52d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919715, "uuid": "3c8f4755-8654-46d1-8940-5fda5b7b6639", "value": "60cfab4134dbdb8f1b5e3450771ee49f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fbfb58-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693920880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920880, "uuid": "46d603a9-9efe-4368-aee3-883b2280e5f4", "comment": "Malware payload (AgentTesla)", "value": "711e9020ac60661ae4152db52de405f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920880, "uuid": "f3bd239e-322d-4b7e-b776-ae2bc07c6fbd", "comment": "Malware payload (AgentTesla)", "value": "37a72a158a2325b4967c6b2a9835fa722b6ca3789316c6120d3f263bfb6c15e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920880, "uuid": "3675feb5-ba45-4b9b-8e85-1fe533dce5cd", "comment": "Malware payload (AgentTesla)", "value": "88909fc78c928a641d1c56d45133a7176c858b57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920880, "uuid": "df0899b6-4281-4e48-b9cc-15f4a2fcaa60", "comment": "Malware payload (AgentTesla)", "value": "4ec1afe08775c9efd17cb913f580557b0fa45bd4a231976f2f5ef6467309436a302c07bd7bc70c0041412bfcea73f584", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920880, "uuid": "cf46c4d2-ed57-4801-9dae-66e77c498c30", "value": "T19AD40120B7F95B11E57A9BF59860215803BD77790932F7480EC6B4CF69B2F608622F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920880, "uuid": "a050aebb-9bda-43fb-ab39-a094d7db6bda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920880, "uuid": "be671b81-b108-4e1b-89e2-98dafce6e71a", "value": "12288:RgD9NkDwMD8LoU+43LhdV8b7Y6ThT6zmJrvMai:RgpNkDV8Lo34ddN6ThuiJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920880, "uuid": "9b270456-d657-4fa8-8ba4-2cf72aa44857", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920880, "uuid": "6b0d700a-3c95-4aa3-b6f5-38716cadbd77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920880, "uuid": "cd28b21c-f4ea-433d-a8a7-fdf89681d4fd", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0318e90-4c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693929861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929861, "uuid": "188d9ca7-9c55-4cb6-80e2-e1b4cbf49da5", "comment": "Malware payload (njrat)", "value": "7377cd7083dd08f6c896069b6e235525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929861, "uuid": "d101643b-187d-4026-8b45-551fdc43038a", "comment": "Malware payload (njrat)", "value": "37a9de85c77b7c0bcf5e7147ec294a3bb9158aff6a5b2aca6e98b11d33c4ae75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929861, "uuid": "934a7d51-6985-4db3-a4af-f8ea4bedd2f0", "comment": "Malware payload (njrat)", "value": "3dd5b7405fdc95686a8aaf1fbb60b37f9f6482c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929861, "uuid": "f59ca5ee-42ec-4af8-ab51-a8aa78a85211", "comment": "Malware payload (njrat)", "value": "99ad650279727ac1514ba9d174035d51d81b920c44f4426453ea1fd510c65e2c81e73e3ccf65ea95e0b0d14ed71d21d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929861, "uuid": "098615f7-6907-4c60-a918-3e12f4cff91b", "value": "T1BAE207467BE58219C6BC1AF89CB313110772E3478532EB6F5CDC88DA4BA76D00641EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929861, "uuid": "c7665e86-3aad-46dc-b770-419551e96a93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929861, "uuid": "e160d02e-a0de-47ec-a11a-f04572e5289b", "value": "384:f0bUe5XB4e0XfOZeANuiEO0YaBWTatTUFQqzFSObb8:UT9Bu2IguiEYqgb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693929861, "uuid": "fa9d92f7-c3f8-4713-8827-122ffb38d915", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693929861, "uuid": "93d1bad4-864e-4008-b8fa-fbd85508e3ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929861, "uuid": "e3cb5499-f569-496a-a3c7-465944bad9e1", "value": "x5rcnYdSS63I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb2d52e-4bda-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693911063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911063, "uuid": "7c081441-9894-439a-94a1-074d206c597a", "comment": "Malware payload (LummaStealer)", "value": "47d732373d0f515ccb37b09f2f55d178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911063, "uuid": "9eefdc17-d717-4b2b-9232-ef703da70900", "comment": "Malware payload (LummaStealer)", "value": "37bb336d579f839aa98af8218718eae84631c7cdf7ed4586728db333ea724987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911063, "uuid": "76c16990-6196-4ed3-88be-00023d8cf104", "comment": "Malware payload (LummaStealer)", "value": "0365f9d183117fd29ab29574b74b67c570651918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911063, "uuid": "f8649ecb-6a36-428e-ae67-4bfc94975dc1", "comment": "Malware payload (LummaStealer)", "value": "6b20a8277b83901d140de0c6a511cb8b18fb4fbe2d866ae11f01e9ed35ddbab7369ef3d4b2e5bd004475dd4d4822d352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911063, "uuid": "f8c6d6b0-4257-452e-9a22-0cb92df965c0", "value": "T185668D46B3F500E8C4A7E078CA4A5507DBB1BC0553209BEB316CA3951F73AE29E7E794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911063, "uuid": "4304df38-ca28-41fb-8098-32502ef0e223", "value": "d9ade7d6b10847ae0c9bdee57ae6e806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911063, "uuid": "7d902f90-4ac8-4ca6-b55f-bedbd2e49a90", "value": "98304:pTzCSONEpdVjeMOz6R3QoT9M6QmNp8rOARyI6:tzCSOepdVjnOz6R3f9HQxRyI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693911063, "uuid": "9e72f8a5-57af-4a42-b3ef-036fd824ac48", "value": 6599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693911063, "uuid": "1aac2d14-7fa5-447e-98ca-1de4c27a8378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911063, "uuid": "e1c5260c-2b39-4cc2-a184-5b24da1968d5", "value": "37bb336d579f839aa98af8218718eae84631c7cdf7ed4586728db333ea724987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8629da-4b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693877426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877426, "uuid": "50f975f0-3a41-4d0e-b08d-ee0e54b12c72", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "eaf2482f308de7dec8e73a0f92f2e1cf", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877426, "uuid": "9785f12c-35e3-42e8-ad3f-9b3aaf40fd0b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "37f72d7cc30ac6952775a5972e510e0f2e0163b11ac7dea1e4dc0449dd8e633a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877426, "uuid": "c3aa1b1a-1c04-45f9-ba33-6058de8f6c0b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ba5ac15491d919d5b4ecc07b345e45336700bb45", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877426, "uuid": "1c2c1533-f7e2-4d2b-a596-0035bb0a7237", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2beb66f9d783bd5c7440353e05e84838e9910fb58afd68a669988fe3f09ab6bb41d65af082ad03b329d64ab801304f9d", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877426, "uuid": "703826d4-9536-4aa1-81ec-4470a2cbdcdb", "value": "T177452347E686807ED06288745C3B9959943B7B35297CB50D77DC4E8CCF33A60EC0ABA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877426, "uuid": "d2a904e8-3d57-4346-a4cc-eb10a8558146", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877426, "uuid": "e98de411-cc64-4df2-a50d-ae465bd321d3", "value": "24576:yI39d/vc6pS61TRXmTrqUvaXbyTzqSIPz8twDmROEyFV/uN4vxt:y6dMGpTRXKzBzq1L8OmgjuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877426, "uuid": "819907f6-7839-4d5c-975d-93d93aa85d49", "value": 1276180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877426, "uuid": "5f695d14-c521-4fb3-a63b-e3d5362645e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877426, "uuid": "9b0b2879-0ff5-4863-81ad-99285e4184ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec831b52-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693920862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920862, "uuid": "cc5a2db1-dd47-4164-956d-2a5440a1fce2", "comment": "Malware payload (SnakeKeylogger)", "value": "b68776526c1399f7934181af2b4e0031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920862, "uuid": "102945e9-cb8b-4e90-9588-f356a6e4ff82", "comment": "Malware payload (SnakeKeylogger)", "value": "398d98ad4ba8f204fa73ab18cb76586cb3a4ae6f9f2eb038791929f6c1848964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920862, "uuid": "199f14d5-f7a9-45b0-8f57-d6d18e80aeff", "comment": "Malware payload (SnakeKeylogger)", "value": "ab21e72b257e67969ca64cb701c8e4557c4dce42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920862, "uuid": "3a370267-e6a0-4f38-96b6-300d35f2f3ca", "comment": "Malware payload (SnakeKeylogger)", "value": "693a3ec8663ebef1f686148cbe0a47ffc7f2ea7c99143334235eb7d4ec53b04ba9b061c8069c26699429c4f19e8d548f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920862, "uuid": "ec611824-53cf-40b2-bc0c-ebe2745aac6e", "value": "T1CDE4C50192E157D1E0BBEFF0DB604111B7A92919553FFA298DC0ECC91E63BB27A93643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920862, "uuid": "4609488d-f9a3-41ab-b249-8f68b6f12a47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920862, "uuid": "0412719c-a54e-43ca-9c32-69ee794a76ea", "value": "12288:jODphClGCxJEAipzFEf6aVSaZF2ot35dxCy:j9vyQRl5dxCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920862, "uuid": "80324731-51a7-428c-b858-665ad1374734", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920862, "uuid": "bf7f4183-194a-4dbf-87e2-0e0e74a0961b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920862, "uuid": "fa52c237-36d9-4a2c-a48b-f0b0f1d762b3", "value": "TransportLabel_9694124096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe513be-4baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890427, "uuid": "90612117-60b2-4ebd-8252-d1c5e7466f1c", "comment": "Malware payload (AgentTesla)", "value": "c0b71200871d733f7eaaefb8d85f7c17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890427, "uuid": "610ed488-d359-4722-9217-ad2a003eee7c", "comment": "Malware payload (AgentTesla)", "value": "3a099cd463190175916c58f9f590da65059c3207f6e5e8d5ee7e4615fdecd4d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890427, "uuid": "a02ad584-a533-4c48-b575-48d5892d357d", "comment": "Malware payload (AgentTesla)", "value": "b76997250f44fcaa177cabdfe21d0dd963f746df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890427, "uuid": "c174f025-8202-4504-81fc-c18ca42e92e4", "comment": "Malware payload (AgentTesla)", "value": "5ea8370230433233eb2ecedad171aa25d7a18dbe5f6d9fcfb402d1109cf3eb05ccf69ac49382ca48d4e6baf4c35c5236", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890427, "uuid": "d3a11bb7-f025-45d2-9462-f384d579b13c", "value": "T126C4120E0BFFCB1AE920DD75AB70133D65D413235AE79A4EB58019F4CEA7F748106A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890427, "uuid": "bf7c1766-c26c-41c3-80b4-88ceecb901d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890427, "uuid": "1c1202a0-6ca3-48df-8a7f-5aca15a1b40d", "value": "12288:btyoUsBxcNI4J1kPPkYT6T6ebyfT4D8wR8v4Y8/h:z7fcOGkPPkG6TusrrY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890427, "uuid": "6106f916-bef8-4beb-8200-0e85d5360a8c", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890427, "uuid": "d5183ea8-2d96-4fea-af43-21b3d0525d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890427, "uuid": "22232c8d-198d-4d38-9de5-4709bd84df66", "value": "Halkbank_Ekstre_20230904_081018_738837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309fa8d7-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885758, "uuid": "700d10d6-8ab2-49d9-8d4b-8ccd01c6b7fd", "comment": "Malware payload (Mirai)", "value": "305e385d7b16399cae3c4bf1b6dbf63c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885758, "uuid": "f3355874-808e-42c5-935f-e610030fd091", "comment": "Malware payload (Mirai)", "value": "3a0e5e526c61fae848d9b3012f6281489f47d20f74176e1b731b07a608fdc26d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885758, "uuid": "e16c5591-2065-4db6-8db1-1a5abf6c9b5c", "comment": "Malware payload (Mirai)", "value": "e56711a672ee94203fa38b14e0d17614d8ef7381", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885758, "uuid": "881c3c06-6dfe-4cb8-b252-ddefe882b3c8", "comment": "Malware payload (Mirai)", "value": "2b5420cf8c3d8a0c8374aa9b9501436871b0af2fa12036129cab1d10b72549e23a3d946247486b3a4dd9751757409ad9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885758, "uuid": "d68322fe-c6d7-48af-ad3c-96335f9bd270", "value": "T172B2CFE12ADD22F0F2E0AD7BB6F849C9735A5670C09E7364271402FCFF824A194F5099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885758, "uuid": "5de109b6-14d0-4dd4-b2e9-142bca98d884", "value": "768:XwwgSUT279k8X3MvHKMdcWvQTE5LlptUSq3Un:gHOWW3MvH3c4Bptjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885758, "uuid": "c21b3c77-6efe-4d65-b66f-b11a2bb3696c", "value": 24696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885758, "uuid": "6925c303-55b7-4b36-9686-ef0d6af6b32d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885758, "uuid": "75a2b21a-f4e3-4f67-b01c-de9597e42dfa", "value": "305e385d7b16399cae3c4bf1b6dbf63c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388d3c06-4bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693903810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903810, "uuid": "84b0ddc4-27ed-4533-9697-5e557c8a0939", "comment": "Malware payload (Mirai)", "value": "984317f312700ba605d65b99813664cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903810, "uuid": "ce4c4f65-d3e7-4301-bd01-d26d21e23b71", "comment": "Malware payload (Mirai)", "value": "3a22c5730cfc5279e2214d547fc6b56e9f23810631892e7d98189e731af22dc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903810, "uuid": "cf6531ac-bc8c-46a8-93fa-0032f603d554", "comment": "Malware payload (Mirai)", "value": "8a3fc3291aea705d0f30375c4bb86a27a8a9c5e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903810, "uuid": "aee6d2ba-07b7-44a2-ae2e-dd2db0312ebc", "comment": "Malware payload (Mirai)", "value": "e893a7ac8e7d94f055942fd0fee9d9baaa581c85a0d29234e3608659f8c0430af1ce98ccca21fbf882af0adb8b104d37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903810, "uuid": "b6986d78-1a08-4fa5-82f0-0114b1316156", "value": "T197C2D130A6A92CB1C7600576E7B857C6BF530F7DE6FE3880114057BA7882D0669EE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903810, "uuid": "a8a05f85-8265-4cc6-949b-a322a24fd909", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEkEdDhymdGUop5hU:A7soTAZ3alkXLvFh8nNEkODs3Uozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693903810, "uuid": "a9bc3a2b-ba03-4e40-83df-aa166124abfc", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693903810, "uuid": "1b43effd-e5cd-4bbb-9ade-632d85afb71a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903810, "uuid": "b56ad028-71ce-4e13-9ceb-14cea6699a94", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7437393c-4be8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkCloud)", "timestamp": 1693917224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917224, "uuid": "b614afa8-a254-41d0-9479-c387168d240f", "comment": "Malware payload (DarkCloud)", "value": "a7d5b4e902de86c0478ecedd90d14c7f", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917224, "uuid": "4a9c4ba5-568e-4945-91e7-ecf3b4024312", "comment": "Malware payload (DarkCloud)", "value": "3aab0958e9a00bd95bede733c42f2adf2c0e1e9a121e39f52680cb359f5af02b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917224, "uuid": "f05691e5-91e9-4ea9-9efa-b92344693ee6", "comment": "Malware payload (DarkCloud)", "value": "07e749e497a2d37bb3a72da6c243e71e02097612", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917224, "uuid": "8cde1cd8-8307-48d0-904e-5c34966e9bcf", "comment": "Malware payload (DarkCloud)", "value": "de7b00883988c79805c4e7c74e36b8d041e42f93c24efcf9bc55aaaf681800e6b3b6abf00bfdfe5af5496ebf14b92736", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917224, "uuid": "d50921d0-ce73-4cbd-9e4b-238fe9a56df6", "value": "T182A42322967CB8C5C6771E724FFA934E5EABF6263469251B3B0013D8F826991C41F70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917224, "uuid": "ec89e810-30eb-4071-a77d-401d98a9adc9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917224, "uuid": "23a1b42b-7480-4f27-9334-895224f9346e", "value": "12288:pYTWWVuQbOLcZNzhe+CPq5EIllcKW0dwLYGdayOkFQUv:pYKWVucOLuzM/67lqFMwT5OOQUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693917224, "uuid": "74478bf4-9741-4b84-872e-2ea38dec852d", "value": 469807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693917224, "uuid": "29fe9270-742b-4f07-a4b1-527919c23f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917224, "uuid": "ae4c0fd5-db60-43e1-bb77-646147fc7b9e", "value": "3aab0958e9a00bd95bede733c42f2adf2c0e1e9a121e39f52680cb359f5af02b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8860ad-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885753, "uuid": "0b5dda54-ca4c-418c-b1e7-65f39b6a98ba", "comment": "Malware payload (Mirai)", "value": "c2019e750aaa5540a3d61b64c0ccc862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885753, "uuid": "b9f2fab9-9464-477a-a1d9-cfd9f176d4d4", "comment": "Malware payload (Mirai)", "value": "3b05486cbe0d8a1d6b44c7d92321ab1fd3227fdbd637e3ca10784753ff7d3d3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885753, "uuid": "7c1ba3cc-b63c-4281-9675-0ae88361253c", "comment": "Malware payload (Mirai)", "value": "14bb7ae455df5a2423da734f6260135991a49409", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885753, "uuid": "b908ec42-f80d-49f8-a537-09a4e182b4a0", "comment": "Malware payload (Mirai)", "value": "b3d5c542492e8d02d2abe2922c1c469059106fd14975dd5894c99b33cf8d76f6386bfcc14a6441d6f0ec90eb39c4b1e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885753, "uuid": "c3adc942-eaf7-4e13-b210-0bf5a1c5218a", "value": "T17DD308C7F900DAFAF80AE33748630805B130BBA545925E372267357BED3A1D91577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885753, "uuid": "56c268bd-50ca-4998-989b-776b1da4eae4", "value": "3072:iiWnAtB7iqUsfBnQPA/jv3rkVrjbiALeZlSmyNxaA:HWFkByAL3rYLeZ7yN4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885753, "uuid": "67ec0e8f-a82f-4a48-b372-9117e475f4e5", "value": 140448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885753, "uuid": "8da58b88-d8ed-4d8c-9675-9948d1e4d595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885753, "uuid": "9477e06a-b06b-4b65-bbd0-774b329e8591", "value": "c2019e750aaa5540a3d61b64c0ccc862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0152aa4a-4bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693911878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911878, "uuid": "0b04cc6f-8ce0-4322-b8cf-ef203a9dea69", "comment": "Malware payload (LummaStealer)", "value": "a9113967b0fd1ab8469affe5e22e5dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911878, "uuid": "9107b75b-80a7-4157-8135-3d427960ff0b", "comment": "Malware payload (LummaStealer)", "value": "3b5e8e6f6a6b79c7bfe058f6ab152b46cd04f78d13aa914f9ffc5de5f94dcd11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911878, "uuid": "d6470f13-3f8a-47af-a399-4024a00e0e77", "comment": "Malware payload (LummaStealer)", "value": "f3ee9c2fb5ea8967729aab03c301cf57bf11651f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911878, "uuid": "fc81a503-7f84-4b05-b9f8-71ade1c49b6a", "comment": "Malware payload (LummaStealer)", "value": "c82277468fdf020f854896b1b5ad63ef6f4b790f0fc15c107a10d4f689c496bdc64ebc3edb2aaef226c45662b8ee720e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911878, "uuid": "fa94c74e-92ed-4b5a-bb2c-e1220dac460f", "value": "T186559E6132F79704E0BD67345CBE40ED367ABF922721C75EA6452B4F69222C2CE02776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911878, "uuid": "aed4c5aa-e539-4048-aacb-3850b060101c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911878, "uuid": "2c420172-2509-40d6-9942-afbaabe668d6", "value": "24576:w7IN9IEbGc1e40SkNd2GRfcyXUs7nNCkbpk:wkJGc1iSkd+V1ktk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693911878, "uuid": "3beec708-a10f-477a-b2fe-39eb44b93a50", "value": 1334464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693911878, "uuid": "67beabc0-96aa-48bb-b508-87ae8bf5798a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911878, "uuid": "0269af9a-c82c-4b38-ba52-7af32d0734b1", "value": "3b5e8e6f6a6b79c7bfe058f6ab152b46cd04f78d13aa914f9ffc5de5f94dcd11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f241c9b0-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874057, "uuid": "643ea513-3229-4ae8-b8cd-9e1bc018db10", "comment": "Malware payload (Mirai)", "value": "b62ca61790e905e7164b77f696405092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874057, "uuid": "1c34a632-ac83-4ffa-afba-acef39c676cf", "comment": "Malware payload (Mirai)", "value": "3ba7a5edd3377d3172ada7fb39e35f68f1dfca74c799cc05affa8a0c3fd7f95b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874057, "uuid": "f1dc763c-6067-444e-b788-f8db7dfb278f", "comment": "Malware payload (Mirai)", "value": "88fa90b4985a4422a7c00749c954789a98a3a857", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874057, "uuid": "455916df-89e7-408a-910c-b019dcffe886", "comment": "Malware payload (Mirai)", "value": "66948e8e5e17be6fae08591fc9d0914ca0b0e7a1a6436087f67f7303f79aeb9ddcd5f53f4cb49af78ee406d8c4cc86ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874057, "uuid": "adc26ffc-1984-4267-82bc-ecfda688128c", "value": "T17FC2D1E07726FA31C420AC3DE52B4D8A3A51167C91FE353764258C358FC265A66F84FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874057, "uuid": "791be440-1b6c-4303-9a81-a72c052b1619", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwr089q3UELu3:oKy4qfqoeJdXWg0FLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874057, "uuid": "a376a3b2-c987-4e84-88e5-751d7cc5445f", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874057, "uuid": "fbce2929-78b8-4f1a-a757-fb237973a55b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874057, "uuid": "0bddb19d-df62-4e5f-8cf2-09cf32a75d8d", "value": "b62ca61790e905e7164b77f696405092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c626b9-4bf1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921009, "uuid": "4fe5515d-d9bf-43c0-bf2f-4f95aaabfedf", "comment": "Malware payload (AgentTesla)", "value": "9e5d3713fec58824214d8d48d71dbc52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921009, "uuid": "eddde28d-bcb9-4840-bd03-c797c475e1f0", "comment": "Malware payload (AgentTesla)", "value": "3c1672147da5e66e2b567ddc8b8d16a5c934fa45928c8b5d526092033ab16380", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921009, "uuid": "9cb056b2-0c09-4622-8cc5-6a0bfebcba8b", "comment": "Malware payload (AgentTesla)", "value": "23cb445e5b94314a3ef423d357eebfdee7482409", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921009, "uuid": "222064c0-6349-428e-982c-2edc0b1a16e6", "comment": "Malware payload (AgentTesla)", "value": "b3ca6484cbef876299dcb30013f71ef4bea80bc03ed3d7269173ca734541b55c73d47ebf2f979874c3fee78acdb482b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921009, "uuid": "9243b635-9ef5-4470-8334-8f949442a96e", "value": "T19B2551F3FB442FE284C24DACB9E8D273A9D406807550B6BF7F5AA905441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921009, "uuid": "098d93b7-82b0-4029-8f04-93d9efd6b960", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921009, "uuid": "9d5508ae-2659-4c0a-8c4b-4ef1036be4bc", "value": "6144:7fi5R0y7Ga2tQySyWv2tQySyWvdS/OAw6+iMr05F4+RO8jQ8d/rQ22FN33YVLbVe:7i5R0/YSWrr0MsjJ028NMLbVePhtOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921009, "uuid": "f47d8076-9b37-4cdb-8a32-c2588d6379b3", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921009, "uuid": "1876e6e1-0941-4b9f-88a9-83891f76d537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921009, "uuid": "707098f2-9562-418a-862f-6927d22757bc", "value": "Pending Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcdd9ec-4bf1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921240, "uuid": "3f55ca66-c7c1-4079-b5d5-9974cd73c515", "comment": "Malware payload (AgentTesla)", "value": "5473830ed0f8cd9b497d47db2dec8b79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921240, "uuid": "853927fb-e55c-4c46-903d-9d3e3b79e3b6", "comment": "Malware payload (AgentTesla)", "value": "3c6cae144e0de4491019269112804d69822eee0f2e7b6e027612c540876f4677", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921240, "uuid": "342e03f8-2fe5-430a-9f59-dafa692c5bfc", "comment": "Malware payload (AgentTesla)", "value": "58c5259e3abeb9826ef7d7f5f865a1fa66269b0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921240, "uuid": "501513c0-d680-449b-8d80-c82fbecfc6cb", "comment": "Malware payload (AgentTesla)", "value": "7841cae9ce45627c99a1f561a5a5cf83e09acc49b1c6ea74aa05b6af264e5097c980b21336c43ed5058e0975b7e6f11e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921240, "uuid": "e74d69e3-2e10-449e-ba0e-c833b117b5ad", "value": "T1BF153E24D070B3F6FB4217AC7567F75002444BFCB99C20B86EA7AD09A0D33966ABD5D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921240, "uuid": "4646f53b-968e-45b5-ab5b-764b3e9fe4f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921240, "uuid": "67ce237c-c709-40f8-9cea-8ac9a3f12b07", "value": "24576:QcD/CmIkfrIkfz9Tdy/2QA1wyHIOGsTYE:7bRdw2xR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921240, "uuid": "2886d52c-98a2-4287-88ae-4a68eab16bd8", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921240, "uuid": "834d5440-3015-407a-8478-1ebf58122dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921240, "uuid": "2c15bb0d-e81e-4b9a-b55c-454caebc2263", "value": "9leH4i7DtlnYKeE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3592b87d-4bb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693896503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896503, "uuid": "505a0d2c-2bee-4465-b85a-40fe26170259", "comment": "Malware payload (AgentTesla)", "value": "782bf801f3d7bf7d3b9fab0337b8023c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896503, "uuid": "84fe2eba-c6a6-4266-91b8-a3b8bd35c2f8", "comment": "Malware payload (AgentTesla)", "value": "3df4a60f664b3a105d0562b885a6ec1a63956917b7c2325357e09e81e6d50899", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896503, "uuid": "2c3b7fbc-0cdd-4217-9cae-f7d78703aafc", "comment": "Malware payload (AgentTesla)", "value": "745da4da0e07a320c35802f44bff4aa3c7b3a78a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896503, "uuid": "a728519c-fa24-4544-a589-55aee87faedd", "comment": "Malware payload (AgentTesla)", "value": "c8a8c4431ee6706a5c17aff69445e2f7ed1bb00d9c1a63a91a5550a510eee8676e3b1732b0d5c1541fc038bfe98c1991", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896503, "uuid": "14b18fa5-40fa-4e3a-8a6a-af6875431ca9", "value": "T1B1E40280F2BC9F53EEBAA7F65828215407B65D9B6431E7480ED6F4D71AD0BA00581F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896503, "uuid": "1889aa57-5d0b-4bed-ad70-2c2c3e9b600b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896503, "uuid": "7e000214-c371-43c9-9552-6e4186a272d2", "value": "12288:0ot830ODHrP6/CVBPvNCcE7Rj8atRUx8TFHYgYRsI/z4Vvz9klpjkDwMD8H:0oE36iBPe3tixQIP4VvZwpjkDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693896503, "uuid": "cbad6ea9-f6ff-4dd8-9745-5e9cd794d958", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693896503, "uuid": "132f509d-ef11-4e2f-b3eb-c25b7316e2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896503, "uuid": "6aa33c0f-03d6-49c4-8891-906a3fa1646b", "value": "PO Request _ WELLTEC DIESEL Co., LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf914a7-4bf4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693922475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922475, "uuid": "1487bc82-aef0-468c-9638-8fd532b183b2", "comment": "Malware payload (AgentTesla)", "value": "4521728a41125b07dec327538dc9c810", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922475, "uuid": "4ede3caf-da80-425c-be5a-47aa6c547645", "comment": "Malware payload (AgentTesla)", "value": "402fbecbd491aca725151d4bfe04e48f40bee088a5f492f2ad47751c72b199ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922475, "uuid": "778e8b1b-48ba-4374-95cc-f85676d695f9", "comment": "Malware payload (AgentTesla)", "value": "bebaa12985661cd7fae0896ec9bbe2de937d4cc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922475, "uuid": "3d94abdc-4d78-4f1d-8909-53e00a905ce2", "comment": "Malware payload (AgentTesla)", "value": "97b6762b7d60cfdcb8727e9488534a67aac7a1854c97d0f67c2995781c720d400bbd427f05804c56d8636f7b05fab466", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922475, "uuid": "617efca6-9c98-4723-a4ca-da6fbfca9a8b", "value": "T114F40280B3986F27C47E17F55A20948007725D1E6962FB440EDA70DB2773BA26642F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922475, "uuid": "08edb054-d9a5-47df-93c1-350166e4b866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922475, "uuid": "a6c7c194-da38-4342-a427-a6d49811e437", "value": "12288:EHmikDwMD842BkcKmbFYOpOLqKvwIQIQT7zQlEqsqHv8wTjIH4Ddekq3nFJ:skDV8ycKoXOOKvJQIkPzZqH0sdg3nFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693922475, "uuid": "1226e186-e439-420a-a797-951a397bc52a", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693922475, "uuid": "b91903bd-9336-47a8-93ed-b07a8e98e315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922475, "uuid": "0970a5c1-8d41-404b-b7c4-700db7b79325", "value": "4521728a41125b07dec327538dc9c810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe814bf-4bf1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693921163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921163, "uuid": "0e135890-7459-42b4-aee9-3e50a1615525", "comment": "Malware payload (Formbook)", "value": "a722ad66813b5fdba6a859a6b51f3465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921163, "uuid": "25479294-b1b3-470c-9e48-f80087bbaa67", "comment": "Malware payload (Formbook)", "value": "40a16f7a51986b7901bb9680f95dcbe6176831b15ef89d64a0f89cb160e27ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921163, "uuid": "ded0877b-7144-4880-a1e2-ced90654fa99", "comment": "Malware payload (Formbook)", "value": "02214737422d0ec7c3dd7ff8b44dcf7ee8ee5f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921163, "uuid": "7e755a32-aaea-4565-9550-9232e0567715", "comment": "Malware payload (Formbook)", "value": "d3c885f16c0dfa21474bc6041aa71fd4a3023fc34a5c49c6c2a07947aac9af899ebfc388bd1d8a51ca42bf823c409be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921163, "uuid": "be6c6051-2572-41e8-a58c-d2981f14443e", "value": "T11A15232DEF5CAA23D72AADBD8573114953F0C1FBBE05D50A8E80319D5933BC68902B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921163, "uuid": "6daca450-2cb9-429e-9ff4-acf317a9a83d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921163, "uuid": "068e7f60-47a1-4dcc-b7be-98f0e953d2db", "value": "12288:6K2whrFlde65nRyKLYK6+hqCyyBuTZxvhG899qYHEiy2zwvB81352SXR0Qtl:FzrD69EuTfvh9QYPzwvBm2SXRDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921163, "uuid": "2b519a4b-0824-4f73-8930-72eb6e0c3872", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921163, "uuid": "44c966fb-56ad-43b1-a303-715024c7615a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921163, "uuid": "c58503cf-50d1-49a3-950f-d67997f88851", "value": "40a16f7a51986b7901bb9680f95dcbe6176831b15ef89d64a0f89cb160e27ee8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4398f4a9-4c0c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693932605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932605, "uuid": "11f1dd3a-ed48-429a-80cb-b614a86ec98a", "comment": "Malware payload (Mirai)", "value": "60bbe1db8d29bbd55d874f9e57f1cdf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932605, "uuid": "db8c8ca1-fc8a-4810-91a9-e9b4e5cbdb6b", "comment": "Malware payload (Mirai)", "value": "4157ddcf4e1cf47ac40a67c64e99d5b0ba36de46f5faa5977aba0f07b5a13e17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932605, "uuid": "7d13efd3-0280-48a5-a1a5-41c8d9faafd7", "comment": "Malware payload (Mirai)", "value": "582de5c795da0b33603a8cbffad36f19ff51cece", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932605, "uuid": "13edae50-d213-42aa-935f-27daf7695e57", "comment": "Malware payload (Mirai)", "value": "82d32a98aa291b98f79ab80d9246c43b11b72ba02c6d31b50e2dd0edcf7b5e136041a4ecf4c067270222a009edef51c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932605, "uuid": "32103af9-b449-4d10-828d-996c9e39a756", "value": "T1AEE32B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932605, "uuid": "c5449e75-493e-49cc-b8bb-c80724e0e52e", "value": "3072:CJLce3pC5rR7/abHbz4NpaIJ8VIJ1F+kXkkTM/9cHMY:CJLcDV/abHbz4NUIJxH+kXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693932605, "uuid": "48cd9f69-c6a5-4668-9fa4-003ec9d64570", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693932605, "uuid": "5044b42d-1238-4a7f-abcb-4542142d9c72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932605, "uuid": "ddbcd986-c664-454e-996c-47a0f7d1260d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99bb2e2-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693922146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922146, "uuid": "e0eaaeb6-e419-4f56-9bf1-c084345ce726", "comment": "Malware payload (AgentTesla)", "value": "ba09185a1a091f39e59a76eb205fafb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922146, "uuid": "d6866027-3731-4e74-ab90-82b4a89066a6", "comment": "Malware payload (AgentTesla)", "value": "415e91974a5d1edca6d45dcfe38c6aa477df9f22ecbd2211e00bca1a381ce2b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922146, "uuid": "78c259c6-5d5d-4aa4-ab4c-f01a6738d2da", "comment": "Malware payload (AgentTesla)", "value": "b4e105b7fb0e91ffcfea5ae3d44cec5c3d5e1036", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922146, "uuid": "0997e8c6-5120-40c0-a580-09b0e8befb95", "comment": "Malware payload (AgentTesla)", "value": "48f98e542294319368489bebe115c28074d703f02d4c4ab10edceeea695b9f87eb8e855fe91884a668a0dcdc3b994cb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922146, "uuid": "2743bc30-e175-496d-bb98-cbdf8c3847f3", "value": "T169A35B3C3A8C4616C3B853BDE18F8114C37692B75312FB49388D46E42F53BD1A916AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922146, "uuid": "8d2a0b76-5664-44d5-b847-eae733419670", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922146, "uuid": "499667ed-2257-4bfb-ab38-42b5b7657f92", "value": "3072:mXIuLRHMIOBEBMokYS5EzpTZefZQW/y/Gh3W61EC2ViNOscEsfJv6/:uIuLRHMIOKBMo3S5EzpTZefZQW/y/Ghe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693922146, "uuid": "c02b5184-83f9-449c-83b5-7efded065a1b", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693922146, "uuid": "25b3aba6-25f5-4d98-b0eb-e54c117026bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922146, "uuid": "42eecc34-4de8-47cb-b4c2-ad28ea2e70ad", "value": "415e91974a5d1edca6d45dcfe38c6aa477df9f22ecbd2211e00bca1a381ce2b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ee40f4-4b8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693877712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877712, "uuid": "4ea4514c-eaa5-4918-88bc-e5afbf570d21", "comment": "Malware payload (RedLineStealer)", "value": "245ad8c888fd3f72727711eba0324463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877712, "uuid": "f43d3a8f-6b50-4a88-866b-a9d97a817a05", "comment": "Malware payload (RedLineStealer)", "value": "41ca3a6295cea2d900dedd6c802b5a246079868e664a6750f59e6a5d7a841928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877712, "uuid": "bd2495ab-63f0-4a66-9765-3bfa27d80db4", "comment": "Malware payload (RedLineStealer)", "value": "06a469189e7f6c7b7fbaf1dc384a3a2129fd3967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877712, "uuid": "69a45bf0-ac35-4bbf-8e8e-2f84d4a3f35b", "comment": "Malware payload (RedLineStealer)", "value": "0a8d9d0f2c2f45077c99d1ced7d53f58e72b97cd14ef57446a474423e906d18fc2c46d5a8bdb2b2fa5a425c490f607a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877712, "uuid": "6b62cb35-46ac-4863-b7bf-db0078964e0e", "value": "T1C7840222B3E1D033E86749716560C6F01B7BBD7126F581AF23542B3F1EB05F01AA97A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877712, "uuid": "6f3b22e1-bb1f-4d0b-ad86-35af7d4cb702", "value": "4d3edea12b0f02b502231d48e469cf3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877712, "uuid": "5df05080-a8de-4fba-bf01-7d4a49a30438", "value": "3072:R3U0uEGnNmWPoEzmemBbdVJq99p5yVsDRzpNMYbG9wKF9hZOlwXBZKvjQeIl0IqM:t0Nm2oEzme6JYpkeNQYC0kYby3rUr6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877712, "uuid": "0ceaa28d-b4a8-48ba-ad8a-8af211bfadea", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877712, "uuid": "c61bf9ee-29b0-46f8-a5d7-306f342831d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877712, "uuid": "96053a1a-e643-4672-90b2-1e389df5643b", "value": "245ad8c888fd3f72727711eba0324463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bcc304-4bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693919368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919368, "uuid": "e23f79c8-b96c-4cf1-ba46-104333b31ee4", "comment": "Malware payload (AgentTesla)", "value": "c2f81ee96b777bf448ea5c75f8551d33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919368, "uuid": "060f2d6c-56e5-4430-ac41-66da00a69703", "comment": "Malware payload (AgentTesla)", "value": "41ece53ba5688f97959fa0ebdbfb979c0b60ee534e05b094bae8cef005875876", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919368, "uuid": "3d9dac1f-7e55-49a6-a160-35e1ded54aba", "comment": "Malware payload (AgentTesla)", "value": "f92fbe821837c527e1bc5499622d62dfabe11e39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919368, "uuid": "4c72f0b1-503b-42b3-90d7-b7154344e742", "comment": "Malware payload (AgentTesla)", "value": "88dde849c99d645a13579d1195eddcd2bde88aaf87c07f5fb750a2ff73d14d452ad765f7a4f595dceaf03bbb6ee724b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919368, "uuid": "9e933d71-cfb9-4885-a0ec-212c4edf77ea", "value": "T1DF7423641101D0EBC55306B22DBF0B79EEBA71342598DB0F1BD892963E32242D95FB77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919368, "uuid": "f4264ecb-a2fc-4f12-881c-288929e6970d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919368, "uuid": "48c921eb-150f-45b8-8769-9545d77d2f3a", "value": "6144:ZYa6sXpO2cIlFMbRV0lqsaG6M4QtiUcfvPWSDUTT/WpaQVtOBJ1/KYj:ZY+pO2cbRV0lEXnQ0fvPUhUtO/1/Pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919368, "uuid": "daa12594-065d-4229-8bc0-e8fadd0fefd5", "value": 355557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919368, "uuid": "d133f72b-81c2-4875-a210-bd073079d1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919368, "uuid": "377f3a78-3793-4704-9eb5-42cef980794a", "value": "41ece53ba5688f97959fa0ebdbfb979c0b60ee534e05b094bae8cef005875876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf962ff-4c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693928564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928564, "uuid": "161db609-3efa-4147-abac-9692be72e84b", "comment": "Malware payload", "value": "ea0d09416d7b9ee39557fb5b49c88bf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928564, "uuid": "791282c2-d656-4744-998d-4b8b281a3d68", "comment": "Malware payload", "value": "433d25d45026e1eb7cc3495279f7fb0c73981bfc92481bdb12f19625481507f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928564, "uuid": "55b7e326-4c06-4fa3-bed2-87ee67fcc801", "comment": "Malware payload", "value": "5bb8a5e2b9e0b181964c22f19d9742edca6af61c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928564, "uuid": "fb9b4114-7eaa-49a5-b852-995e86aed549", "comment": "Malware payload", "value": "9484534b67d4affae9ba36c2e9e6bd2366755b889922b112b1f12ef1efd6abb0f20582476ae75793502070ac908946d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928564, "uuid": "e84e0a09-55dc-4110-9dfd-e9ea0cb2a0f4", "value": "T15CA312D53ED7060AF40D09F08449BCE1829AAAC632BCE6D5C22D0BA336524EC6C74D8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928564, "uuid": "8898752d-74d1-44b0-af34-98126ec57739", "value": "1536:Kn8UP7xuTdcx0e1P8+dd/XFIIlqX9FoBNxgkO7w2NVd7jiML/aXj:oX0xEX3lqqXSnE+/az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928564, "uuid": "37e1fa2c-7a5b-40f6-9ca7-5b6530d5162c", "value": 99120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928564, "uuid": "70676eb9-c21b-44f1-8efa-ccc55db7fb75", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928564, "uuid": "eb96646a-fb43-4f2b-9c10-9f805aafbb5b", "value": "433d25d45026e1eb7cc3495279f7fb0c73981bfc92481bdb12f19625481507f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b3af25-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884243, "uuid": "cb8c1c1b-612d-4e24-96d2-2d6682b1a558", "comment": "Malware payload (Mirai)", "value": "7c110348d8304c2066b9ef0d5ab77c6a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884243, "uuid": "1a104c5f-9e1d-44b7-8473-8944ccec9916", "comment": "Malware payload (Mirai)", "value": "4403a06d2113122da3e66c6e8550792c981b248a93e1213fc3fddf5d19bd1129", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884243, "uuid": "739867c1-8e0c-4656-bc47-b5834285a2bf", "comment": "Malware payload (Mirai)", "value": "8f8561cce1f78bf9e342b070703ea7c9ca6bbe45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884243, "uuid": "7e2811b3-3adb-4fe2-8591-c66a5f91db68", "comment": "Malware payload (Mirai)", "value": "91820f12ff7cb673facf0515fb5454c732835bb87e7a7e81fd0df08b434feb8aa2467c2e7b1a1349ec029a30f39a9a0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884243, "uuid": "09bbce6b-e395-4602-bcad-08ae7f7563e5", "value": "T18A735BC9BA83D4F5EC6309B25137A7728773E12A146AEE42C72DAD35CC92910E72735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884243, "uuid": "7b48c1ff-5a04-4297-a0f7-d0d58e9c4551", "value": "1536:ui0zOTnGDoKB5KA1F4oVlpdtqNEloSjot0rOCeya:f0zunMoKHfqoTLt6k1jW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884243, "uuid": "7009c9fa-c577-4233-b9ff-650e6b720091", "value": 80232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884243, "uuid": "e3269ce8-5c29-49dc-819f-af87c80ef46b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884243, "uuid": "c3726fda-f265-4ff9-95ff-849c7aea79b0", "value": "cundi.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f98cfe-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693921761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921761, "uuid": "fda32b13-1365-4041-aca1-7e5bbd60e8b1", "comment": "Malware payload", "value": "1ebaa845d210302fd9123a2f6250d0e8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921761, "uuid": "50e98aee-ad02-4acd-a492-9b0686b5d50f", "comment": "Malware payload", "value": "4413f84b350f7223310ab3c4c6e7ba414584c957393e270587281e2cda26eb0c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921761, "uuid": "e9423db9-19f9-48a2-98ca-990787ea7d9e", "comment": "Malware payload", "value": "f0f63cc176fbe6e64e54c7f192dd5c16c111beb2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921761, "uuid": "70b6fa1b-7e84-4acf-afd2-8be8e66baa96", "comment": "Malware payload", "value": "b2844d14d6f0c8e50dd0ab55f80b3df7690db5a843408f48f96cd9ef4880bcbabdb5a30bd3b95c2c0dde0b9d6201de46", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921761, "uuid": "5f61e575-dfe4-4bb1-be53-ba55fe333c85", "value": "T11E34A82164DF688D71737F431BDD6CE98F8FB2E1562A64AE7040034BCB52E94CE9A631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921761, "uuid": "d5512167-fdb0-4292-ab18-1999dd7f107c", "value": "6144:yjKDwzqtfDH7wwZwwY22MhSfYkcwQEQ/UQwQGO8QfQbEL6hbbgLnokPu/GRAr767:yjKDwzqtfDH7wwZwwY22MhSfYkcwQEQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921761, "uuid": "ece2e8df-e8af-4a9f-95b6-53e2a8947dce", "value": 246494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921761, "uuid": "e52c8af5-9ea7-438d-89d4-7858fef9c292", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921761, "uuid": "6bcd6da0-6ff7-4b1b-8f24-40177905b39c", "value": "LHS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7182fe90-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891450, "uuid": "fd94cb69-a00f-4c50-a53b-695cedb7f887", "comment": "Malware payload", "value": "d9490ede26f9ce201319a6d5a084b47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891450, "uuid": "428d4be1-ec12-47f8-891a-8eccfd6d3e58", "comment": "Malware payload", "value": "44f76e0e8cc99d0387e0df11533ae8472ebecfb21142bc286e95b8fd99c45751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891450, "uuid": "315ad23c-c701-4c6c-91f6-b91471122060", "comment": "Malware payload", "value": "cdfba768a629b574a5534f8bb09a580ac94de0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891450, "uuid": "325aa6dc-d964-4385-a080-844753d78bf2", "comment": "Malware payload", "value": "4c14a9ed938c82f972a93c30393dd9407286a618bdb839af13c6af829cc921bbb14c10f6b260f8f2f55714387e7d744d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891450, "uuid": "248cdd76-747b-4f28-a360-aa966db73fb4", "value": "T185465A31A415263DF2481AF03A50865BF06C60CB4F39E5F70D8A15E7A3ECAE663BD971", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891450, "uuid": "6e3485fd-321b-4c24-a4b5-bc81ae1fa461", "value": "48246eb64cb05f56f073f843df37a04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891450, "uuid": "a424523d-aca0-43a0-9781-95cbeb02f535", "value": "98304:Sf4iKuJYX85nH5oAmr6Uvsg3bSftdjaOKocSTsFwt8:SAiKPXK6Eg3b1XocVat8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891450, "uuid": "eb7a9d2a-4c2d-4d84-89c1-1bbbc82b5c99", "value": 5638128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891450, "uuid": "f7ca7072-3bed-452d-b621-cee96bf90569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891450, "uuid": "339a64e8-cee6-4f9a-955d-6ea27b15cadc", "value": "d9490ede26f9ce201319a6d5a084b47b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55dd39-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tsunami)", "timestamp": 1693927014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927014, "uuid": "42e38d41-1a22-4612-85f0-0d7109ced0c4", "comment": "Malware payload (Tsunami)", "value": "d490548e9f4a8d8b89fdb027d397d355", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927014, "uuid": "8cf7319e-1c4e-4cda-8bc7-3f737ca895bf", "comment": "Malware payload (Tsunami)", "value": "450a7e35f13b57e15c8f4ce1fa23025a7c313931a394c40bd9f3325b981eb8a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927014, "uuid": "33005f8e-aced-4454-a66d-91e77c10bce4", "comment": "Malware payload (Tsunami)", "value": "a868180bab57db3b659bed2a2cb04e9d9e9084f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927014, "uuid": "10c9ae85-4288-4169-bce2-4c51e5582f7b", "comment": "Malware payload (Tsunami)", "value": "2a927edaf16dd4a1d0a81f36d1eb8c79264c334ea09e9057020d55d8d0ceaffcc8e7390f694e3692437defccb5ce4cfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927014, "uuid": "6ce143e4-256d-4fca-9a3d-d8e40650bf50", "value": "T178465A07F99204E7D7FEF1318AA66321BBB2B065537173D3AF4087691916BE89D2E700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927014, "uuid": "ef58c45d-8ae4-4591-861a-240bdb5d12f5", "value": "49152:D05bz5hIsSZqTD42uRT6lDGVs6MDmPnKQDMmrJdAS9xbjbE8c:D8N0qTqNWGnrPKWPdBjnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927014, "uuid": "951e953c-d239-4c22-8a1c-d65ab3b37c89", "value": 5650615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927014, "uuid": "9c6c4c20-a19f-4827-8852-b774e4b57fee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927014, "uuid": "2d04239b-9335-4c04-a42c-0ce9aa09b070", "value": "450a7e35f13b57e15c8f4ce1fa23025a7c313931a394c40bd9f3325b981eb8a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441eaabf-4c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693928311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928311, "uuid": "330c19bc-1b74-4d4a-a9a4-fe1768fdd02b", "comment": "Malware payload (RedLineStealer)", "value": "4175074d73bff5aab3cb25d29f9f7ffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928311, "uuid": "7ea9b691-3a29-4de2-b1c9-e6fb9eb03500", "comment": "Malware payload (RedLineStealer)", "value": "465d976ab0b979a9dc45f87e2658546fccbb2e6e4b1f2fa426dc884d6d038e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928311, "uuid": "d74fd588-eb9d-471f-8ec0-1843bd2e9a7a", "comment": "Malware payload (RedLineStealer)", "value": "90447a57e6aad5db12c17faf95c0610a54980027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928311, "uuid": "5801257f-eba2-4a0a-a408-f148cb60993c", "comment": "Malware payload (RedLineStealer)", "value": "0aa373640ff9aa0809a175d477daf39dc9315143e6a7a02533896f5b90e1b06b4af90d4d20da2a7a52f9c076326940fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928311, "uuid": "46d3cef4-deea-4eaa-ada7-7aac27f28200", "value": "T1A2052252AADE54B3E8F01B7058FB13C30B35BC7649B8CA2A7751A82A0D736847975337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928311, "uuid": "37cb6a05-cba5-43b0-8ed5-10664a1a67ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928311, "uuid": "885ce2a8-8190-4281-9a1c-fbdeffc0c0e5", "value": "24576:fyIxqD1VK5QEIjAM7RtKil/WkI33fr3s:qxW5lGAMdtKil/O33T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928311, "uuid": "442bb162-c19f-4801-b8a0-a6ce1d61f875", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928311, "uuid": "a09c586f-7768-437d-b77e-c23ff0bdf81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928311, "uuid": "bc60a224-48f5-4300-8b0a-91067e2423d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af313540-4bdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913458, "uuid": "3ab252a4-c3d3-49d2-a4f5-10e188e4ce68", "comment": "Malware payload (AgentTesla)", "value": "3c829ae5984747635a996b6ddc66446b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913458, "uuid": "96d21e83-324b-41ce-968b-4bdfc909c09d", "comment": "Malware payload (AgentTesla)", "value": "466e9cff3817e503364feb17b63dede82666d976d13f91d1a1bc8bfb97d1357d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913458, "uuid": "8edd0c16-73b7-43c4-a1b9-fef83676e7a0", "comment": "Malware payload (AgentTesla)", "value": "b46576ad4b73ef39c663401fd832e53d7b33ed4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913458, "uuid": "dd8e471b-9cd4-47c9-865c-d0ad460e8e87", "comment": "Malware payload (AgentTesla)", "value": "5e8198d7ede3502fdcf082af7ff489227a287921ae587063fc436f39a9d60d09fb0b804d40100adc98b619608bbdb599", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913458, "uuid": "8dc50a9f-6d7f-4824-ac81-1d9848fe5ecd", "value": "T1B394233827E5C2B3CC5667F15DBEC75B97B9EA30DD74850B63980A0E3A362006CC9796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913458, "uuid": "fbe03951-cc24-4370-8842-e3304971bdd5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913458, "uuid": "8202092e-ad9a-4d35-93dc-826654546656", "value": "12288:/YIDgv2hE7h1CYvYICN4WhS51OgdTvcc7:/YID67hM+InhSrOgdTvcc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913458, "uuid": "0707ffb9-f374-4595-954f-1333bc1a31e5", "value": 415704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913458, "uuid": "eb6690f7-4b7e-4d88-b51a-6bc029b068ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913458, "uuid": "894a6e9d-9a39-4f20-9911-327e20194763", "value": "SOA 023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c745a7-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693920858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920858, "uuid": "9f61a74f-c922-4945-818a-d6de827bf0d7", "comment": "Malware payload (SnakeKeylogger)", "value": "9b20476cc3357144383d2d396a4cc536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920858, "uuid": "3c26ed53-333a-43fe-ac76-e3de1e55408a", "comment": "Malware payload (SnakeKeylogger)", "value": "4707406289ad536e4093ed4dbe358209a9b0ce37d32e91e36b1d25f874f23d94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920858, "uuid": "cb1cf31d-cf79-4ffb-b02f-0ae14e99a540", "comment": "Malware payload (SnakeKeylogger)", "value": "74ba96d3622408985e6a8ae38519c6d1cd467a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920858, "uuid": "3164bad5-d76a-4ab1-aa25-cb615eb04147", "comment": "Malware payload (SnakeKeylogger)", "value": "bf6c71545acec1b213adbc20bf4b476e941ef8d187a58efcbea49fbfde88e5eee5a3e46af4a9d9798f23e82bac0f79f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920858, "uuid": "6444fdc5-be38-419f-9d9b-2b3e8a936515", "value": "T187D45B0123F59B10E57EABF5DA70812287B93956656EF31D9CC068CA1EA1B139FC3B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920858, "uuid": "9a1841ff-2355-4dbf-8b9d-da30c06def06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920858, "uuid": "c132adbb-8c31-417d-adba-e7c9277608d6", "value": "12288:bODphClGCxjxAipzahU72wHm49+C3L7IZa19gW6t35dxCa:bnHKeBsl5dxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920858, "uuid": "31483d62-4464-41f6-89e9-0ed690f6d67c", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920858, "uuid": "f2fb7353-073e-4a7a-8b34-10cbc45961c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920858, "uuid": "3aebdf6d-d6db-4d52-be16-8916b94bfc2c", "value": "SGH09865456789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63276baa-4b9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884554, "uuid": "49bd9aac-56d9-4b5d-a789-e6e489fe63d1", "comment": "Malware payload (Mirai)", "value": "ea945f0deb54350a1a3f2cc7d8ea73b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884554, "uuid": "c32176b4-13b2-4646-999a-21e2373bf8a8", "comment": "Malware payload (Mirai)", "value": "475c01e88575bfcb31e9ed894cca4183f929cf565660e8222c01764d829c74c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884554, "uuid": "462e4ca7-4901-4101-b802-43aff696e85e", "comment": "Malware payload (Mirai)", "value": "7fe66fd0216ef6d15215ce7e4a3794b039ebab91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884554, "uuid": "22c0ec3d-edc0-4004-94e7-6e351a5cf884", "comment": "Malware payload (Mirai)", "value": "9534352adbfe8504285a12d4cc800b35a656372a4626680ec8e790831ee507370eff1de80aa3cf868d2a87275c621b35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884554, "uuid": "820b76a9-8587-4675-a352-6d2cd8a92c16", "value": "T19ED2F1E09B911920E9F164F8E6F88929A323E070F0F57ABBF0D831E8D48654A15FCD57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884554, "uuid": "86841684-9141-47e8-a675-8d1f706d356c", "value": "768:6tzYP+2463tlspOBz/jMMMR5Qr3pyS5tX+bs3UozLGf:6tz44Utq0B/ItR5Qr3pZrzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884554, "uuid": "36654d93-24ad-4d97-93c8-46da3860fade", "value": 30724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884554, "uuid": "a8f81a04-e59d-4364-ae94-21a618633558", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884554, "uuid": "8b03f1e0-8793-422c-ab70-ba677284abea", "value": "SecuriteInfo.com.Linux.Siggen.9999.25031.24493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cb60e7-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693920878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920878, "uuid": "f4a89b28-824f-4ca1-b4e7-8bd81e37efe7", "comment": "Malware payload", "value": "216567d51c502090d1e03aa865bcfde5", "object_relation": "md5", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920878, "uuid": "52daebb9-7f60-4e89-b2cf-c6575cec2b00", "comment": "Malware payload", "value": "480e35952d335b34d99bd1116ed5ea7938a7e0ef09face5ef0a9e8164182777d", "object_relation": "sha256", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920878, "uuid": "d42a40da-fdb6-4b44-a1d0-ced7ca398d27", "comment": "Malware payload", "value": "c5afbcfeb758aa0349864d422db276833955c89b", "object_relation": "sha1", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920878, "uuid": "f79075fc-bb2b-4d08-b181-0ffbbcaab6c4", "comment": "Malware payload", "value": "0a65cc3efd2d6369a39827fd5609d5c0c1ee61720faab6c8f8eb9514b561ffd44baa7a04f3751ad69c81d1944e86616e", "object_relation": "sha3-384", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920878, "uuid": "71747ea2-aecf-4aa3-ac76-3b4446a7a065", "value": "T128F059383184BD2B2A735E22C2128640FE711B934129605874FD62378F715DB07B31D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920878, "uuid": "a3760d35-f34c-412b-b46b-bcd13b4da3d4", "value": "12:TMHdGGqq9yos26K9YG6DLI4MWiNuGEoORnYPENObQVv/vXbo3xT:2dL9iK6E4lYPZQV3vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920878, "uuid": "3bfee4a4-a05c-4221-9147-69d295ad3df8", "value": 546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920878, "uuid": "f53be718-4747-40c4-bc4d-b5b980c7d993", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920878, "uuid": "658578fe-97b2-48b4-bcca-c03c6b49c675", "value": "user.config", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09fe8596-4c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693927784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927784, "uuid": "9351dc06-741a-460a-82a2-71242da5fc04", "comment": "Malware payload", "value": "19b88bfb8ca6bdb7e1ffeea399e93b89", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927784, "uuid": "743ab27c-de3a-4207-813a-78044aa42f82", "comment": "Malware payload", "value": "483caa78de5286c7195a3539a6acdaa9189bec108deac1b041485b6401d1cb33", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927784, "uuid": "cab5cfa8-5359-4a34-abb1-9a2b35d7f19d", "comment": "Malware payload", "value": "c8d7a8d536158742624bf149394494980e0a7c77", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927784, "uuid": "977fbc17-3252-4ebf-8fe8-9c799d89c85d", "comment": "Malware payload", "value": "71074a1050383852ea6ebef30c5153936f9a0cd8df8967ca6a76cfcc2200c699a08d653f0b2b397c06ee6022d96f3cff", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927784, "uuid": "bb5c344b-7e7e-49a8-b706-2e98227c09f5", "value": "T1F7D533A7C5D92D634B5B7B877A4C350918E1FB134D6D4DE7BBC2E1C08080E06AB92F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927784, "uuid": "0a75e389-44e5-4f28-8b94-1b54e0cf9c64", "value": "49152:GhCwNl/aWSwtqNu5rPqPVHjeEVQyEgMQgUrPTBsyNCKpP1odtgeI5eaIHrO4:GjNFaWSwFrPqPxlVQyEgMuzTBf7P1odJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927784, "uuid": "07f6f7a4-7370-4e68-990f-b4311e0b9439", "value": 2917976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927784, "uuid": "8670fe63-7ac6-4b2c-baf6-f02f27026874", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927784, "uuid": "fcee2d91-2a53-4102-aba8-35da6370f082", "value": "FRPSAMSUNGisinduser.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15395661-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693890007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890007, "uuid": "e2b5ac01-3679-4c0e-be88-da6f34c80b1f", "comment": "Malware payload (SnakeKeylogger)", "value": "f67550c4f4d35e54d29e41cbc64d5bb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890007, "uuid": "38f8279e-b6b3-4377-aa86-cd722168a4ae", "comment": "Malware payload (SnakeKeylogger)", "value": "4853da12f682cf7232c3a41b5de1c28e838cf72c8c118fec7f66dabd451598b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890007, "uuid": "ef984961-f44a-4c18-8844-b2782572719b", "comment": "Malware payload (SnakeKeylogger)", "value": "e177424341b024398724d7ebb23bfb02bbc9dcba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890007, "uuid": "cdcf8333-7dfa-4f5e-aef1-fc70b9afb283", "comment": "Malware payload (SnakeKeylogger)", "value": "0adca30992a76ebd962a03ad19d95db3f932802f3a59d7685d7dade63399929f94dd9ae5d25a5e86f6b044a93d646b05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890007, "uuid": "43f98861-10c3-4f2e-bde3-6d7a822b4faa", "value": "T17DC4F1A9B1F82E27CABC1CF44001A04407B684715983F7D97DC6A5D766F1BF64A82DCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890007, "uuid": "531892af-fb4c-499c-ab05-9274003e276e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890007, "uuid": "a38d2d2f-e242-4e03-963a-6e51af770d05", "value": "12288:eSq/F6T4SPt3Jtkz2XKsh1FUEmwBBruXSnkDwMD8HCz:J+o8Sl3Qqasp3HruXSnkDV8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890007, "uuid": "5e33bd79-2266-4d95-beba-c4b075e1f223", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890007, "uuid": "94d4255a-67ae-4c6b-a173-0c5da761e117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890007, "uuid": "f0804b79-e9a1-47cc-86f9-24a34f9090ea", "value": "scan copy remittance 103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe46eaf-4bd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693909728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909728, "uuid": "0aabe7cf-476d-4d6b-a47e-1f4974dc290c", "comment": "Malware payload (Formbook)", "value": "b13e8b6efb9638ee40d1287dfe5077f1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909728, "uuid": "975e1cec-bf9b-4508-995b-dac95829808f", "comment": "Malware payload (Formbook)", "value": "4950435af571f947e07e12806f79ef388022c35e6feed3025fabf440b08463c9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909728, "uuid": "682334f7-c6e0-49e8-9e11-5d017b9d69a0", "comment": "Malware payload (Formbook)", "value": "da45f18c4f6168d339e22617a445e5c2e7685785", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909728, "uuid": "1ff0859e-03f6-4ddb-a071-fe0e23d6b989", "comment": "Malware payload (Formbook)", "value": "64b8a699c3ae321f64102455efcea61ac86d6f45133763985332886424d5088b809ae203c5008ae1199a37a0790807e5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909728, "uuid": "21f9f7f3-8c29-439a-aa3c-0b4548ae3db4", "value": "T1EA842361C8700A65DADBE593DEFB59B49076C311C49A33E4F24C80A15BFBA8EF2D2158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909728, "uuid": "84ea1529-2e96-464a-8288-bf42a358bb8b", "value": "6144:NmtRFl5keG/kC+jzLI8kIeUdOb3ls2d2QIBw7GOeExSkPrV1XCbTVyUu9DNKd+Fl:N6RF8exC+jz88BeYW3lshQK2FPP/C/43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693909728, "uuid": "bc5c323f-4c02-4629-81ed-64e01b82d3a7", "value": 385481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693909728, "uuid": "c21a5e3c-9da4-47a4-a95d-7779ee978fdb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909728, "uuid": "fbdf9778-8028-40f3-88e4-6af9ab2a6c36", "value": "INCORRECT INVOICE.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b92ab1-4b9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884555, "uuid": "91e19a04-4bd2-4604-b921-5a7c530f65b2", "comment": "Malware payload (Mirai)", "value": "bc3cbd07f9c245499d83d0e07073e00c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884555, "uuid": "c1e30edc-44da-4e5a-ab49-47181bb59b27", "comment": "Malware payload (Mirai)", "value": "4b917099eabfb136dc00cade577a088ba9a0ebe129e56dd20af54191e080465d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884555, "uuid": "bc56f908-c470-4b87-a455-59be96942ccd", "comment": "Malware payload (Mirai)", "value": "93a705b4c9ba6af2b389736105702ac2e8d50f46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884555, "uuid": "e41e915d-58b7-4a3a-b869-f9e4f8e5ab59", "comment": "Malware payload (Mirai)", "value": "98481e91f3865c4430e2a35c64e6eb2dd45a1e6bc493e7cf79539015c3aeb67461d1a339b7f641bee4cd1e47531a514a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884555, "uuid": "c8c55639-dc02-49eb-bd40-43bf673be235", "value": "T12CF2D16F6680BA59C9ED1CB950C9313BAC19308532E7076D32388CC9A7F79A7714D5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884555, "uuid": "483138cd-2117-45ea-96a1-246373834c5f", "value": "768:qq7Hmvrr2EACDT2GyRgmFJmBiVB9dBGrD3W0:qMSrYGUpI0Dtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884555, "uuid": "98910917-2ef3-45be-bb3c-0aab9cb5fa5e", "value": 34540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884555, "uuid": "1f769b0a-022f-4ddd-9317-61bbc5a4d173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884555, "uuid": "c9e9bd0e-afa1-41b2-a6ab-9ea6aa9a6cad", "value": "SecuriteInfo.com.Linux.Siggen.9999.13852.30731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec31a8e4-4bef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693920432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920432, "uuid": "855c47cc-27d6-4725-808e-0acf59c351c3", "comment": "Malware payload (AgentTesla)", "value": "1b0bde91dda76a2f6c077a9df2068852", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920432, "uuid": "8efb35ad-c2e4-4e92-be4b-4f0a9bcea298", "comment": "Malware payload (AgentTesla)", "value": "4c54e1a30026a1e7bc327a31cf05cd9f46f26ce0b122a6d48d699c63b37dc85a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920432, "uuid": "3ff4b8a6-09bf-4618-8165-fa47661be4f0", "comment": "Malware payload (AgentTesla)", "value": "d4e16f19399a7aaa004dc2477ecf22f960607935", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920432, "uuid": "b4469a23-01f3-42f1-ab9b-a1955743ca02", "comment": "Malware payload (AgentTesla)", "value": "fe472febb2524e19922dae2ce55b0e9d5b377ed4f7c343ac0528f39a12c0548ebdd3c2a06dd068c8253f2d588c04eaba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920432, "uuid": "e7e6fbcd-baf7-4ef3-932c-53763e6f1666", "value": "T1EEE3390BBB8A85B2F3450B39C79B52300F74DA96B373C24B746D23151B037E99A7664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920432, "uuid": "f7908e0f-cd3f-4a84-8d06-fc7663cdf285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920432, "uuid": "b21380cc-04eb-4239-9df0-ee4bf7b3882a", "value": "1536:j4oDuKB/QyMzAr3HNG+QoxZ4a71wW7aPwjabEQLfe0rcEfrdl5PAaZ/Sv93Q28F4:laA/ZMzA7kYZzJAPwGb7nLfhAP8tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920432, "uuid": "f101eafc-c73d-4593-a0d2-c55beaa9938a", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920432, "uuid": "4a486761-c7db-4032-a4bc-742767a73f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920432, "uuid": "04272eb4-0e1d-4451-ab51-475dac054d49", "value": "4c54e1a30026a1e7bc327a31cf05cd9f46f26ce0b122a6d48d699c63b37dc85a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e620cb-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693915179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915179, "uuid": "7eb614ae-db77-4a61-bde3-e4205de80baa", "comment": "Malware payload", "value": "169c494f1660579ed02cec5b5fb6c620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915179, "uuid": "ccb91784-140d-4063-b934-ccf721bf7078", "comment": "Malware payload", "value": "4c8cd96ba0b4d6dad7ad2666eb7a39ae065ec2a0e2ffbb67d0cd3c33862ddd7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915179, "uuid": "2142588f-74d7-4482-80fb-91cac551d1c8", "comment": "Malware payload", "value": "b3e24bb23881dd0bc744df9b4fb712a41233f0c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915179, "uuid": "adf13a5b-0058-4bb2-b767-7b4a93851352", "comment": "Malware payload", "value": "93d67e5b35179207d391ee45955485b76ddb6be56fb95e100846c0f0254c996ad96563867221f76b2cd12a7cea7031e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915179, "uuid": "605e06d7-e119-4ed7-8715-ebff7a067551", "value": "T1C4551212FAD284B2D5760A32593A7710997DBD201F24DA2FB3D43D2D9E721C19238BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915179, "uuid": "be252f18-9e95-4020-b99c-53b8f92175f2", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915179, "uuid": "33f93b8e-f579-4982-9dc9-a4677b10746c", "value": "24576:wNA3R5drXmDkPZB00wuZ60W0GkQKiZX4ZysNNCHWFJpn5aeLnJ9PC+RG:p5UkH0WZ62GkQ7ZIZys2HWFDse8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915179, "uuid": "133e27a0-3d58-4abf-a2f0-6aa304b36c6c", "value": 1351902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915179, "uuid": "3bd86beb-73b5-4fb9-8d78-ae2c2e445823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915179, "uuid": "244c5f00-a111-462d-b6d8-53badde0ac38", "value": "risdrnglder_sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dcdf881-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1693921804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921804, "uuid": "6cd68bc1-8731-40a0-97db-6d13acc927ef", "comment": "Malware payload (XWorm)", "value": "447fa4267db5002e20cbcc5c4f03fe64", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921804, "uuid": "1d90a474-126c-4e46-8272-7eff12b85708", "comment": "Malware payload (XWorm)", "value": "4ca23c140f02ad3f9a8d0df97e57a6282faf8aa85433efd3f7c07a5ba8868da7", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921804, "uuid": "dd40360d-917c-4b46-86d2-73d0d4bf04bf", "comment": "Malware payload (XWorm)", "value": "e9b42c38458441d87f2796092e9a522dae28c0d7", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921804, "uuid": "e2de55ef-2996-4f79-948f-7335ea3d9159", "comment": "Malware payload (XWorm)", "value": "e037ca753134031f55cce4f0f86eb605941aec73976cb0f6d1cdb542444cb569f45fb5931a339a2db79be5caea2369cb", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921804, "uuid": "fa62640b-0590-48ae-ad73-522febf5f3f3", "value": "T18D72BF89B9597759CD17CFB7B24A145A319B5B08CE5C3EB13912332813BB9034B8E375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921804, "uuid": "667890a9-2814-4268-80df-3d5d3ace7240", "value": "384:dXPx2AVwOasxI/z0fgMi9J7xNRerxCzQW/tO8x:VPDwOxI/z0fgMQ5nYrx4bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921804, "uuid": "0ea1e197-2064-48d8-b604-8c0c5d473f26", "value": 16968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921804, "uuid": "e52d5375-833a-45cb-ad8a-c1db75f26fc2", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921804, "uuid": "d4bd103e-feea-412a-8a99-7fdeef4003ef", "value": "Manual Modulo de sergurana Authy.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4ecc18-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693915203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915203, "uuid": "eb14d1cf-3765-4fc7-8da3-0816fe9766bc", "comment": "Malware payload (AgentTesla)", "value": "1bf2ab8eef87346a00c35aee1364488b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915203, "uuid": "486efb96-aa5a-4ec8-a948-43cbb84a1d8f", "comment": "Malware payload (AgentTesla)", "value": "4d656ecc961a366e3e0ce76c438720783e14d4684bcc376663ec12c82de707e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915203, "uuid": "5e40b367-d494-4d84-b54b-98d161d1f360", "comment": "Malware payload (AgentTesla)", "value": "825282e892eea78627b61d2973e2af8343b42554", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915203, "uuid": "bb55d2ef-3e75-4a1e-b20b-a2027c1b2d0b", "comment": "Malware payload (AgentTesla)", "value": "9ec3a54930b057d85ec196ca2538a96ede8bd4462a1847e8c965e582c2b0b6f83719dd3c2db7cc154b9674dc45245a4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915203, "uuid": "c34d1112-d25a-4818-b31d-ba98a681a1cc", "value": "T11945ABF1317D8383E1A18EB11FCA86B079F135ACA8D0560DB0F99B2E93D2355149D9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915203, "uuid": "6f20afc9-9334-4f0c-bd9e-837a32ca0364", "value": "1536:Nx/TVJAY1c9wqvnAv77vvvvv7vvvvvvv7vvvvv64+mhhhm+DtqOgdD7TPxdFP75d:Nx/5+9wqY+mhhhmitqO2DfxvPXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915203, "uuid": "94c6e073-7924-44cf-9267-8380839dbc46", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915203, "uuid": "6acb121c-9d29-4e8d-af20-45b2807cc8e4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915203, "uuid": "4ce2b6ed-098a-4339-a8b8-2a93c14e2127", "value": "nRegarding TT payment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d133a968-4ba4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693888175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888175, "uuid": "c367955e-6614-4026-86b3-96024975d375", "comment": "Malware payload (AgentTesla)", "value": "5b3132834285810838cd8a81f5e89d39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888175, "uuid": "36931f14-61b3-46f6-b7f1-778e16b65178", "comment": "Malware payload (AgentTesla)", "value": "4e6fda468f16cee9f106def8f3217930ba442d79daa41cde7dd5b6f817bd5127", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888175, "uuid": "bdbae539-d5a5-4dfd-bc4e-d7af0c9112cf", "comment": "Malware payload (AgentTesla)", "value": "6f03af8f8f79e47d4d71a68cfd6320ebea696bde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888175, "uuid": "baebf94f-cc70-4cdd-a247-7ec463c170f1", "comment": "Malware payload (AgentTesla)", "value": "7f53d94dfb2c469d8f907a91b878610708ada7410261e5b2db1973b6fc5845b0ba6c9df83209acf0482680ec712e5f81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888175, "uuid": "50f1c44f-7490-4dba-8a98-4c1ef44f7234", "value": "T18FF41240B3B88F47DBBFA7F51818605007B6599F6132E7490DCBB4DB29A1BA10681F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888175, "uuid": "e53246ec-07cb-4451-9a6a-3898fa2c4c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888175, "uuid": "164c7a32-1592-4f30-953d-d5fbd96fd32d", "value": "12288:Moz83GaCfBsxcMgVRgyxSA+CIaYnhzxKhd10k937NVJthsQ6H/73brUvXkxkDwMO:MoI3B3RYR3j7YnNYv1007ThsN/73buXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693888175, "uuid": "bdee151a-fa49-4fe9-ab74-55cd78418a9d", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693888175, "uuid": "da8f6b77-732a-4934-804f-c2f22976b305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888175, "uuid": "6f63fd52-9ab2-4395-babd-fbf1f2824e90", "value": "SecuriteInfo.com.W32.MSIL_Agent.FPI.gen.Eldorado.1360.13650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7be2a77-4bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693897984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897984, "uuid": "83ae5e23-df5a-4236-bbd3-0710f8cb4c6f", "comment": "Malware payload", "value": "f1e57934c6904bdd60219d257cf55c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897984, "uuid": "c4ab1bfc-f40e-48d3-8584-0faeb64506a5", "comment": "Malware payload", "value": "4ea162b1b77a7d2477c035314acfed6390a9957d16327a361a23234aba42f972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897984, "uuid": "559d3e74-0360-4526-9f6b-2af32e260c16", "comment": "Malware payload", "value": "8e8c3fab72d2aeb3988a6eea634a1762075e533c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897984, "uuid": "c1850bb8-f355-42a6-a462-66dc48c2d125", "comment": "Malware payload", "value": "66a306b28c2d126665c9fb0cb4e789ab5051b30367fa11837a9d998d4eb28cfbafa90ae9adcc911fe119a31d569e83b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897984, "uuid": "acc36b79-25f6-4407-8417-f825ff9ccc5f", "value": "T199463390E3902AE5FC37E23E99324856D5B23C661365C7AB05A402675E173E0EE3EF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897984, "uuid": "14b89ff3-a7bf-4014-9fa3-45cf7164edbb", "value": "c37e09c5b0695a85a9bc5acc3c3be323", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897984, "uuid": "8a4b207d-548a-4136-bb3b-77f4be14afac", "value": "98304:+dzwqYSb+sX1ZvbepdJolTlPNs2PKToa1FptF07TsU/h1pMFpMndHyF/K3ljRarV:+dzJYSCsXDj+dJolpPgToa10/TpMFOng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693897984, "uuid": "dcc5e6bb-2f8e-4635-9558-085ff014e6c0", "value": 5736255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693897984, "uuid": "b8d388f5-d17b-4a5e-b298-855a9a95d59b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897984, "uuid": "13a74723-0d7a-4ced-8342-1dea918b1cbf", "value": "simple.ghf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04edde9a-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926916, "uuid": "bd439adb-53ec-4726-9d61-9ecb643260dd", "comment": "Malware payload", "value": "cb42acc26fc460bf02b00f38ca4b430b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926916, "uuid": "1057dec9-dc40-4588-879c-bb541c805759", "comment": "Malware payload", "value": "4ed5c7939fdaa8ca9cfc6cd0dfe762bb68b58adb434f98c1a28aae53c3b96b00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926916, "uuid": "2f215773-6551-4356-bca3-713e7ae78726", "comment": "Malware payload", "value": "6ed3326e64cabf5cba4c04da4aafcc4e86b07754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926916, "uuid": "442f6e5c-5773-43e2-919e-5eca43aba7da", "comment": "Malware payload", "value": "cb6e500eb5379ad0c8e8bc439405d6bd67cf7813d650307b455a6b2b01f4e542c95f520f05495ac03f0f0b437d25ee50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926916, "uuid": "6bf6bd5a-813c-4058-a816-cb4f8f5395ba", "value": "T1C0E0230B6B60E3C3D10C8E306344033C43D38037989103478F10ACC04C02244CD31E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926916, "uuid": "44800a9f-f377-40e2-8ab3-74e6939f1701", "value": "6:BnX//In8/r1/9ammVtbN/ssaSiAWmSfnXsF6NNV9t08q:BvwncrN9oHbN/NaSi1Vnu6NNVw8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926916, "uuid": "d5dce931-cadb-4aff-ba0d-95da0c3af5ec", "value": 302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926916, "uuid": "277edce1-cdc8-48dd-beeb-9b3ce2c1830f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926916, "uuid": "4d6910dc-cfec-4cd2-ab81-d9277e3a5778", "value": "4ed5c7939fdaa8ca9cfc6cd0dfe762bb68b58adb434f98c1a28aae53c3b96b00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f574fe-4b89-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693876497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876497, "uuid": "0ccee968-8f69-4ebc-9a79-c7ed4faa77c7", "comment": "Malware payload", "value": "c969d837546bf40999ad9fdcc10ab1a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876497, "uuid": "91ca8253-96e9-4f2a-a795-fa7bc278d2a1", "comment": "Malware payload", "value": "4efcdc51e82b9e6241e65e28e539379a34877650a9807d5e486d04815cd9472b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876497, "uuid": "7cc77189-e836-4278-b1bd-697ecaf9e774", "comment": "Malware payload", "value": "5f2ef43813cae3d788f88272b282b715b37a867c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693876497, "uuid": "fe4d9223-34f6-4f00-a61d-e9d7aa1ee1bd", "comment": "Malware payload", "value": "2519022469f226d6e24d48a70233b9bb4c6e2111622506477331b209a97a9493b9f206c7ee1ff0dfad74ddf4b998d993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876497, "uuid": "0b6c4077-c71f-4d8a-af47-67c18f3fe6d0", "value": "T16E548D11B1D28032D47205331974ABA1697EBD300F659EEF97D85E2EDE342C19A32F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876497, "uuid": "1125fa1a-69d7-48d2-ac54-71caf190b30f", "value": "645f92d85a01d733bee3984af53ec796", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876497, "uuid": "fa118b69-cdef-4248-b3e7-cddddc7f2726", "value": "6144:OswogpGTSqymyzMqESCvPlvPQ3WAOrofvk0y:OsHLyz6vNCW9IXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693876497, "uuid": "e98d09a8-0809-4904-bd7d-f917ca2865bb", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693876497, "uuid": "f139f41e-bbac-4540-ac6c-da009f64804c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693876497, "uuid": "eb463bdf-1727-4d35-bb80-ca1737288d4d", "value": "jtquai.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fadffbc-4bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693893004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "611179d5-6ab5-4c76-ba6d-b087a47c54db", "comment": "Malware payload (Mirai)", "value": "5109fe643490d75c8723824548e59065", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "7dd1b455-dd95-4061-bf1f-6ecd4c4995a1", "comment": "Malware payload (Mirai)", "value": "4f4ed5e406bb0417ab9ce2c1d84386f8362e4c8740ee120fc55e42ecdca9f50d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "8c365e7c-9289-4a4c-85fc-de01c11d8959", "comment": "Malware payload (Mirai)", "value": "a54bf0cccfc0a26ea9eebeaa2abff54fcaae3e29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893004, "uuid": "97e1a4ea-0f46-4100-8878-e6373e5f9198", "comment": "Malware payload (Mirai)", "value": "093e0ba9886b93a1b3b8438d34b2c356772ab2729fd2c75eebb817b285c836a545d49d16acb3fda3340ac8a6fc6ee3a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893004, "uuid": "414ae632-be4c-4ddd-952f-241135891b9d", "value": "T10AF2E287E8B95BEAC46E203C5CD9154B684D628F7C0EC977DEC4212E14C5B617E7E381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893004, "uuid": "6099f2e9-3999-4858-8fe6-def2bc0d65fb", "value": "768:k7uYDdoaNTIXXYx1pjTP9CYf5aAUmifDrAp53inbcuyD7UHQRjX:knDaaWcpjTP9G5fo3inouy8Hy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693893004, "uuid": "528ee59a-42e4-4951-8933-f9cbb1e03835", "value": 34364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693893004, "uuid": "248cb087-9852-4d78-a555-1df83ff87801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893004, "uuid": "12fad9ac-68dc-4bbd-a3c5-879c78705d7c", "value": "dark.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62962bf7-4c39-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693951984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693951984, "uuid": "4cdbdea1-3e7e-413e-9e8e-da10cac076e0", "comment": "Malware payload", "value": "3f589d9180a808aab6ec1d6b88b3f997", "object_relation": "md5", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "destoreyer", "colour": "#9AEA3C", "exportable": true, "hide_tag": false }, { "name": "destructive", "colour": "#A01B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693951984, "uuid": "de7906b0-8493-4328-8a66-8575b855b820", "comment": "Malware payload", "value": "4f8eb1b7fde3d4ae1ce91b0cd0e4f902d39630c250f740c0c59e6ce9ef1031e9", "object_relation": "sha256", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "destoreyer", "colour": "#9AEA3C", "exportable": true, "hide_tag": false }, { "name": "destructive", "colour": "#A01B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693951984, "uuid": "9f62716e-2a04-45f9-bafe-bab9273d9f19", "comment": "Malware payload", "value": "e8cf99e3182fd3b0fd323e53ab8d93d36df2ddb6", "object_relation": "sha1", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "destoreyer", "colour": "#9AEA3C", "exportable": true, "hide_tag": false }, { "name": "destructive", "colour": "#A01B37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693951984, "uuid": "e22ab92b-fc67-48bd-8f2d-129ee8700cfc", "comment": "Malware payload", "value": "d0d95859b25d1f3cc6a09eeba80a7f91993a69f31bced4eb2e55fc383a912da7bc429b7ad123fcda2ca5c7ddc63536a0", "object_relation": "sha3-384", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "destoreyer", "colour": "#9AEA3C", "exportable": true, "hide_tag": false }, { "name": "destructive", "colour": "#A01B37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693951984, "uuid": "db449e51-3662-4623-a281-94954995154c", "value": "T156F08B9441F62073D8B427005A4F0F82934DD7DF7145936A50CD29ABF85B70AD0382C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693951984, "uuid": "bce8ff1d-405a-4544-84b4-5e76a950c185", "value": "12:ixVjhR1b/n+k6y6UpWDmVPFduVM1t2uDmVsCPXUZ5sVhHsYCuw66QTeHrFNHH+Vo:ixV1PD+kaGWDm57uVMRDmbXRvC96WHrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693951984, "uuid": "aecbe7ba-24a1-4f69-b390-1cdd1ccff2f6", "value": 578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693951984, "uuid": "0bb04cc3-d3b7-463d-beca-6d4d1a1cf3ce", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693951984, "uuid": "defe99b9-8c66-4e35-84cc-9f7e1889f1c0", "value": "explorer.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b8655c-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693914918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914918, "uuid": "a5246cd8-c507-47fa-bf06-2d23a6edc953", "comment": "Malware payload (Stealc)", "value": "b2e1291e62d4181f43d8eab12979fe96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914918, "uuid": "0682a99f-0220-419c-9c20-fb7f53acfee7", "comment": "Malware payload (Stealc)", "value": "4fa066ec21247d30bc4cafba293d36e2a02e5ffc6dd491591dd52fe38e87ec50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914918, "uuid": "243accd5-0eca-4769-b117-0debf0cf9087", "comment": "Malware payload (Stealc)", "value": "30503770527c920b7e87fd8844aab77e44975ad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914918, "uuid": "5f6b2bdf-2285-4d85-99a6-b41bcf68fdf0", "comment": "Malware payload (Stealc)", "value": "1fd1fc5b0a4c28263a9692aea4e24d7a76de14ad50f0156d79fdec019209d2b0b352ffafd7e96d60686f750fc108aab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914918, "uuid": "b1f6be54-14ed-4436-9c2f-c8ba090a2b50", "value": "T11C446BD3E2E0BCA2D52647328F2ED6F8771EB951CE196B96A3186F1F18751B2D213310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914918, "uuid": "1cc3da6d-7061-4025-a7a5-5986e58941c6", "value": "e4fe26c348a216c8f499120b873de5b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914918, "uuid": "46d4cb20-83d2-4486-89ee-d0bde975e07a", "value": "6144:Z46IQPHW+lpLr10eunkn5uFldBay2aS3iVTTa:Z46nPHW+lpP1hunk5ucAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693914918, "uuid": "3924ddba-7ba6-43fb-abf9-d23f5871e374", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693914918, "uuid": "801c3833-f4db-4212-9325-5ef90699e835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914918, "uuid": "826596ef-397c-42e0-a7fd-c8c9acb97424", "value": "b2e1291e62d4181f43d8eab12979fe96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0bcdf6-4c29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693945294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945294, "uuid": "84fcbcad-9cdb-402f-aada-697580d72b83", "comment": "Malware payload (Mirai)", "value": "a62650b435c6f85f520aa947dfd73226", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945294, "uuid": "a9a85803-a513-459f-a4dc-1f2810746f76", "comment": "Malware payload (Mirai)", "value": "515591dcad400574b1bdf3d07698ac38cf0209588deba6a6fd6c025c2bd5a70a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945294, "uuid": "6bdb93a5-b2c3-495b-ac7e-16738d8ab47d", "comment": "Malware payload (Mirai)", "value": "e8c97f75d996b8da4d39fd4c4a3ffb79fcc589a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945294, "uuid": "737a3a7a-7e98-4eca-8b9c-97547735098e", "comment": "Malware payload (Mirai)", "value": "e8d28ed12ec8de99bf63602bf72d4e581d687327464bacf5605c4d0ca247aa1c11f116c683cd72a0403a8e72f22a785c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945294, "uuid": "2f2ac5b1-9ef2-4d3b-bd97-774dbd428e8c", "value": "T172C2D0E07726FE31C420AC3DE53A4C8A3A51067C91FE393664258D398FC265A67E48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945294, "uuid": "4cca9faa-8d74-4e84-9314-0901a7c639d4", "value": "768:DMKyhegCCMqfizjoNpd2vJdX6vwrl+G9q3UELuv:oKy4qfqoeJdXWgUrLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693945294, "uuid": "2268eae1-b3d4-42c4-8216-6b400946ade0", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693945294, "uuid": "6dfaa070-6cd0-4c27-a872-e77d25cbb22d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945294, "uuid": "04920433-98c7-4acd-a91e-15f9b3dd324b", "value": "a62650b435c6f85f520aa947dfd73226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca3591b-4bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693895522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895522, "uuid": "0196f489-e206-4aee-826e-04094cb64094", "comment": "Malware payload (Formbook)", "value": "e0cf6c61ae619f0cc88e21aeca286f14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895522, "uuid": "67cd1412-1cfc-4f32-b324-43f1256d291b", "comment": "Malware payload (Formbook)", "value": "51a15921691e898e879b022164f0cfd0cacdd2214116ac176dab7b9d124f8bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895522, "uuid": "6a1dca35-dd96-448e-a2b1-edb9105beadc", "comment": "Malware payload (Formbook)", "value": "11effd762830431a5f2d2797b42a4026a38eca46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895522, "uuid": "613e62bd-8b5a-4d0d-a5c9-4f7150b93d95", "comment": "Malware payload (Formbook)", "value": "d317927d85b9c1882010532e93bb5d98c7b90f8aed1a243f9263ee13bb0124f676ed0d87104dc01d4575542c060190f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895522, "uuid": "c13fc8a2-4ee0-49f1-a57d-f587b15fe117", "value": "T15784234C95E0C167DA911472897D2BABBEF63C1A508C864F2B703B9DBD71322A51F743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895522, "uuid": "4827ab96-bcb2-4586-82de-358f59ee9c50", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895522, "uuid": "2b5b9b82-d6cd-47d1-8aa0-32cc06273a3d", "value": "12288:/YBA6in/QkHlmahLA8r/k5KQKnIfgKf97:/YBA6g4k7hs8r/k5Kbaged", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895522, "uuid": "40e2922e-5354-4470-b9e6-3cc11b5eb34c", "value": 402104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895522, "uuid": "46f2e160-c7b0-4cc3-a7be-1b5be4dfcffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895522, "uuid": "9c3d2fc9-8c42-49c4-9108-ae6d14ce2290", "value": "EUR 90645.49 Xenon Payment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9ba392-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693921861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921861, "uuid": "36c9d7a0-9288-4bd1-ad39-a876bfc50491", "comment": "Malware payload (Amadey)", "value": "e14914a151a636c8ab8f58757086c507", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921861, "uuid": "63c1d3ea-d204-4f20-9198-76406b488591", "comment": "Malware payload (Amadey)", "value": "51cb42250be947f6acf9a715f565403b07f6334dc138d4412aa44020eb5619c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921861, "uuid": "5bcd28f5-37b0-44ac-bcf8-a5362935476c", "comment": "Malware payload (Amadey)", "value": "33641be7cf8a41b24e5e4819263572a3c0a8d729", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921861, "uuid": "fa6663d6-e1f6-49b0-a227-1a719736357d", "comment": "Malware payload (Amadey)", "value": "c39305cd05dd46f2a8035d324fc396467f05ecda56d95f061434d5d03ccefdf81c09149b1cca67c1a181717c81699aed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921861, "uuid": "93ebb1dd-79ce-4cad-8e2f-353240ceffad", "value": "T136052342BAE940B3DEB117B05CF907830736BCA8587897673386A85B4C72AE4E574377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921861, "uuid": "ff3d0d81-15ce-4d65-9e35-7ac6ace3ab16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921861, "uuid": "27b2ed35-334b-4f1e-bc6d-bb09abf6f3ba", "value": "24576:/yDtoK0XWMhMu7bej4x72wKHhcaOua1LeD6D:Km2u7bej4xqwKHhcoa1i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921861, "uuid": "adae3b50-3b1e-4cfd-895b-d38a6c219688", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921861, "uuid": "c82993bc-ad99-49db-8ef0-0a49064951a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921861, "uuid": "f8bf2fd8-4156-4a9e-b1ca-8d5ba0983ff0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bce51eb-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693891333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891333, "uuid": "3d4a1652-0995-4a95-a0f3-b1a3868bca1d", "comment": "Malware payload (Smoke Loader)", "value": "13a6e4e8a870e1c5c2f125642404da2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891333, "uuid": "60d6e491-11b5-44fc-a40d-37697fdbece4", "comment": "Malware payload (Smoke Loader)", "value": "51ebfed69f77c7eaa5d393966fa11d1c9445a6e018460691743e723cac98b790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891333, "uuid": "4768ad83-6f1e-407c-a669-dd8f61e620bd", "comment": "Malware payload (Smoke Loader)", "value": "f2654295767414e404478b9e703a9233ced27c0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891333, "uuid": "d01c4808-e277-416c-b724-f29e3725adb6", "comment": "Malware payload (Smoke Loader)", "value": "06472ce745a636fdf60f794413edda6336de8f999445fcabe1596386b9f05087de595af9750c8f17da38596c41d3e106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891333, "uuid": "507d1110-0c37-4d07-914f-43618be2fe7f", "value": "T197543783A5D0FC61C51243348F2DD6EC776DB8529E59AB5736583FEB28322B2E663310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891333, "uuid": "a5126e88-11bd-48df-b5f0-24cb07a7ce27", "value": "2ecd68902b681b798a1768b60fb38fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891333, "uuid": "c61a4dc4-237a-4fcd-baa8-82f703c9b2f2", "value": "3072:vCNMZtOOLulN90v7rpbRAPIiyfUOyYSjkhfM5x1V0MAspTLh:KNGOOLUN9OpmPQf9yYSIfQQspT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891333, "uuid": "c3750ec2-38dd-4346-8275-bde3f25b6a21", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891333, "uuid": "b314e286-db38-4a53-8037-c15839bcbaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891333, "uuid": "f4e767c0-dc1a-495a-bf2f-381fbe1c4ccc", "value": "13a6e4e8a870e1c5c2f125642404da2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcccb9a9-4b8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693877081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877081, "uuid": "34199937-1b85-4811-946c-93586f8afed8", "comment": "Malware payload (RedLineStealer)", "value": "c6491ac5db54aa41bb1e749635e7cfdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877081, "uuid": "3e1214de-2421-403d-b0e9-c053d0e7e4b8", "comment": "Malware payload (RedLineStealer)", "value": "528483384df0426da85ef7a6d94a87f47d9fad555b012743ca7fb796d1bc5595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877081, "uuid": "c3c75761-5283-4957-98d7-4b4ecff82a0a", "comment": "Malware payload (RedLineStealer)", "value": "74d19f6824a40ae07098ff95819fb251e8898a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877081, "uuid": "dfe4ecde-ad38-40b2-8f4c-1695c2aa6a89", "comment": "Malware payload (RedLineStealer)", "value": "e344988196b04f76c5b89f6d3c567bbbdbe85dc180ed18fa72be749c1fd9f8215e8f96600d292a8e4db44e6b2378ed1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877081, "uuid": "142217b9-88c7-47ff-81c5-1336797f851c", "value": "T130F412166BCD5073DDF42BB0A8F707530A36BC960878D32F27856C6A48726E4B93536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877081, "uuid": "b2df1164-e1ec-487d-b054-a38e57708105", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877081, "uuid": "b6f0654d-c165-49df-b51f-352b24ed09a7", "value": "12288:mMr1y90EsoigP1aCTU0iUYPx0KSXkl/EPKave7CYKKRcqX9p7N+PzPlZtqdkfl/:LyqgvTU0ocIcP927CJKmqfNuZYdQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877081, "uuid": "2fa30c0d-c7d3-4406-9e6f-9ef16ee6c5dd", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877081, "uuid": "80db79b6-cac8-402e-a6be-d1b4ceebe534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877081, "uuid": "ed2912c0-04b7-47c0-b815-2356c4ec22e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a1bf1a-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921383, "uuid": "9cfcc3c5-26d9-44aa-9216-0e2b6b7034d8", "comment": "Malware payload (AgentTesla)", "value": "15f1b5075cc448f48b421d0fbe2c859d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921383, "uuid": "cd8e5810-819c-46e9-bf9f-a690eb1f1b5d", "comment": "Malware payload (AgentTesla)", "value": "534f5d4dedc8204a8be8f509f90510f05ff419100f5a3908b1235e005903a599", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921383, "uuid": "8b2e1b25-45d7-4ee4-8dba-9a18407f802f", "comment": "Malware payload (AgentTesla)", "value": "48ebdd060de1067a1409d04564c041272c345ebd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921383, "uuid": "3b37a222-fabf-49f7-a626-b81a8c0ddea4", "comment": "Malware payload (AgentTesla)", "value": "431ca1403c3007fc336bd9f7e7f0fae42eacf5ef41503f284fb6788dccf710a0eab6f1a12c8b9812c7997b6a61bd23b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921383, "uuid": "b214c8b3-68ba-4461-9599-11529ee65a13", "value": "T13705B86CFA45DE3FD38C4C3950F9DB2B69B99BADD0E1A3A1C01051B518E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921383, "uuid": "68d5b37c-3c81-4541-86d3-8f6baf26fcad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921383, "uuid": "67c8022e-22c6-441a-90db-8738852fc247", "value": "12288:6H41ItaBXPQxSSWr6cSuZmI2miXEKDLDzGS5:M67gI2miLDL/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921383, "uuid": "3912cf7f-210a-4c64-a4e3-c3d09a61837e", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921383, "uuid": "d1d4dee4-665a-4b5f-82cb-27c0ed09ab67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921383, "uuid": "2a03282d-862d-4a7b-aa27-4f872de18a1f", "value": "534f5d4dedc8204a8be8f509f90510f05ff419100f5a3908b1235e005903a599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35323dcb-4be1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693914112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914112, "uuid": "2de0d0c5-d9b7-4f34-a3d0-470d5f1b7803", "comment": "Malware payload (Formbook)", "value": "739111491bf4ab79c1a48045d1ccadc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914112, "uuid": "c2565273-33de-4bfd-92d0-0f60a07ad63a", "comment": "Malware payload (Formbook)", "value": "5368aa2878d041834fa80e9e777bbabfb9bf8ccd01a31bf0fe012df369ff4ba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914112, "uuid": "d56b3cb7-0cae-4adb-ab9a-676eb23a103c", "comment": "Malware payload (Formbook)", "value": "45a81bc3d3f3254cb6e794bbb97688bec5b864c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914112, "uuid": "c4324fcc-da46-404d-97e6-b190de578855", "comment": "Malware payload (Formbook)", "value": "820ae1f52afd447179a89dac80e700f7a22ca0f96318da9efd4dbcd76b4a864bd6ed1ce939245d4cb7b5e835024df61f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914112, "uuid": "dbc97191-99e8-4860-b860-3c29870859de", "value": "T124B4D002E0CDA9EFF00C45B46D29F2ACBD275C256C31AD665E81B4549B78703AAF393D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914112, "uuid": "17524136-c5a3-475a-b5fe-5c680d3306dd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914112, "uuid": "c5d28c63-b0e1-4da8-9d56-005ca500c42d", "value": "12288:WYDwt3fL6DOOXMJ4sducpwtWdlsgovjAg:WYct1OXqOtWdlpov0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693914112, "uuid": "858da30b-acef-4fa1-9ea4-96c02beb48a7", "value": 511812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693914112, "uuid": "08c3103c-1a69-4412-b761-23fe2c8c4c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914112, "uuid": "a5dd7fa2-0926-4137-8765-a202ed78a0f6", "value": "z83PAYMENTTTCOPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d6c6d4-4c46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693957815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957815, "uuid": "f0565148-aed9-4f1a-8d7d-a79ad8a527df", "comment": "Malware payload (Stealc)", "value": "b0d66385ffa45d0022c967559839c413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957815, "uuid": "5dd83969-1931-4be0-99a9-71bda1b283eb", "comment": "Malware payload (Stealc)", "value": "53cd047dfb61fc7c3391c4300b4a75fbaea2b9d304c4a482e493f8eb4e7f2660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957815, "uuid": "19508c84-1977-476f-ad14-76d68d4d68a6", "comment": "Malware payload (Stealc)", "value": "4db534125cdf68b46a0c5375e0805c6d5fdf59c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957815, "uuid": "cbbbd8f0-09aa-4cf2-9677-13bed0e5ad69", "comment": "Malware payload (Stealc)", "value": "bbc08d691e01d966497c73c1417c3435d05d8d3be970ba4009a2b1df9f7b99d144e46ad0cc401d69a9f55b48b4f7861a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957815, "uuid": "5142a278-d9b9-4ba0-bd57-d9919945ee77", "value": "T1E3545AD3A2D0BC65D92787318F1EC6EC771DB8518E596B5AA3186F1F28790BED223310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957815, "uuid": "61e8b0f7-cb29-4de1-8926-5bb68d73838f", "value": "b4063692f94e7d5a4ef3c227197b9a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957815, "uuid": "b63b3f73-2ef1-4f70-ba81-abdd8c29cb14", "value": "6144:0zU+LJBoif6Ui8AhhT4xCQdNGk+3tTKAaIl:0zU+dBBiUUgdj45B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693957815, "uuid": "61e9cfda-26f1-46a7-8551-7111c1c1c08b", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693957815, "uuid": "b457f5fa-c840-4996-bfe4-ea07e15f5ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957815, "uuid": "dafc6f10-dd72-436d-ab1e-9c46abb83286", "value": "b0d66385ffa45d0022c967559839c413.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4e9ed0-4b80-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BitRAT)", "timestamp": 1693872491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872491, "uuid": "3b4f78f3-5398-4a6d-8910-c33dec00b240", "comment": "Malware payload (BitRAT)", "value": "29e932d3d12d1811d99691acb7f228bc", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872491, "uuid": "064d5ccc-3fa0-4928-af07-e58229095a50", "comment": "Malware payload (BitRAT)", "value": "54375a390c52d783d96492938d05920567a0232c2c22436161e83f21745b7711", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872491, "uuid": "9f01693f-5506-4b79-b2f7-e9df5ecbd5df", "comment": "Malware payload (BitRAT)", "value": "4c67dd3dbb393ba68e602ed43223001bb88d94e4", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872491, "uuid": "11f1b6b0-70a0-4048-a1bb-b8e20bab446e", "comment": "Malware payload (BitRAT)", "value": "30d5d0cdf1bcf49aa828e3266826721da09ae09816db1bf3c10cb45ad1ab23e9f05d51f5c97066f4ede8d02985a3fcd0", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872491, "uuid": "fe27ac70-1b46-4a8a-98c8-8aab7fdf9d19", "value": "T18625AF0273D1C062FF9B92334B5AF6515BBC69260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872491, "uuid": "cffb9006-3814-4b9a-b785-bd43662ee12a", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872491, "uuid": "4d0057e7-c939-4d06-9e20-751f5a1231a7", "value": "24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8aNrpmD:BTvC/MTQYxsWR7aNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693872491, "uuid": "c310c999-ef08-4c7c-8026-b63faddf139b", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693872491, "uuid": "38a4f7db-ce21-46d8-82f8-f8974172529d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872491, "uuid": "c40ad7d1-b0d7-459b-93e0-fb9f0320ffb1", "value": "UmeMemqbMti9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b2bcd0-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693909733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909733, "uuid": "9f85d791-cab4-4c3c-94cd-5bc9b26d98fd", "comment": "Malware payload (Formbook)", "value": "dfa626cc1b5c4fb30142ebe638aba595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909733, "uuid": "ca9038cd-7d72-4137-9873-9dce6ce54d69", "comment": "Malware payload (Formbook)", "value": "5453ab6ad1bde2f5286311d91550037266ec90d9b032c61969ef0196241746c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909733, "uuid": "e0a9b2b5-d06b-45d0-9f1f-ac58901edccd", "comment": "Malware payload (Formbook)", "value": "a5df190586cc57e175d0c8f33af6b766ec7abbe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909733, "uuid": "dbd9d15e-80e4-41e2-8555-2e076ff18d9f", "comment": "Malware payload (Formbook)", "value": "e07de3af5bd129ed90524ebfeb5802e1961526d91977ee70a732f44cdf4e13f254649096d05b86769d88a34b4cc649cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909733, "uuid": "f7875820-f446-4f69-afd6-ed567a07327e", "value": "T17C8423A45BE4E463FD3D84B22DF753EE1BF5E91134698B1F73904528BB26680260E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909733, "uuid": "938a7548-b0fd-4dd3-af6c-07b148dda77e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909733, "uuid": "8e6097ef-f6d3-4d78-90f5-2a8e5f30366b", "value": "6144:/Ya6JnPjzM9OE3NYEaWsvJhK2jVI2CRg/ekQDaMEx2akjYdrMjrtKMx:/YbLEPaxo2CRrk6aMNUd8hPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693909733, "uuid": "3a6aae2c-4d04-494e-8794-46e35b87aec4", "value": 401070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693909733, "uuid": "d717288c-935c-4d57-a35c-2adc2d5bfa1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909733, "uuid": "b8dd1b95-0278-4578-b3f2-07d004693419", "value": "INCORRECT INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2247c50f-4bf4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693922241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922241, "uuid": "7732e023-e2c4-4b1a-84a6-6e672cc668e0", "comment": "Malware payload", "value": "65656f7bf63efa72bbadc8d74586f00f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922241, "uuid": "a4e83aa4-1484-4441-b786-9042e2e2a6a4", "comment": "Malware payload", "value": "54edd68b57574f5c98a257b594a61a84cf2a0b12629716fcf07ae7694268e143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922241, "uuid": "d662534f-a466-4a6c-bf2d-6d2628bc16f3", "comment": "Malware payload", "value": "9d659db3c7e1ef92d86919e0fabe76ca1b319370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922241, "uuid": "0a2e222b-3a4f-4168-9a1c-74958d9f79b4", "comment": "Malware payload", "value": "634cc57b30fd1b5f8cf11ae09615bec1a1410561c183818cf4c5b81cf285e265fa113c90ec8e3f5097b8f444a8e564bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922241, "uuid": "d4c0481e-faf0-447a-9445-7496053c7621", "value": "T10933F8167555CD22C39E2A7ACDDB401403BCEE43B5A2DB2A799F32AA65027F70C056CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922241, "uuid": "5371651b-d8c4-444d-94f9-97f15b51fc01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922241, "uuid": "d34202e6-5462-45cc-b25b-b90d4e55d3b1", "value": "768:fA+Gc51R2sOq1uSWVVTPrUWNeMEahvbEl1McNs9fv6B2fuxp2oDDPeG5LE3FS4tH:o+GG1R2s1uScTPgMKFpRG3FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693922241, "uuid": "6bf5eaa2-7bbb-4b67-97d0-84f2d7344b26", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693922241, "uuid": "5ac0da72-d62c-46bf-a572-c60a87f11d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922241, "uuid": "a14f02ae-acbd-41e9-9a68-ad0448f05039", "value": "54edd68b57574f5c98a257b594a61a84cf2a0b12629716fcf07ae7694268e143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6c87df-4bae-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693892433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892433, "uuid": "6b3f5e6c-f197-43f5-b8c4-ead1b48f76b6", "comment": "Malware payload", "value": "c82288e91b9b0985909d14ed5337c643", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892433, "uuid": "811b87b7-246c-4d17-b859-851ba42b9ca5", "comment": "Malware payload", "value": "559d96dba9a81fc8ba3595454fb3bbabbf9811805bd29df8d3dab1535d0c1022", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892433, "uuid": "5296db38-4c14-4531-8fae-e10e109e85cb", "comment": "Malware payload", "value": "df8ab5fa3a746a63a5811d82e16b14ea13fcc83e", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892433, "uuid": "21653b71-9715-405f-a7b1-b534a3fd947b", "comment": "Malware payload", "value": "2efdb7b61acadddf17eee8026d76eb74db3d6b69ef68abd3080946653dc73b1769d26407c8535b32b3119a3011ee656e", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892433, "uuid": "ed1e4f23-4022-4892-8dcf-c65e86881aaf", "value": "T1B614129DA78008445B8757A173F02057CECB90EBA4519DB77C6F89864F01E272993BEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892433, "uuid": "f3a959a7-dcf7-4a71-8b6b-311cfb626ee3", "value": "3072:EZu9l6ugdu8ZwqUn51FncNhZ1N4q7G1ehPdlholE2zg/UB4FfDZjZDzkjnfLLRa:WuefU8ZwBn50hZ1b7GA3lUBc/bFf1ZDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693892433, "uuid": "e3eec6f5-efa4-4998-84ac-91d70819a3cb", "value": 192726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693892433, "uuid": "c489cd2d-f1ed-476a-8eff-b15df53ac784", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892433, "uuid": "1728f1f9-7ef7-4c8f-97e7-1edb74a509b0", "value": "Signature-Mails-75028.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2288364e-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885734, "uuid": "c13c2f55-ba71-4dca-9b1e-ee85ccf95de2", "comment": "Malware payload (Mirai)", "value": "93d270e29681ccd3b571547add6538e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885734, "uuid": "2e4c56ff-150d-4cb6-a934-59b7e9359075", "comment": "Malware payload (Mirai)", "value": "55d8ce1f15600603d1cb6eaae8af0da76acb10ce01c70f9b01c1fda6938bc0f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885734, "uuid": "77d77967-b15d-4c20-8ec6-37e87429ba16", "comment": "Malware payload (Mirai)", "value": "8fc0019d2763af2d275e128b0e74d686751b47d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885734, "uuid": "182c4a47-9c2e-41f4-a4a0-78b4640205b4", "comment": "Malware payload (Mirai)", "value": "89df07a1f3c3a64942174d3124f30b8f392c8f9238eae9d31cc4a80f6a20ac30294413a7625ec66f37410a1fa34cf7b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885734, "uuid": "f34f4610-7a31-4b7f-8693-25ab45a4d8b7", "value": "T1B9D2D13280493B71F3F22976DD3742429BAD1F3C81E7FAA2962576986CE70D1E524C4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885734, "uuid": "1ca91fbd-a4f7-47b4-bc1f-b13099d148e6", "value": "768:EWfqCHsF6at08FqjMCmRdtzjUUxPisseq3UIyu+:Bf9MJt0qHzxiskX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885734, "uuid": "cd3c5f51-1f91-4c42-ba4b-ae528082455c", "value": 29272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885734, "uuid": "9da98bd1-b948-444f-a9ce-a8d33c8d9c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885734, "uuid": "5ed23cd8-4d5f-494f-b7a0-4f6ff9afa554", "value": "93d270e29681ccd3b571547add6538e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5f6661-4ba0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693886126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886126, "uuid": "b315b4d9-f74d-4aae-bd06-ad8c423edc72", "comment": "Malware payload (njrat)", "value": "1fe8fa1834d9952ca80236f481cd11c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886126, "uuid": "ca9cda45-8a26-4424-a1b2-264377416ea0", "comment": "Malware payload (njrat)", "value": "565f68ddbcaf3ef1e9100c1f2b09380f04da4613d060dd476459fff883820a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886126, "uuid": "16fe0957-88b6-4480-8c89-21a354583297", "comment": "Malware payload (njrat)", "value": "cf8657291d1604376cafaa70f73607c64f32f821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886126, "uuid": "45f0795e-8faf-49a1-a392-45636180823e", "comment": "Malware payload (njrat)", "value": "957f09c2194efb57ee70609eb55d26d2dc2a99259328b4460b54ceeff3ae292b9569e91d43faa7de9b007b0b2c6ac165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693886126, "uuid": "4645cc54-0771-45db-ad92-7248713131a5", "value": "T14D033B4DBFE08568C5FD067706B2E412077BE14B6E27D90E8EF6649936335C28F50AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693886126, "uuid": "87be2322-99d8-40e4-8df4-678d1272572d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693886126, "uuid": "b4885654-cdde-4406-8eee-e3440e1e407f", "value": "768:ZNv+R1NkrppqFidrM+rMRa8NuKdtXhLw+:Tv+R1CNpqUG+gRJNddw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693886126, "uuid": "f614870b-a4a4-47c9-aef5-811be080887c", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693886126, "uuid": "0c1bf080-5f6c-4067-b792-3d2c6a9be123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693886126, "uuid": "a518bff5-075b-4311-986d-b650cf55503d", "value": "1fe8fa1834d9952ca80236f481cd11c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa89def3-4bf4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693922470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922470, "uuid": "134dbed4-c6b2-43d2-b0d8-3ccf1a3d31c8", "comment": "Malware payload (RemcosRAT)", "value": "cffe529403460c6affe0f52c1e7de602", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922470, "uuid": "49d82daf-18cc-432d-8612-19a3586eb7f0", "comment": "Malware payload (RemcosRAT)", "value": "56a3dc5c90ade897e349ba0fd0433770dcdda32b5bd2a1c6608b2af2f9b34c05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922470, "uuid": "f27eeb98-b3db-43c2-a137-653cc3376cfc", "comment": "Malware payload (RemcosRAT)", "value": "3e03898f87c2cc47d57893c3dd55302281e9f2b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922470, "uuid": "4b75b090-60b2-442b-89c0-2e64b8b1c551", "comment": "Malware payload (RemcosRAT)", "value": "cfe25bb9dcc00f521d8ad39225f261a806549032f3a2109a8c3a41d625a4db969d4b0a4d8886b653d7d5d57a349633c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922470, "uuid": "b6aa4219-10b9-47c6-b269-59d38b4c207f", "value": "T1E5457DE2A354CC72F06A3578C849B6C0382A7DED693A5CCD666C794A1A73761793C03F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922470, "uuid": "0597823a-d5f1-4f92-9e0c-5a0a601141e9", "value": "beefa6546dd4570bf21020f1082d8b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922470, "uuid": "a666b65b-5b17-466b-8960-2ea019274b5a", "value": "24576:ORTaL+A2f8Zhp8bYm1EnyWjkf0eFuPD+4m:gTaKsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693922470, "uuid": "a06b175f-6256-4f2a-a75a-de7509e3a951", "value": 1243648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693922470, "uuid": "708a13f6-55cc-4a8d-9a91-9ed99909ac04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922470, "uuid": "224d71d3-16e5-4524-a0e9-422e1c3bb85b", "value": "cffe529403460c6affe0f52c1e7de602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9480a79b-4c22-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693942189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693942189, "uuid": "e9dc2771-9080-463a-9e18-3ead158ca8b1", "comment": "Malware payload", "value": "55c86e7390185b0cd596d179bbb5d1f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693942189, "uuid": "3ff80057-e877-42c4-ac22-55e29e7d03dc", "comment": "Malware payload", "value": "56d3ec75bec33d4b0ef4cef57f66dae9d64cf5d6eacb8c3caec3f0b745606f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693942189, "uuid": "7a6292c0-6c07-4fea-9c60-2bdd90a6a464", "comment": "Malware payload", "value": "bb17fcdc78efbfc68d4076b7d103650e8be219ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693942189, "uuid": "19fe3912-f023-45ef-9f99-1495cf8def51", "comment": "Malware payload", "value": "3f1de552c8bae13b0c6c4ef4af8907b288bfd3fb847036cef2ca01c8c4081b6805f7c55cada23e7e3d23d91b60cf2749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693942189, "uuid": "b33dae47-aba6-45d0-941c-5557a0dc6a7e", "value": "T1C372E62163EC872BE6FE6B795D72111007BABE4B6835DB4C0E96108E5A33B414E12F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693942189, "uuid": "35b28d6b-f2ad-4982-8bae-39283c81dba8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693942189, "uuid": "c2dad3f2-4631-4a69-af9c-949ed1d9820d", "value": "384:FjYw8dQ7S1+0fV2dMkb2I/kXyZaQOL84SOEsCBjEfAk:FEXdQ21NVab9804REsCBjhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693942189, "uuid": "41887969-4f7a-4cbf-93b0-8ef0866a3b29", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693942189, "uuid": "f530fa6d-9ac6-4548-a14a-306389a8d455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693942189, "uuid": "a1ffbe3d-f538-4673-8906-d4e55923f9d1", "value": "SecuriteInfo.com.Win32.TrojanX-gen.25794.3034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148f7527-4b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693877121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877121, "uuid": "4f9a3f05-6b5b-41e5-8a61-3ef49bc4e5bf", "comment": "Malware payload (Loki)", "value": "9b20ab940a2d1bdb2118a2b4ce3626ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877121, "uuid": "46e1420b-6d16-42d3-9352-80e83681bf9f", "comment": "Malware payload (Loki)", "value": "56f0530e2fe7f20dd89155c53333036a80aebf510d8217fd83f74229b1fbefa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877121, "uuid": "c9a6961b-68c9-45c7-8e2a-6b9fdf9753d1", "comment": "Malware payload (Loki)", "value": "d0c1cb9b96e9fa35452e3812a6416615b9037168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877121, "uuid": "83034eee-41c4-465c-a83f-14983067af74", "comment": "Malware payload (Loki)", "value": "f00632c1521a57ce473ccb8cfee5f1017ddf77ca3bbe8b26ca7434b54653a382ef63065e6fddfb1c67a142f0fdbfe2c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877121, "uuid": "13289c76-128a-4ef8-b594-5abe38d5b0b9", "value": "T1CD64AE38B6F4341CEA6C05B1BD391D0A35A33BC6B48105637DAE3099A85EF90EB5CB75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877121, "uuid": "59a54254-83bb-4406-9831-bb884558d3ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877121, "uuid": "6f8a91ea-34d0-41a4-b9b0-447888dcce70", "value": "6144:wU+RsiQ5qj3cwsc6EilHl52HvxHH8qfxntk06SgYQaogmI:wTs/52oc6LlHiHJn8sntkSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877121, "uuid": "82c4ac56-9b3b-4074-b357-030c1056c451", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877121, "uuid": "b09c5456-24ed-43d9-b497-1f7b8c8088dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877121, "uuid": "5a96cae7-4b95-47b5-bc30-1d587df37afe", "value": "IMG203948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089d22bf-4c06-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1693929929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929929, "uuid": "3b8e7889-4cd3-4dfd-a236-5d8cca8d7134", "comment": "Malware payload (RecordBreaker)", "value": "09474a45bbbe3642ceb117cd678cc201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929929, "uuid": "33602947-3812-45a3-a87b-9d2f1e6a0087", "comment": "Malware payload (RecordBreaker)", "value": "56f72bd5bbb46ed2afe6db50c751172f6825966c2d3f80308734f07aed402249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929929, "uuid": "1c437cc6-76ea-40c9-97b9-fab8429abf67", "comment": "Malware payload (RecordBreaker)", "value": "49d228365ebaa022ef617e356801abb23b4f95c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929929, "uuid": "3b7dceac-3cb9-48e8-83af-948ff4174425", "comment": "Malware payload (RecordBreaker)", "value": "a4750e9a387f09cadfe04894187d29f6b31e52e03226231f5c52e59bcb00a1d2d47a99e935e70cdd0ec80e7fbbc4a3fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929929, "uuid": "b3a4314d-0a6c-45f6-b0c1-5d1314fb7d83", "value": "T11276F163A0DA2471F8732A367892D432393E5C8CE04629A929F4AFD7F572D0C5F4B791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929929, "uuid": "db70d09b-d070-4276-a261-47b51ec65a18", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929929, "uuid": "ea0a43e9-6921-4811-8214-1f7ee9b2bb5b", "value": "98304:QZcZBwjotiAqIZZn9mU2BhNITBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64Ta:YjOpqIZv2yTVHJack+YlGlSRRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693929929, "uuid": "ecfed500-4a54-486a-a1a0-7c7549816cce", "value": 7492944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693929929, "uuid": "406cd20c-2c17-4c9c-b34e-740a9fa75759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929929, "uuid": "b9c72cc0-8cff-4436-87e0-e7c6761f4f69", "value": "09474a45bbbe3642ceb117cd678cc201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebce545-4bf7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693923738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923738, "uuid": "21cdf08c-16aa-4e6a-91f4-eef854e85a05", "comment": "Malware payload (AgentTesla)", "value": "26d19932ef0d450e1e47647209ee7114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923738, "uuid": "baea013c-742d-4493-92e6-ca3c3e358775", "comment": "Malware payload (AgentTesla)", "value": "57484231b68bfb5c3047448ba2020d2f683e22f9d86f31bb9e8a610567cb118c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923738, "uuid": "7e0ab638-9ae7-4d3b-8e3d-069fbc4bcfdd", "comment": "Malware payload (AgentTesla)", "value": "2affcb59eac374d72de1021048d31dc23d214b58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923738, "uuid": "9ecae612-9547-4ba7-a02d-fb4702cdd2d2", "comment": "Malware payload (AgentTesla)", "value": "a3eb97f5f0aa2552ba56949a879edc3dd059226c4f02dbf3cd77ef57b9390595b46c2a27581ba5fa8165448267f0aa78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923738, "uuid": "a98805f8-3e74-4562-9eaf-021dbea64cdb", "value": "T17AE41248B2B89F67E6BE97F5441435A803BA685B2132E79C4CD7F0E726E0B904641F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923738, "uuid": "827f5d0e-930b-495d-a549-52b325a6af01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923738, "uuid": "120e394a-2a8d-4b4c-9adf-970c2edebf35", "value": "12288:g4G/U8mzSLZcm+1EmRXF3QOmp5NIgSQthwavk0KnkDwMD8Ht:g4WU8msZcm+n13Q1FRtDrqkDV8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693923738, "uuid": "d58768ff-28d1-4703-84b9-3048270496a1", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693923738, "uuid": "735cac68-a357-4121-b01c-4599d9317d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923738, "uuid": "66edabfd-3898-47c2-a71e-de64f54d1a8d", "value": "debit note pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189d217f-4bcf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693906333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906333, "uuid": "0291b577-19f8-4e96-8f4b-3f46cf0dc32a", "comment": "Malware payload (RemcosRAT)", "value": "cbf234faf143cd9fdc9702a6a976153c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906333, "uuid": "1cf169c5-cdfe-41fd-86e0-52f06a12bef9", "comment": "Malware payload (RemcosRAT)", "value": "59e7f344c86d2adef46011daccd3206e9fb87ad3edc3b88910daf4e5bc5c2401", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906333, "uuid": "210c8c8f-06ab-479a-9238-4050863883dd", "comment": "Malware payload (RemcosRAT)", "value": "3a80997a96677a0bacd43a14a776a5a3dd716cae", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906333, "uuid": "b6ee7528-d921-4d05-98cc-f5155bbb02c1", "comment": "Malware payload (RemcosRAT)", "value": "be1ebac2ed11318937446a9c804f149b6eb1b374416a7cf17fd8eb3dd3e1ab035f483c5a5c7b9153f3428e7e2811fea0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906333, "uuid": "b9810e7f-609c-49cf-b46d-ca5ba93ef35a", "value": "T165A3336D938B4460CFA463BB831BAE0895FC776EB3589176B89C133037E9D79462603C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906333, "uuid": "7decc3f3-2608-425e-a009-37d70d0bd0b3", "value": "384:ojGD480k5SMgBeIPu92IqYz/ibe0sdOq0A/0mmmH:Pt04gBeIGEs/ibe0GO286", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693906333, "uuid": "756bcea5-2673-4e41-9aa7-8eb1faffdbbe", "value": 104980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693906333, "uuid": "afec9c24-63f1-4a2a-8faf-642b8c487f9b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906333, "uuid": "36041ad4-bc74-4566-9459-b903654708fe", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c95b6f-4bdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693912608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912608, "uuid": "8ee4c8a2-b324-41d7-b715-02104b8809cb", "comment": "Malware payload (GuLoader)", "value": "e5bf9584b1fc072e5af448c9e69a4ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912608, "uuid": "41da6333-c819-46bb-a0c3-38e350e4ac89", "comment": "Malware payload (GuLoader)", "value": "5be9a105842416d225d391c67414ca7dd1f429a785edb44d76023d6bedc381ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912608, "uuid": "bc9bdcde-a812-4875-95cc-a5fe7dfcb530", "comment": "Malware payload (GuLoader)", "value": "99103fe0be9d7919f9756dbd190cfe0dfc69f6eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912608, "uuid": "2d2e847e-1938-4fe1-b816-f40023050f89", "comment": "Malware payload (GuLoader)", "value": "4fa39f3fd71664ad967216669dc306f52ed077a8133ba38bb80a1b2d21f07811143523ee9ac8bbf9dc7b3427486898aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912608, "uuid": "c7b850c9-c974-4220-85b9-4b387818c4cd", "value": "T12DA4225223E0CE1BE657727AD47AAEF486389E42D9360B0B1B11BDBE7D30351CE14762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912608, "uuid": "687d11e9-e3b6-4857-a28c-267204eefb13", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912608, "uuid": "6ec10e44-3517-4a18-a5f8-0faf1311d0d7", "value": "12288:OqYRUZ2Ro17RhWF/1oFW0qUot/moNPKlr51obRH:ORUZ2q1HWF/aWU1lgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693912608, "uuid": "8267a59b-acf2-4933-a813-74c0248110f2", "value": 483332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693912608, "uuid": "f19f6e73-85a4-41da-add3-c96f63913a92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912608, "uuid": "573d5609-e80d-4ad9-8887-7523812d6978", "value": "5be9a105842416d225d391c67414ca7dd1f429a785edb44d76023d6bedc381ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f42cabc-4bf6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693923149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923149, "uuid": "5e24b0e7-e733-49cb-8825-89bc679327d9", "comment": "Malware payload (Smoke Loader)", "value": "0635ddfe2cca62b12b5032b420a3810b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923149, "uuid": "dc08301f-9d39-46a1-b93a-4a5e1a1dbaf9", "comment": "Malware payload (Smoke Loader)", "value": "5c1735b8154391534f98e6399a2576a572c7fd3c51fa6ecc097434c89053b1f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923149, "uuid": "eecb9416-e02c-4e87-a298-d30c55855c76", "comment": "Malware payload (Smoke Loader)", "value": "3309142e04408ef36249a7ba5945f7e641035801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923149, "uuid": "3018cd86-85b3-4aa6-afe0-0fefc7dbba69", "comment": "Malware payload (Smoke Loader)", "value": "6548884a706dd27fac2359a481b1db1f299717c44a64e65f05f82ad45816d349074ac296c7dc72c1a551d0af0ead3e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923149, "uuid": "bef191b8-3d83-4a78-8c00-6fc6bc296610", "value": "T15C544B83AEDCBC61D41647318E2EC6E8771DB851BE096B5AA2186F3FD4793B2D163310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923149, "uuid": "d3982ee5-802a-4acf-a115-b45f32f5bf6c", "value": "cd74dd88bfa053259aaabed77401f3a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923149, "uuid": "c446c6e9-0d6f-4340-b6f8-87ce2610f813", "value": "3072:/wpV356Q75/6qlk33LWkA/d0VSV8uwlPjCXP/w5pwA6mN3YAbJ5llaa0k87:opP/6qlkHLWkAXUPjrpwA6V04a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693923149, "uuid": "ae9e9df9-375d-4397-8cd8-9b687edbdb3f", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693923149, "uuid": "0c5e2f33-6922-4468-b19e-1c59de893948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923149, "uuid": "960be08f-bcff-4b3a-b440-e611f59c1c71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b2ab6a-4bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693895544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895544, "uuid": "ad664040-65fd-4d3a-af28-9543b1d31748", "comment": "Malware payload (AgentTesla)", "value": "899bec8ade4b0b4e450f309ce8c0d9a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895544, "uuid": "51b9f757-21c4-4a3b-b746-8f81a8cf423c", "comment": "Malware payload (AgentTesla)", "value": "5eaee0dafc1a86ccfbb28508d7ff975a85329f8a8722baebddaefa553593b80f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895544, "uuid": "6e051605-b123-4803-bb99-c3c496edf728", "comment": "Malware payload (AgentTesla)", "value": "aca0fc8d1a982333ff24ce7486f5bfcc836389f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895544, "uuid": "a2c409e8-b36b-4b0a-bb83-b6f73fe8c28e", "comment": "Malware payload (AgentTesla)", "value": "2f1a1206018b25c5ce6871643072290578bdf371e1e7a6576293ef91efd0661b457dadb47fb85b274405c089cc60999c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895544, "uuid": "6af031f4-c012-452f-894b-498ba93a269a", "value": "T187D423812E1252ABE4BAA7F659110130CBB08A1B257FFF8C4EC663F651D731266427F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895544, "uuid": "78446ae0-7e7b-403e-8d51-7a5b73f8298b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895544, "uuid": "9a71f0ba-149b-420c-925a-0f152053d90e", "value": "12288:Z9/XRXXUcy6av1KFnoH2b+gcrsZttSn+pjjtM0:3/XRHjy6adKFwn+RS0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895544, "uuid": "ec4ebc70-7598-4a78-86c5-6df89ee07056", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895544, "uuid": "241f7c88-a5c5-48ae-9976-7efd0a87402e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895544, "uuid": "16b74810-c34a-4c4e-a6fa-cbac92c4bc38", "value": "Request for offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21441823-4be7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693916656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916656, "uuid": "62c29331-fc0b-4cfc-88ae-3241df76798d", "comment": "Malware payload", "value": "62b1d5ec0e9d91af515b4141eb1d4114", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916656, "uuid": "b7bc3fe5-dfba-4d91-8393-5ddb9ca81ca3", "comment": "Malware payload", "value": "60118fdf009e44bc0c45b70d86efddfc2e0d390141e82f4367a7cb755c9aeed4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916656, "uuid": "110e57ee-e7e8-4aa0-98fb-14f642b4715b", "comment": "Malware payload", "value": "20180a83a000aee4f86db2686a3e597dfbefc568", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916656, "uuid": "e53e6f02-6c81-436a-b8a1-57d8cda7443c", "comment": "Malware payload", "value": "9b3eb242ad02b709dc6a03ffa8040ce2ae9c08423f74e55540ab4a93c9b5e2731cc0ef56e1a86cb3a440b202ccf758bd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916656, "uuid": "1e428d67-03b8-4b9f-b03c-8e6d321c0b50", "value": "T1E205235C5C1CE536879893F5270905EAEEE270AD1E1E1EF868D3281C45C7EE98B2E770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916656, "uuid": "1dec6da2-85d0-46ea-aa95-eaf740bc2102", "value": "12288:YML7nvXmv3+4Sx2LUl27hH30bP47jVPfTNB05JUhHnxMeg/mMeT:Vmv3EHQH30bg7jVPfTNu5Jq21/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916656, "uuid": "b7bf30dc-9748-4f5b-b03e-7e4922d53628", "value": 806684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916656, "uuid": "bc784bce-d39d-4776-9f89-195196aad280", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916656, "uuid": "069669b4-a869-47b3-964f-c13e6795cafc", "value": "Orden de Compra No. 20181.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51595c37-4be7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693916736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916736, "uuid": "c3329f4f-2fa8-4f3a-92a0-04519b6d2871", "comment": "Malware payload", "value": "abb344d9640f18c36c8537bbf41ec874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916736, "uuid": "ca222830-aefe-4081-9e5a-50b6fd9b893d", "comment": "Malware payload", "value": "60f57be591e54e5d90ce837593518e23e826aa623d48816ea2bf397cedae6441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916736, "uuid": "660c9f70-1bc9-46e2-a0c0-6d51575ee59d", "comment": "Malware payload", "value": "f23867dba7bb4ea7ffaa2d29b0729a68e1b78b2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916736, "uuid": "9519dbc9-0bdf-4177-ab41-ef554728a370", "comment": "Malware payload", "value": "b5859582fa0e2ab505fbac19ed5ba3f6742fae03f9d2435046bb9229201c35a1040a55351e99e9c7e171a13301559769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916736, "uuid": "bdb4462d-fd6b-45d9-9b67-6a7f47a26136", "value": "T1E207E111F9612174D84630B2782CBB3E5E380A2BC77589DBE9946CD47FB85D2323A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916736, "uuid": "3b35b5b4-31a6-4ae4-9cc1-0b152fbef319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916736, "uuid": "d83c512c-e1e9-4c92-861b-4e1c6c4dc931", "value": "393216:o/gfGhijo3hVoYYo/giRTxkS8uBb3V75rbQndRu23rR2kIiBRqGQ/VkCpuZj3NG7:vGhiGgwV75r4u239uvZoMiw6A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916736, "uuid": "81073cfb-5a0b-4f56-b127-adfc7e622cb8", "value": 18377728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916736, "uuid": "a7a11c83-2e20-40fe-b7f9-3636d0b7c906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916736, "uuid": "78da9177-354e-49c7-921e-fc0547686343", "value": "60f57be591e54e5d90ce837593518e23e826aa623d48816ea2bf397cedae6441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b850d3b2-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693915191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915191, "uuid": "c73497ec-75d2-4cca-901c-aa5d13706bd4", "comment": "Malware payload (AgentTesla)", "value": "62eb2fc7e30be194a8d3beb0977aceaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915191, "uuid": "9f8f50c3-dc5a-44d6-bccf-a0ccc6b98f67", "comment": "Malware payload (AgentTesla)", "value": "61b761d7a48536d93b3570b1a47695c8160d753cb61b3fcac777acb0bb61e424", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915191, "uuid": "b0df49e0-a016-4653-9c57-31452020e2f4", "comment": "Malware payload (AgentTesla)", "value": "5c6813b5b658e76e1e40dc2a5c1077e804a2af5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915191, "uuid": "7c50704f-4617-4f90-bac8-b14670e6fb41", "comment": "Malware payload (AgentTesla)", "value": "a8b73fedbe86520b357a79e52f21c7f086961c580d3383e1c5f77562907ba826c5ac7fa851e2e4c388cfaded927da41d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915191, "uuid": "bf7be73e-8755-4bad-a796-1958e54fad1d", "value": "T1DBF4F15476B85F26E679C3FA8534650817F9769E283EE34C8DCA74EF2761F420A01B23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915191, "uuid": "4bf684fe-8111-4f2c-b6a6-1e472f2647a6", "value": "12288:fgiDhpFun9VfJhiEVOhNs+BK0vhdxaac/7jg2I6gwIzq1UhRcOJ5c0D:f/hp0n3BtUqU/27jL8wIzW5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915191, "uuid": "d00e7528-ab93-4ef0-b4ae-26092f286631", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915191, "uuid": "7e519f33-baed-4fff-84d9-b83d7c40d587", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915191, "uuid": "b3ed0f54-356f-4fdb-aa26-43727575d24b", "value": "nordinazione d%27.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef234c70-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874051, "uuid": "a4d95f48-60d3-4b05-8726-b731f6d5aca0", "comment": "Malware payload (Mirai)", "value": "6b5db3b9ce02f7a900c25941b05e792d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874051, "uuid": "9f7bd881-f88d-458d-a957-292f7b27f59f", "comment": "Malware payload (Mirai)", "value": "620fdf8c1be24608014455e5b9cbdbd9267461ce63712eaf3ff876fe012813bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874051, "uuid": "ad25e1c2-9194-4692-bc92-e7a37e2c91e6", "comment": "Malware payload (Mirai)", "value": "c8be6bec1e1180db6aa2eb3b0eff65631747806b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874051, "uuid": "3bc6debe-c57d-4e90-83a4-f511189243a3", "comment": "Malware payload (Mirai)", "value": "b6099cdbf7e2b8bcb9a9c1d15afa7df470031f7640b98432ca9e96cb4af7a9ec2e3dc7da38b9fe68fb1e274b5450f845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874051, "uuid": "e99b65a2-b325-42a7-9c6a-9b2c90af5f85", "value": "T130A2E019BF58828BC832797455D9F5D21397FCA1F29DCC4A2940C15FF0A33A96834F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874051, "uuid": "063ac899-58f3-471b-9ae8-1a05b13baf11", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTe:798o08kxofBE+ZkXaITbp2F2TWul0c5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874051, "uuid": "05e3bdeb-72e0-476a-98c6-38406120bd88", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874051, "uuid": "c31b780c-6e5f-493f-b5f5-b6e59a86956d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874051, "uuid": "63462c60-c4e5-4b94-989a-3e14c87b384b", "value": "6b5db3b9ce02f7a900c25941b05e792d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df24e7d-4c0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1693932998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932998, "uuid": "e42fb8da-a4a9-4625-af3a-4f9e732744bd", "comment": "Malware payload (Meterpreter)", "value": "3ff00881bbc994ee27612517d0724539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932998, "uuid": "657e92c9-7e7a-4a1b-b422-3ef65720b94d", "comment": "Malware payload (Meterpreter)", "value": "62347adc0eb422dbe801f0e4275da3ea80c49b55eb1e5ad2db199f17d25a416b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932998, "uuid": "dc73251f-ac3c-4ad3-8b53-1d1886cfb4f1", "comment": "Malware payload (Meterpreter)", "value": "17577d9d7b89c173e167775e98cc34b1b3587a17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693932998, "uuid": "e97efd58-c563-4db6-ad6a-562734f9f788", "comment": "Malware payload (Meterpreter)", "value": "aa36077261495c7a42946d1a51b393938aa59d1e840461f79616443da386cf79b16b89e058a25bbba9e96ab53fd9b8ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932998, "uuid": "e365f5aa-53c9-47ff-920c-ddd3b9fcc1b1", "value": "T1AC65DF52B6C244B1F59601B516ABE77F6E39B141A720CAC3D3D0DC280D526E2EA3F35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932998, "uuid": "b20a12bb-98c8-4b1f-8c09-7e328d346cf9", "value": "1bcee876dfae5e68c3451c29f9217c72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932998, "uuid": "845826e7-c122-4b97-9c68-0cb6c1dd92a2", "value": "24576:WNbP9SNg9nmKu2HhIYjAY6RTVSTPkSnexozrxQAvTWjYIZTbRFPUN0gLuweIC:YTRnU4/FQAiFxfPka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693932998, "uuid": "a2f22f22-bdfc-4954-ac5b-627c3fe855b6", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693932998, "uuid": "de8de981-90b5-4c6b-8021-f827acec9884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693932998, "uuid": "34021fdd-95f3-4003-9666-42dcb162356c", "value": "62347adc0eb422dbe801f0e4275da3ea80c49b55eb1e5ad2db199f17d25a416b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b95e18-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926941, "uuid": "85332651-f5b0-4ebf-89f1-1b390cb22209", "comment": "Malware payload", "value": "55a594a57692ae976cb7ad8d51dc6fff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926941, "uuid": "06df9a6d-a366-4b27-a81f-ca3d700c37ef", "comment": "Malware payload", "value": "627292a9371346643c85839f6db2223c8019a04f1a7eb11883e23f5d780c9c0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926941, "uuid": "e8f5d355-e028-40c7-922a-a0d55dd58783", "comment": "Malware payload", "value": "bf032c58767a4f8581a92756ae20ffe2047348b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926941, "uuid": "289740de-596c-4946-bef7-bb639321a622", "comment": "Malware payload", "value": "f7da83d510077edb1ad8422cb81daa377a4f2da2f62e465b43a7db9d79c907e9dc928912b56d3b1c9357c15290818417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926941, "uuid": "9eaf769c-acc4-4663-8cdb-2947ccebf9f9", "value": "T12152C0D8200FE965E18A113F6ECA95D32D0B0921EF4E2219AFF545BBEF199D54F00B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926941, "uuid": "a3c31b09-2d8e-4c07-86db-199610329646", "value": "384:0qF6rAVBIwZ3iMSog6pSGCuMwLkIIhMF5L3q1y:0q8UVBTtF9S9QL3qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926941, "uuid": "adb082bd-5739-4c52-9735-b32a75f7a930", "value": 13952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926941, "uuid": "f9228b52-8b62-43e2-90c1-29a24d5dfc10", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926941, "uuid": "1c120aed-6e48-481e-95b4-bb1d2072af39", "value": "627292a9371346643c85839f6db2223c8019a04f1a7eb11883e23f5d780c9c0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82017089-4bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693902645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "434473d2-00ac-4822-877d-4656331d5434", "comment": "Malware payload (AgentTesla)", "value": "b85eeccf5c6ad6e5fd7dca4ffdaaf21e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "c2760d16-e4c6-4d84-976e-2e3d16dbce02", "comment": "Malware payload (AgentTesla)", "value": "628e749249520c025d931f4e78c48d9fc450362f60f7ad7d31f1e4e58927cfb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "24abe97b-4c7d-4dbb-90e6-3e44224d92c6", "comment": "Malware payload (AgentTesla)", "value": "8bbe7aa82a29c5c2c9c04c206022c5327e63b8be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902645, "uuid": "0c8eb19f-5032-475e-b247-8133f24dab9c", "comment": "Malware payload (AgentTesla)", "value": "69d1dde146442940a5d696ad15e488c20e779f411079d4f5af8cd3546b88078aa7572c4c1c659e518196e9dbfdc4f516", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "29397cb7-137e-4d7d-8aad-479a3ecd0077", "value": "T131A42293DB71D2F7C4034AB03CB44A29FBB4D0C95175061B375C399BBE1AA869C8E25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "43e349a9-a76f-42a8-b783-923f040f1663", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "c488dc3a-dd87-4e9f-8b96-b1a4d3aad958", "value": "12288:E0JI+8FhzTuCtWgZHYi9p/8/Qo6dU6Kx9+sOYhJOml:j83zTuKWgZ4i9t8/f6DKx9tN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902645, "uuid": "bf95691b-d92b-4baf-9a83-2d8e9edcf458", "value": 471360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902645, "uuid": "ff3a3118-b77c-40da-9a2b-a70e27c88130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902645, "uuid": "aaa9fb0a-1e6f-4b34-8979-1ddb9046bc0c", "value": "Booking EBKG09538802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566315f9-4bee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693919751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919751, "uuid": "205e7e6e-6bdb-4655-a9d9-a0790aacd447", "comment": "Malware payload (Mirai)", "value": "3436a3d5ba8931ba2d9b782cb175cb23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919751, "uuid": "93fea97e-9acc-4c8c-9557-528d54ccdf2c", "comment": "Malware payload (Mirai)", "value": "633d9d1bc90bf8f010e84107cd7f104f2ee8769bf2820aeee472186ddbfab0df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919751, "uuid": "b6d2f9e0-6ef3-474e-bdf4-ca6230d2280c", "comment": "Malware payload (Mirai)", "value": "fea36debe91b686633e9de44a6a778a881218d81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919751, "uuid": "55984caf-1434-4370-a461-cd3b39d6091c", "comment": "Malware payload (Mirai)", "value": "d2a904ddcd2b4aba188d5ca6c84dc9f09834c85761d49333005d6f7a846c1a12a9c1ea59ebea97741b92c88eb51e1fe4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919751, "uuid": "b0c0ba4a-81d2-43ef-9320-62b46688eb9f", "value": "T1E063D70AEF614EBBCC6FDD3746A9074231CC564712A83B3A3674D92CF25A54B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919751, "uuid": "06afe47e-e0b5-4573-9a4e-37f6a7a22b27", "value": "1536:ZX6OTnDInO5eTZAZ/dHFN8DXoCSrXnhv5A:3P5gZA2XONhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919751, "uuid": "b6928a27-83ec-497d-bb1f-084fc8694e81", "value": 68216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919751, "uuid": "a8b2fe73-3d71-4bf7-ba9b-3e525de4b337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919751, "uuid": "087f68f3-c957-484f-81e5-bdabb5885557", "value": "3436a3d5ba8931ba2d9b782cb175cb23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376ed09e-4bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693903808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903808, "uuid": "8d4811da-d3ba-4e98-a501-65707f222b4d", "comment": "Malware payload (Mirai)", "value": "b8b91a1a14aec9903553375d2c039e68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903808, "uuid": "79fbc4ee-51ca-45f1-8e18-759682bca692", "comment": "Malware payload (Mirai)", "value": "63f2ff4fb7b5fdcd7f848bbd2f0b30176e0dc9740a6036fbde923eeb946e1020", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903808, "uuid": "b36ce781-5485-4be8-805e-fd0cbcb65704", "comment": "Malware payload (Mirai)", "value": "2c1c95c0a5160e1060bd2423b80f63c9b63a36b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903808, "uuid": "8025770a-52b4-4b8e-9c8d-bf78e6a5b510", "comment": "Malware payload (Mirai)", "value": "197199e5e405a89fe08448c878addd5de1701a905e7e85f8654b7db2870f940a7e1639b49d1db6ab5f99083c2c5eec40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903808, "uuid": "8f6aae82-3e66-4136-9b48-68e17e6751ec", "value": "T16D33F27257AE29E151B08777FC33BC1AA6DC16E9586730DA2CF06A1977C58034EF2642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903808, "uuid": "494b8cb8-8eb6-4e40-ab1a-20ea8e75a978", "value": "1536:69O/ZMAXIxNUk05zDLcPqF1aBexo4opKZbC:69O/ZNKypDLGqFUF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693903808, "uuid": "60333e87-c8cd-4a29-a848-56031bef6430", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693903808, "uuid": "2279ab09-6431-406d-a18e-b1029daf88d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903808, "uuid": "447b66db-06d8-46a4-ad66-b51872d2945d", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239ba6ac-4c3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693954455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693954455, "uuid": "601bd4e6-dfce-43a4-8992-daf02fdbf9a0", "comment": "Malware payload", "value": "7ad1ba7ee327356de0a6c0d280fb4754", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693954455, "uuid": "b30f9f15-bf46-4790-a35e-f453a9650846", "comment": "Malware payload", "value": "64695508e6ecff99e522db5a0ffe433a577c8c4b8bc7a59d4dc8b9eca9520e9e", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693954455, "uuid": "fcbff62d-2818-4535-b81a-74dd66024df1", "comment": "Malware payload", "value": "842b2ba2bab2db2bd85ea28726b359d8b76c8638", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693954455, "uuid": "6eee119a-1771-44cd-96b7-8e050bd68869", "comment": "Malware payload", "value": "5d8cb8d49d01b0ee19b40814ceedac59b36345d420c6b4f087aa8f980ef1be5c7adea177313dfb0df563f4733905a39f", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693954455, "uuid": "9de1e260-3a67-453f-8a9c-324fa2e2cbc7", "value": "T1856633A9863BD9D8CEDF58324D6E2E335A06083AF5F64169E484BC187944F09F248F97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693954455, "uuid": "f1bb6544-86c8-4468-a1d1-3555e42bef0a", "value": "98304:43TXJv9FmSuggqk4GDfBmRJ6Ir1R5ZaLMcRtIIQx3BBs5OGRoeGo3bZjhxPGtORz:mD7kSuggF4GDwRbDPaFY3BMvpbZqOOef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693954455, "uuid": "56a8bb6f-9a24-432a-89d3-9a997b5928b3", "value": 6740839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693954455, "uuid": "1466f9c3-8e67-4a4d-a6fb-43fed814bac6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693954455, "uuid": "da3694c3-ba85-4d23-bbf8-7d6bb9e56203", "value": "AnyDesk-x64.msix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92d7988-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890255, "uuid": "01e3f820-7782-4238-ae97-2feca12ec836", "comment": "Malware payload (AgentTesla)", "value": "153afa823f6b1d7166a255f0b9226018", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890255, "uuid": "bac2ce7c-2319-4f5b-a3cf-371276ba8b5f", "comment": "Malware payload (AgentTesla)", "value": "64b60ee9c91fc4e3255f8fad1b88f497d59965242647f7ad12ee94acb09d5e26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890255, "uuid": "155fa2bf-f255-4616-9a0f-3611ee7dcff8", "comment": "Malware payload (AgentTesla)", "value": "7ecd50cedb0b74ceb87b66c47aca4766f784df5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890255, "uuid": "dd240bd4-f4ac-47c1-90e5-2cc588037234", "comment": "Malware payload (AgentTesla)", "value": "93ba3a3ce34dd6bc80c71a978931ce2b28b0279b393c7aa1088c43f26ac95113325bc2cbf141caa6cadbf652b30e9cc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890255, "uuid": "592ff896-7e2e-4928-9531-519cbf4fc5cf", "value": "T101F43334B6146C94B78EC36042112ADD77A191D0537EE3BEF5FE6EA2E01BB7B6741022", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890255, "uuid": "4ce6209e-15e3-42c5-8bdd-9658d9535d19", "value": "12288:No7JCogj6xk6pvFJpXmAp1CFH3B2d+sEwbnZK9fIt9haC0xd6BwUfjqOW9n1MBmv:W94j6xk6pv7tdSXDsEInhJaC7BSaU7Vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890255, "uuid": "d08d0c5c-02fc-40a5-b52c-191e5cfaf007", "value": 741759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890255, "uuid": "daba0d70-4648-4b60-9ed6-5c50e8c0e151", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890255, "uuid": "05044ef0-796d-49fc-a269-ed11f6f2f093", "value": "PO#1803842.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b812d6-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905308, "uuid": "3c2394a3-ff0f-4dd7-a623-0588ef299a3b", "comment": "Malware payload (Mirai)", "value": "d2063ea748eb904c8536984202938af8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905308, "uuid": "2deac3b2-093b-4d3a-819a-7d046d2264ee", "comment": "Malware payload (Mirai)", "value": "6697bc6b3dd7e0cad077af8503e4f95f63d16d11f6f8daa2ffd67c3685b4549b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905308, "uuid": "5f338f5a-0840-4913-a101-1d22b39b4ea3", "comment": "Malware payload (Mirai)", "value": "ce14691b97f5205bdb250f9c42b36d0542381bc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905308, "uuid": "874d7504-4b36-44a8-a95d-0a060542685d", "comment": "Malware payload (Mirai)", "value": "f3704e93ac48d2f3bca3817524cdb1fa1e3dff1d0e0d815f007e6b1e113f343a71d90c5f47ed924509669a8ab9ecc485", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905308, "uuid": "eca4520a-3688-49fe-a01e-a7d48b95c88b", "value": "T107E2F1A7D372A052DD782BB1F96E85CB6BFD4F9CD13770A31A0456282A560035F3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905308, "uuid": "aa063612-b23f-4872-8bce-426323bb176f", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9Xgti19q3UEL5Is:Porm1vpALgUJkiIL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905308, "uuid": "04353572-7178-4875-907b-c76e2e6c4c87", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905308, "uuid": "d3478e8a-62cb-4e97-9005-20dc8293559a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905308, "uuid": "e52d1dd8-c844-4f9a-940d-557a953ed8b6", "value": "d2063ea748eb904c8536984202938af8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6017dc4f-4b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693879824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879824, "uuid": "550be4f7-8dee-4f01-9f49-7281280c08f0", "comment": "Malware payload (RemcosRAT)", "value": "67641664818bff85950ba48865f5abe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879824, "uuid": "b9330c3b-c6ce-4225-853b-fc9d950beabd", "comment": "Malware payload (RemcosRAT)", "value": "67334009d5d6fb492333a8d6a850b2c464654aaaf96ddeef125129af29ea3d66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879824, "uuid": "f1875ffc-ad68-4bc4-ba98-6b2b35ad1b4b", "comment": "Malware payload (RemcosRAT)", "value": "ff6320dd5948d3eab817e4027b09bc53053bd59c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879824, "uuid": "9d064288-c8ea-43d3-bf10-2533d460d22c", "comment": "Malware payload (RemcosRAT)", "value": "58f1016c100ad136c176906e388d10d79523ed404e6e40a2adb182557ee9a1d843978e2b5d2e004ae016ba912d36f78a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879824, "uuid": "28cca9fd-e22b-4a23-9b1d-1cce1b3a47e0", "value": "T1DA84F171F3A19417C4F6023E3C29967EA7E14C432D97FF1A23807F6A7972702960E659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879824, "uuid": "1757f56e-eb8a-4c1a-b5af-934f211f5b9d", "value": "d4b94e8ee3f620a89d114b9da4b31873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879824, "uuid": "51600f5e-7a06-4c95-9581-5d5f9c63ae5a", "value": "6144:UqaFH+9EKMusYcV51Z+qJ7H8s2Sf+NVim3hN30CwSvO6c+DjU5mcwo7Kq:c5o5cV1LFf+FN385+DcmcbKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693879824, "uuid": "4f288b42-9d22-42f5-8fe7-e0e150cf68c1", "value": 373217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693879824, "uuid": "b36a5ded-0741-46e7-82a9-f06375077154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879824, "uuid": "b004cb9a-6184-4844-a8f6-bb52d6ae393b", "value": "R60-2000-NL1-15.27 (ZSW).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f670f74-4bd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693910720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "da4a18a5-aa02-4a68-9dba-d3582091e014", "comment": "Malware payload", "value": "785cc2dca96525c74dc9fbe8d8474ce5", "object_relation": "md5", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "5bf8cec2-ae8b-4546-a8d4-d6c0ff6b654d", "comment": "Malware payload", "value": "67c4691c1d99f52e392edd443d6f11d7c20a25651727b379b3649aaa83faae0e", "object_relation": "sha256", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "ead910f2-8e74-4eb4-a1b2-897e87b9c10d", "comment": "Malware payload", "value": "9cb6c5bf9c703cd22d9052a0bea4d8b7da768047", "object_relation": "sha1", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "e7517429-f5de-4f0e-ae18-07510840302b", "comment": "Malware payload", "value": "7b941737e8401799dc845ce096eedc66c0a67cb4e70147cbb2a5cf24954a7c0af325c2349137a37bac0f5125c123da5c", "object_relation": "sha3-384", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910720, "uuid": "198ae9ca-dcb2-4bb4-8cd1-8cfad2af6c29", "value": "T1D653E09C7B783048D45218F83E461662C88B85563A5D5C533E8E97EE2F00BF26F47AE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910720, "uuid": "1fb7b8a0-197c-4916-ad78-5f7b01babb36", "value": "1536:XIAR/3ZL7+MPmO9PjLLLL+Tk7+tOaw6VjkQM:YO17+6d9PiTltCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910720, "uuid": "6c73a162-caa4-4822-8635-383c5b1e2141", "value": 61997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910720, "uuid": "4c75c45b-636f-4839-ba19-26d1ccbf203a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910720, "uuid": "04ff51da-dbcd-45e9-906b-f5d01521102f", "value": "Conferma Pagamento.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb42ac9-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884251, "uuid": "00248670-c10d-458f-bc76-53b0c7cf662a", "comment": "Malware payload (Mirai)", "value": "8863093b14086ce73b4556f3b63e1eb5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884251, "uuid": "01e0dfd0-c5f6-49c6-bc2e-ded1ec76b29d", "comment": "Malware payload (Mirai)", "value": "68acc9d3ba4735d9088fa60f02b1ccf7adf156c5df409b50ff63f8759c38115d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884251, "uuid": "b8e1ad97-8237-4b13-b155-35843b646a67", "comment": "Malware payload (Mirai)", "value": "ddfe2e9020fddef9503af0117597b58b02ec5cce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884251, "uuid": "cad30aa1-d09b-4c86-b9e3-f80aa7215674", "comment": "Malware payload (Mirai)", "value": "5eb5320bf6144002346dd0903a005243de2ccdc97646e2ab5e84c8c0f7dd377858fa0993b2a472f1898725f9f115c1c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884251, "uuid": "4fad9a42-ee95-4819-8013-ec6a80d22eeb", "value": "T11DB3F845FC509B17C6C212BBFB4E428D7B2A1768D3EE72039D256F65378B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884251, "uuid": "541c02f6-4ee1-449c-ae44-8ed034be2687", "value": "1536:0hEOKwQZiFi19AJVm4VemhTTrl8OUiUc1b9tsL0lk6wywqFWiBiNhgA3W3OD+Z:0hmoQ19l4Fh/rl8ONb9ezQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884251, "uuid": "7be8cdfd-840f-42c0-b01e-ec3725275724", "value": 117504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884251, "uuid": "62f7a956-b51b-425a-b811-05fa600404a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884251, "uuid": "74be95b1-2687-46b6-96b9-de47757e1940", "value": "cundi.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb2e03f-4c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693927867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927867, "uuid": "d62015cd-8cca-4bf3-a76d-fe38fae976a8", "comment": "Malware payload (AgentTesla)", "value": "1cab6b53e787af79c1295804d0ceadc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927867, "uuid": "07e6cbf6-9f3d-4e44-bfbf-3c05fb6d1442", "comment": "Malware payload (AgentTesla)", "value": "68df344e83bd01178e018d4da879a7cb8954f95bce29608b9473fbc9f92c96f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927867, "uuid": "eaad7ad5-e9cb-480f-82c4-66cbd690c5f8", "comment": "Malware payload (AgentTesla)", "value": "4316d42aecbb150b2ba3e49b6996ec010c4c322f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927867, "uuid": "50c0e198-c3d5-4c27-82fb-a020359a5667", "comment": "Malware payload (AgentTesla)", "value": "3b852f813f75d201d27e03423abee536547d3ab4f636c86d596fa0ad6b9abbb295a5a59335f6da7b086a5f959ecd649a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927867, "uuid": "e675290a-eb06-44e4-8608-55f8b1293b6c", "value": "T1F7F40281B3E8BF26D43E47F14521548047B25D6F69A2FB450DC3B0D32B72B921A92E6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927867, "uuid": "c602bef0-668a-4e83-83b5-1868b8fbfd80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927867, "uuid": "01e5b3b8-e248-4d57-a460-ec52ccc06946", "value": "12288:vHmakDwMD842WniCqVh4PCTZtbmS4aXXthGbCgCu/gN6MmTGDY0JNwfK0ZuBbaJI:fkDV8mniPX4Peb8yXaeWgNxmsY0JKlkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927867, "uuid": "547bfcde-b5e9-4bbe-b94d-ddceabd9d039", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927867, "uuid": "53bff971-2dcf-40f4-9b3c-8f89aca7fe85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927867, "uuid": "bcc6f9d5-d274-4001-82d8-4acd2515c433", "value": "SecuriteInfo.com.Trojan.PackedNET.2316.19151.11236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a095f4d-4bfc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693925878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925878, "uuid": "01b90bc1-17cb-48a6-8db3-48b64de2ece7", "comment": "Malware payload", "value": "be54c1c6cd7939219b7c4780545d3c18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925878, "uuid": "f6f4d059-9cca-472f-a155-06380d03b586", "comment": "Malware payload", "value": "69093fc23cd07404066217249927e4edc6f35e635cb48588bf9381e776484f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925878, "uuid": "00bd946e-e32b-42ef-b88f-5852abd75ba2", "comment": "Malware payload", "value": "00231e46e70097cf5fa38f66bda82df20dd498e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925878, "uuid": "46574eee-0652-4d6d-a6e0-dc0ba84ad8d4", "comment": "Malware payload", "value": "3d7f7c9a97b3147e70097886e561b4d16be7e9ce5077928804a7492a61a78ff1fd31f0b444afdd0c8c3f0442d3b0f40a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925878, "uuid": "8cb73672-43b8-415f-8b01-1f9252676f23", "value": "T15D266D07FAB244ADC8BDCC74865EE133E625B84A41127B273BD45B102F26B259F1EBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925878, "uuid": "904d4b52-00eb-46ef-8c21-50eb2a179d8b", "value": "49152:aNvAFc38+PAhZC1cO1V3bixIllKwSNar9Oe+SBRTTEqkw7Pa4c2q+IU6iNQk:aNvn3CW51v3BRTT+wS4t6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693925878, "uuid": "9efb0728-bd2c-4fa0-9eee-2cb843d6b028", "value": 4558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693925878, "uuid": "48a50494-acf8-4dae-b45a-e9ce02cfa1f0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925878, "uuid": "70cc6e1f-a2bb-4086-a225-8c5aca2f903b", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1516e91-4bad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693892013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892013, "uuid": "5e7d0651-00b2-4326-b1c0-2747eaeeacaa", "comment": "Malware payload (AgentTesla)", "value": "0b4e7b7e899ebba3fa66e3dd1bd95f8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892013, "uuid": "7fe24e6d-2e3d-4b53-a384-d5a6e4089850", "comment": "Malware payload (AgentTesla)", "value": "69d31a62dc0f4c9faffbe33f0c65dfa6240ef17dff57cc5ccc1a15f1219c5eb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892013, "uuid": "ac1c6d28-b02e-408c-915e-b0ea4ee7d283", "comment": "Malware payload (AgentTesla)", "value": "12f13aac4f95ca4a6f78bc12b1e93a1451e1a1f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892013, "uuid": "fb2a2751-e1eb-4efa-8aca-d86fc49b3a71", "comment": "Malware payload (AgentTesla)", "value": "52043f2532e038b8a934860e9039309344c316befc903ce8c9a640bb2cc259b1a46538428184ff0e3822d300ee9865f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892013, "uuid": "859b19b2-c258-4b99-8c71-d794b0d95934", "value": "T165E40200B7B98B17E67FA7F25858265403BA9C5B1071F7984CC7B4DB2992BE00741B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892013, "uuid": "712a9ef1-9e1d-483d-8328-702273783d9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892013, "uuid": "6780d6e5-93d9-4a55-9cc8-f5c7a7eef635", "value": "12288:Eoj0PfXDOGsnBjclityOd+pIt0Qt36/cULkgYr6M3O5ykDwMD8Hl3:EocPKGsnBYlit5oIuIELkgYGM3SykDVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693892013, "uuid": "160be371-aadc-4077-a711-c3ecd8216a5e", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693892013, "uuid": "61e1b341-47c6-4b02-a739-b0ce8a8f2bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892013, "uuid": "9e851c6f-3834-42be-bbcf-41e52e054f75", "value": "SecuriteInfo.com.Win32.TrojanX-gen.2970.21199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2103448a-4bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693903770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903770, "uuid": "5853cbb7-5f1b-440a-aa4b-239be77c5cd2", "comment": "Malware payload (AgentTesla)", "value": "3043fe3399f7ed9fa2174c03ebfe983c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903770, "uuid": "2496c2a2-d9ca-44db-91ac-f97117485389", "comment": "Malware payload (AgentTesla)", "value": "6a87d0d5b748e335538941087243f9885603d01a4985883ff48e8c1936f097ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903770, "uuid": "11aafb8b-36b5-4ce1-b5f0-cc65791d9d74", "comment": "Malware payload (AgentTesla)", "value": "e580e73a905c178259394c3ba795a5c946f0d557", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903770, "uuid": "de1d5b02-7c1c-4edf-a9b7-5c1f9e10d1ea", "comment": "Malware payload (AgentTesla)", "value": "7242a61fcf0c01b67ef4c70c54566bbff04fba0fc89f0e940e501ac8292c46e9b344606903f3a52df1cfe97a5997d4ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903770, "uuid": "5c07d051-6b23-4ab7-a18f-dc044c0350d8", "value": "T13564BF12BAC444B1D573293459F5E730993DBD200F368A8FA798752D1E322C2AA37B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903770, "uuid": "991f703f-e0d5-4411-af86-d32957c150db", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903770, "uuid": "03af0a72-6c20-4d05-bce5-149051cbe5ea", "value": "6144:OQ+KaiKX2omqZEIvjzmW69H7hEYLjnl01S:aKry2/qZXzmdH7htPnlSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693903770, "uuid": "645e08b5-3153-4872-8305-e6798f20f4ea", "value": 311337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693903770, "uuid": "0b807b4d-a003-4bdc-8de5-a5bc3b4df6b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903770, "uuid": "9046f3ae-4883-484d-91bd-5b04a25f4fa7", "value": "Rendel\u00e9s_(PO4035247)_Trend-elektro Kft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4238dc-4bf9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693924571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924571, "uuid": "6c662159-e122-48c6-a42b-a8b3abed8930", "comment": "Malware payload", "value": "1619996070d8ba25a63241065390a0dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924571, "uuid": "11b16c83-3c91-4c87-89aa-736854f2909f", "comment": "Malware payload", "value": "6ad2665473ea28a2fc3a657d938eb787e34f9dea3ac43f1016b27159aca940ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924571, "uuid": "59e5bbee-0143-469e-a182-d298d81ebd63", "comment": "Malware payload", "value": "f95ef5e598ccfbae0aee8fef8c6bfc9cf26e83b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924571, "uuid": "86f7129d-13bb-4e23-b32e-5448d4574b19", "comment": "Malware payload", "value": "500a5e4553d3b144f6aca8626c27df9fbc06962d5ae0462431d6dc702babac1e57608ff532594b79b895c4ce12c041da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924571, "uuid": "159aa2f0-6439-4904-9e27-71c85ff7442d", "value": "T16D549D11B5E2C032D47219330974AB655A7EBD300F649EEF97D85E2DDF302C19A32A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924571, "uuid": "18bd20b5-f781-4799-951d-d62812c81998", "value": "4a54823b0f069b8d75d16f5447da2c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924571, "uuid": "27a9f0c6-d665-4ba8-a5ec-f8139ca0b03c", "value": "6144:6RjIlPXejqs+0dDlrKf15zAO40cP6sEB:6ROPejqsXKR+0cPFEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693924571, "uuid": "11a22b01-1c52-4395-957c-b7873f33fa64", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693924571, "uuid": "25450c2f-965f-44d1-8b8f-8254bb9967a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924571, "uuid": "6771feae-df44-4432-a5db-b715c71d80a7", "value": "SecuriteInfo.com.Win32.PWSX-gen.17347.30450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f95acab-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693927176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927176, "uuid": "fbe18c4d-8066-464c-b6df-de6ae69b9d44", "comment": "Malware payload (CoinMiner)", "value": "7f84e9286cce6bb81172ec9476568c66", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927176, "uuid": "cd29ba4a-d7dc-4b86-9c53-d0b2428c969d", "comment": "Malware payload (CoinMiner)", "value": "6ae6f5e35f0ca059dd8c22564192a2ac320f4bef4050436291d87180d988e06a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927176, "uuid": "544ca865-59d3-426b-af83-fdaaaf5274a7", "comment": "Malware payload (CoinMiner)", "value": "14e1584f7bce9004e45ef044ed5dc6f8e7837201", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927176, "uuid": "672bd5b2-628b-4289-928d-2ce2c07833ae", "comment": "Malware payload (CoinMiner)", "value": "9ce0a49cc89afa63a0995688c61563f246b0b44546bdd175933c772c4789b53fd8c0cc0ea77eb562bd39cc27a9c24382", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927176, "uuid": "393a0374-924c-4c9c-9317-d50e166ab1e1", "value": "T197752A5FF49320BCC18FC474875BEAA3E8B0386D11257D3A57D0AA387A66F906739B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927176, "uuid": "24d848aa-6247-4671-adee-36002cb23b48", "value": "24576:RK+qlit3+bAJlbmo/2fZwIdZQrZIQ3oiEo3Y6n5eaucw:6it3rmo/2xdOraiEo3Y6n5eaucw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927176, "uuid": "47d6c7a3-de84-4af4-9bb7-8b634604ebd9", "value": 1667072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927176, "uuid": "b2cff21c-a487-4bdf-b338-025c91f65d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927176, "uuid": "0d0cab90-6f2f-45e0-ace9-619d2c8ab09d", "value": "6ae6f5e35f0ca059dd8c22564192a2ac320f4bef4050436291d87180d988e06a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429e5571-4c28-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693944629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944629, "uuid": "703188ad-b84e-4108-b282-8468de9a0c2e", "comment": "Malware payload (njrat)", "value": "0d0adf421d3c9b3fdd45741ac9a2587e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944629, "uuid": "48d2037c-dd7a-42b2-947f-cd7b73466adb", "comment": "Malware payload (njrat)", "value": "6e452c71b8b9e2bd9f09ff878cb1a30d55134569c44c50d1a5ce2e397b8ff500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944629, "uuid": "ea8d8ff6-bc6c-4fe7-a42e-11bebbc105ad", "comment": "Malware payload (njrat)", "value": "3981e2d22eb5b959cfba8db18ea511d7c0a51852", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944629, "uuid": "92a0b9d5-9f77-4e43-9277-a898514c41fc", "comment": "Malware payload (njrat)", "value": "83be12e337c138e9db1c4bfc599bb04b98e5122a5dc0dc59e8a466502e2363106e0f189bc3533f0b5e04bb0c817d0552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944629, "uuid": "6cc0962e-68a8-4302-8ce6-3d227a3539d7", "value": "T14913D78CB694E174D5FF8BF1B4A2B2890B71A017A806D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944629, "uuid": "463ee79c-e044-4718-8ca9-e63118b21678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944629, "uuid": "03aa455a-37fc-4bb0-825a-eeabb942005f", "value": "384:3ZywKFIB+oyi7nx2wSEzavIuZzQIij+ZsNO3PlpJKkkjh/TzF7pWnt9/greT0pqD:Ja+IlirxT4HuXQ/oQ9/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693944629, "uuid": "b0c4d98e-e2df-426f-a1ad-b5ce41ffd283", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693944629, "uuid": "2d35643d-a4cd-4a52-9fae-c3104056fdc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944629, "uuid": "a1454f45-0a2b-4363-8dd1-2da23de4f149", "value": "0d0adf421d3c9b3fdd45741ac9a2587e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ab43ec-4bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693897973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897973, "uuid": "d53fa617-b409-49a3-857d-91dcba96788b", "comment": "Malware payload (AgentTesla)", "value": "6b5c31b37f84a3afd286abd0a2fa855e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897973, "uuid": "933a4597-4654-4402-9d30-54504af0bd6d", "comment": "Malware payload (AgentTesla)", "value": "6f08efedbf64da10f23a4a8a1294cd25715301e07616deaee53917e47364a5dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897973, "uuid": "cabfbb50-7378-49ee-b862-acf3a6443148", "comment": "Malware payload (AgentTesla)", "value": "3a04eac476ea6f827ad2f4951fdb90f22dd9c7f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897973, "uuid": "76434ce2-40ac-4db9-af15-01d867880e7d", "comment": "Malware payload (AgentTesla)", "value": "ae3379284735b76b219705eccb3fbc49c89232d919583943b6e21502b3078e03b7e04515563612bcf3d38fffd836d0e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897973, "uuid": "84691c5e-248a-45e3-a1af-5d29fb5c398f", "value": "T1BE73B7522219BD03CC5C6DF6B80BD9CC9C631EB04ABC533AEDE07A192B71F1EA759191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897973, "uuid": "dc49e761-fa2c-4426-8749-6d1d6a040fe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897973, "uuid": "c0ee1f1d-feca-44f8-a4d9-c746236b5495", "value": "384:kU5CaYegtexIMx1OtF8OyEMtMddR0ShPgddddddddddddddddddddddddddddddW:kUd9x5ef8OyE6WbKbLZi1ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693897973, "uuid": "a81c3e0d-4280-4d19-8718-0a1d52f60190", "value": 77800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693897973, "uuid": "2eaa9c44-904c-49bb-b40e-8c55706ca6e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897973, "uuid": "bba906d7-db33-4219-ac8c-d36f88c74c17", "value": "16938979727d2dd9e8f8db2cfe41fd911dd4077134775db457beedb4788283e28d29837b6b362.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c053bb-4b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693877470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877470, "uuid": "6aec70bf-a766-4f29-841b-cb15a2c2c629", "comment": "Malware payload (Mirai)", "value": "dcd267b2aac7be72edc2ff0e53239951", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877470, "uuid": "3c58f42c-12a0-4cd5-b17e-1c81614efdc7", "comment": "Malware payload (Mirai)", "value": "70d1843586baa5c3028a92947848cbaa90e50a369ffe65b8ebd8d2b5688d11f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877470, "uuid": "0a37b165-a859-44bb-a891-4b477191cb29", "comment": "Malware payload (Mirai)", "value": "820320aa2c64653254513ba2b9acac56d8c23f8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877470, "uuid": "a324295b-7edd-4a99-9d49-0bc27f5430f3", "comment": "Malware payload (Mirai)", "value": "0c93f36088f7b3e6d2e6af56d3dea2f8a7a38389b1ba837ed6009dae56c372505e7cc82c035b7dbc779f0adc006ae4e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877470, "uuid": "18b52344-b564-4236-aede-ed2cd1704fa3", "value": "T15CB30A45F8508B13C6C662BBFB4E428D7B2A1758D3EE72039D156F64378B95B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877470, "uuid": "9ac390db-c66c-44cd-bdd9-b081676f3776", "value": "1536:BIZ4kfIqL6sSFoAiUZz4VZCyt7ebTBX+ggaxjvT5glGiwywhJrzb3hs2yFqOGOfF:BIwqLCFomz4WEibTBbN9VBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877470, "uuid": "7fe7017c-c2b2-4f53-a2a3-5fd9f9600994", "value": 113228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877470, "uuid": "d26e7a6e-e4ed-4241-8501-a5dca19d68b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877470, "uuid": "7a70a699-c57d-486c-b78d-cd5570847e68", "value": "dcd267b2aac7be72edc2ff0e53239951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4896c4-4bd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693910604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910604, "uuid": "1566ca60-ae5c-4243-9740-c8574a7cecfa", "comment": "Malware payload", "value": "54803df779b6d86533a513c71fdbd82d", "object_relation": "md5", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910604, "uuid": "c4fae755-bd08-4a55-b528-01e036e5851c", "comment": "Malware payload", "value": "717c6d49e4df554a386191492a5b0096dc3d07000de5ed58d2862872ef3b83cc", "object_relation": "sha256", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910604, "uuid": "8f055e6a-344f-453a-a9f6-fc0eb32c6df5", "comment": "Malware payload", "value": "844ee84c605cac35a2e661d811d1a4584c032c6b", "object_relation": "sha1", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910604, "uuid": "55dd7675-ce84-474f-8b97-6bfa0b58e427", "comment": "Malware payload", "value": "1c78adb4dc3366acb57e6607b5797eda029a389374381b126dda88f3d0b47f1018639386d21cfd222945a82d65c3a4a8", "object_relation": "sha3-384", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910604, "uuid": "c8a17deb-fb8f-4aea-8181-a089cc1843b6", "value": "T104454940F6D346BACF861930305BB336E7312909471DCBE3D7E96A31BDAA3825C6652D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910604, "uuid": "e74a103c-fc44-420b-b378-4b6f26edbe0e", "value": "60b3de40b460773ece0a368ca6d61d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910604, "uuid": "eb69b76b-3fbb-431a-8ba3-21e9001ebbd9", "value": "24576:fz9+2tE1IOF2V3sAYAph0S/naTzxafWxQn652FpOa/m:YiEOtAaLhLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910604, "uuid": "89d24c88-44b5-4229-9358-9f6368d7207a", "value": 1254912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910604, "uuid": "61d14282-da9f-4734-b0c1-c7678933c9eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910604, "uuid": "0c3be859-4020-4da0-8c65-2f3bbbe40282", "value": "Conferma Pagamento.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b064dc-4b8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693878322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878322, "uuid": "94ba1920-5b26-48b9-868f-1890176a07ef", "comment": "Malware payload (RedLineStealer)", "value": "b9cf51cd1b4843ecf08b0c4248a8347a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878322, "uuid": "d79a097b-492e-4c5d-8455-969bf4e52913", "comment": "Malware payload (RedLineStealer)", "value": "71e74bf6976db1383c98f6b29946fffcdf815ee4dda0e43e216fc689e1ce190b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878322, "uuid": "0b480c66-e4b3-4710-9a76-7f46ce3277e0", "comment": "Malware payload (RedLineStealer)", "value": "06db35fd42465782f23d2494515cb3f766cefb39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878322, "uuid": "bee6194b-71c4-4ace-baa4-e01e70158743", "comment": "Malware payload (RedLineStealer)", "value": "f0b68c8d36da404e1326d279877fb7aca007f42418d635e70aca2813fe08a255b4d5b5735ea1688d702c72fb1dcbf19d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878322, "uuid": "bf64cd83-55a6-4f56-acad-625788522b86", "value": "T14B74F132B7E1C473E0A744306521C2E22E7F78B25174819F77885A7E3E713D05AB9BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878322, "uuid": "e0d651ff-5f5d-47ea-9788-9f06db6bda30", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878322, "uuid": "3d08e33c-a15a-4381-821d-304a5474d851", "value": "6144:D4OhRV/CraJCG4cFovBzvWzRojUEndQW9hgSjXAp7wDbSX+/w:DNhj/CeN4NvBClEOVSk5wDr/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693878322, "uuid": "4acf938c-1f03-4a51-90b1-fbadd0aa560a", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693878322, "uuid": "420f3ae0-313a-4317-9dc2-c9d6c5c4199d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878322, "uuid": "1d8b4f9b-a02b-4652-918b-547375a672e2", "value": "71e74bf6976db1383c98f6b29946fffcdf815ee4dda0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ff18aa-4baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890416, "uuid": "1cd5fd43-90de-42c6-a326-a5845d2c30c9", "comment": "Malware payload (AgentTesla)", "value": "f48493dfd7b854f64984cd6f0cdd0cab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890416, "uuid": "fe5e7b7e-8afb-4087-a2e7-227f59918e01", "comment": "Malware payload (AgentTesla)", "value": "73d672503b088756bf78d3470d9b52569a170a797cbf8d7cd0f580e7d20e38d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890416, "uuid": "bd3ce901-7df6-422e-a8c1-3d7940346d7a", "comment": "Malware payload (AgentTesla)", "value": "e6075f117c7e1adfb02468d94dd39ed08c908c75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890416, "uuid": "2cc1b671-f2f8-4692-906a-d331cdf37b00", "comment": "Malware payload (AgentTesla)", "value": "95d80e815937cbe95f2dc86945044fce669af81ec7253ee562e6fdaa570fccc4697950341b5c93ef4388a66827bc2354", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890416, "uuid": "a1255352-b163-4276-bc76-d00e67d96a7b", "value": "T1B7C1C51263C8A337C5624772ADB2D740A27AF762AD52CF2F2D88910B6D633540B72775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890416, "uuid": "7e60febb-bff0-46d5-9ea8-41eb9844b55d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890416, "uuid": "77bfdebc-3ce0-469d-978d-e5ed2a4cd862", "value": "48:6bGOliWnddTyDur8/67pKZnjTFy7kDcfzpxERfNrsF6B1PNMdtKvr/bsyUhvCtiG:nAiVOcxjc7CBv46/NMd4vrAyUgJazNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890416, "uuid": "9dc643c7-119e-479e-acc2-1e02c71dd652", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890416, "uuid": "fbbaf27f-3ab0-4d27-8b19-2ec1213097b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890416, "uuid": "98cc749e-cc61-4362-8eb2-9b9b1f46f173", "value": "\u00d6deme \u0130\u00e7in Proforma Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2d39d6-4ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693887312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887312, "uuid": "66ee3d9b-67bc-4f3f-9ee1-8beae487cded", "comment": "Malware payload (RedLineStealer)", "value": "a477e021e70d6e4722516e31f5568bb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887312, "uuid": "d23abddf-175f-4480-b1d8-c9018a1d474d", "comment": "Malware payload (RedLineStealer)", "value": "73edfdd54d4fa881cd50ae517cf2741ce00c870539b5dd5123254b5484d5426b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887312, "uuid": "e8309556-48d9-43b9-a1d2-e81b21468c70", "comment": "Malware payload (RedLineStealer)", "value": "4a3af9212b2d324f54fd6d64d63c5b3a0d05b856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887312, "uuid": "cfea53fe-b8e2-4c86-84c5-732b4efaceee", "comment": "Malware payload (RedLineStealer)", "value": "ff0f3b1bda34207d0185ed645505f0061cf2bc0621dfbb21f8f4ca8f5e76c90c1c7343d391f37bda0ffa6efee5ffe26b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887312, "uuid": "0f15f254-c0e9-47d2-817e-fd762141cf06", "value": "T1CC840222BBE1C03AD057593459F0C5A0FEBFF8522AB9846F53D40A3F0E747D05A663A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887312, "uuid": "23786868-d99b-402e-8349-56742a2cad8c", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887312, "uuid": "463cb9f7-4de4-42ca-b851-e4a46589efcf", "value": "6144:tIOhRE+G7feKKekvDN1SUNocMlM5FAcHUPX0GNG+5mAr1M/v:t9he+Slm7fSEocHFdUPX0UGW9W/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693887312, "uuid": "faf43854-a213-4d5a-a425-0fe5cc1ad842", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693887312, "uuid": "bfaf1ab0-a12f-415d-9dec-eb9bb7c7aea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887312, "uuid": "6b851b10-d3ef-4b29-8108-29f0b7286a90", "value": "a477e021e70d6e4722516e31f5568bb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4d6647-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693927059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927059, "uuid": "eef66c2e-0492-480f-a35e-6bd992a0b9a9", "comment": "Malware payload (CoinMiner)", "value": "fe746a7ee18c4d7ae97ed7bc16427a0b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927059, "uuid": "3fdfb6d2-b069-4284-b5eb-9c7760950d64", "comment": "Malware payload (CoinMiner)", "value": "74000cfe16063882b33111df4ea0ce04ac207f4ec2e0adf7410d86f251d5f351", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927059, "uuid": "1e6f4b4f-ecab-41af-b5b7-4e9df6668d57", "comment": "Malware payload (CoinMiner)", "value": "e193e337e39d57da05dbe7bcf5ad49a9e45bb88d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927059, "uuid": "b4cee64b-768a-47a6-a76a-d2e6785aabf0", "comment": "Malware payload (CoinMiner)", "value": "67ac70113405989b4c3046e5712d8dadf2c214e08e07fbede0c44a56b20ee1dea6f160bb4803ccbe8af0eb3ef72aaa44", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927059, "uuid": "39960265-8a57-4d32-945e-025406bdf625", "value": "T119167D2F51B2A47CD496C070175F95625A71F06A27267CFF17C0BB303B29CE1A729B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927059, "uuid": "3c07a0df-2b80-4cc0-abb5-cb32f6b36843", "value": "98304:ZD9miI6sRlPYiB7qQ/tbb2dTkvWQy84NNigC6WIP12M2xIVcR:Z/4RIkFQcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927059, "uuid": "cf519fee-b69f-4bf1-aad2-3702908ee2e6", "value": 4265912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927059, "uuid": "ae78b433-c0e3-4785-9794-04035674a1d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927059, "uuid": "4c149ec2-41f6-422f-9da3-6c3cd39c3b9c", "value": "74000cfe16063882b33111df4ea0ce04ac207f4ec2e0adf7410d86f251d5f351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f812a-4bb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693895635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895635, "uuid": "b4591d65-f7a8-468b-9e21-813ffac5972b", "comment": "Malware payload (AgentTesla)", "value": "af3d0d58ee3ce54fd913eb12189f00b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895635, "uuid": "66a5f39e-363a-4290-976a-700d9d9f651a", "comment": "Malware payload (AgentTesla)", "value": "740ade7a62a555ad148bb2d2d97bafcf893a8be5b0db0e278ef9f16bec310c07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895635, "uuid": "f0cc6b99-358a-4ecb-89c6-104daacd26aa", "comment": "Malware payload (AgentTesla)", "value": "d717f4d3061b2d73b4146fc6c77d847b8b2575cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895635, "uuid": "733b3ab1-01aa-43f3-8e17-7dfda5d4ab7e", "comment": "Malware payload (AgentTesla)", "value": "493e35611aa2ff4fd1323b8a4a1f3e43ddb0e2f6c45c75fb21d1131e50d9ba44e654e035b0b6f816eb4a0bb04806e75e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895635, "uuid": "b4cb1855-6551-4364-beb6-a9fd9e353872", "value": "T1EEE40240F2789B13EA7A67FA1824259403B65D9F2172E72C4CD7B4DF35A0BE04681F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895635, "uuid": "5260555e-552f-4541-8bae-14300ba669ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895635, "uuid": "c3388b7e-f8da-4b94-b55a-155bae0df3e6", "value": "12288:Dorm0TJ30vcZceaqYPjsLpI8bof4Bg6GpikDwMD8HUU:Do5J3GcZmqYPOpbbhNtkDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895635, "uuid": "24f88a00-cb04-44d7-9ac1-b7bea5249d1c", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895635, "uuid": "3eb5bedd-3207-4fb5-9873-1798b5b7459a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895635, "uuid": "136bcc76-f6d3-41fb-a1c0-fa7bd51f609e", "value": "RFQ___4120281562_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e5c820-4bd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693910248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910248, "uuid": "dbf522b2-0954-400e-8241-aef212c6ced4", "comment": "Malware payload (Formbook)", "value": "65b8f0d5e0879e399e0f0a1b20d72d54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910248, "uuid": "9c750daa-a273-4548-92d8-6e3e1c86d836", "comment": "Malware payload (Formbook)", "value": "7439b7be3572ee86c84019ac60a182f9f183f7ce14b56a59898a9772fbddedf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910248, "uuid": "d69c28d0-2701-4dd9-93f1-28ee7a1c9388", "comment": "Malware payload (Formbook)", "value": "2f77979ecf3dafd8a0f6f1777f91e9433fcbfc0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910248, "uuid": "99bf5aef-a5b3-4bd3-a5a3-db003aee0d5a", "comment": "Malware payload (Formbook)", "value": "1bba2387275c326b6fc8ccf1a6d933cc91b179fe8d0c71f2983cf010df2852039aa8b97b468fbd6d6ddf1666393bf31b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910248, "uuid": "b57939fd-e24a-46de-929a-f060c164405f", "value": "T1C6C423056F9C2A2AD06F07F87859621AA3F6307A25B1DFFD6A5BB8D009777403B10772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910248, "uuid": "6cd0d613-6bcd-4b3e-aad6-cfc1d2853cd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910248, "uuid": "04ce4691-1c41-4059-9eec-b482869ecaf6", "value": "12288:k0Dl+C42xjW1SiEBGg6u4vL21R4yx+Nxk0wlZUvm:9yB+T4vL21qo+bkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910248, "uuid": "36537188-d5f2-441b-90f9-aec68a8cb5e3", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910248, "uuid": "cf511e4d-e850-484f-b0df-bab7c9ca1402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910248, "uuid": "99cb013a-d1d2-419e-b8eb-5474654b1799", "value": "7439b7be3572ee86c84019ac60a182f9f183f7ce14b56a59898a9772fbddedf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f35e08a-4bd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693910720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "51f922a8-8e4d-4836-8bf1-4129f93faa16", "comment": "Malware payload (AgentTesla)", "value": "76e088b1e157c4cff0dcba3fb9e5ffb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "28251270-703d-4a0d-ae33-20ca2b82ee5b", "comment": "Malware payload (AgentTesla)", "value": "744d04ba9ba4933861c815e0ca2a1bf80e7b394a3a794f1566f91c39c5571608", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "9972f76d-4324-463b-be7f-97c56a9a5266", "comment": "Malware payload (AgentTesla)", "value": "8abc7b33dba97fbcf3539bfb8fcd6315ae851316", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910720, "uuid": "79e811f9-a0f7-4743-81ec-9cbae7145049", "comment": "Malware payload (AgentTesla)", "value": "8bb62280b2b062bd9f8a15a637089167134faca2e858d366072a2dbb506659045888dfc051da1ccc9c359fe3f603b236", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910720, "uuid": "be77c24d-caee-4043-a1d0-1c40f80c8a4f", "value": "T169740C5A7A745132ED00CB3419F69E11D2EBEE6C2BE0551A24D8F66D1B322FE8F079C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910720, "uuid": "97c7b41c-a410-44ea-8728-8d51d69d6fe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910720, "uuid": "92b1ad03-6b60-49e4-94a1-a545beffa620", "value": "768:E5jJ+kQ720zEjss2Hcg1Ijcn0sspAlpq8WLyg1uMN0+dzsR8+eEYrW6WW:uokQLUWpqZLy0uyL+fYrW6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910720, "uuid": "852d9b02-2252-4a4a-a57d-96dacab0202e", "value": 347104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910720, "uuid": "1f9091cc-3ce6-4d42-ad9e-3f66976c88f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910720, "uuid": "6a26a2ee-3393-409a-b296-edf8f5502353", "value": "744d04ba9ba4933861c815e0ca2a1bf80e7b394a3a794f1566f91c39c5571608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe5ae51-4c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693928948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928948, "uuid": "35650164-6db7-4edd-9128-0387bdea3dcb", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "867954af1cfa5ea480208fdb10e143e4", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928948, "uuid": "4cbfd049-f2e6-422d-9c6d-58bc225575ca", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "759e28b5e743ef6368816dafb62507ba7133cdbb38853e21ff98964aa3c0d454", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928948, "uuid": "cba58c48-26c9-412a-84f9-b68f7ac4acbf", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "30c9954da1d56fe7d905d272c748af7a2e8ebdc6", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928948, "uuid": "48555309-0b70-4a78-afdc-28aaa8e695df", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "74217ecf9d8b21ec9151ae36a3bd3a9e1dd2fab6b155479b219401a380b3dbc7c838e32afc21461419a117d8ea0b53c8", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928948, "uuid": "902bd1cc-6ced-4b6a-a7b5-5757770ea51f", "value": "T116452304E2D5C4B6F121D4B82C1ED699523777A32874742EB7DCAD8C6F32BD0A9847A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928948, "uuid": "24a2513d-4834-4804-8b7f-79116604066f", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928948, "uuid": "2d5c6207-2b22-4d28-ae03-b3e99f6a88d0", "value": "24576:PI39d2dcL8+M7z6jG0j08qqZHicNBbnpbjz+ouZxDH4Az/qyFV/uN4vxt:P6dgr6y0j9VHicNBbnpb3CTDYAzluCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928948, "uuid": "d909c0d6-a836-424b-a4af-2090843ae650", "value": 1256761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928948, "uuid": "3e8b5917-83ed-487b-9b90-4533c8f9020a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928948, "uuid": "ff65e06a-7a70-4efe-95f6-c2085e72fcf0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d10950-4bf6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693923237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923237, "uuid": "a0a30fab-e9a7-4222-b17e-944ef52b987e", "comment": "Malware payload (AgentTesla)", "value": "a9a2e52715007ee61891ba27a8980c0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923237, "uuid": "7e7d2c6b-6392-4d8e-bf5b-9aba9021fa90", "comment": "Malware payload (AgentTesla)", "value": "75a5d5d46fa6c5178a43eea7c2d4d0bb66dd6879413318416dd70b4ef27faee8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923237, "uuid": "b72f9849-3d62-4bc1-9488-38785483692b", "comment": "Malware payload (AgentTesla)", "value": "c171e4c8260d41326c5242eee5305f360d514dfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923237, "uuid": "16159749-2c4b-4b51-908a-d3d2c91308a4", "comment": "Malware payload (AgentTesla)", "value": "8d7f2e58184526a83ede0fc8105e4c8163337f17fdd1033baae411b0dea2a17bf04558ed7492e4130afcdc1ea4a46927", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923237, "uuid": "4be328c9-f22d-4c98-bdd3-c27de3c423d8", "value": "T1B4F40281B39CAF27C47A57F08911544007B26D2F28A2EB180ED6B0D73FB5B915A91F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923237, "uuid": "4ad7ea46-2dad-43bd-a3d5-a8c6d97a2c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923237, "uuid": "69792d62-bd16-48fd-a219-8d460a817cec", "value": "12288:KHmTkDwMD8428oHT+H0+ipkXcbz3NjiFlnsP7vmsgX0bzc8SkEobA/+2:LkDV8pT+ULpGqz3NmDsPDmsgX0bzcUNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693923237, "uuid": "fc31b7b4-f9c8-4d20-9ab9-db042b20277e", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693923237, "uuid": "999e7f37-f33c-420e-9608-b5178be724f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923237, "uuid": "7943633b-91d8-4180-a308-9f6612fe09b1", "value": "PURCHASE ORDER FOB DUBIA PORT .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae8d54e7-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693910021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910021, "uuid": "ba5b8a75-db7b-4c09-89c9-9a746dcf3006", "comment": "Malware payload", "value": "325b5a65307577d500e378d1c7c99d95", "object_relation": "md5", "Tag": [ { "name": "pascal", "colour": "#A517DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910021, "uuid": "8b237b72-d93e-4df2-9f77-fc6fff4716ac", "comment": "Malware payload", "value": "75a9d696eaf19927a7200ff4b32948bd7922e59fe1d0230262c7b9f54d7e687c", "object_relation": "sha256", "Tag": [ { "name": "pascal", "colour": "#A517DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910021, "uuid": "6a1871af-c0b8-4623-9bcf-87825166c0a2", "comment": "Malware payload", "value": "e1e235d2998a4f20194d632adbfa0537c4ccee7c", "object_relation": "sha1", "Tag": [ { "name": "pascal", "colour": "#A517DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910021, "uuid": "d180d64b-9d54-4d0f-9a4e-815f0ae5c7df", "comment": "Malware payload", "value": "0720381f11ff78d063de8b527bcb7b5824bf0508039024e8dc422590e25410a36af24a9bdca1f7d6c2528c92e19e9074", "object_relation": "sha3-384", "Tag": [ { "name": "pascal", "colour": "#A517DD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910021, "uuid": "2570a51f-1fde-4fbf-ac2d-794faa0abc51", "value": "T186053C49970ADB537BE783CD6C413B82E8A96D0DC7D1C3E56483A57E3A8B8F1492D780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910021, "uuid": "336d7858-f843-4e52-abf0-d3ff627984ea", "value": "24576:RX7cfhcBLIkzVPyPT8h1HjM6ShsDg633bgjzRBsDxjYHAvrki5FEoGWj8I2Yjjdn:RQfhILIkzVPu8h1xt/bqdBUjXr15FEno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910021, "uuid": "39ce3e06-85dc-4650-8490-edeba57aa5f7", "value": 829715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910021, "uuid": "cb55cc9e-5bb8-4d2a-b1c9-203ce03da471", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910021, "uuid": "92a266ad-6ed2-48a2-8b92-d095c577f33a", "value": "dmz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c36a86-4c31-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693948418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693948418, "uuid": "2e11cb26-3dd4-4b80-8890-6d169e919af0", "comment": "Malware payload", "value": "e8a493a741378ce85dcc4fca39186df2", "object_relation": "md5", "Tag": [ { "name": "lumma infostealer", "colour": "#4FA352", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693948418, "uuid": "4cfa134d-e2a0-4f45-b246-5fb2590a4a0e", "comment": "Malware payload", "value": "75e4047d931bc36f91fecefcb2c3b424c7ac15924ff87e1997d4c9865b756a6b", "object_relation": "sha256", "Tag": [ { "name": "lumma infostealer", "colour": "#4FA352", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693948418, "uuid": "9b01424f-0a1a-45e5-9b07-72806f6a7055", "comment": "Malware payload", "value": "62a609ec5ab8176caf63e6440bc08e722f394763", "object_relation": "sha1", "Tag": [ { "name": "lumma infostealer", "colour": "#4FA352", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693948418, "uuid": "38d89528-fff7-4b6f-a464-ebbf1985e1dc", "comment": "Malware payload", "value": "ebe53242475d7bc324e5d8b9fa0cac6a4bab9570899601f72caaf2445e660096440a2baffa959628efcf0be3e811784e", "object_relation": "sha3-384", "Tag": [ { "name": "lumma infostealer", "colour": "#4FA352", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693948418, "uuid": "b5166a2f-63f4-4aac-b7f0-ac711524a26d", "value": "T129D61212F99FC536E66E4176E4B8FB7A117A3FE1473184EB62E43D9A19704C112B2E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693948418, "uuid": "688308bc-fefe-480f-996a-26033a7a18e8", "value": "393216:7BfME5J7YxuBNJYylrSucxoNJEsCIQZyqao:pMWYxaNJjSucxSKshN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693948418, "uuid": "c1a3e197-10f3-4106-960b-4a152edd164e", "value": 13080064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693948418, "uuid": "b1a35d96-716c-42c1-be6e-bece9064d168", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693948418, "uuid": "db995f47-ec82-488a-9ec9-ec0ca9fef49f", "value": "75e4047d931bc36f91fecefcb2c3b424c7ac15924ff87e1997d4c9865b756a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d6abe3-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890219, "uuid": "e6a28719-b372-408e-ac45-d8e0bd9939e0", "comment": "Malware payload (AgentTesla)", "value": "406bf1e5cf818d73b22596bec384006b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890219, "uuid": "fd500e41-54a8-43f8-8f73-9126e8cf312f", "comment": "Malware payload (AgentTesla)", "value": "7702510cdfbb17588f4a6bf872cca1bf476d4553c8f978785139c48c3c202a1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890219, "uuid": "106a87f4-37e6-4c08-b3e6-a2d99ac01868", "comment": "Malware payload (AgentTesla)", "value": "3f3632ff8ea8454232fd099bf63f06471be08a46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890219, "uuid": "57e5bb84-8e57-4923-9504-4ef1fee2c1e2", "comment": "Malware payload (AgentTesla)", "value": "69f135902a7f0af194aca7f2e10c0330efb13fb92c7115863aba2fe82866af89c25a539bc7924c639c06afc456d87ae3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890219, "uuid": "407ddb8a-e5fd-4cb4-8fd9-62085e8a384d", "value": "T1C4D42320F13D0D95D7FAF8FF1245AD0CADAD794225412A77B1FC86A21A42C6C5EE910F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890219, "uuid": "0af42e45-a4f7-4e96-a455-8d89ca0bdbc3", "value": "12288:dhFKnVmwVgKw4ltO7juoyGoqh4rU7F+FhsA9eSTgUg65k:dDKnUkpw4ltGynq6UsF9eigUPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890219, "uuid": "97993077-a5ae-4928-accf-b84199623add", "value": 633639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890219, "uuid": "9a873eb6-da88-471e-a2e1-bb701a679dbb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890219, "uuid": "18e1a814-dbc2-4589-97cd-f2fc7e794791", "value": "Purchase Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78010d8f-4bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1693902628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902628, "uuid": "da7402c6-4c01-4022-b0fe-24fa690315af", "comment": "Malware payload (AZORult)", "value": "6f0964c3c582ac027aa42f0be2f978d6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902628, "uuid": "cec54da9-387b-4684-afe8-24d0b870e88d", "comment": "Malware payload (AZORult)", "value": "77139402d8d38cfedb303222793713f82654f83e9b813f45630af29fed601076", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902628, "uuid": "a868363b-997a-4f01-8837-0020f9a1c0d7", "comment": "Malware payload (AZORult)", "value": "ed4adcd7db3c9ca837abb379b9a29a6734320bb9", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902628, "uuid": "25652ea4-14dc-482d-93cd-e532cce98de4", "comment": "Malware payload (AZORult)", "value": "80ec2af2b3f9947cc4a7d8b77d5fd152bbe9dfc5af57072645e5ddcd397d48cd860611a1adfcbde3c9c14bd81f203d79", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902628, "uuid": "d8f242b3-905a-4b23-adb3-579c359eb51b", "value": "T15494E0812B90DA3FE79E1B3484F5EB7842B8ACE07862860377953E9F7E15F8DD905250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902628, "uuid": "0bf3c2a4-d910-4091-b357-00894619c1bb", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902628, "uuid": "2556e8c1-c149-41a4-87e5-11b11945ec08", "value": "6144:uT4DtHOOUPy5MI1RhksWkohzakN+jjoPo3hcxrOx/SGI4HY0JCKtQzWXRqI8yEk4:uTeeZjN+HoA3h2r4SKQYhqI8dkg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902628, "uuid": "92f92afe-3e5f-4dbc-8761-e83d29bbf725", "value": 432873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902628, "uuid": "522a52ac-dcd7-4fce-85cd-2f3f6cff02d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902628, "uuid": "ef65a36c-6436-405a-8e7a-763f9e2cbd7b", "value": "swift.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f560dd44-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874062, "uuid": "b83b7e8e-e7c8-43bd-beed-20456e468822", "comment": "Malware payload (Mirai)", "value": "05ccbe781cf9d98ffea3008b5fe68fce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874062, "uuid": "a05d489a-ecdc-4fb4-81ba-51f9bc19c004", "comment": "Malware payload (Mirai)", "value": "7717771011b144e85822c1d09dcb5833ae96334bc7fe32b8284dca4e961e84c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874062, "uuid": "7c337018-26da-4e8b-abd0-e97a1cba5e35", "comment": "Malware payload (Mirai)", "value": "5a00c1d48fa9b9d40b5ae7b91d4c4ea7b5412ad5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874062, "uuid": "99563d43-e293-43b1-92d0-06f13ab93b2a", "comment": "Malware payload (Mirai)", "value": "b937fa4c80ea6ad9469f81a91ec8ccb444997732ab0cd90d607af56408a6950433aeabdeaf0cf8a40db111d987d8e63e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874062, "uuid": "7afb1bbe-f267-4209-b68c-57aa3870c1ed", "value": "T1BE230271880E8EF125703C32DFD5D793B6E12AB1C567302396280A386F75B131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874062, "uuid": "b24d8c9b-c03b-4c5b-bcf7-74b011d9e88b", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3t39q3UELbUXfi6nVMQHI4vcGpvD:gECFd+A6YHAxtGLRQZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874062, "uuid": "e62895b9-ab9e-4469-9653-bfdd3300904b", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874062, "uuid": "880ef679-5e26-41d6-9365-89bd28f2e1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874062, "uuid": "92f0d178-ad54-45f2-8623-8510d621d798", "value": "05ccbe781cf9d98ffea3008b5fe68fce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc59702-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905319, "uuid": "ce9e984e-8eb8-4bef-90f1-66fa364feef4", "comment": "Malware payload (Mirai)", "value": "071994508355f7f6ac819b8585f70b17", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905319, "uuid": "37159e22-0e83-4f09-9f21-88a9a7113282", "comment": "Malware payload (Mirai)", "value": "77400ec81e9997eada62923f8a8c9888ff98bb8e7a469139ca93e05c812b1349", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905319, "uuid": "54890b1d-db2b-49af-ab38-9719575a9a51", "comment": "Malware payload (Mirai)", "value": "bad17d033f20e37808c3aac9d1aa5c3ba6825c3c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905319, "uuid": "9a91be34-4466-4889-84d5-1f9770bbb52a", "comment": "Malware payload (Mirai)", "value": "55dc86b7087a03c5c8576e9f632799187d92916e183fe783c0f6d42736ab275deaff051bd9815150efddaaa98d96cfd1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905319, "uuid": "3de1c1ec-da7c-4644-a169-04b0595ce139", "value": "T10BD2E0AA85E7F6BCD0AB65F5043D06C5ED767216C11A17B708E8706AEF131D80E31EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905319, "uuid": "54edb4b8-4b73-4b35-bbe3-fc4a9ce86dbf", "value": "768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBtKpSx0sx:kYJdJZiy1aBnQfTqBgUtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905319, "uuid": "52781f75-0472-45fc-be02-b6a8349ef586", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905319, "uuid": "0a9a046f-73f1-47b8-a337-85481e382442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905319, "uuid": "cfc2c835-070a-4690-940a-71b2dc695ec5", "value": "071994508355f7f6ac819b8585f70b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be692a8-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885723, "uuid": "b4db8d9b-60dd-47eb-8e55-ff08bb21055e", "comment": "Malware payload (Mirai)", "value": "bf6c64f74d8faadbe228628934e7a91d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885723, "uuid": "b24152a0-66a1-49d4-a423-fdc5316c9c8f", "comment": "Malware payload (Mirai)", "value": "77976916ba8532720f41801355d78c7ff4b684ea6a9ce86076d95fb18efbd69d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885723, "uuid": "12c35ac4-4ffa-4589-a6a8-2ae0a87c053e", "comment": "Malware payload (Mirai)", "value": "f80e2054e219c484fe7091f23b70a93db59f76e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885723, "uuid": "3b2d9f6d-8db1-480f-ab86-da97bd4271dd", "comment": "Malware payload (Mirai)", "value": "73da14a4c748e38402916906acf904f51e9ffdd00e09cd32081807c3117dc3aa2f16abba4c5f622c3d7a732dd97148f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885723, "uuid": "cb25f56c-20c1-4ddb-b2d5-f1452b85af07", "value": "T190B2F19B06DC0246DC8D62BEEF5F2EB7B301A8581FA75EF07B958989637316863C0814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885723, "uuid": "d816221a-0b91-46c4-9a8e-f704e782e258", "value": "384:MB7LalTr/lS3rOVT6rJoA/0np7NYLPr/oIZeySzi4uY1XiBNpld/pciu5uwYuni+:27m2bOVWNj/0njYLzPSzWH38uwYugIgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885723, "uuid": "8390ca9d-7137-4579-a477-9422ea2af44a", "value": 24484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885723, "uuid": "2feaf589-4e60-4ad0-8067-d3fe1647906b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885723, "uuid": "8ab9fe16-8823-4129-9706-f0c867b2626b", "value": "bf6c64f74d8faadbe228628934e7a91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c57e30f-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926955, "uuid": "45b9e720-fbc0-4ed6-b7c6-b198873111df", "comment": "Malware payload", "value": "fcd6088fcb5649580a875a5c3711248d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926955, "uuid": "93c4e7ad-445e-4c64-b16b-7ff29efbf2f1", "comment": "Malware payload", "value": "77b881109c2141aef8a86263de75e041794556489055c1488f1d36feb7d70dd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926955, "uuid": "62020fe9-ecbd-4356-b698-e26e963626d4", "comment": "Malware payload", "value": "a71e97ee7d5d3a7eacfe14e5794b96feed56ed83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926955, "uuid": "504c7df2-49f6-47ee-9ca9-2e1405f03b5f", "comment": "Malware payload", "value": "76b668c430715f6658af442eef5daea494782d4deafb4953212f8781d86b28a4b549e2b381a753ad41c4246611f6789e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926955, "uuid": "1615b7c5-5c19-4903-8fcc-53163c470eea", "value": "T141A26B97B763C17AC68E577056CB8228B0FBE4F0A3B6510B271CA63919133544F2FA96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926955, "uuid": "9ed9b4df-8fb8-4f01-9104-9aa38182a494", "value": "384:jGag5Epa9nusb09AmyqAN0mIg7nz6666:1rsntQZy3N1zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926955, "uuid": "40b29550-57ee-4d97-beb6-71adcabe3ca8", "value": 21888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926955, "uuid": "4c2175d5-c950-4772-b8f7-5a539f47af20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926955, "uuid": "a53df2be-00f9-4cb4-a2eb-830f2b0ebcfb", "value": "77b881109c2141aef8a86263de75e041794556489055c1488f1d36feb7d70dd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09a6fc7-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693915151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915151, "uuid": "0f1ccd42-1f14-482d-93c8-ad3a5f48036a", "comment": "Malware payload (Loki)", "value": "3a73349d2cc757ba5abbd8c1b5741d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915151, "uuid": "5b08d3ba-4617-413f-9477-84e1fa55c22b", "comment": "Malware payload (Loki)", "value": "78d51768c418d3a79a63d462d5437e6f57984c5316782d12355a1d71096f3ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915151, "uuid": "7784c1b8-613c-490e-905e-f9fff63e250b", "comment": "Malware payload (Loki)", "value": "1f9139888fd12c91d3c7e7169f85e7ab46d2089c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915151, "uuid": "a20d0735-a1bd-4b52-8785-4007d3b99a9d", "comment": "Malware payload (Loki)", "value": "7240f865c1980637de3589d15db25915397368bda16b425629fa776d99517c1dd7c18b1ecb7382718c5bb2387c9a6945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915151, "uuid": "6e05f11c-0a6b-445c-9dc6-8e22d80276d1", "value": "T13B84BE9C725072DFC867D472CE695C68FA6434BB870F8203A02759ADEE0D997DF250B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915151, "uuid": "69cf064c-8303-4c95-8f4a-70245309809d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915151, "uuid": "c9673570-c31e-4d89-aaff-4ce6b8f78e95", "value": "6144:yCh9exZxBJYeaIrVWBX3sdQkADN3XEdHgfx3Qp29OBVu9b5+S1aCMwW1jXMzsK5q:hh8LJ3O39k4X0+x3E2QB+b5+Sb2JXMzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915151, "uuid": "13fa1a46-df59-4563-ae01-a6519035249b", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915151, "uuid": "aa8ebb35-467d-435a-9f12-09386f58087b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915151, "uuid": "b13fe5ae-9b80-492e-bb1d-e6dfdf2c0454", "value": "rserver1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c4366a-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890389, "uuid": "25e4ff2a-3e90-4147-860b-519a7e8ffda5", "comment": "Malware payload (AgentTesla)", "value": "cdec9771292980491cf324fafd7f3ac6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890389, "uuid": "81f33fa7-76cf-4881-ba9b-322ca1761f84", "comment": "Malware payload (AgentTesla)", "value": "78f25ecc4d28fec2c11b821ec4a8b4a6f5cfb7ab7dde361c0a9d632b40c65a4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890389, "uuid": "3d06c96d-6f6e-4f38-8279-bc123ab2097d", "comment": "Malware payload (AgentTesla)", "value": "06973accff85cfc01dbd2b3a76d5753b995c35b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890389, "uuid": "f6c87161-f9bd-4be5-8513-df5dde46cae0", "comment": "Malware payload (AgentTesla)", "value": "620e236f40668ea641ab8d29851654bd98394d576a26a6a706978a6ca54cc63ac43b464539dfc01c94a1303e74e10663", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890389, "uuid": "95268df0-e11a-4f3c-b082-3ab7cd3b3529", "value": "T1E6E4011ABB74C66BCC2C377CF0200135C374ED487126E39A8B8AA9197DE7791D9419BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890389, "uuid": "c088eaed-1495-4c9a-924f-888b6527361a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890389, "uuid": "0779c335-2fe7-469b-b182-7e894f3f2e57", "value": "12288:DUiY7bVy9/Xrf9VT0w4Y5AOgX8m1NXGwShLLAuXTCOnz5P7MNU:vY7bVS/XrrAY5AxX8m19GwSh/LXTBz5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890389, "uuid": "eda547f1-2754-40c0-98e6-2364dd230952", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890389, "uuid": "033f100c-4c60-4a8c-9038-07b4c3761b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890389, "uuid": "110068f1-0593-4491-9d8b-6de69ff41871", "value": "\u6cf5_\u89c4\u683c2023\u5e7409\u670804\u65e5RC1371-00A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4f8081-4bda-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693911384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911384, "uuid": "a715802c-ab17-47a4-b735-61431db42a7f", "comment": "Malware payload", "value": "56bb6db032d03578e6f596eaeb0807b4", "object_relation": "md5", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911384, "uuid": "c365ebb3-3c84-4dbe-afea-c0329715c705", "comment": "Malware payload", "value": "7914ada2b2516c56cf68a6eae34701831ddb523d981b1ad3bc69d3859df93f20", "object_relation": "sha256", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911384, "uuid": "3ffaf18e-2d57-4fbf-82e3-6113670b8fad", "comment": "Malware payload", "value": "8d271e148e504c36ce2f5efc120bac433755d175", "object_relation": "sha1", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911384, "uuid": "3f0383cf-bd6f-4552-8391-4b2cc20ab0c8", "comment": "Malware payload", "value": "699f7aff881b1e45703769253878b0b00d5772f098bbb98ef1bb97ed3e27ed947ab656ec78bdf5b5543d0abaa12aa60c", "object_relation": "sha3-384", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911384, "uuid": "cb374ca9-feae-4ac5-bb12-973716cd34e0", "value": "T1E8112DA032883C5703B31F22C62A8388EEB6A58E0452119879DF21BE9F315DF079306E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911384, "uuid": "74c6b67f-9d3f-4c9a-96f8-e99af909e856", "value": "12:TMHdGGqq9yAas26K9YG6DLI4MWiNuGEAaOkVl/ENO/JuWzFAXTHgmEM/uM4MXU2i:2dL9hK6E4dl/5JusAXT9h/u1Q9FR8vH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693911384, "uuid": "e825cb64-24e2-4d9a-821d-34d7c2e6063f", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693911384, "uuid": "6f32be1e-f99a-4b35-8af4-d20e2dbe8317", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911384, "uuid": "3e18b867-1218-4d24-9dfb-767fae42e61e", "value": "ScreenConnect.WindowsClient.exe.config", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cbb084-4bf1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693921096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921096, "uuid": "ea279515-77ca-4417-adc9-3c37777e7820", "comment": "Malware payload", "value": "67b5cb033c2e594700892d3d816167a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921096, "uuid": "a6623121-05df-41b7-b58e-31bfc4a92950", "comment": "Malware payload", "value": "7926ce87de7fbcd875b3807137e9f22edb6e537410952f41094edcdac79e4d14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921096, "uuid": "0c27695c-1e9b-4c63-9128-b63c53a9d6e6", "comment": "Malware payload", "value": "e3cba46a5b06af6900df801cbb93c069b4617317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921096, "uuid": "6504a3d7-937b-4484-965c-7789b2408b77", "comment": "Malware payload", "value": "e42dc8c76eb49542dc34959e915087e7d7b680add99a6ff8cdc8e1ddc9f774139c7a257abefb272edd9bae1202bcd755", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921096, "uuid": "11ccd3c7-65ce-42e1-a618-447110a04a7e", "value": "T1EFB76D51FA0D1395E96C957B8F3B055103F26CFE5960E22A74C9B2751AF33E2480AE2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921096, "uuid": "d492f8b1-deb8-4cb7-812b-f82f05bb5e97", "value": "768:tJXX35YpGtuS+rmbWH2pTQJkLASChYHBFvetUGv006MF+DvsYHWwqDrOjfuohAcq:tBiGtujX2OKLsI3o6q+DvsTru/HDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921096, "uuid": "a7d2ff57-619e-4744-8d19-fa7072f28601", "value": 52428800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921096, "uuid": "7993e3b1-d50b-4b0a-8bac-25616e48582b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921096, "uuid": "6b3c53e4-5429-4475-a3a7-6708265159cb", "value": "7926ce87de7fbcd875b3807137e9f22edb6e537410952f41094edcdac79e4d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad8425d-4ba2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693887198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887198, "uuid": "685aa385-69cc-4ff0-bb1a-217f44444055", "comment": "Malware payload (AgentTesla)", "value": "259aef3b9b4abbf3b452e55cb34051f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887198, "uuid": "d87ecbe5-697b-4a55-9715-83948d5e845c", "comment": "Malware payload (AgentTesla)", "value": "7a698bc21ef14cf1862c2ea6185e8c82b59aa318977ec3dd24526a74881fdb01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887198, "uuid": "d1927f4e-e949-488a-84bf-0992f2f83626", "comment": "Malware payload (AgentTesla)", "value": "1c94f8a6f5454c04e511249633e57cc6c13002c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693887198, "uuid": "e2315327-965a-4beb-914e-2d8af7514e75", "comment": "Malware payload (AgentTesla)", "value": "4754531b776ba42484a089f6f7b3718f988771dd75172c4e70fa5940c227a0db4a9bb76310ce08bee7d0f89a0974db27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887198, "uuid": "ee7ba87e-0663-43c9-bf6d-73ca233f1880", "value": "T18A73B8522209BD03CC5CADF6B80BD9CC9C631EB04ABC533AEDE176192B71F1EA759191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887198, "uuid": "2aaf228e-6e05-44a4-9af0-5d69cfe12c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887198, "uuid": "d32bed3a-3086-4ca6-a0be-b69c932d2e86", "value": "384:YuCOeegxO5xIMx1OtF8OyEMtMddR0ShPgddddddddddddddddddddddddddddddW:YcH7x5ef8OyE6WbK1tZi1ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693887198, "uuid": "277c29db-65ec-43dd-87d5-b3f1f19131bc", "value": 77800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693887198, "uuid": "0bc0f9ef-94ae-4c04-aeaf-a7b6ca0ab91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693887198, "uuid": "b183d2ae-c35e-41cf-bdcb-3f225cb8e51d", "value": "16938871965beb62bc6a5ccedf0fca2bed737e2036f8c905c380d976d88666ee6c987b1efb524.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ad7d18-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693890001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890001, "uuid": "b305d8d1-0ffb-4a3c-a028-9a6526d4ce30", "comment": "Malware payload (SnakeKeylogger)", "value": "df5aa3f09be1a9867d76c6e6f889a2f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890001, "uuid": "457674e6-bc21-4268-adf3-54ded895a6eb", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad8b74ac85044fdec2b62194c0e22ce7d31b353a97bce4ea09e80151bff60fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890001, "uuid": "03f60c6d-0ef1-466d-9ab5-f9a8f93eb645", "comment": "Malware payload (SnakeKeylogger)", "value": "11c82e7a522aad3b2db9818f90d54f532d230810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890001, "uuid": "35c36947-cbc2-467f-8c90-a654793470c7", "comment": "Malware payload (SnakeKeylogger)", "value": "f04f21a35a8924ae46b340e65f0f0fd8d2f0cf98d8623f94aed3cff416e00a496b7f338866b2b539e16f33a75f7a81c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890001, "uuid": "e3fd6cb7-dbe2-48b0-acb4-e1f5d963926c", "value": "T1DFE40240F2F89F07E67B97F65914A5A407B6A9972032E3540CD3F1DB29E1BA04A41F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890001, "uuid": "5ab2db44-51fc-4f57-81a3-26c9d6724e40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890001, "uuid": "969254ab-f191-46c3-a7e1-3f36c6fbf439", "value": "12288:ToV/jApG3rtCNxglJgmQy1JNfTlc3aZEigq9mYtxQWgsbgetdmzkDwMD8Hi:ToVrgz/WPJ5iKgsgFeXmzkDV8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890001, "uuid": "90290173-ba30-45dd-8398-716bbca8b921", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890001, "uuid": "692a21c7-9d60-47de-99f9-79128af2b19a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890001, "uuid": "76a1279e-9939-4146-9b31-d9b26bee6bed", "value": "Profoma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f45d780-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693891366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891366, "uuid": "7a9d1eb2-ed13-4028-b7c0-7a654dcba500", "comment": "Malware payload (Smoke Loader)", "value": "351eb3770f1c5f8575f57f1dab5ddfc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891366, "uuid": "1a941b8d-3db3-4520-9cdc-6b3fa8398db1", "comment": "Malware payload (Smoke Loader)", "value": "7aef7ffaf61197e78a2156c8122511fbd5be4c294b8822f3adac8cede6dba8bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891366, "uuid": "65cca0a4-e596-454e-8c44-13da0ec21258", "comment": "Malware payload (Smoke Loader)", "value": "adb64168ab1e29451b95acf823cdd99632af8c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891366, "uuid": "acb5d99d-3a7f-4f35-bf4e-2366892dfa9a", "comment": "Malware payload (Smoke Loader)", "value": "688b3274960054db52092ce855c5ea3ea59b045d33402db4d4d4ccf3f3647ac6ae419caee2ccaafc5390485670e77d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891366, "uuid": "b75d9ad9-dfd6-4e28-8c49-13c13a0a11d4", "value": "T1D924D021B7B0C132C06759706570C7F16E7BB8221AB9459F37995B3E1FB07C02ABA752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891366, "uuid": "0c7b65e6-dc1c-4a40-b63d-b46d74e4520e", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891366, "uuid": "29432442-ed11-4c0f-bc50-a22be6a5eabd", "value": "3072:1dZ5vtVOhlMJUUA08jVGLxO9WtE8U0dqvwLPnM6Q9:LLOhlmUUA08R0tKSqvcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891366, "uuid": "5dd575d9-ff21-4830-9c19-a2c6097f75ea", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891366, "uuid": "e001a19b-092d-4903-b476-23c079bff771", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891366, "uuid": "59a01eaf-84ca-4a0c-8c5d-dc793d549b22", "value": "351eb3770f1c5f8575f57f1dab5ddfc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9bb3da-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Konni)", "timestamp": 1693890400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890400, "uuid": "5ddda511-2c42-4075-9399-445973da4d3e", "comment": "Malware payload (Konni)", "value": "6f5e4b45ca0d8c1128d27a15421eea38", "object_relation": "md5", "Tag": [ { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890400, "uuid": "afd4e755-f948-47bb-ac4c-15d1ffec9adf", "comment": "Malware payload (Konni)", "value": "7c08b9178c05ab765a3d7754ac99f4ba1abddb226dbb6cc898bc692bba1898a1", "object_relation": "sha256", "Tag": [ { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890400, "uuid": "4cd3e9b8-5a77-4248-884c-da351dfe42c4", "comment": "Malware payload (Konni)", "value": "1a8d8aa268d0475408f8a10c96d4cfee5e122011", "object_relation": "sha1", "Tag": [ { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890400, "uuid": "7f6a2a83-8ab8-4bf6-bea3-d866fdb10b0a", "comment": "Malware payload (Konni)", "value": "7a0f784d4adfb36f118818394a5e4157cc082dfaa127f97a4f643f1f43f51cece2ac27ff46d57baf791d16bb77120725", "object_relation": "sha3-384", "Tag": [ { "name": "KONNI", "colour": "#0C6B38", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890400, "uuid": "2feca280-3062-4c29-a379-e878a16769e7", "value": "T12304CF3D09DF182FE96CE67942E55697F063D62A30B1687900FF87264F13912BE8532E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890400, "uuid": "229e26f9-88d6-4278-945e-2936be91b8bf", "value": "3072:7g99+K+7S7ft8Niq+NXh2qrGqToXAZSWW2NETulGS0xVjIQzu8tZKaDJJhVRYmxi:kyKySJqsxxyqJ/Su0ScpS8vKaDJJhfY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890400, "uuid": "46c39b08-5a5e-48e9-b51d-6cb7168009aa", "value": 180614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890400, "uuid": "a8ab61ef-77ea-4973-bad9-d63a13c1f854", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890400, "uuid": "fed0f50f-5959-4436-a055-bbd644f887be", "value": "\uad6d\uc138\uccad \uc885\ud569\uc18c\ub4dd\uc138 \ud574\uba85\uc790\ub8cc \uc81c\ucd9c \uc548\ub0b4.hwp.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18135097-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926948, "uuid": "d83e478a-9a96-46a9-8ae4-baf89bb1599b", "comment": "Malware payload", "value": "bae17b05babdd430c378792d6fadbe26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926948, "uuid": "5c2af776-86a3-41d3-bc59-7b74f2e9ab02", "comment": "Malware payload", "value": "7d1433d9dcf6dabfdcf273310eee02164705703e11fa0d343358e68a4e267355", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926948, "uuid": "b200df20-ea79-425c-8fe2-2d6fbb038cb9", "comment": "Malware payload", "value": "458d11fdeb5cc470546467bb74618799241ff3f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926948, "uuid": "322728b6-8f86-4bdd-9118-e685f4e673b3", "comment": "Malware payload", "value": "46e80bbf86fb7aa2c0700cad1ecd070c3e92e4979191624999cf625a5e9dbba6de67ca4312a8cc88a45d0609a820968d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926948, "uuid": "de4c8dc0-54d6-4fbd-b63b-6ab276859ce5", "value": "T18F723317F3F0CD3FC8A9037840670634B277E864676683132A0966762E537D47EBAAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926948, "uuid": "8c0917ea-0942-4329-afbf-f4779b7d65d2", "value": "96:RgYuTEqB+B4otMlGNUQif+PJEBodw7/EuBSbBGoiVGn+:RO/wif+W6H2PkQoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926948, "uuid": "8ffed035-5bdf-48d0-a2e4-c4017c181e8b", "value": 16864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926948, "uuid": "25a09a7e-2124-4083-84aa-b7023c4ef3b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926948, "uuid": "3704a5c9-2dc7-4f45-bfcc-d19dc30c12e9", "value": "7d1433d9dcf6dabfdcf273310eee02164705703e11fa0d343358e68a4e267355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcef368b-4bf8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693924218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924218, "uuid": "7ffea532-16bb-486c-8984-462e849c14cd", "comment": "Malware payload (Stealc)", "value": "0c7288749ae9ec6ab19f9bb84e3a7eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924218, "uuid": "670a6ccc-8d37-49c8-88ab-104f6290962a", "comment": "Malware payload (Stealc)", "value": "7eb30d30b2b5718edf8d25b393135b1888183628f634a7d78423ba51ec5d9d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924218, "uuid": "33aac7ea-1c1e-4995-bbe4-d9a06cbfa858", "comment": "Malware payload (Stealc)", "value": "a8c41eece43a94eff904a0ffbff02a6884ed1126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693924218, "uuid": "a0541ed8-3d55-424f-ae6b-9a4ebc8cfefe", "comment": "Malware payload (Stealc)", "value": "adfe8288d50ffd6fc2255ea88a9aef2f95dd14f25a0f3dcba9eb50b95a0b53152168258aeffcc6af1f9fcbfc09728a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924218, "uuid": "e1ba234f-b364-4607-ac68-86839df7b985", "value": "T12644CF22B3D5A432E52346309E66C2F46B2EF8718FA67ADB27945B3F0D705E1C671341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924218, "uuid": "430f6e75-dae0-45c7-ae9e-7020695b606a", "value": "a9c54504b028704542d65795e246a1d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924218, "uuid": "b6d62434-01cf-45b5-949c-641ef9309d9d", "value": "3072:BQiD26ewR5ohIqtIgb7X3VGJGt9DiJv6DcgbtII1x1nix7bngMO8nbb:O5w1qWOVGJK9eJSPbbx1W3ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693924218, "uuid": "388a586b-101e-4820-a59d-ee258f016d1a", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693924218, "uuid": "e9787080-00ac-4b0a-914d-cf20d44a0900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693924218, "uuid": "4ef4acfd-ae89-42a2-a207-67999b6bf0e2", "value": "0c7288749ae9ec6ab19f9bb84e3a7eba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e34c0fe-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693921536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921536, "uuid": "8b40787f-8c06-4761-a3c8-f941529cb814", "comment": "Malware payload (RedLineStealer)", "value": "c916ea02af97ec73387ef8ccb017ff55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921536, "uuid": "00fb825b-a769-4353-9c06-9b0857fc699c", "comment": "Malware payload (RedLineStealer)", "value": "7fd998d13977acd53b1405ad855eb5bd034062bebd4b345b22f58697d0936bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921536, "uuid": "e9bea0f4-f98c-4ce5-8d78-e2eaa7c33f6b", "comment": "Malware payload (RedLineStealer)", "value": "d6ea90d6e21153af07f112912eef19115f92f5ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921536, "uuid": "b724d361-0afd-4dcf-92c4-0e5d61091eaa", "comment": "Malware payload (RedLineStealer)", "value": "39011868d5b0f9db75e0ed3fa0a276fedb2ff0e2521fe76a73c74e83d46545d64823cdc2dbd9d95a12b62a8f215710d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921536, "uuid": "0e96c7c2-c8f8-4735-85f2-f19109853e9d", "value": "T16F645A11ECCB46EDE853C6316D50B1B12294EE782DD4CB9A73B44FDB0E617580B8DBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921536, "uuid": "ddfc0854-841d-4ad1-91fc-a8434c6e8a60", "value": "59e9016f955a6d31d640ba2784453b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921536, "uuid": "2e8e6391-9579-4ea7-81ff-a79afecad5bb", "value": "6144:hh/L1istcm1bEx9nS8+z3eO9PuHsrW/8U5o+O7UW5LbtJVEL5h:D/L1iQExl2uO7UYyL5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921536, "uuid": "c2193870-913a-4e47-98c8-6affe2df3b5f", "value": 307576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921536, "uuid": "6a6cd8f7-cf9b-4e68-a132-50efd2b2af6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921536, "uuid": "359b96e9-8607-49bd-9e7a-b250b5fc0f28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadee7fe-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890258, "uuid": "e0763f8a-130a-4e7f-987c-d3b6e1d7a32e", "comment": "Malware payload (AgentTesla)", "value": "43e50100c8aa22cdc11b9dfedf4e622f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890258, "uuid": "f4c5e7de-5a1e-4eae-9162-730988db0544", "comment": "Malware payload (AgentTesla)", "value": "80189568f501aa3d44dc730be8cc81336b5eb4d9238c0a559ae1e6c52342fae8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890258, "uuid": "3a52288b-9c31-4429-8713-35e091e3e268", "comment": "Malware payload (AgentTesla)", "value": "75885192cae6a4ac2c058b99f8e5f6ff043cee2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890258, "uuid": "b529f590-735e-46e2-b82b-4519a58c57e0", "comment": "Malware payload (AgentTesla)", "value": "84111ba0b51cb4d0110d447c29cd2f796edf8a0ba0efea24cb4c914927f2063b39b285a061011cefa9d4fb3f9b4e7789", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890258, "uuid": "0885791e-d300-45af-8e95-2d384d44a6fb", "value": "T14EC5330E37A29007B95498BE95D79AEC0E2D2004410F68DEE5ABE71D80B50DF867D6FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890258, "uuid": "c9c8e356-ca55-42d7-83cf-58967281be24", "value": "49152:Vy8gxISNzb1YLVk6BLtimNQOAQO49G0+Z+yqu/K2aTYBjR:V8HF6tiS4rRQjuKTYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890258, "uuid": "6bab9720-1509-4591-a47a-abfcbaae65f5", "value": 2671700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890258, "uuid": "19fa7911-46b6-458b-8231-31576b1615ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890258, "uuid": "306e2e05-d99e-4922-80b7-35ed5eded16d", "value": "Quotation requirement N0-697045.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b22df7e-4baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693890419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890419, "uuid": "337b4dd8-6b6f-4512-bd2f-f2ac61acf208", "comment": "Malware payload (GuLoader)", "value": "34f435d33b6d31f1b1eaec57bf4e7bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890419, "uuid": "a394624e-1471-4650-a252-5debc13e46b3", "comment": "Malware payload (GuLoader)", "value": "8044f340276e2623beff0e0e2d0853af1831fcaecefbb9a9d0954f08cc8e74b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890419, "uuid": "f498473f-61a4-4817-8c18-2da999f05ebe", "comment": "Malware payload (GuLoader)", "value": "34b4621040de77ca6f60fcf6954cd02247b72358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890419, "uuid": "d5fed3aa-6b1d-4d3b-8ee2-b59123bbf4fa", "comment": "Malware payload (GuLoader)", "value": "911e2905e5e097170ab88161bc6dd067f3fc1b29e1a6f44c9d92e7477d3208edc50be4a77847fa8be27bae26762f7d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890419, "uuid": "6047ce66-df86-4b24-84e1-b8d851954816", "value": "T12294E0546BA0D97FE39E1B3440F5E7384278EDE06922960737953E9F7E21E8DEC85210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890419, "uuid": "25c6ea0d-9e79-48cf-89f0-245a4877950e", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890419, "uuid": "8f29cd99-2fd3-4658-9d34-aca392ca0db2", "value": "6144:uT4DtHOOUPy5MI1RhksWkotiGzuw8a4KVb3NTfccC94dofgQzYMm9Jjp:uTeeZcba4KVb9TfccC1gQYv9Vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890419, "uuid": "0b5f4ecc-ba05-4ad9-8c58-00a9b90fd31c", "value": 429884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890419, "uuid": "4cf528d2-c6e0-4a3e-a376-6859b8749a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890419, "uuid": "05f36487-29e0-4947-a46f-f6ca376835cc", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17e3b5d-4bdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1693912576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912576, "uuid": "78515332-aa82-49c0-b968-32b8f549fcf4", "comment": "Malware payload (GuLoader)", "value": "9bb79f4312fefed8d8e7c9ed58cd3a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912576, "uuid": "8cc0ccc4-3ff3-4e29-84b7-c85fb66c42a1", "comment": "Malware payload (GuLoader)", "value": "80a10c6ddb0a21c9a5c8d1495612f8b8a50c17d6d4469f04fe2f5c0e1f7b2e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912576, "uuid": "22f59c69-fcc6-4c46-bf66-9e2175da4f24", "comment": "Malware payload (GuLoader)", "value": "407ffe8c5c32cab54bd6eed355854a848da5d10d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912576, "uuid": "a50965d4-cab0-45c7-afff-d4b8728bb972", "comment": "Malware payload (GuLoader)", "value": "7ffdedf6c2c852391fb8e6b82a29dcf636482a8dad23b29851eb8772f721237ebe373880c59042ef36ad460748a0246f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912576, "uuid": "7ac60746-9f93-4756-ac40-acaa96368d69", "value": "T13EA4221322E6CA6FC99397B6E4B9EAF559BC8E01C932070B0F507D7A3D31293CA16351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912576, "uuid": "584fa920-89d1-4902-9377-910c772da467", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912576, "uuid": "02010a91-fe83-48e4-8f22-b62403446010", "value": "12288:OqYRUZ2Ro17RhWFmZGWTVXOcwjCvAX5bnY6sZlr51obRH:ORUZ2q1HWFmZGSXCg4nYPlgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693912576, "uuid": "1926bb83-72f6-470e-b3f5-e0bce428df16", "value": 488565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693912576, "uuid": "1cd38469-f64c-4853-9f68-161f96cd4396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912576, "uuid": "d984664f-4604-4e5a-ab00-86af04536539", "value": "80a10c6ddb0a21c9a5c8d1495612f8b8a50c17d6d4469f04fe2f5c0e1f7b2e97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d8e9ff-4bd0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693907080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907080, "uuid": "7690fcbe-508a-40aa-9d05-fa20be010476", "comment": "Malware payload (AgentTesla)", "value": "4ba44a93e54a59f27960432394041468", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907080, "uuid": "3002fefb-eded-4bcf-ba74-a571e01a8020", "comment": "Malware payload (AgentTesla)", "value": "80a6f002e01a7d6400ae7bbc173ce550d9c882187631ffc9fa7d23bb672924ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907080, "uuid": "3cd8d619-d7c2-41ef-8a1e-aafd1567ed60", "comment": "Malware payload (AgentTesla)", "value": "77204782555389264edafa7028b7b06961e8a7cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907080, "uuid": "ce64974e-2a00-40fa-b36d-5c675918d370", "comment": "Malware payload (AgentTesla)", "value": "ff20e17c1e14faf283370033dadc80a344f7db2d5415282009b53cbb44ed1c94a7b2afddcc5037f8bcf3a753d6535a72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907080, "uuid": "c3986428-0ab6-4d32-8512-bb8d4a1182b4", "value": "T1A72573F3FB442FE285C24DACB9E8D233A9D406807151F67BBF69A905441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907080, "uuid": "21ade59f-756f-47da-b4fb-f593c7285ef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907080, "uuid": "b3ac9291-e5f9-4541-83be-45a668af7c22", "value": "12288:PBC7N7YTVJOzxmbfNGgebbDrLolJ7y0PHP4dnnS1O:PBGaVJhAgWAvT4dnIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693907080, "uuid": "9c78cf67-9134-4ab4-bbfe-a859445686fc", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693907080, "uuid": "110ee77a-3248-498a-9c3a-166c2bc0de5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907080, "uuid": "019e8bc7-942f-479a-aa16-447e8d82d219", "value": "ETD - shipping invoice documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fdcdc8-4bf7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693923583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923583, "uuid": "b4301ff7-37f8-4b9b-a667-11afdc82a64e", "comment": "Malware payload (AgentTesla)", "value": "e6635836630de76766b85832fb7a90fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923583, "uuid": "fab2c66a-af96-4303-b42c-2b9e53bc85cd", "comment": "Malware payload (AgentTesla)", "value": "811dbbf4475500604a073378100dd5cc9d85e0af25d17d23d3d27d2bd09f808a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923583, "uuid": "d00024ff-f18a-4a1a-8056-b70dd03646d5", "comment": "Malware payload (AgentTesla)", "value": "199c7409740a0152fb593dd05eee80e911693557", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923583, "uuid": "6f92c501-e700-451e-abde-a555b2f15f4a", "comment": "Malware payload (AgentTesla)", "value": "e57a746bb6ae8503824e1544a5bc057f00bc0ac598cc3c29715e1bb0ed711716256fddf395b427e43a7d55fd21d1eb72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923583, "uuid": "2ef406d5-0bcf-4706-a71d-f643294d3dd1", "value": "T12A2562F3FB442FE284C24DACB9E8D233A9D406807551B67BBF69E941441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923583, "uuid": "535156f6-ecc5-45d7-9e79-b5e01e3ca507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923583, "uuid": "7dcfda88-f4bf-48d4-a487-8a003c8a26af", "value": "12288:rBIL7YTVmfBIBcoMKTZSDIwsGLRQn38b55sL:rB2aVmoMKTZZGLRc3MXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693923583, "uuid": "a082e94c-936c-4534-90d6-726e6d7f49f7", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693923583, "uuid": "f12ca4a1-03be-439a-b1ac-4050a89c6710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923583, "uuid": "53066840-526f-4085-bb72-50e5a5bfb9a3", "value": "Payment confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b692c463-4c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693928503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928503, "uuid": "b6879fdf-d585-42f9-befb-80f73bf3cb13", "comment": "Malware payload", "value": "3b3fa33a5bce97a7f2750860c76b3ca3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928503, "uuid": "4df830b3-d904-4b51-8bd6-94f018000d37", "comment": "Malware payload", "value": "8156e80f934b3e6d0e23a0098fdd290f7d7f3a2a63e2f0c474fed8ed9f97f2d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928503, "uuid": "3778823d-a492-41c0-a383-ec89900ae40e", "comment": "Malware payload", "value": "5f337a4ec681c2809fb7d5c52411d434aa03fec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928503, "uuid": "1e9dcf36-17b2-48ae-b140-f1e4e626eb73", "comment": "Malware payload", "value": "5e34a0bf8a551ffc5c1d1c34ec95b6b90697b01dda8489ad94e8a8b5146c18f21617788f07ffded4a1652f84dd942e57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928503, "uuid": "0c9c0b33-160b-4b82-ac20-5646af56c1b6", "value": "T1BC9423861571D2A1CE33E2F43A6EB3E3B569586FE64C5B570D8308F21C82E9054A37E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928503, "uuid": "8aeba1fe-1542-466e-a954-75b3b47903c8", "value": "6144:i79wiNwELRUym7+acHWVd7TfvwHyzWWpjAI19wBUsNwjmOih5aXR/E2IbzKgj5C9:iyiOFztc6NrvTzsI19uNw+57bzr6Cs3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928503, "uuid": "2ee5d22c-7be4-4fe0-9e5d-ccaa9caf965b", "value": 420368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928503, "uuid": "cb7b94f2-8c64-497f-9ba5-b47224d521ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928503, "uuid": "6768b4f7-0a00-498e-84cb-55c09fa2ebc6", "value": "8156e80f934b3e6d0e23a0098fdd290f7d7f3a2a63e2f0c474fed8ed9f97f2d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b56234-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874041, "uuid": "4570ab53-3186-4dbf-ac29-1a13b53e1a02", "comment": "Malware payload (Mirai)", "value": "fb7ca39514dc892af1bc1430346d2c07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874041, "uuid": "0c2a3ddc-032a-4146-b1e4-1cab783b8f1b", "comment": "Malware payload (Mirai)", "value": "81f4d62a53445d0e5d2948352cabd605b38e8c8c6a7714ee939a36deb0cb66e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874041, "uuid": "aa4bbd0c-25b0-42f1-ab7a-bcc981a0ae65", "comment": "Malware payload (Mirai)", "value": "9dad06d357989e4f11cc7a5c16d3059359c7c752", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874041, "uuid": "dc6c730c-a257-4c3a-8fc1-461561659a46", "comment": "Malware payload (Mirai)", "value": "00fb2552bb73ee1fa1c5aa131f2c592508c0c7ade5a0444780e241496eb10819dfbae70fed1ce6f73326f753e3592e4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874041, "uuid": "fe64b7d6-d014-486b-8541-190e0b6aa4d2", "value": "T12582DF3021AB35F5DBE10434FEAECEC6A7160BF9D1FC369216486B78C94200621F96CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874041, "uuid": "af96ecfc-d259-4f2e-88af-e7fda1c74544", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMadhymdGUop5h5li:6GV0P6+kom0tVAoNvm+to1ds3Uoznli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874041, "uuid": "5e1ab503-2d78-4d6d-8c0a-f79434e51197", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874041, "uuid": "8f41ebd9-3614-48b3-9f1f-caa2d42c6027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874041, "uuid": "04dd49ac-d13b-4838-a53e-8ef35abcca70", "value": "fb7ca39514dc892af1bc1430346d2c07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20620853-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693926962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926962, "uuid": "d4fba66b-57ce-4d2a-805a-fec6a1d645de", "comment": "Malware payload (Mirai)", "value": "e9ced34f67565a5ade1cc63158508320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926962, "uuid": "d86f4739-58ce-41c4-8d8a-7d9cd83853fc", "comment": "Malware payload (Mirai)", "value": "82fc42ee9e74f7581d48f740b118c54b9c3421c15255dd047e3e39b05ead17ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926962, "uuid": "f7140390-f5ee-4628-ab1e-3a7e4802ee5f", "comment": "Malware payload (Mirai)", "value": "e5731df931ebcac41d5350c11085a53ab45a1fe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926962, "uuid": "d2e71d2c-903d-4b2b-9d31-1fc9251c264f", "comment": "Malware payload (Mirai)", "value": "29199d84bd5676032cb64ebf5bcacbc4eb2e2f31baa4c3223be133ba0df6bbedf30f47b7a16abb583f4d8fc0e1b7970a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926962, "uuid": "daa8a3c1-1d3d-4ca8-8ec5-8b3bd1881e62", "value": "T181D21943B88580FCC159C1741B3BB63AC826B5BD1339B2F63BC4FE26694AE714A5F509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926962, "uuid": "3fec6d47-1404-4554-b21d-7b4698bc00ef", "value": "768:T/6bgNSDnNv1r/6em6JcAyKcahq4J3k5BXz/YzR:GbgEDn11r/6em6JcASMjUTD/YV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926962, "uuid": "a2c6152d-2175-4c00-b80d-d00e5fdf5a90", "value": 29379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926962, "uuid": "2901d715-959b-4bf3-88cf-a70f8565c3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926962, "uuid": "03457a88-e6b0-4643-88bb-008f57a93f0d", "value": "82fc42ee9e74f7581d48f740b118c54b9c3421c15255dd047e3e39b05ead17ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab4f372-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693915222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915222, "uuid": "c12bda6e-3d6e-4df6-b856-c29de02ecb33", "comment": "Malware payload (SnakeKeylogger)", "value": "1de345446bf985826dbe743aa29352e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915222, "uuid": "652f9ccf-acd6-46c8-9f96-e6a9b9cb3004", "comment": "Malware payload (SnakeKeylogger)", "value": "85461d79709687fdcc43f0ae970245f49c4c42d89681afbb0109c5eb2b7a903c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915222, "uuid": "578fe5f1-7e5c-4326-a210-949a26f9a10f", "comment": "Malware payload (SnakeKeylogger)", "value": "bf456557b60f9b4bae974aaabdb81144234f0f08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915222, "uuid": "5eb68ae7-f538-4952-a3ad-4222432d947e", "comment": "Malware payload (SnakeKeylogger)", "value": "a8e7174a03b1baed031cbbc7afd26e836a69c643b2990d25bc4ba91c9911a5a0936a29e977d0c8a39bea4e6b9153f65a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915222, "uuid": "adbdeb24-3888-4be9-98db-8e4a10a5c4e5", "value": "T1BFD42360517BCE6EECB943F851A4EA3E837453B3613AE7BE5AF490C9452A342C2507C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915222, "uuid": "5a79b20c-4a70-4304-b41d-02762defb3ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915222, "uuid": "c4eb934b-f425-491f-9ac7-b90804f14f8b", "value": "12288:hCjd04ufk4HAbBl6+WDXX3fPoBgerMiAXyqOiqX5R/EU32/AWNm68ys:cd+fkBg+WDXX3fPodMihSqpRjud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915222, "uuid": "4df0dfd9-4867-48ad-b3a0-9337a6d6754b", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915222, "uuid": "3570a800-8a26-412c-8312-a96434595225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915222, "uuid": "3ac84156-23ad-4d62-a6d9-950d0e86d693", "value": "rLB178K-SB2033-0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da609f4b-4b94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693881318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881318, "uuid": "9c25e768-b792-4e3b-9e2e-9119c9a09de9", "comment": "Malware payload (njrat)", "value": "1c00c8e24fa814e9741571c74df2f71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881318, "uuid": "e26a1385-e134-4afe-8d8b-3ce69f455d7f", "comment": "Malware payload (njrat)", "value": "8625ed4acd5cb983bad7b6809a517c3525497a72c6b87442e10410c0c02f723a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881318, "uuid": "85f15d4d-d289-474c-bcb5-266f078d59cc", "comment": "Malware payload (njrat)", "value": "a3affc050e39e6ec21b721474e66c1be1e5dbc15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881318, "uuid": "1cde7631-109b-4ed7-9f48-7511e8dd072d", "comment": "Malware payload (njrat)", "value": "416cdc5973a6ecbc778232006af66b099273cb994b88c0043ecdc765d953d290d2de0c1be385f734fee161dfb79c80a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881318, "uuid": "ccdd1ea6-a72d-4c45-b7e5-5440837511d2", "value": "T1D8E48C02B6449619C7D87635C6DEC52503B29ECD1A72C10F1EFA3E9A3FFE687D50A218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881318, "uuid": "9bc4472d-0a20-49f8-bb5b-571737020902", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881318, "uuid": "53836b37-90eb-4b47-b3dc-5089da6c2f60", "value": "12288:qwnK1jqkCoBTYqfnA6dTvGXq8dU7wNc96hYJQq30yV:qwoqkCoxXo6Oq8dU7wxhwV30W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693881318, "uuid": "8d480ac0-420c-446a-8721-b4f359023e27", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693881318, "uuid": "c05582c1-db14-4369-bd46-a2f590728dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881318, "uuid": "0f9a4879-b45c-4225-859f-8a62858111a3", "value": "1c00c8e24fa814e9741571c74df2f71f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db649d0-4b8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693878613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878613, "uuid": "64daca5e-b572-4a16-bbff-e28cc95a7fa5", "comment": "Malware payload (RedLineStealer)", "value": "17aeceaaf74bbec641275d43dceaed19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878613, "uuid": "54de575a-7f23-46ed-96ef-7c6132cb7a47", "comment": "Malware payload (RedLineStealer)", "value": "8630283398aa9fa05e2c9b181b118a2af4963c3e91c7440058c2ed05ef7b515e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878613, "uuid": "09b1222a-05b1-4f17-b85a-d2cb711de46b", "comment": "Malware payload (RedLineStealer)", "value": "2a4a9e5cb59fe172c6ebcfc50b3ba4ddce19eecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878613, "uuid": "7908fd56-b235-4841-94c9-b3263656940e", "comment": "Malware payload (RedLineStealer)", "value": "eefc1f7d401b0cee429f4659b95140a2bfd5faf512006205bb69ac0e1999845d58ec4feb31521a1cbaaf797d8e2880ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878613, "uuid": "75af28ef-a93f-4758-a17c-b9af9986071b", "value": "T182840222BBE1C033E4974A74797187A02B7F787229644067BB945B3E1EB13C06EB6753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878613, "uuid": "db22434b-dacc-406d-bb97-bdda6749da54", "value": "4d3edea12b0f02b502231d48e469cf3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878613, "uuid": "2fd4d2b9-23ad-4cd1-870b-de7e67a43847", "value": "6144:AJNEUPDV2W10uIVtGhdiZQCbeOYHxPe6o3tirm:AzxPxb1BIa9moGNOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693878613, "uuid": "b31b194d-fa31-4d54-8e5d-12780f8a9a94", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693878613, "uuid": "3e5f739b-7f0a-4a4d-9c3f-4a8bffda790b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878613, "uuid": "b5f113ce-e249-4558-bb95-85559156d69c", "value": "17aeceaaf74bbec641275d43dceaed19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea95955e-4b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693877480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877480, "uuid": "a9d6744d-14ef-40cb-ab74-73e72102c057", "comment": "Malware payload (Mirai)", "value": "eb0adb39dc94feb5b82139706d208663", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877480, "uuid": "344dbb19-e48d-4dd3-8e72-e858f89bc41f", "comment": "Malware payload (Mirai)", "value": "868df634463ed3292f807458d2d1178b8217f4dd82ee7c2caf299b9a1146fe94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877480, "uuid": "e9f7aaaa-80ee-42c8-a16b-25de6b6f5533", "comment": "Malware payload (Mirai)", "value": "543d1b57f5e8b3f57a063afa7f05cdd123f9760c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877480, "uuid": "9e76666c-4324-48be-8b0e-3befdd18c877", "comment": "Malware payload (Mirai)", "value": "7fe514c459101e8d480c68e1adcc2fb4a50aaa9e0b4e2993886e8931dd5cfa79ed83643f62e4bf8086f04bdfe757c56f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877480, "uuid": "51b698d4-d4a8-4888-a61e-7e96ab06e650", "value": "T15ED318C7F900DAFAF80AE73748530809B230BBA245525A376257353FED3A1991577F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877480, "uuid": "c764aaa5-80e0-4024-bf9c-e85963547ae5", "value": "3072:0VfyY4QFD1CLtiUpaFzHQ7jdfTsVzjbifLQs+wy7Hffa:yftrUpa5HidfT3LPy7Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877480, "uuid": "8238400b-727f-4c37-9cfc-1d414d46ce76", "value": 133516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877480, "uuid": "1bae6901-457b-429b-917f-485138a49eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877480, "uuid": "c5f4278c-451d-452a-997d-254070fb1f78", "value": "eb0adb39dc94feb5b82139706d208663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0cdd0c-4be1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693914102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914102, "uuid": "f3e3c673-6681-43e6-be89-4ce1ed8b8d49", "comment": "Malware payload (RemcosRAT)", "value": "d964507c49e1fa2871d3307f2e4e9649", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914102, "uuid": "a0e1e6ce-91fb-4fc9-a497-7793553c7b62", "comment": "Malware payload (RemcosRAT)", "value": "86c2e7b0d299d117fcff4792d8b19209e0e4336156f24c335e99a9aaa33b6923", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914102, "uuid": "3df9edd0-2881-4e35-a11f-a8bddf99146b", "comment": "Malware payload (RemcosRAT)", "value": "d9ff10e6ca66a0517de328cfc670fce7f3280384", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914102, "uuid": "a5140bf0-390b-4b9e-ad52-37c269cf4833", "comment": "Malware payload (RemcosRAT)", "value": "65c6484f746e060b0eaaf509bbbf5392a7d16988207303e2225c910b2ffca226bfe81f0bce047606cd72bd6f60c8ebaa", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914102, "uuid": "2aa7e7b1-fa22-4fed-a8ab-d8a07f3d1f33", "value": "T1A1E3F71BBD5B87F2CA48573AE59B60340336E681F3A3EB0A358E535A1703BEA4D45347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914102, "uuid": "8fb3f699-f33c-42b8-9ce6-069ec8d006c8", "value": "1536:eqoW6FHmUAPr9/uKiA+W0cAxwns8/YNTRoDvj7Goa45o93:ncFmPPr9BiAxDAxwnYNT+7GoC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693914102, "uuid": "64d9d217-39b9-4ae5-a6cd-48b886d5822d", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693914102, "uuid": "8fb9a0cf-ef65-423e-97a3-abdb521d0e83", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914102, "uuid": "e3c92e34-e290-4f51-a4f1-188ec9c19fc6", "value": "n315417938.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fb7522-4bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693919237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919237, "uuid": "593e20be-3bc1-484f-9aa5-65cc495ddebc", "comment": "Malware payload (njrat)", "value": "ea5d2d9686395801a1f4e5549ef6bc28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919237, "uuid": "a87fea2a-ad66-4f79-a670-b25e1a2b8756", "comment": "Malware payload (njrat)", "value": "8798951c445ef2181ed4836e704aad8d18581f57d01d1b33893a264abf4aeb6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919237, "uuid": "e7b48841-e36b-4479-8c9d-39839e155eea", "comment": "Malware payload (njrat)", "value": "c364b9669bff791cec4064345760de216cbfe9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919237, "uuid": "fb0c662f-59df-4225-b9ce-336004a5c63b", "comment": "Malware payload (njrat)", "value": "b36525eb872a65598743bd87ca43988cc051415e1530bbc450be1d626680bfaa24cf87bae6736292741c3a44f2cf66ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919237, "uuid": "cea24cc2-745a-4faa-9789-d632dda4730d", "value": "T16B35F13222A14197D1E7DC36893BBEF131F5272B5F42B8B16AD969CA19111F1F323983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919237, "uuid": "25cad503-df32-4419-8db7-8ea5081af40a", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919237, "uuid": "254f3eba-ef75-42a7-a64d-d0e49913986a", "value": "24576:yk70TrcGxN9M3K5mLh+90c1Gt2CYsJMOE6W2mqMkOXQkvoYH:ykQTAGxNLQ+9IPVJYGml8kJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919237, "uuid": "037dba21-d08b-4514-a0c9-7f37c79052c3", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919237, "uuid": "45d3efe7-4229-48fd-bb16-e186adf93a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919237, "uuid": "b04b2588-8e76-4936-84c0-6987e2c55818", "value": "8798951c445ef2181ed4836e704aad8d18581f57d01d1b33893a264abf4aeb6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c40c6d9-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693927143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927143, "uuid": "a46ca84d-a0c1-464a-8651-b9e7c0cc5680", "comment": "Malware payload (Mirai)", "value": "b9d6de8b9431445def383e28bacf5ca3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927143, "uuid": "dc8590fc-30e5-47eb-8aa1-a78f08b2c324", "comment": "Malware payload (Mirai)", "value": "881df712cf015b4b4bdbcb183e4af44ea7366e7034b862d4e2651624c71c4ef7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927143, "uuid": "9bffa78f-1633-4c29-9d1a-3dc6750a7cc4", "comment": "Malware payload (Mirai)", "value": "3bd78f4dd921089edd3999a23523b2f9ebfa5a57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927143, "uuid": "45e1e1ca-7862-42a6-9eb4-41c20a6b6113", "comment": "Malware payload (Mirai)", "value": "80e79957f1ec1f448eaa73061c38e0e68f1261d577e5e7b3afa11655c1a59bab0b6cf09c36a828e31953d07da0571105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927143, "uuid": "b738d132-f414-41a9-969a-d027927ef0bd", "value": "T17AE56C13FCD509EFC5FEE231CAA65B617B317465437373D31E9046A91A2ABD82E29302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927143, "uuid": "e6cdda41-6495-4bcd-9811-c43f3d04012b", "value": "49152:MhkeoKxfJb5VO4GfKgg9htbiOuoIThPWdWani8tgjxkQNxDx:e7jba4Gf9PqbtUH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927143, "uuid": "a299ff55-44c0-44f3-bff9-b1f661ab5209", "value": 3029542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927143, "uuid": "b36e661d-7c1f-4bde-a870-34ff4eb149b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927143, "uuid": "da3c2c76-9ef3-4705-9b59-120994366154", "value": "881df712cf015b4b4bdbcb183e4af44ea7366e7034b862d4e2651624c71c4ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb424707-4b84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693874394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874394, "uuid": "f35623c6-f9aa-47f7-b370-72149f3e4bb3", "comment": "Malware payload (RedLineStealer)", "value": "30ede620fe27086117bf713b91f17195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874394, "uuid": "b129da64-011c-45b7-b23b-10f7bc62dc6a", "comment": "Malware payload (RedLineStealer)", "value": "88bfec737aacd088f81705a47a0e2f505ef43020d9c70ffb4c19c082707145b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874394, "uuid": "07a7e179-591b-4ac8-b179-d10470115c70", "comment": "Malware payload (RedLineStealer)", "value": "e33dcba11568a073600c85eae7b1807f9be3b573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874394, "uuid": "969ea51d-19a2-4e86-81d7-984b6326afe6", "comment": "Malware payload (RedLineStealer)", "value": "db2aade8ec92e5a932dd864bac56dcfbb47a45d4af71e3b8dfa0464de32a629c4fc9d62c7d3aa941ff82a84e38a749cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874394, "uuid": "1b2c78f5-6348-4583-939b-19cd2e42987a", "value": "T15984022137EEC072C45704B429B9C2E06E7BB86116B5549B77580B7E1FB1BC09EB6363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874394, "uuid": "7f360a42-0b38-4c9c-afaa-7ce2dfa6727f", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874394, "uuid": "41cbfc98-ebe9-433a-8e30-498b9c2073e0", "value": "6144:XoOhRlvy7qXUJPNCcVp86OUfga3JTHphWEzI+GqzdJGwZYuj57zXUa:XdhTvye64j6OUoa3JTAhOdzV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874394, "uuid": "0ec55c34-8cf6-42bc-9149-eeb0a9311fc7", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874394, "uuid": "72fd4860-2d6e-44ff-b991-4085b13ef24b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874394, "uuid": "b985119c-e945-4ee9-bfec-4eb05ebad427", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e43366-4bcf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693906335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906335, "uuid": "c3c29afd-0aee-4acc-b455-629cc583fd90", "comment": "Malware payload (AgentTesla)", "value": "34480c998d0f47c3b0960745ec2c6071", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906335, "uuid": "c0687541-7bf8-43a1-9cb2-654b188fffbb", "comment": "Malware payload (AgentTesla)", "value": "89342b49c1da5ee02b661baac37cb104014a9fcdeef9d6bbcc1d70ed8ca42a15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906335, "uuid": "e3d74d6f-2922-4f17-9b91-eda0d3dbdbdb", "comment": "Malware payload (AgentTesla)", "value": "68c17e1f27355a5b5b5d5d9010d34f2db67bd1db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693906335, "uuid": "3e30cb19-156f-4fce-8f3c-b27401e2bc1d", "comment": "Malware payload (AgentTesla)", "value": "2ff0f1fa3a6823a7b533966989c0c29352f33896a148146b4a335a6d6f41da85ab785dff0d66ea5383c97ada7f363a74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906335, "uuid": "c0d17954-2682-449d-9339-aa1c79fab03b", "value": "T12F33366DD34F02A9CF52523BAB1A0E4542FCBB3EB34552B1346C537533AE82D91622BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906335, "uuid": "c0d8978d-3d18-4a83-a6c1-3eb31e3ba989", "value": "768:ZwAbZSibMX9gRWjb/fBiu9JOa2AwUg+0pPryNYSghaXw8ieGW:ZwAlRa5iuaafwpCYSg6w8ieGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693906335, "uuid": "c4d1acd5-cb48-485f-9937-97bdb7ee4bdf", "value": 52213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693906335, "uuid": "97760efb-4de1-4b14-9160-8542d8663c70", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693906335, "uuid": "ee19cca6-144a-4173-933b-325521a2ac7c", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.27101.4149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b142af-4c11-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693935002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935002, "uuid": "5951f032-6484-42aa-aaef-65e0b982c29b", "comment": "Malware payload", "value": "db6ca75e59e5018ce801ba1c70cfb0c8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935002, "uuid": "763db74e-9d9c-4550-a4db-ccb50e75f61d", "comment": "Malware payload", "value": "8999d1472bd1c56292c3230c718e4eb496094ac9847f82dcb250553200cd44e1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935002, "uuid": "17c194d9-b637-45ce-9ff1-f0a7cb1dbd37", "comment": "Malware payload", "value": "03d7fe634dfa6a37322199eae7eb28a3664e46fd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935002, "uuid": "100810d7-51ff-4ffc-a2aa-3cc4645b8566", "comment": "Malware payload", "value": "2d586420755694e35425af3dbf3d8e5ed0e0f3dff5d6eb139c2932bcaf8d3dbf435b1a035fc3fceea4665efed693a9f9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693935002, "uuid": "86629f00-4ed3-4613-af9e-6b8adf7c736e", "value": "T1D2B15DF8A40838C2E63E486F7243F8CF03E5725249C699D87254B6EF58FB65EFA02454", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693935002, "uuid": "b6ab7930-82b5-472f-908b-3c1eaa69af33", "value": "96:O0Sk8YJtXBAHzlOBl8GTTxkmoBB80gs2QOVj6cTkXekVNd87UlPJQDAQEElEoFbg:O0bjJsOD81FR2QO9UvuUWjUWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693935002, "uuid": "95593f19-7d03-4342-8859-6502d0da003b", "value": 5540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693935002, "uuid": "eb13dc16-31e9-449c-9770-53c604e5531f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693935002, "uuid": "09ac15ad-a25a-4706-82e4-bb77de002d65", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.23461.14486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c3e668-4bda-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693911026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911026, "uuid": "c3fde387-aec2-43af-b23c-fe7e68adc177", "comment": "Malware payload (AgentTesla)", "value": "c9529a25d594961e607b4dcae422cb3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911026, "uuid": "64f190e5-08e1-47a6-883a-b7ee5235ddbf", "comment": "Malware payload (AgentTesla)", "value": "8a4401b2bfd1bf7cd88327ad700415d6d785d64a403967052ff8f90752f35339", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911026, "uuid": "48a49a15-d435-4ba0-95f9-837c22034f37", "comment": "Malware payload (AgentTesla)", "value": "c098cb76892d3a15e411df6f7609898bb3eded3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911026, "uuid": "23c71dd6-a7d9-4bab-b263-787b8e15326f", "comment": "Malware payload (AgentTesla)", "value": "25f0254255763cfb8d016a50126dad167be081949ab17ebb5116310853fd5ba98f2f085fbc34990dc93701cc533ab572", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911026, "uuid": "b6799467-85b2-4647-a52c-5607b7cca0d9", "value": "T1D0251202BAC15872C472193759B4AB21AE7DBD305FA58ECFA3C04A2DDE315C1D631BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911026, "uuid": "f785a873-d8c5-43c1-9069-54ff29e320bd", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911026, "uuid": "a526f0ed-8760-49d4-8050-ab8668162cd0", "value": "24576:NTbBv5rUanD9l9oJVxmemCppraBGa6mXcqIAXiAQFSDJ:HBja7xmem6prvLAXiAVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693911026, "uuid": "bed3843c-ecef-4423-a840-8dfe873029a9", "value": 993261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693911026, "uuid": "830dc41b-2a56-43c3-bc47-64d447b93c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911026, "uuid": "455510b3-42d7-4ac2-8d4d-74b7dfa997cb", "value": "8a4401b2bfd1bf7cd88327ad700415d6d785d64a403967052ff8f90752f35339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d82c79-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693921467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921467, "uuid": "a8fa9e15-83ca-4f2b-9f94-f7dbd08e235f", "comment": "Malware payload (Formbook)", "value": "e084805d9f56752576e9b10e31be5f74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921467, "uuid": "7fd1421f-1b13-43a8-bdb5-581bbf8bbc6c", "comment": "Malware payload (Formbook)", "value": "8ac567bfb4be359b1136e1236bbdbac3e160077a89952f967467a345a23c0047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921467, "uuid": "e09596a4-02e0-4469-87cb-5eaebfbb092d", "comment": "Malware payload (Formbook)", "value": "e88d854924d30edb64a040a4b95860be4fb12122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921467, "uuid": "99627564-2746-4db3-acc0-fbc0b3c8cdf7", "comment": "Malware payload (Formbook)", "value": "a91bc3d2770037431669b47cb06286616a8daee251e7ca4214938f5bf4d0400204060aab85d929ec37064345de705748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921467, "uuid": "ede0efb2-1414-4fd9-9757-990663e3246d", "value": "T1B2E40105BB75C66FCD2C67BDF0210025C774EC0A7022B79B8B49AD592FD77A0DA029A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921467, "uuid": "61ea6482-fe9a-40fa-8abb-04fad6395243", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921467, "uuid": "c4ac6066-7cba-48a2-9323-109736e30db4", "value": "12288:jriweg7KVy9/X8uS5Vi+zXJNFzu+AxyZNqB/OQZd5tvg18cbxwgQIQewV:nJ7KVS/X8uS5Vi6P/sOQfzvg2cbWgdQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921467, "uuid": "27a61be3-93a0-47f2-b6db-95d53edb17a6", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921467, "uuid": "cb6c28e6-b552-4266-a1c5-ef4757f7b2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921467, "uuid": "2a4cd447-6a59-4ace-bdff-c901e59b2b35", "value": "PFICNOOCMAY23002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec30e8-4bad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891926, "uuid": "b2190600-43dc-4607-9cb1-4f6ffe3276aa", "comment": "Malware payload", "value": "9a35cf5f6ef80c7f7c32f646a0e0042f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891926, "uuid": "56b2f743-9919-487c-bbd4-f42db09a8be6", "comment": "Malware payload", "value": "8bc19c3b9a855d9284172c62bd7b08b9d7b2e6342b321938120435de8e8264ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891926, "uuid": "1f72b2e7-9c20-48b5-8f60-55b85d599af7", "comment": "Malware payload", "value": "bc4371f2b1dabf9abf2cc41fd3a953593c554791", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891926, "uuid": "bc7459dc-758d-419d-bab2-9485ae985e33", "comment": "Malware payload", "value": "2134bdc0f52bc55f0680997d455823863d59c2dde4cc4dfa4ee639657598d83af9345866cabcba48c16cdeb80968564e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891926, "uuid": "9cff0312-3166-4a25-9516-16b4a17cbf83", "value": "T1CFC4AD023AC2D0B7EE6F01701429E63D6A3DB5314B614DEBABE4DE7C4E70AC15A31976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891926, "uuid": "54bbfb7a-3f1b-48d1-9e29-73c68ca49c51", "value": "34999208ee5440ad6be0aebf694f1f01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891926, "uuid": "97893710-f454-4d81-9426-eacd7e376a09", "value": "12288:w0phNnd57NxQ/N1M4WaUswYWwPlwsOyD8g4V:wKNDQ/N1M4WaUswkPK2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891926, "uuid": "f2c36eda-5e0e-42fd-83cc-bc4c116fa6e1", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891926, "uuid": "4f1211ab-60c0-432d-8f7a-72ff0ce10c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891926, "uuid": "1615690a-3b2c-49da-a28e-28b79fbee7a0", "value": "VCBeacon.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556b609f-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1693921468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921468, "uuid": "a064edd6-b623-4504-9feb-f08deff5688d", "comment": "Malware payload (AveMariaRAT)", "value": "136ad512f3d7a151d28ec542a84ba833", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921468, "uuid": "edb474e5-4a37-4549-85d3-482096323191", "comment": "Malware payload (AveMariaRAT)", "value": "8d44a4970e02bbfda226173c14bd757ebd35125a24bb52caf01f8abbe7abec3b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921468, "uuid": "523acf33-d02d-4d28-ae79-b5f694ce3823", "comment": "Malware payload (AveMariaRAT)", "value": "bf26888eba1e38ad6f6b67acb15a82640646adc3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921468, "uuid": "42fb4dc3-772e-4080-8bf9-e8c6eb14a5b7", "comment": "Malware payload (AveMariaRAT)", "value": "a5c7ec18cafce801b25a6c91cf2e25414ce29fd4960f112602bdc380f25f17648bc897d3b3b17e33ca58f8b3f5615e66", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921468, "uuid": "baafc74c-2c96-4561-9020-ac1a13fc27ce", "value": "T1A374CE1EA9D611B4C198CD74A7FA90EE1AF6532F64167BEB24A803F6DF1174F60020B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921468, "uuid": "f8f47e1f-0c82-4166-9996-76b28e9d51cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921468, "uuid": "360359d7-1e85-4b40-b1ce-5d8fef779833", "value": "3072:tKwTNwme7IkrAsypLIDyimbNWo/KwlpxAX/JhkF/yU1P/Qbcm8PgcQZ9t4ZfnzAW:yme7WPpL6mbNWo3lQMFn1XfmG69WfGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921468, "uuid": "cee4987f-5bbb-4b65-9f82-7c7c2fc1aeff", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921468, "uuid": "857d6cae-d0ee-44b1-b56f-86aaca7fc6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921468, "uuid": "b43e5147-2a81-44d7-a639-2f3a92a4f8f4", "value": "8d44a4970e02bbfda226173c14bd757ebd35125a24bb52caf01f8abbe7abec3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aa39b0-4c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693929622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929622, "uuid": "709d5f5a-1e06-413b-9edc-7b4fe7c65a69", "comment": "Malware payload", "value": "432137a4a01881da74f623baf27f558e", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929622, "uuid": "d23dad2a-5b83-4d57-9de2-898648e40413", "comment": "Malware payload", "value": "8d7b5e3ee73c2ecab553080733af31c0fff343f8eb1582ae767e2fe8613565bc", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929622, "uuid": "08874e22-4abb-491d-90f4-c5f503bc7845", "comment": "Malware payload", "value": "3865570266f34108162346c06ff810de6e43749b", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929622, "uuid": "0ec18b40-8401-40fb-849c-0a9134496b37", "comment": "Malware payload", "value": "e1a52308bac7e26f29691481d088c28cec749f86a6a2662aa6ad191b51a46cf7304b752f61622116a4771c2a0d1e5040", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929622, "uuid": "fffaa381-2d02-42d6-8c85-2704a44c8462", "value": "T129514441BD861D3023E2E3A15E34DC92EE01B31F1B52272079AFD0985F746AAA1E7579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929622, "uuid": "2b9d1b62-acf9-4340-83e8-bbb0fadb208f", "value": "48:edK/Dv9N1noGoiJbsgOgsiRQdRSWwPtLeZWHCo7xA2UzRoQAR6L88:edK/Dv9DXoilsfiRART8yEiI1UzRkRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693929622, "uuid": "d2cfe31e-d927-47d1-a502-b8773cab5e4e", "value": 2963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693929622, "uuid": "706b8f5e-3076-4e37-b16c-e5f312bc48b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929622, "uuid": "f68bc001-aa69-41a5-b87a-21759b6f618b", "value": "mygame.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bffaa9-4c29-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693945272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945272, "uuid": "0a8c85ba-6705-4812-9e55-c2a7f8532b52", "comment": "Malware payload", "value": "15acbc45c2e88aa16a33994d88b8affc", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945272, "uuid": "7c76311c-2bc9-44c6-8de6-3b958ccd915e", "comment": "Malware payload", "value": "8f57b10a281c40de79ac5c576c341269e48a472cb152f7adc046cc6d3771e452", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945272, "uuid": "51151884-b820-4e40-bc88-a2cfc08e1b7c", "comment": "Malware payload", "value": "520412845926df7557adb5ec06772dc31ac7bd38", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945272, "uuid": "c82feb85-4049-49d4-8773-fcdb9a949f92", "comment": "Malware payload", "value": "c0f9e2270553e9adadd4389d6646ce129c4dfc04a61cd5a5dca2ead4ab46818fb3442af01db9b280cafb2bc02f1b545c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945272, "uuid": "6a8414ee-09fd-45b5-b326-edb4c06b3e2d", "value": "T151E3185D3A8CB970FDE39EF0811F986D062671112503A833115D4AD85EAABBDDB93C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945272, "uuid": "c8a0ac4c-b4aa-4627-b06d-431e94b58410", "value": "3072:s1djAcY6p8j3ongWq/YvlStGoZ3wNfernEKifoI+FQc2GBs9Mox5LMLL1tR:gBrp8j4ngrcoGo6ernZiA3Oc1khxdMfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693945272, "uuid": "60b58715-8860-4e92-9362-8ecc85c27597", "value": 151036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693945272, "uuid": "6b7a58e8-048f-4f11-b0b5-450044739dce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945272, "uuid": "adefde8c-de40-4500-b90a-b5bd31c40f96", "value": "prapp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b82528-4bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1693904119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693904119, "uuid": "2033c46f-889c-4b6a-a9f8-c936d9f04d44", "comment": "Malware payload (TeamBot)", "value": "52987edf2392e991e1f069aa29f4f9a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693904119, "uuid": "0e915ae4-dd49-4ab4-a608-7e08645056c4", "comment": "Malware payload (TeamBot)", "value": "8f6c22643d9030c26cf77fcf5692f1d76966f7064928cd9ab08691ab6d6ade3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693904119, "uuid": "328e6265-d34c-460a-b37f-43011e814373", "comment": "Malware payload (TeamBot)", "value": "4b66d855c5d9059fc0a8cf92d5f1fd5a0a46cefd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693904119, "uuid": "fb880462-4079-41a6-aacb-696f8e051acb", "comment": "Malware payload (TeamBot)", "value": "faea1eb54dd0b12a261f03aeffbab8972f60a77a7fc683098132a28d8548a503eaa225a9d99b4cec66073eab93ba9e89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693904119, "uuid": "d6b553fc-256c-4b93-a928-7f53891a4553", "value": "T1255427A365D0FC62C51247348E2FD6EC772EB8529E596B7336187F2B28712B2E613310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693904119, "uuid": "86a4862a-ea9d-4525-85ae-eaf901f16ef6", "value": "2ecd68902b681b798a1768b60fb38fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693904119, "uuid": "3edf4516-e011-4bd3-a6b6-601553016703", "value": "3072:HCNtVWSjL07Mw5TuOAFZiC+EK1fXJnCzwApOwRc5x4qspTLQV:iNeSjLoM6uOIiN1fXJnVuOwRg4qspTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693904119, "uuid": "d8a6b16a-e580-41ce-b15d-77c123046c93", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693904119, "uuid": "9de559e5-7542-489f-a6ef-3e558509cb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693904119, "uuid": "cb0965f3-a109-4cf8-a724-c5b7976fb469", "value": "52987edf2392e991e1f069aa29f4f9a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56621081-4be6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Grandoreiro)", "timestamp": 1693916315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916315, "uuid": "864da76c-94ee-4feb-9fe3-bd17b8e19980", "comment": "Malware payload (Grandoreiro)", "value": "1b9405596e82ddf6ad77725a871e15f3", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916315, "uuid": "b301a99d-1886-484b-b438-ee98643ca9ea", "comment": "Malware payload (Grandoreiro)", "value": "8fc463f7184f2ae8ba018823b488a1b4a2d0e6dcad1ac65815d9d53bf0462d17", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916315, "uuid": "f6e14017-6d21-40f9-b402-a79b4c42bcc2", "comment": "Malware payload (Grandoreiro)", "value": "6cb2eeb498832e9413bb169a12e08243f9898cb6", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916315, "uuid": "fbcc4882-f237-4230-9ec2-b06089711f00", "comment": "Malware payload (Grandoreiro)", "value": "bc323f0b3cda4d48ec228894ad3c5dce414385b4a8ec1d6630a9261e46339bb18f485eb009b8032147dd2abb9a8265bf", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916315, "uuid": "b90eb6d8-481a-48fc-822c-3290f7a1bd19", "value": "T13B16337A6C5663C3CE1D2E7576F381D9E7415ACDC02EB57760650BB880B5E8B093A8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916315, "uuid": "36f87aff-6484-442d-84e9-843086704eb9", "value": "98304:qA4iuqTEDXwiIm3vhBCfl0KdLyJpPzLnZlLONaMwLoSutOMw:JrvTEDXtpBCGKh8//+azstOMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916315, "uuid": "9d9d8ec1-a441-45cf-83e5-049e588e8d0f", "value": 4139050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916315, "uuid": "d66d1211-623f-4979-8df6-3d4245f5a930", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916315, "uuid": "f03c271c-f226-4d5a-999a-7013b808f84d", "value": "ID-Attatchment_AOIKQVFGMPJLQKChgoyj.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0c10b6-4b99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693883124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693883124, "uuid": "d7b2d672-68dd-44ff-9785-bd369ee50480", "comment": "Malware payload (njrat)", "value": "1dd73a57dcba3c7132fc856ec1012d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693883124, "uuid": "a34311c7-0145-4c95-bf8c-242e90b38d32", "comment": "Malware payload (njrat)", "value": "9009778d8dddf424b6487cd6c6da345653d640a23e957613cca37f11544c17cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693883124, "uuid": "deadd9d0-5f0c-464c-a74e-38eafdba5806", "comment": "Malware payload (njrat)", "value": "05681033db2260f1c19e6c993f2f03e4637b494a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693883124, "uuid": "23ee18ff-1c03-40d9-b801-7c5ea6639fae", "comment": "Malware payload (njrat)", "value": "1a51c2affe68d6bcdc5feb3661fb1bd809521291aea6bace41bf3170b8d400ae397c28daeb1f6cff081fc6a8d8d7708b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693883124, "uuid": "27be2780-2866-486d-8697-3da92ad3b471", "value": "T14B93E94977E52564E0BF56F39871F2004E34B48B1612E79D88F219AA1B33AC44F85FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693883124, "uuid": "99721980-0431-45f0-999d-fb11ee8345f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693883124, "uuid": "f002eb00-bc48-4ad4-9653-f5de855f02f4", "value": "1536:qgSY3SUFKnOr70txlZbgoxXejEwzGi1dDWDegS:qg/7KnOr70txPXni1dAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693883124, "uuid": "fce969b6-9e92-4c01-88ef-5827b084d73d", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693883124, "uuid": "933735e2-259e-46aa-9dd2-ac6ecc11c073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693883124, "uuid": "97ae3091-c7d6-49a8-8051-46db31f23b00", "value": "1dd73a57dcba3c7132fc856ec1012d27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d601f7-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913771, "uuid": "c15eca8f-4f18-481d-98af-1adcf3669c84", "comment": "Malware payload (AgentTesla)", "value": "583a0a447748e4508e1f66f5441b977d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913771, "uuid": "754349aa-8d45-471e-872e-84abb8395233", "comment": "Malware payload (AgentTesla)", "value": "91c3f9beb32ac46007d28c178185f301425a371ea1a81603a3aa40812093ce8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913771, "uuid": "23786082-fe06-4847-947f-86fa9ef60900", "comment": "Malware payload (AgentTesla)", "value": "3319fe3d25d0e9ac8c40b3153da449020989f0a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913771, "uuid": "2189c9f4-93b6-4dba-9fa5-ae420f0123f5", "comment": "Malware payload (AgentTesla)", "value": "4c8d6461ccc14ae94f5e5ec9935b72e445a7ba24b2767c7a0c98ea34af2961c8bb0fb7ea3091807753d924f9e0e37dd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913771, "uuid": "82471f2b-8bcd-4bf0-b956-60249f114c20", "value": "T15E45D0EB2AA4582EC97D4AFEF3384C49B3AD85E85307F705B89947B09527B306731613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913771, "uuid": "abd720a0-c758-497c-bf28-54d9b4442c73", "value": "12288:HHpMJyuE18hX7rbSbd/2Gd0n5FndwyX+ygX9rdjUK3SxGP1/GYU7mOOP8b4vNwYc:kX7HSZOGdOFdwsytrNixXYUQKGJ8dMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913771, "uuid": "4fe10834-2d65-4620-9f56-68b17c5892c7", "value": 1181696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913771, "uuid": "ad47610a-a820-44ea-a3d7-f50c8de8b6da", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913771, "uuid": "46540c99-3be0-4abc-89f3-972e1c921c12", "value": "rQjtcxinln.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d98523-4be8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1693917385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917385, "uuid": "8fd96678-2f93-4e9f-a54d-69d4f80c825e", "comment": "Malware payload (SnakeKeylogger)", "value": "8fbd2f968fd6f6c10a93ea9e976029e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917385, "uuid": "7a389fc9-4a71-48c2-b6f2-80f16a6856ba", "comment": "Malware payload (SnakeKeylogger)", "value": "92252e96c7db737e221fbe7b947a2755b504006c4542aee48e77b418e1dc1056", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917385, "uuid": "6dcc5213-e5e2-4018-82fe-f8050389d30e", "comment": "Malware payload (SnakeKeylogger)", "value": "72a8387d6dee0166a0c8adea161e0e233bf87b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917385, "uuid": "974af54c-0ca6-4833-bfc7-6d556fa62115", "comment": "Malware payload (SnakeKeylogger)", "value": "c4e5df58048f9997d0e4707694625382515f13ee53f0c4a1e0d1c3274d1ba9278e2d6b8204a8cea1b2b4a507e3f0d19e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917385, "uuid": "4ba1df1d-218d-4ccf-8143-cffd2fac1a22", "value": "T1A2E44B0123F59B10E5BAA7F1DA70912287B92D56656DF30D9CC06CCA1FB2B139BC3A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917385, "uuid": "3f340d98-630c-41e6-8278-695e61aa4418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917385, "uuid": "ae99835d-3f76-4dc9-9e30-3f31c0909324", "value": "12288:HODphClGCxpxAisEtjLlGHg6Gxt35dxC:HNFPl2pGxl5dxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693917385, "uuid": "12180e8b-901f-4d91-869a-c1250890eee1", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693917385, "uuid": "2de26655-5680-4d6e-a576-e21be53182d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917385, "uuid": "e00723d8-b09c-48e7-8890-552b8b34f35a", "value": "SecuriteInfo.com.Win32.RATX-gen.11161.10028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe1c959-4b94-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693881032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881032, "uuid": "aba5a81b-cf7b-4b6b-894a-a327c781b4ba", "comment": "Malware payload", "value": "e20813dcf60bdc2b291d912b678affc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881032, "uuid": "093d40c5-e13d-46e0-a3c3-ef861207c661", "comment": "Malware payload", "value": "926239abe333c3d219cdcd49ba34a7e1bcaac76b4e217d9fbc7f8688f019bdce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881032, "uuid": "275a1e42-e384-40b6-9110-6cec687a7872", "comment": "Malware payload", "value": "b8adf18d8a2061e422cdf93f7c9653c208c46b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881032, "uuid": "71fc5597-c7e7-415b-a361-37ac4f8b1785", "comment": "Malware payload", "value": "b657271e0beb45b101f744a963a96d62295193d3a85e5197ea467b2f861102d1143fe0c018907faeac6ea6acee9cfe55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881032, "uuid": "528a5ded-6bee-4ca3-b158-152c13ebbe18", "value": "T163B5232676C08970E8B2283549B59772BB3CBD310B754EFB4B586B2D4B301C19E3A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881032, "uuid": "19ff1f81-a17f-441a-b05c-3038e52b33f7", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881032, "uuid": "603ce06f-8aa4-420c-a94b-9723ca03856f", "value": "49152:8cbi6JY0QP2OmLh0bOKYwUrHFzjE4iTGl8G2vOgRI1IExGrDiJg3TKmOoQDiHuan:8cbF3/wUTB9hKG2LoxmDwgKSGiHtFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693881032, "uuid": "61b03d06-4429-4858-ad3c-fdb1e090e7ca", "value": 2367512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693881032, "uuid": "1180ae7e-025e-44b6-80ad-7ee408b81b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881032, "uuid": "b5ff1d2c-4b07-4b22-9aee-369b69c7ddab", "value": "SecuriteInfo.com.Win32.InjectorX-gen.628.12559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48731212-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693909850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909850, "uuid": "fadfc50b-7f9a-4598-9aec-5098594a2d98", "comment": "Malware payload (Formbook)", "value": "5792fdadacb62ea6231ec28353acaef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909850, "uuid": "3d3b2440-31b4-48aa-96be-46ef8b0746ed", "comment": "Malware payload (Formbook)", "value": "92c0dc8896d63a6d6f22de9ba6645d7b321456a09ab1509a790c771999b5e724", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909850, "uuid": "45e21b12-44df-49b0-8dc1-1bede45353cc", "comment": "Malware payload (Formbook)", "value": "a232ba1d52faae84064838c55061435ae695251f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909850, "uuid": "e0016f16-6ec6-4bcc-b5b4-d47051d699f5", "comment": "Malware payload (Formbook)", "value": "102c7cdb69829af02ba2f771c22bd6df3f5a51725666152dba937aa9356429978ca3bf896d824b64b380551f2a0d0e1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909850, "uuid": "b6748a5f-3939-48ba-8ba9-2546b9a525ab", "value": "T190548D01B5E2C432D47215320974AB616A7EBD700F649EEF97D85E2DDE302C19A32F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909850, "uuid": "60c1ab08-ba44-40c7-ae19-62b451fa2a2e", "value": "4a54823b0f069b8d75d16f5447da2c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909850, "uuid": "141945b6-8c83-4ba2-9675-2a0e57643500", "value": "3072:606SBmQB0QfcVDm9wVutctJJNEGBw9DKCMYPpCMQwcpRLiLxCMvicH7kQ24wpAgJ:wChC4U8LKCtx4wcpEkMKwrYAO8fFxEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693909850, "uuid": "2f463810-2d72-414e-9f8f-6fa3cfbbdc14", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693909850, "uuid": "f9ce48d5-da6f-4f89-8eef-9665ca2571fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909850, "uuid": "306c5d50-ab88-45ab-acd6-aafda70b66b3", "value": "SecuriteInfo.com.FileRepMalware.13403.1752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674d5894-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693890144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890144, "uuid": "0bf3b36d-9dc1-466a-99a5-3fe958612c62", "comment": "Malware payload", "value": "1ef6a976896f5a931b36f14d21fa7a31", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890144, "uuid": "de58a77f-bac5-44ba-8dd1-a09b8eccc9b3", "comment": "Malware payload", "value": "93193aee22c426c5ec9dbb5b992c668d8a880039d1debbbb0e4c6af1778cc2bc", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890144, "uuid": "50f6cf20-3799-4ced-8a90-13ccb52d6100", "comment": "Malware payload", "value": "3ebce7e14c585a1e8b9bbde9145f2a351f530930", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890144, "uuid": "ef798bbf-9289-4dac-bb54-9ae8490646ea", "comment": "Malware payload", "value": "5fd060613b7f665542b4095f6aba24566fa77d560e57af789acb89ffd8b12e73f2c51234c43fb913fce026ef00e0c91b", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890144, "uuid": "baa83b36-14ef-4987-907c-65dfdb5a3189", "value": "T15FF3021532A5C405E48AD6BDCDC0D2F76184BC43AF63CB4F39C43B3E58B85E98653A6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890144, "uuid": "890d1eea-60d1-40f6-824c-71862e3c1749", "value": "3072:r8tq3KR9pLmLXOKkoJ2it60+xWkcQmZlvMNYHNFOLci5QzKRwOrMczJQw:r6NCLXOHoJvwhivfNFOLciGngG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890144, "uuid": "8e6e31a4-401d-41dd-98c8-cadefda24954", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890144, "uuid": "961401cd-acaa-4bca-8dc1-ecf5fc88f708", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890144, "uuid": "aa849c2e-0382-477d-8421-87de21fdecdd", "value": "Enquiry No4076524.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd55ae5a-4bd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693909724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909724, "uuid": "ac47e3fb-07f2-43f7-97f9-204f1aa35a68", "comment": "Malware payload (AgentTesla)", "value": "7f855e9edbbefb410ef945c7a16ca57e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909724, "uuid": "f7d334bc-906b-4544-80c1-d7dbbd829149", "comment": "Malware payload (AgentTesla)", "value": "9350f2409a3b9927cae3196b7137793a50141660e1db0ede012db47fb92e470a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909724, "uuid": "803d1308-0f54-4059-b6d4-47912605d175", "comment": "Malware payload (AgentTesla)", "value": "2e10b9caa971943d35549159e5f3791dbbaad387", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909724, "uuid": "70cfa135-1391-4bf1-8591-33e718c34b86", "comment": "Malware payload (AgentTesla)", "value": "a2dd1f2c0fa85be7414f1bfec86b67968653f918c16b9e7d01e56cc162d9332504cf27d27ba2e78d6f6b508f1fcf4e41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909724, "uuid": "07f90135-c916-40ea-8ca9-b3b357f77b37", "value": "T1F8842393EB76E044D050EB8E13730CEEA8E112E77C4B4AC269F599CC3379A0E15D56A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909724, "uuid": "2b10872f-6d59-457c-9821-ee86cec5ed73", "value": "6144:ZHlEC9sXir8OZTe8Ho/Ah6wSNl8eleBmGPkD0HL5hSRdcdlTCKb+Bdnvi/pvy:bE9Sr84TcIhVU1eBfPkoHL5hYNKRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693909724, "uuid": "cc4ad453-100a-416c-bdf2-400e188f92d4", "value": 372154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693909724, "uuid": "4c064ab4-05cf-450c-a636-f9a34032f3b3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909724, "uuid": "a90e1113-da05-4b03-8f19-e6cd7d3488c3", "value": "QUOTATION_SEPT7FIBA00541\u00b7.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88bcedb-4bc1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693900696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900696, "uuid": "4a498c05-0e37-4f40-9eb8-fc94fc5254e2", "comment": "Malware payload", "value": "7472c6c54e249a0a147997c4ab3392cf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900696, "uuid": "fda24f2c-92e3-4216-9d23-dbc26f6d0665", "comment": "Malware payload", "value": "93daf2aea61f29a41ba2c76e2b016dbd4256bc5659bf6e79a2e3d59c1b493681", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900696, "uuid": "b97dd2ca-08c9-4b60-b0b8-8c9e962c8e8c", "comment": "Malware payload", "value": "ac109f66df047d521cc6554a3192190266c8aa6a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900696, "uuid": "3cdab371-600d-4e2c-b473-4a1655162d46", "comment": "Malware payload", "value": "d8d0fb6d04935ce5ee35daa2dbc6b18424f5cbcbf007e005685343d182d745c5c0378dff41fd88da688431b5db6822ec", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900696, "uuid": "4427a406-61c4-49c6-9944-15fe40a3bc52", "value": "T1C533BB48D9908E8B337363D97A3468B41B77C6BC40190846F0E5F25E7D97C6AF6D322A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900696, "uuid": "93b139ce-28e4-4366-97e9-c6d2dab9ac6a", "value": "384:Lz0U48TjCaE8lt/5/vJuKfHefBQseFZh1mgyCb6yjAbJJB0upf3g7N/u:LIF8iXe53J7HeZCbTPuyMbJJBpAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693900696, "uuid": "dcfe6696-50be-43bf-8527-9ec31d4061ee", "value": 53857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693900696, "uuid": "c63c933e-df28-4cda-a3c6-a5c6867b9f62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900696, "uuid": "c7e564bc-4d86-492a-b538-f5d26f31f1d1", "value": "DummymhtmldocmacroDoc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef1989f-4bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693919336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919336, "uuid": "f2703824-cad8-4dc3-9251-5710fbe831f5", "comment": "Malware payload (AgentTesla)", "value": "ba998f76f0b32d06a81e2351219e9bdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919336, "uuid": "6b1ef004-aff5-4569-9aea-e9290e15374b", "comment": "Malware payload (AgentTesla)", "value": "947ace355c2fdfac5fcccf157b2812d24d51d85c738dbaa5f77b27dc41cf7f29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919336, "uuid": "518899e5-0805-423a-af3e-594e3b341387", "comment": "Malware payload (AgentTesla)", "value": "83bc33e12f5eeff2de314a73187dcf30d287fb2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919336, "uuid": "eda9256e-9f82-4a8e-aa09-505f4741f830", "comment": "Malware payload (AgentTesla)", "value": "2c6bab12b6452a5cc9568d1fe597c01b1b8b5ff8e731aec8d644eb1157010e20bb2ad2ce6d41a91cd686f9da620e8fe5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919336, "uuid": "e9851fab-dab9-46e7-9439-ee65dfeb7c99", "value": "T182252312153CBFFA4AF8FB3964B70FBC77BD0FA08C19E999826C4087D559F26550A4A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919336, "uuid": "8976214e-d212-477e-a028-d9d8ea31b9e2", "value": "24576:5VRN+72QNaVkgpDYbmkqj5csBb7Hw4kXzF+:nK+4WXy5x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919336, "uuid": "63ce396d-25d9-454f-9f96-e22dd5c801da", "value": 966579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919336, "uuid": "a74f47bf-197e-41a6-8426-2ee1bfba2963", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919336, "uuid": "116e08de-fb93-4a57-9a01-2f6ab48681f5", "value": "PRE-ALERT IOF23-247780.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dae8268-4c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693930394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930394, "uuid": "d140668f-9ed8-476e-be01-d4ea703c28d6", "comment": "Malware payload", "value": "edccdfe63edb328f7cf261551451006a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930394, "uuid": "6f629078-e180-4d15-993e-4fbce9f75b59", "comment": "Malware payload", "value": "983b3072d9b24148a802c195fab1834fd1e6f62bd56a6a721c22a7571fefa5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930394, "uuid": "71fec072-5fdc-4922-b711-81485541c4a0", "comment": "Malware payload", "value": "38ebb587e97f68688492b20921bd4b10299e59c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930394, "uuid": "f0ac0e00-34d2-49ef-9031-05d37edf2481", "comment": "Malware payload", "value": "1eef46269a6ce51ca91e68aa010462d4fe489c1edbf370b106b36aa73844ce0d0b62d8f51fd31c0afa866149502a43ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930394, "uuid": "3fb6d746-2397-4fbc-adfe-fccd7c2c7d43", "value": "T18A1541F3FB442FE285C24DACB9F8D233A8D406803551B6BB7F65A945405543AF29F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930394, "uuid": "3d544f48-e978-45a8-bbed-42aab488f2ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930394, "uuid": "a207e131-24ac-4295-90f5-6e3bb3e00398", "value": "6144:fFElpOLtQySyWv2tQySyWvy4l94oCPxvTrLLNcF5+pCFOsp+88CUILI2R5F282t1:fJS94oVKmOsp+MbfR5F3mW4llrg2SQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693930394, "uuid": "9310ed34-7183-4a96-8ed7-d5ae2762fa99", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693930394, "uuid": "b3c73358-7866-40c2-b743-67ff6f626349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930394, "uuid": "3956782a-76d6-43db-9803-394d00a6fdc8", "value": "ielcAiUZH52NiNx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40461519-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693873758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873758, "uuid": "cba6fef9-2087-4031-9961-9e8b03a7d299", "comment": "Malware payload (RedLineStealer)", "value": "8453e5b0de3f3b1ee1c582f92a3b2591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873758, "uuid": "fa05d31b-13e1-46c8-9c07-59042e65ffdf", "comment": "Malware payload (RedLineStealer)", "value": "98eb125bcd2ad6d905a2d39c67a3deb66201898a1d12195f432cddf831750b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873758, "uuid": "225b0f37-018c-4105-82d8-af5f2d201497", "comment": "Malware payload (RedLineStealer)", "value": "2ac4a5c75fefdf7096c4ae46a159ecbe4b413a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873758, "uuid": "72041f3e-767a-48eb-a698-95481ee0813a", "comment": "Malware payload (RedLineStealer)", "value": "b392280299330edad967403c3e8132dea31aff9d8fde868b7330255c3aa34783aa76c514dc1446821d2587aca19e0d4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873758, "uuid": "0b61b0d8-ab79-43b2-a9b8-77c5ebace91c", "value": "T13F847CC279D3847DE52D557CBBA08F6B05B8AC2046F0589FD24943C98ED89C363EEB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873758, "uuid": "0bffdef8-da77-4336-a91b-b32b00dcc8be", "value": "af4f64454f6d21ce0181cd6c7d9855d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873758, "uuid": "408ef271-f6e7-45be-9216-3cad265399c3", "value": "6144:bTLvYFTjTwOY1JQWMFh7AON0yKsuS/+hcJFBihX0DtFrLmJiE2SDJVQntoxIkzTQ:bToTjTDv7gGuS//sEx23pkEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693873758, "uuid": "657d4d6d-53d1-451b-8c33-ffdcf873e260", "value": 403832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693873758, "uuid": "8c50c499-1907-4514-873d-888f0c9d8cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873758, "uuid": "89ce7cb2-9e90-4fa1-a94c-cc84593388ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe0500c-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693920868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920868, "uuid": "f3184811-e447-44aa-ad5b-784b8b622ccf", "comment": "Malware payload (AgentTesla)", "value": "a3fa0d0918a75f6c99158f6ebf4c3d1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920868, "uuid": "ad2eba8b-aeb0-4c7a-a85e-e51b8baf2a77", "comment": "Malware payload (AgentTesla)", "value": "99a86523fd3261ae4f48f4fdeaafa3b7cfedd17e929b523d842d5f165a34c691", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920868, "uuid": "7920256f-4b4a-4e9a-b890-32405998a19a", "comment": "Malware payload (AgentTesla)", "value": "28d47d325a7caa6dad4dc1c2499f3901c39a1935", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920868, "uuid": "6aacc410-ce1e-441c-9ed0-1d65e5f4e0a3", "comment": "Malware payload (AgentTesla)", "value": "2c0eb606dd1fbffab60488824b7cba928659ae2053fd9a57798617c713ca7a6273b73eb7eb07d4e7cc3db685d523f065", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920868, "uuid": "52dde866-f80e-46f3-b733-dfb850cdd0e8", "value": "T1D0D412039B652F26E5F6EBF808116A3043F03C5B5061D3291D86A3E739B6F1056A3FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920868, "uuid": "5524c57a-1f89-49e3-8c69-d7057c63a514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920868, "uuid": "58f29b1a-7928-4155-b4a0-af0894d241ca", "value": "12288:O3C0hUL78lLU4/gTdb/bb+PqGhHiqGR8f648g2nCf:OSSs78lLH/gBb/bQHI2W5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920868, "uuid": "a854e339-129f-426d-9fc2-8fbd9aaec82a", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920868, "uuid": "2f567ed6-e64b-44a8-b55c-75b2e063f838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920868, "uuid": "e792453c-6755-44e7-a807-50f49953c0a5", "value": "a3fa0d0918a75f6c99158f6ebf4c3d1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4918a180-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693909851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909851, "uuid": "e1c008b1-f7c2-4f81-85f1-18d8ce460e30", "comment": "Malware payload (AgentTesla)", "value": "7341ec8b7c1de04140312a95727880cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909851, "uuid": "8240b907-eef5-4787-86a9-b6c69ebd31b0", "comment": "Malware payload (AgentTesla)", "value": "99b4d761a4e755655ccc1a2b5d0191f7d070dff2ff6d03ff997d882491b1137b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909851, "uuid": "c8a0e8c2-1125-497f-b0a1-8b0967030833", "comment": "Malware payload (AgentTesla)", "value": "96f93fb4b14064884f746c9e43a4ede5ac48de43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909851, "uuid": "91621d08-c857-4b60-83f0-fb412acae452", "comment": "Malware payload (AgentTesla)", "value": "b9313c5f30aa1b156147dfe413d1f7a8c1916ed7c79c287d135ae0be5df69ce551b9337d7173d0e1ac8ebb5ab17d94e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909851, "uuid": "cc0912cd-ef81-4e9c-9eb1-2daff7d06654", "value": "T1C02562F3FB442FE1C5C24DACB9E8D233A9D406807550B6BBBF69A905441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909851, "uuid": "bd2d6621-fff9-4d84-8c33-1035a8c86041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909851, "uuid": "444cb61e-f435-45cc-b978-dc29fb898923", "value": "12288:3BIx7YTVOs1bJMB+KLkSS+CU4Yj5vGje9glnEHyiL4:3BkaVOoY+0k9lU4Yj5OlnsyiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693909851, "uuid": "c173b326-5e6a-430d-9953-0f3adcef8bbc", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693909851, "uuid": "c2f4d32c-a554-45c1-9016-c2270f164579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909851, "uuid": "ae8e3fb6-a716-4a0e-902e-20368d63676a", "value": "SecuriteInfo.com.Win32.PWSX-gen.14157.28628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e614af-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693913790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913790, "uuid": "4b8345d8-4a62-4ee1-aeb0-a238f9e1ef62", "comment": "Malware payload", "value": "251ac4f443bedefaae119334791897be", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913790, "uuid": "dbf0b587-4ba3-4032-a410-7ea8c193a841", "comment": "Malware payload", "value": "9a13a845f60fbed9aa4e8df6c49ca71ebada5b069132b9e3ce8a9603c1cacf0a", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913790, "uuid": "78c55fe1-9e1e-462f-9e50-710a71020f4b", "comment": "Malware payload", "value": "c83516342d6a1cba7f5c15f91e34586af12704f4", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913790, "uuid": "c8738961-e4a5-47cf-a3cc-2c4d4f5bc6d9", "comment": "Malware payload", "value": "9110069ac1d73b1155ce4886f67236fdd66ecfc74f5c2eecbd899d1496f9ccc6005918a5bd488f550be9b5b37249c09f", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913790, "uuid": "4eb69e0c-7b4e-4872-be3b-b0ce7707413a", "value": "T140558B03795B8DE4E3868773C59F94000FADE3417267C78F298A73D62D03BA56AC9693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913790, "uuid": "aeca6497-3ebe-41ab-8c4a-c87e652956c4", "value": "24576:oHSddjJjiX96ehkq0/7Ac5KVMUvfGYbL4OuQdTKIAEThXU:H0VXfGYbEudRRT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913790, "uuid": "da495c05-caee-45b1-8a2f-ca8bdddde628", "value": 1316864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913790, "uuid": "1e24e312-1cb5-4686-a5b7-17de1e131800", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913790, "uuid": "1024ac6b-75b0-4873-b07e-82b8d65c8424", "value": "rSyumdri.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3588fee-4c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1693928524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928524, "uuid": "d4c0e85f-a0be-4d6e-95da-fbb431c0bc6f", "comment": "Malware payload (CoinMiner)", "value": "32e9801eb913d68a6bab75641b97fb2b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928524, "uuid": "99fc63e2-d2e7-4a79-b1b8-840a90af7160", "comment": "Malware payload (CoinMiner)", "value": "9a7f32e59380deaedad632f1a40697d5ef403349f322c502599e99d81bc6dca3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928524, "uuid": "dc913dab-6671-47ff-ae4d-e74ac68a6b85", "comment": "Malware payload (CoinMiner)", "value": "e2b6b1be37e96d6b6facbf6454aec0df13dfc227", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928524, "uuid": "ee8dce49-59dd-4f3d-9134-46630f69b549", "comment": "Malware payload (CoinMiner)", "value": "313b194b2d2e6faa06987c2e9aeef77d53cd49baf5c817b5a52dbfebe8bcbf9359a444a3287e9b95efdc1349b2732689", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928524, "uuid": "fa42f3e7-ca0d-42e3-94fa-e766ebf32eb3", "value": "T198B4A526ED670C9FD07FC130899B4E71EE293B9EF1A42D25035341290BCE5E467AB9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928524, "uuid": "be278218-dca2-43f3-b566-6154dcc308b2", "value": "6144:EEYy2yLyypXsfK91oKOsjDxj1LYrMDDZAzung:BLj8fcSK1jdY4DDZwung", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928524, "uuid": "ed355858-eecc-462d-8419-f7498ed6b76f", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928524, "uuid": "0d376b11-9343-4437-a8ec-91f3229c1676", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928524, "uuid": "6f72e682-ec2c-47d0-9bd4-dd2e2ac5f24b", "value": "9a7f32e59380deaedad632f1a40697d5ef403349f322c502599e99d81bc6dca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719ba2a4-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693921945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921945, "uuid": "9402fb01-1c0b-43a7-a007-5306f7e6dbe6", "comment": "Malware payload (Loki)", "value": "cf630c287b45b750281de01ac996b7ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921945, "uuid": "f73b4575-920a-4f79-bddd-96f30e7c1f61", "comment": "Malware payload (Loki)", "value": "9afa755ca4d1281b0fa54f6b6d591205d551d4c881f1955b52bb35d242976f88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921945, "uuid": "4e301ae3-ba45-48ae-baf8-bebf83b14466", "comment": "Malware payload (Loki)", "value": "2dd77e99ac86d2e7ee8c8e9d0b072025ef0d1525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921945, "uuid": "e70a20c6-2b7f-4f12-ae9c-8d7008a3607e", "comment": "Malware payload (Loki)", "value": "83d7c8795c476bd2b5a6e7ef6522746628bd6c0ed107fad36f20e24a8fa12d6945f7feb2bdc7751496a5567024448ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921945, "uuid": "bef1c616-43c3-4320-bbf3-2c3c36d1ab73", "value": "T12AD4BEC5E98495A0ED59AB306A36CD3652237EFDA874A41D25DE3E273FFB3932025013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921945, "uuid": "8a26e685-8690-481f-94b5-74dc03a6dba0", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921945, "uuid": "d2601cc6-37df-45c8-b90b-5e7dfc7c9196", "value": "12288:ogrP7r9r/+ppppppppppppppppppppppppppppp0YD4ljU7nrH43cPnBlcd4qick:V1MD4tvsPftqcgbQvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921945, "uuid": "4ddc0004-c621-4f75-8114-67faa7b770ba", "value": 609360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921945, "uuid": "59792bfb-a898-4306-9912-dc5e26699331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921945, "uuid": "c6b18afe-1033-4aa4-b293-30432956650f", "value": "9afa755ca4d1281b0fa54f6b6d591205d551d4c881f1955b52bb35d242976f88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9967c9-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884253, "uuid": "21c0ef76-d251-4078-9708-85f267c90534", "comment": "Malware payload (Mirai)", "value": "bc9ce2416f7a12f6f264aff3cb25616b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884253, "uuid": "0c451604-ff08-457c-953f-e11a3dc08769", "comment": "Malware payload (Mirai)", "value": "9bbe78e3c5200d484fb9c0640c4379178bfb1ee814b57973f403484c6c53eeb7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884253, "uuid": "c3401045-19d0-4406-aec0-9b4e830e99f6", "comment": "Malware payload (Mirai)", "value": "f186c79549d85d86e8f1c84b50e62b764c5af5eb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884253, "uuid": "b29670bb-e554-4baa-a530-acfefac0a74e", "comment": "Malware payload (Mirai)", "value": "1c36cf9e591c3fe23599180d0247a31aaf8a94f8d95f1856e34a0d6cbab602aa62e161dcc54e7cbfcfdf87f36be78e0a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884253, "uuid": "17d3ccda-40e7-4671-a9a6-f61c1b1510af", "value": "T1BAC32945FC508B27C6C252B7FB4E428D7B2A1758D2EE72039D256F61378B86B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884253, "uuid": "92179082-6eb5-4486-8cd4-f7965f1cf8cf", "value": "1536:4hEOKX5darA0F0AC7M4VeWJ/TZNg+OJuFPk8XdBelnqbwyweFnpwjsq3tYlsKbO9:4h++dF0y41llNg+ODydG9BV3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884253, "uuid": "53127f2f-ed98-4446-95ac-bcc148b17e50", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884253, "uuid": "b4b27527-5053-4908-9d30-3f4ed83c6a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884253, "uuid": "2ae5df4a-09da-4fd3-9678-1e9ea65e8649", "value": "cundi.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49af1ad2-4bbf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693899544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899544, "uuid": "a9b41f67-0e28-4fd6-9962-4775327c0504", "comment": "Malware payload (Amadey)", "value": "c268c12a4bbaaf2ad07eea2143fe2a4d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899544, "uuid": "1404d34b-8d65-4efa-bc25-ff11c947b988", "comment": "Malware payload (Amadey)", "value": "9bf1fd35f65f36b14c6991118681efe9b77513b835ae6c6acc6b3f08a8ab54bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899544, "uuid": "efc9585f-4a5b-42ca-8f96-bd48221ac7d4", "comment": "Malware payload (Amadey)", "value": "a2d5203a625cf852ebeddad8b236d0ccfb072c09", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693899544, "uuid": "f997e4ce-d996-43fe-96d6-3cc42e7b8b11", "comment": "Malware payload (Amadey)", "value": "739fd9fa77de62dfd3ecba563e624ada5701e79e130bd69be08896d3966755a60cb2a4c697de823af7a7bf474635f7b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899544, "uuid": "a077511c-af80-4ec0-979f-1db8da1f3a57", "value": "T18DE41246AAE84427DD742B715CF713831A31FCA11DB4D36B6B97288A0833AA4F53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899544, "uuid": "d5b155e2-a51e-4533-8f76-b86d6a6c4af6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899544, "uuid": "15bd8c36-dc8d-4875-8537-e8753605f878", "value": "12288:cMrvy90oz0sQ7xOIn6PQCDOdgpRJRct4AKe+qXHp7IgvE31eWZGLfOkjFV:ryD0sQsI64TWdRcyAKDqJI931eWZuf3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693899544, "uuid": "4ef88233-b66b-42ba-a7b2-20e6fc296b53", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693899544, "uuid": "7343af75-a699-4ccb-a6a9-f8de75156a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693899544, "uuid": "5a8cc446-29cc-44e1-8ecc-c17a18502db9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793adf6e-4c28-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693944721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944721, "uuid": "7b220a23-8e33-4847-8026-da1948414376", "comment": "Malware payload", "value": "fa88096dc62259c03595cbfc9af617b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944721, "uuid": "c7610740-4c02-42f2-b9b4-e3db20380537", "comment": "Malware payload", "value": "9cba4a3a8c717452313b6f69dfe074ef4ff11c281b66d1f252ec0aef8317e62f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944721, "uuid": "fba6c9bb-76c3-4b59-a37a-bb19aedece41", "comment": "Malware payload", "value": "a8d86cbceffad2b7f4c5949ca30e94325bafe0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944721, "uuid": "72a59c1c-bfab-4537-b18e-601db5c90e3d", "comment": "Malware payload", "value": "7726840a3d1f88e061ea20cac77a3a2705d4f6502592ec4ab3bafbe9588e084dfff5e6ecebd469771cf7159edb015313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944721, "uuid": "c423a379-455b-4e34-93ce-54b6422a7404", "value": "T128727DCF770C48FDC56AD0F9C05A9A6AE271360649F2871F1B744B692F637816A1DF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944721, "uuid": "5ae7da6a-8518-4f18-ab5f-02b9c8f0d249", "value": "58fd8cf882723d55c0eba8f514d1422d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944721, "uuid": "3d18d0a9-2360-40ea-b44e-90b26832ea9c", "value": "192:KqNLRkN7KX6lCUhKvwncXg++bwlpVCjPloNN2qXXnUiChMWAlKfmi:AS6lCDIncQ++bwnVCjPi2aUiCxaav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693944721, "uuid": "8f52171b-8980-4e37-b1f7-ebceaa7668a7", "value": 17180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693944721, "uuid": "24951926-b92e-4138-b3dd-a5349b8075e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944721, "uuid": "5c9f4115-093c-4882-9859-3a36656d0d55", "value": "9cba4a3a8c717452313b6f69dfe074ef4ff11c281b66d1f252ec0aef8317e62f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af1a3aa-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921799, "uuid": "a33aa190-792d-4ef7-8975-c5abc40f67f4", "comment": "Malware payload (AgentTesla)", "value": "6b6dc4ff54ebead36534a61a3d4e8921", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921799, "uuid": "7aa55275-fe23-4bdd-93c3-a9aeb288a687", "comment": "Malware payload (AgentTesla)", "value": "9ea1e8c1490a1c3659655784855b99ce09f0fefd5b752669237bd82f48f87798", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921799, "uuid": "04147aeb-3d43-4c01-925a-291c4b0c522b", "comment": "Malware payload (AgentTesla)", "value": "ae2ba5a1c691f3b4b90ac0d0fbf94c0f06e146cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921799, "uuid": "abeb9e74-956d-4e3b-b42e-3690d3f343a6", "comment": "Malware payload (AgentTesla)", "value": "331b0269ded55b345b132e57b872c8e676ecaa84d76afb8e369c7b7b9461819469bfee1248e0bd09739b60be38268819", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921799, "uuid": "2e775247-9d5a-4547-a96b-0d0e0fd38a1c", "value": "T166A3192C7788DF62D35EA578E5A1104027F4D06B1B03D38B9E8918F8B647F71762A2DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921799, "uuid": "e8608253-7356-4ac3-908b-3fbb7b12b640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921799, "uuid": "80a85cc1-47c5-443c-9702-942705945f30", "value": "1536:Fn15hgQFjK53xG6DMpCMWzXc1i9HnEMGBiNlNT4rc2dR1elTzeIBhGu0FuyqvBdw:Fn1fgiK5s6UClsGx+6gBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921799, "uuid": "14beeb97-e5e6-4605-9eb9-6793b9ce67a9", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921799, "uuid": "30dbeed2-f052-46ee-ae79-1e9d6063cdd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921799, "uuid": "01a3f5fd-9902-4464-b45a-dd101883440b", "value": "Ziraat Bankasi Talimatli Islem Bilgisi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e246c3e-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885727, "uuid": "4d1e42ed-d243-4a1c-8813-a069b1bdebb6", "comment": "Malware payload (Mirai)", "value": "4cb948a32c4ef20b6d74006938218277", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885727, "uuid": "7a69bcef-129a-4ae7-9bec-09b2d46e2ede", "comment": "Malware payload (Mirai)", "value": "9ef61be75e7275c7fa42c1e68c533332bb580bcba297097cf230cacd8aa2298b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885727, "uuid": "5eb8dd7e-b432-46b4-aede-a71fe38d6a0d", "comment": "Malware payload (Mirai)", "value": "8997b6216a149c550f86df86a8aad5c939594ff0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885727, "uuid": "6c611e73-31b6-4228-b9ca-8cebcd32dee6", "comment": "Malware payload (Mirai)", "value": "1f7052981bd2aaa8fb664c783382d1c8ce5d95db7bb68800fe7b70677fd674276a6cc6cd0dd94dd7c1225df7342423e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885727, "uuid": "9b6db08a-4cef-4f60-958f-d434d55c5714", "value": "T100438E26C8299D94E10DC634BD784E741B23F00C9626AEF69E8786924053F7CFB993F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885727, "uuid": "dc20858b-bf23-4b11-9bd5-369d97e2854f", "value": "768:XZame9eieaqteKc/ziVjwtGzdn048K86UwyFN36UVfvrC4CkoHuLC8v+79yfX:JamM33wa2VwtGGwyFN36UVHfQOLC8vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885727, "uuid": "d7cd1988-05b7-4a72-a44c-f8f330e25373", "value": 56000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885727, "uuid": "2c23901c-47be-47f9-b902-81d1d2ad8d75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885727, "uuid": "e9009552-3917-4598-8414-282345c4f887", "value": "4cb948a32c4ef20b6d74006938218277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e82317b-4bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693893029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893029, "uuid": "29249c13-d776-4778-ae43-9a9c51aa643d", "comment": "Malware payload (DCRat)", "value": "a489e0949a6ab17501c6c777951ed66f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893029, "uuid": "bffd202c-986a-4574-a9a0-d72fd7e4dd9e", "comment": "Malware payload (DCRat)", "value": "a11433d110d71d37372dbae7ea9ab0eb19689415e397b3f40b9f583fec959aeb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893029, "uuid": "c837f53a-4b3c-4d30-9c2d-7d69c418ec43", "comment": "Malware payload (DCRat)", "value": "fcd75526120ab3e5e831a57798b3e23ca68e91bd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893029, "uuid": "5663b6d2-33b3-4ce7-9551-bbb467f3937b", "comment": "Malware payload (DCRat)", "value": "592f7735a47b97d16324170b7ff23c740ab9721672717621f705a896374c47bde75aa08c9c955649701dc6173e369ecd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893029, "uuid": "11b5b23c-8071-48bb-b623-54f947f8546b", "value": "T18FB6337366A900C1E5E98C378927BED572F2433B87416D70B9DB5CC22933AE5A342C97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893029, "uuid": "64d6d110-c5db-4ab1-92b9-7a83a5f3d5aa", "value": "c628ea34d4c8d513317049fd9025fadf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893029, "uuid": "b38e9866-3c25-4245-95db-3b3a1592cf03", "value": "196608:NXjnqs1ck0sBhd48u2WvCwIPcfsqnXbul5wWvCuVFAmk/TbgvGdj:hqseWBhVulvCwIUkqXal5XvH7AN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693893029, "uuid": "19a94dc1-82e1-45f1-9885-a96c4c3fb575", "value": 11448832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693893029, "uuid": "1d40c55a-a835-4ba4-81c8-e1109012fd6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893029, "uuid": "ea23972b-c876-4794-8b1f-808118e8ca0c", "value": "a489e0949a6ab17501c6c777951ed66f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bca803-4bee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mekotio)", "timestamp": 1693920022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920022, "uuid": "cece5dc9-a0bb-47c3-9b70-65791eff1733", "comment": "Malware payload (Mekotio)", "value": "ec2b89b5f8bf063117ead3a5f87d4119", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920022, "uuid": "688e606b-1a7a-4657-8356-943f238887dd", "comment": "Malware payload (Mekotio)", "value": "a19c0b7b6aa1fd4f5f024a50564b5f85c2431752edc527c0a09928cb8c5eb9fa", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920022, "uuid": "87458a26-b5c7-4447-be6f-24566f48b562", "comment": "Malware payload (Mekotio)", "value": "247da03362db95a4fa78527246969ae9152e8c41", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920022, "uuid": "5d112a64-f834-4298-8e92-ee2ed7f57a26", "comment": "Malware payload (Mekotio)", "value": "daa6d72a2aa6baf7d922229ae36f37f0c06e0f41760fa0ef8a123b68aa93e6c290858c7e588bd6f9d2363520d8e80316", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920022, "uuid": "642c4395-030a-48b0-ab3e-f7c9dddb8048", "value": "T15F2733EB15872BC6E044F13A2867850B8015AE798EDF0111732F37E2747A48EF7F5A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920022, "uuid": "0e3219b3-a49f-4d2e-8f23-31a03c1e6176", "value": "89b0a4acdb0a8a481252638a4481943a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920022, "uuid": "4f587e20-b04b-40f7-83d2-8f4a16a48964", "value": "393216:GEOKzodmSO2ku33L25GYTEG5OkdlzNk8lxaoIKIdIL9pbbqf7yWzpsUX:GqzodmSO2133LRYT7YkdxNkCeKdbWjni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920022, "uuid": "c16abcd3-66d2-4e02-b619-96d885de6ecf", "value": 21426176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920022, "uuid": "3c4f8dd6-1df6-40de-8bf7-b9977f16f9b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920022, "uuid": "e7ac5fb1-de50-4c6a-8c70-89ad4e1e9c14", "value": "03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b1dbaf-4b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693875004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875004, "uuid": "0cead715-2404-4b10-94bf-a1a47df0c9c1", "comment": "Malware payload (Mirai)", "value": "45e6d5c49783188cbc810e5fc6ff9e5b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875004, "uuid": "21b9e574-5b15-4b5f-94b4-812d74ce863f", "comment": "Malware payload (Mirai)", "value": "a248655ebf8a65b1397e5c4779ef2119bbc344a38e5280ac9461288a5dee084b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875004, "uuid": "7ba09369-078d-4b68-b389-c55de6a6686d", "comment": "Malware payload (Mirai)", "value": "a00193259db64f701ae598a891f05b7037b98fc0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875004, "uuid": "0ec7c3a3-5e77-4567-a3a7-b1a2396199a1", "comment": "Malware payload (Mirai)", "value": "a854a2fd7e33968859be068e03b0887ef0ed475b16b4f8f44db8f3b44e3254fa8db9016b858f826620bbf6b6f53e29ba", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875004, "uuid": "d4a6878b-4ebb-46fe-b41e-bd88b55d587f", "value": "T114D2D0787B0145D7CEAEA1B44EE50B262DA08FB2F1436C077598D9C7BB0985D2CB5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875004, "uuid": "3941379d-e362-4e0d-a0f6-7ec70e7b2766", "value": "768:O4ylAtv6pqLJM0RXaxGyUbXtheU/S19QJgGlzDpbuR1JE:RMBqTRXa+Zhr/rVJui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693875004, "uuid": "a0a2f4be-01dc-40af-afe1-c7f5ab152525", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693875004, "uuid": "fe1075fe-e463-405e-94ce-969c24500d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875004, "uuid": "7d7a954e-6532-41f1-976d-fecb73f34fef", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd11b493-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693874075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874075, "uuid": "2d45ed26-07a5-4c10-aeae-3cb7fdaebb98", "comment": "Malware payload (RedLineStealer)", "value": "7925016e969f25067fac768db119a8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874075, "uuid": "87d2d251-26bc-45a1-a044-50a198319197", "comment": "Malware payload (RedLineStealer)", "value": "a2b12b3c794503c2a72841b51d6d56ec4ea6335618cba2609ee68220376cf73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874075, "uuid": "baa7ccb3-0c3c-474f-8106-edb7f5cb81a7", "comment": "Malware payload (RedLineStealer)", "value": "7ed338c279cf36e34e2689b123482b9476d0e0f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874075, "uuid": "0cbf719e-9613-41c0-b039-1e0eb1ae8134", "comment": "Malware payload (RedLineStealer)", "value": "c1f7da9945fcb678191b90d1b050d1ca46619691e12f6b9c851bcfd15aef7141b2588fe0fa9a0eb0e16fd372f6f42bac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874075, "uuid": "9f0696dc-f2f2-47ec-89a9-83fdc8785f00", "value": "T132F41213F7EA8062CC6627B098FB16D31A31BC6519B8935B3786696B0C33994F631377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874075, "uuid": "7aeffd4c-0d6c-4e46-8bff-f8c9a012aa00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874075, "uuid": "d9c7dd0a-6d46-4c55-96a2-c7e676017d58", "value": "12288:PMrWy90Yg75M/ncBqMH7Rmq9uSiyWvKRDLXGp7W5QERqFCuox85nZxN:dyvAM/ncZFm6uSi5vKVLmWmC85ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874075, "uuid": "17e00ff6-df27-4c00-9ce5-a4abc31b39f3", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874075, "uuid": "38d6a67e-2f8a-4887-8afe-c3cc1b8bdabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874075, "uuid": "63324b9c-fc2b-428b-8c88-28422d83f913", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e412b18-4c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693928891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928891, "uuid": "61c6e349-b124-471a-9e44-981f9e662243", "comment": "Malware payload", "value": "0d60923ea49eff0f3624cd2fa2eb4b47", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928891, "uuid": "9d0d7c02-33e8-42b2-b78e-5bb5174bd397", "comment": "Malware payload", "value": "a423a2a11c1904e42dc8630064e252ac4568220417a9ae072a557131e9386617", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928891, "uuid": "3f99535f-bf8e-40b8-b0dd-fb45f9ccb655", "comment": "Malware payload", "value": "96c5fb1d27bc80c19e3d5804fa32ec4879280f4d", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928891, "uuid": "cafd2640-3a84-4615-9392-eb73eacdd410", "comment": "Malware payload", "value": "657b1d3e5dacdce7554d0baff0e9d12afe1a8d5d79f749b254e3e4250fb6df875970605ebd37552bc3dd7d3de8b4634c", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928891, "uuid": "20268d38-63e8-46e8-b8f5-1deab76bda6e", "value": "T17E01FE966D521E342BD5B3D26E21DC40A906B26E4FA1331031A9C4D86B3068A60D6D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928891, "uuid": "38c6d82f-c8b8-4abb-9de4-ebfe1bd7bf00", "value": "12:1BUL+7PNIjRLZxR7U+D3cy8A3xdvDoXnjD9O6AtHiEDrgiN6FKByF1LRefXjn3tf:1qLhjRLV7vDsy8AhdsorgZ6i1LRefJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928891, "uuid": "fc0749d5-65fd-4507-ba64-14b1721e198e", "value": 677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928891, "uuid": "1319bb43-a62e-4215-ab80-76a1043848db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928891, "uuid": "0b043292-33a6-40c9-9160-31b1e51b5ddf", "value": "bash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57759e6-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874035, "uuid": "e35b261b-ffc9-4bb6-948c-5c571026b3ca", "comment": "Malware payload (Mirai)", "value": "cb7a0ebb6834678646f4a2b184eebcc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874035, "uuid": "5381d533-2164-473a-a4ec-f90bec0fba07", "comment": "Malware payload (Mirai)", "value": "a4f4abe208171407cddc5bc3d336ceaae84256ea629bd002f775fd29afea3370", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874035, "uuid": "aab63922-8ca4-4b60-a519-d75e47f63359", "comment": "Malware payload (Mirai)", "value": "dfbee5eca5da9b2b4eebcfb92584c583e2618c3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874035, "uuid": "4e09cb59-492e-4568-95ea-ad516c0ac7e3", "comment": "Malware payload (Mirai)", "value": "49a588d7017729142db0f42524e6b753a0706e486bdb6c10fc2df5e770e03d19fe3c0d723c773363cf9b3791eacc6265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874035, "uuid": "354646c0-455f-4722-9d72-8a31fd7fffe4", "value": "T1FBA2E11572932D66F3ED1C3CC96E8357F9A61BFCC0B5327539455620C94D24A3E38A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874035, "uuid": "f9eb23dd-64ca-4a0e-a91f-09a2b9c348de", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjsNWhymdGUop5hc:vvQn4j+ZO5fKAlxoQs3Uoza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874035, "uuid": "4312cccb-e7e0-4777-a477-fc1b14558d8f", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874035, "uuid": "9a9d3b93-5c2a-4513-8eac-a288e634a3e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874035, "uuid": "5d3888c3-1907-4564-bedc-678116ef18c8", "value": "cb7a0ebb6834678646f4a2b184eebcc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20291f2-4bee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1693920012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920012, "uuid": "3e345f5e-4af7-427f-b36a-2b32f2cacd91", "comment": "Malware payload (Loki)", "value": "00861ead466c05f9ecfd29938e1ee550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920012, "uuid": "400d37a6-31b7-4342-ba25-519aa6ce1c11", "comment": "Malware payload (Loki)", "value": "a570f3f4ad10fd35d399e0d9ab0ece6be170e154a058a9f37b644868ee123c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920012, "uuid": "d61e4830-3d2b-40ed-9a75-cf9700f486c5", "comment": "Malware payload (Loki)", "value": "4933a69b449d794acff5c0cd8adda894b10bf18d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920012, "uuid": "864b0874-1903-4edd-a29e-90b9e6f98255", "comment": "Malware payload (Loki)", "value": "7773889f6c6e92ed8f9c0d271a041ae6a2236762b908f954f0e097784d318a1260da1709479fd36f24f47f8b8f833e03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920012, "uuid": "61f23602-2020-4e6f-94cf-ba8672b5e227", "value": "T16884C0A82E9374A1C96E0170315D2FDC0D72EE4B94A7DA3E3789B62822F27D760171F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920012, "uuid": "ec0d1065-d584-45b1-85d0-3c44f2f55ac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920012, "uuid": "916d49fd-8e6d-4a4e-b5aa-9e683e310b0e", "value": "6144:H94xRTjkQE4KM4SyzscJX9P0IXA9daLyauTJO491cACTfgjdSgHI:u5c4KMyscJJ1A9dRauAY1kfgjdSgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920012, "uuid": "edb3dd9d-10f1-4a44-9649-915235bfd01c", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920012, "uuid": "8a3c1be1-46e6-4bf6-92e7-e92160db466c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920012, "uuid": "7bc81628-5acd-49b1-b562-cba288eedc1c", "value": "Img-09052023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ba1a90-4bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693897980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897980, "uuid": "62cdc0c5-4165-4292-ba29-28a99b08b55a", "comment": "Malware payload", "value": "79e6f2e1a2a967cbee8803b244fdff72", "object_relation": "md5", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897980, "uuid": "d35959c8-deef-4c26-9c2e-fae9ba9c38ce", "comment": "Malware payload", "value": "a656947bcc659d1465ad91dcf8f2cab6d0ae17918eeb0cbf7408b6a8b062adb1", "object_relation": "sha256", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897980, "uuid": "abf048f4-21a7-4bac-8a87-8e9b2e266b89", "comment": "Malware payload", "value": "e51d26097505137367abce02a6bd1ef242967615", "object_relation": "sha1", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897980, "uuid": "e343b9fe-eaba-44a5-a58b-18b529638cb2", "comment": "Malware payload", "value": "bdf5b06defda1c48fd52e27d8f6a72d2badc4210a625fb1db1e49e0bf177c636c1337a9f777208b03c5e057c090fcd7b", "object_relation": "sha3-384", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897980, "uuid": "3c286290-6362-4882-9cc8-e6d3f8dd56ef", "value": "T1F38503F20B34DB5907359CCF301A3A0769BEAA5B5C3AD5B21D03303CEAACC2AA141580", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897980, "uuid": "a2e2807e-9bd7-4b64-a374-c612be418f81", "value": "12:lphphphphphphphphphphphphphphphphphphphphphphphphphphphphphphphZ:mqqyovuh+bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693897980, "uuid": "5e592d21-4b77-4ae8-8321-aefc1b74b80c", "value": 1721696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693897980, "uuid": "db042fdf-a253-4951-a25b-46fd885c762a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897980, "uuid": "30505394-c884-449b-9681-988408d2273b", "value": "RecevuttaO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc4a09d-4be8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693917244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917244, "uuid": "ea8f4275-43b4-48cf-bab9-57362a06548a", "comment": "Malware payload (AgentTesla)", "value": "5094e3280f7ed666d18eb0147d7eb956", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917244, "uuid": "61cbef38-b4ab-4069-b980-f695f30868e6", "comment": "Malware payload (AgentTesla)", "value": "a6ef554485f41737fa531b9e3cd60c27ed677d1ac4c479e093b312c5dfd45a6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917244, "uuid": "72ebebd9-420d-4c4d-b10c-3c40f004409c", "comment": "Malware payload (AgentTesla)", "value": "d56739cd5f9c3c225ebcd38e20d441d1376cf22a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693917244, "uuid": "13959955-9f19-4aa5-8102-3ef42da1b390", "comment": "Malware payload (AgentTesla)", "value": "dc5d1240231cab8ea1ed2f7f093469841311750d729dc2cbc427af5054738a38893550e6c86d1d2e47c203c395b0d66f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917244, "uuid": "3f58abfd-12be-4b12-8de7-e9d4a12ac793", "value": "T1BA14A00226FF424CF2B37F125AB9A5750A77BAA68935C65D151C424DCBA3B04CE63B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917244, "uuid": "a5f7098b-bc53-4f4e-9d62-3e3c21ba1640", "value": "3072:b3yk5n5oCYOpmL3uXGpQbrStqm/xds8LWo4mMiUtmJKZZH6ZzLZbpneXsH4GG:b32CYOpmL3uXGpQbrStqm/xdsxmJrpnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693917244, "uuid": "8b0afb7c-a292-45e0-ad2c-b8a03ab211de", "value": 191152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693917244, "uuid": "e7fb5c6f-cbbb-46c7-8a26-64d54ebe25ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693917244, "uuid": "3bbe067d-8498-4a43-a26b-2fe0e845c59f", "value": "nogoforget.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab02ec6c-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693920752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920752, "uuid": "84ebf14f-c8fc-4b74-8f5f-6bec04e3cf66", "comment": "Malware payload (AgentTesla)", "value": "16e42bb66f06e9471e198069e335c8cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920752, "uuid": "9760a22f-7035-424d-835b-6aad03fdca43", "comment": "Malware payload (AgentTesla)", "value": "a7d8310d7c0f84675e04bd7c1acfa4aff42a13240faaf323c71fa651be2a1d3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920752, "uuid": "04e1eb2a-2ce9-4e22-b9d5-9080c7bf533b", "comment": "Malware payload (AgentTesla)", "value": "e70a03c133b263b1abe1fb68d9fd963ba6f50218", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920752, "uuid": "8b95b0eb-db5e-4b39-90a8-d7f6687aeb62", "comment": "Malware payload (AgentTesla)", "value": "8de0f1ff9a248170b0f38a13ed913ae620c9b848f28f3075162ac311b22f73b757570267b568e2830d9d34c428d3c178", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920752, "uuid": "ffa84b9d-c1b2-46b9-b992-5d1509c3e151", "value": "T105340F177E48EB11D6983D37C3DF6E2453F2A0C70673960BAF48AEA525412536E6E32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920752, "uuid": "1ced7cdb-2c55-497c-b569-a6ecae54e10e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920752, "uuid": "39c35fa0-dff7-4ac0-850c-2e21419ff936", "value": "3072:cqD67qz5xiWpcI0q0mvbSpFnRDmsOv5fA55:cqDWqlw0cIR0s+F8sOvG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920752, "uuid": "72739a43-97e8-40c6-9bd9-d02a1e50ff17", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920752, "uuid": "b33bb040-3f79-45e2-a795-c40fcb4cab0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920752, "uuid": "3e0c32dc-b58a-4fc1-a1bb-5508a6e0d1d9", "value": "a7d8310d7c0f84675e04bd7c1acfa4aff42a13240faaf323c71fa651be2a1d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0c9496-4bc2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693901026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901026, "uuid": "0d70be55-5d69-4b43-bad9-e7cb0f711751", "comment": "Malware payload", "value": "5791e2f173300646df45d5698867dc27", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901026, "uuid": "81622c2b-c294-49d7-8990-184d4c35e00f", "comment": "Malware payload", "value": "a8e90848cdc80b7134da128a50574ec9f913f947ce72a769d392177eb8647377", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901026, "uuid": "6ebb76b9-9cf1-4e66-b82f-e8001ba64559", "comment": "Malware payload", "value": "b28280fcfccd6891e88d912834062ee18e9f7333", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693901026, "uuid": "c9597fb0-e3fa-4b1b-9be6-14f20b630491", "comment": "Malware payload", "value": "179f3c6603b91aa3e4662811b10f1323598bdc7b441ea3a17fa04fc863d89417007f19297fe8b1cbc3770b917795d32e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693901026, "uuid": "6fb99aff-b54c-46f5-bf42-2014dbf6664f", "value": "T19003F99D3295322242DB207450FF168A687389B31D6AE4A4E19FCAD07F3495AE177F3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693901026, "uuid": "86d7ff63-9d6e-421d-8fdf-ab6455a7a68e", "value": "768:RH7MFQVBs6q6912tfIk+YEV9i06WUfWvOI24tedZrm1P21WRboRWOmGu3:RbMFQVBsdwk+Y6l6WUfWvDTtgZrWP216", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693901026, "uuid": "83af7eb4-97c6-40b9-8002-984a3f188ae8", "value": 39372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693901026, "uuid": "29d74cf8-3d4f-4edb-a8f0-aa2e84ecb195", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693901026, "uuid": "093ceba5-d808-4ce2-b380-625e6980e0c9", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf5381e-4bb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693896595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896595, "uuid": "2b29084d-8e33-4604-80d5-3f34955774c8", "comment": "Malware payload (AgentTesla)", "value": "abc2650dc09f51841679f830605ea1ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896595, "uuid": "c0ae2a06-79fd-4a93-b300-5c9abd250c83", "comment": "Malware payload (AgentTesla)", "value": "a97cf5a7b74c82f02c256675a26a7d2c949f6c078a0644a8b9ba5d1ed96e3506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896595, "uuid": "990eb5c9-37ff-481f-92d4-7f65da87824a", "comment": "Malware payload (AgentTesla)", "value": "31fe211018471a230e0a8150b61c9322a83dfea1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693896595, "uuid": "cabf9457-a0c3-4234-b973-0c30fcb5540d", "comment": "Malware payload (AgentTesla)", "value": "8346c56af0be48faa68f10a7a2575733eae791d30974f7a6d194bfde6caac05cb9386fa9423e160d4fd3c79227855599", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896595, "uuid": "2f634f20-4600-4c55-a3ab-2ea356364d45", "value": "T10925337A6DBCBC9D098C5679642B6F590DE18B90C44CFCFFA380184381DAB92DD638E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896595, "uuid": "a1016434-1123-47e0-9008-f4eb71573eb8", "value": "24576:l3XOFUJGP50sYdpm/mg97QFfJDHOVa0/H2/3I1EnB:pOkVCDUVJ4uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693896595, "uuid": "88afb82f-abdd-44d0-a464-7a089fde8022", "value": 1044136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693896595, "uuid": "25e9296f-f59c-4159-adc7-7e268b570ab3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693896595, "uuid": "08e6aa56-7957-43ed-b5d4-63bb2ffa9e84", "value": "SOA 817055394021.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86295e7-4ba8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693889958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693889958, "uuid": "3bdc5be9-a0cd-4e5f-8473-3f9e778f020a", "comment": "Malware payload (RedLineStealer)", "value": "63710cbc80a53126c0f036132d7c843f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693889958, "uuid": "e7a0c0f5-ba75-4745-acb7-7245e12ad750", "comment": "Malware payload (RedLineStealer)", "value": "aa226c6c46946b6a6741347f21119a6c4789edcc7f997f45571446e8bf7a945b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693889958, "uuid": "bc3796a3-597a-4d0a-9603-fbb8d87d0310", "comment": "Malware payload (RedLineStealer)", "value": "824e8190909d648f02b945485e1adf5c79df491e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693889958, "uuid": "096ff5e8-50ce-4587-bb87-c6ab41e2af47", "comment": "Malware payload (RedLineStealer)", "value": "39fba9d9fdb1e349e071ed5b23723a4bfd88067eee33076b8b98a7cc40f1e3edb22a33ea58b5dae6b4672e4a9dbf0ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693889958, "uuid": "901a6d98-eed0-4f1b-90d6-023bc74bce29", "value": "T1EF444B03EBABAC36F59CD3BD01E5B566350E691201E27BDF0B4725C9904C8A3CB9C5B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693889958, "uuid": "e5980794-b757-4e63-8f80-923135f3e054", "value": "42a881513039e37416778f46caf53ae1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693889958, "uuid": "4518cf0f-c9dd-451a-baef-c12fccbdb779", "value": "3072:fnZ4EMpgVttttfkKbQygQxIzuBloTKXP5SvzL6rCWclBhCzDNj:B0KNkpTzUImmzVB8HN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693889958, "uuid": "65b007ee-1580-4074-b880-080a9e4c6874", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693889958, "uuid": "7233ee07-0723-42db-9f2c-268f740221c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693889958, "uuid": "067ad29a-e552-47e0-8767-50d465d022b8", "value": "63710cbc80a53126c0f036132d7c843f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c090e87d-4bad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693892012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892012, "uuid": "6cb4724a-64a7-43b7-b9ec-a28c95555200", "comment": "Malware payload (AgentTesla)", "value": "32dd0bc1a5962950afa255476da266b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892012, "uuid": "360ddf9e-d3f9-4282-90e9-90c450fd0520", "comment": "Malware payload (AgentTesla)", "value": "aa31e922bb30de60d59504ac899af44cf15bf070176c9af732571d3e8aa06fe0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892012, "uuid": "7a8db529-5feb-4933-b03b-b74e56b5cbc7", "comment": "Malware payload (AgentTesla)", "value": "0228aba247f1b88c164977d843f8bb78d2c3e18d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693892012, "uuid": "7a5c6527-8922-4845-a88c-fcddcff95a00", "comment": "Malware payload (AgentTesla)", "value": "e0b11375a7cb90abb12ea15fe5b9a4861eb726ea5399139a1bda20a9b57267c35cb4c92843629066b17b04b935a2e0f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892012, "uuid": "6e803203-4dba-404e-ab06-f8228d2b55e5", "value": "T12D2552F3FB442FE285C24DACB9E8D233A9D406807551B27B7F6AE905441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892012, "uuid": "031c3951-0069-4cc3-9355-09f1bbb68eab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892012, "uuid": "206015d1-a145-4d76-98f0-4fdcfc37ff6f", "value": "12288:qBGu7YTV0Y5yXJ8z3SKXzhh10d9OmHnFv/+j289HkT:qBRaV0rZ8z39XFhXsnN+jxET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693892012, "uuid": "b48c47cf-4ecd-484e-96cc-9d2b89be1df1", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693892012, "uuid": "41f805af-3419-4f31-b869-8f320dbf394e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693892012, "uuid": "559b9f16-ca4f-461e-b446-130443001d1e", "value": "SecuriteInfo.com.Heur.MSILRandomKrypt.3.31592.18049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2528a6d-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874030, "uuid": "1973f6b3-e44e-4aa3-a0fd-c1899832564d", "comment": "Malware payload (Mirai)", "value": "bbd161d6a33177bacdab62fabc5571e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874030, "uuid": "af9729cc-9387-434f-84ce-113d1fd3454a", "comment": "Malware payload (Mirai)", "value": "ab1b3623080c452b75bde00b3d87b4b2479769da9262d807c88e3f007737390e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874030, "uuid": "4671b986-119f-4bc1-95af-6733c859ca14", "comment": "Malware payload (Mirai)", "value": "4242de146d677965fd254e515d3976fb1c7eda4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874030, "uuid": "9306493b-712f-4651-8922-a41eee4c5b51", "comment": "Malware payload (Mirai)", "value": "56cc383953fe3c05575a737bf3b124e975a80f67bafe169a29d9cea4123b1e141d03d1758635c97ceddec8d200a48928", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874030, "uuid": "40fa207f-0d3f-476c-970d-95dda9525865", "value": "T10EA2D025D345AEF4DFEF9DA092C2C2C276E543C6278AC8E240EEAF017516046B789D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874030, "uuid": "d0c9dbf8-ae42-434c-88b8-f2e0f692b6dd", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5/M4uVcqgw05VxJz:9RxsSVsMD6xiJJE5zRWNW4uVcqgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874030, "uuid": "fbe2f5cf-559d-4a8f-bff0-168ebff4fb0a", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874030, "uuid": "e807203e-da05-410a-b7fb-53f75b289485", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874030, "uuid": "98ef7d8c-bd1c-4a53-942c-eb51db4bd8c8", "value": "bbd161d6a33177bacdab62fabc5571e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27f22b4-4bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1693919476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919476, "uuid": "d3bfa52e-65ac-46e2-853f-3e2ff62d0e51", "comment": "Malware payload (Adware.Neoreklami)", "value": "cdcab15323430f35e4cb8b71ebe4ba5c", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919476, "uuid": "6b9b3af7-8677-4075-b1d6-6d3be3067ee2", "comment": "Malware payload (Adware.Neoreklami)", "value": "aba7d7fbfddd990757921c232546c2052b082d243c6ed4c68bf743ee87ae1ee4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919476, "uuid": "029b5fdb-77f5-4d89-b0cd-731fcc795b9f", "comment": "Malware payload (Adware.Neoreklami)", "value": "95af4ad030c52757928d452dd8752ef147cd3e96", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919476, "uuid": "c0a06cbf-0515-45ed-a908-c08d56fadb95", "comment": "Malware payload (Adware.Neoreklami)", "value": "1f9794254b246a7f602e32e1933d457eeacbe96f6525bcbf294f2900dbf1bb957f7b3f30c2e9a6a8066bcc2d52ea540e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919476, "uuid": "48c6a49c-a5b9-4763-afcd-7f2e0aa46e5e", "value": "T1186633B4F9A59875E3A1B37305596BE4B7EDD21A0F34D83773140E4B9E7E086870A2C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919476, "uuid": "08bd2f36-46e1-4986-b9a9-134267ff9731", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919476, "uuid": "be1d039a-9582-4840-94d1-938c701f2db7", "value": "196608:91OQ6cTNmVWmAzri3ZJQo+t+rmkqkTSn5QgHF:3Og6AQ7l+457Ty5Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919476, "uuid": "cfb019f7-c423-4449-a79c-e793cb4a7616", "value": 6530562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919476, "uuid": "8ce879e7-6bfd-40e2-bb25-7639b8d980fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919476, "uuid": "7cf66e4b-a2a3-410f-8036-d7b8c6a91ab9", "value": "aba7d7fbfddd990757921c232546c2052b082d243c6ed4c68bf743ee87ae1ee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a1723af-4c45-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693957124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957124, "uuid": "e1ccb862-e8ab-4533-a93d-ba125c70e6a8", "comment": "Malware payload (AgentTesla)", "value": "be623054dfacc4a2ae3bc5be197079ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957124, "uuid": "7ef94bc2-a459-4e63-b609-b36fb7fec0d3", "comment": "Malware payload (AgentTesla)", "value": "ac2b25c96cee7e7d1020c8c7959935b764eefd849df8a7ef0675140988aeb0a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957124, "uuid": "809490fb-b09b-4144-9095-d73674e5fd22", "comment": "Malware payload (AgentTesla)", "value": "d29d51625c5dfebd4e23e3fea7be80e043e16ec0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693957124, "uuid": "f05d586a-7c13-4825-a1f6-ff1afdd3e716", "comment": "Malware payload (AgentTesla)", "value": "4c23bec2c7dffb02a32cd581d3fc95f481df93fe374261f0731a9becb6418721a7e6dfd92fb0c9ee9d35bfbf03d1bd16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957124, "uuid": "df9f28ec-3998-43ca-b18e-e7f1fa9560c9", "value": "T13A554FF3EBC13BE1D0820DFCBAE8917F55EA05807540B66BBE55E906485247BF24E8B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957124, "uuid": "82dbf246-0f6b-4be5-a842-d1f12a346a36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957124, "uuid": "f4d7c2e5-43cd-4004-b968-f1d7b84fec2f", "value": "12288:JBIv7YTVAKrN48wh2qWvqZzbVFtq+tVSFGBI/qlFDZuaEtgV/fOSZM1i5hmY:JBWaVPrK8w8qquB2GV7gaEwGQM4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693957124, "uuid": "262913cd-a044-491b-915e-61d9c4071510", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693957124, "uuid": "15a3115c-8904-4828-9e1c-cb018bd469b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693957124, "uuid": "8f87d6e8-a49d-4d67-b7cc-7d20507e935c", "value": "SecuriteInfo.com.Trojan.Inject4.60790.11658.12591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fabba9-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905329, "uuid": "9e00f4c4-fc16-406c-b5bd-2cacab353961", "comment": "Malware payload (Mirai)", "value": "034287728ae180263516ea4cca540174", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905329, "uuid": "2ea5a53e-0f61-4652-90f6-b9a72d0b0bee", "comment": "Malware payload (Mirai)", "value": "ac7cf4dde0137453a2e97d321691555a36b3f738ff65a68053c12aeeae03fa91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905329, "uuid": "cf32cdaf-4e8d-4211-a29e-c519bb8f8a04", "comment": "Malware payload (Mirai)", "value": "3bb8aba1f1e3a963b3396607189acc67d93d248a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905329, "uuid": "b3782983-ada6-451e-831f-c0802b2a18b8", "comment": "Malware payload (Mirai)", "value": "0bdcf704a99e95c68f318d9cf5ebe41f381d314250f0c90dd8d1547c958421e64f6d4ea6244274e98c59713f376007ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905329, "uuid": "70e6403d-3630-4539-a8ee-daf911c12854", "value": "T148535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905329, "uuid": "f6baf045-911a-4f8c-8bc8-7f977ff38ad6", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8vm:N1GjR8EVGOlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905329, "uuid": "f25e867a-8232-4988-b07d-7733e9fd135c", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905329, "uuid": "af1117b1-188e-4bfb-a978-3ebcf2ec19b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905329, "uuid": "0fa24d30-fa51-441a-856e-a1e212be434d", "value": "034287728ae180263516ea4cca540174", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f9ab2d-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1693920883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920883, "uuid": "e71d5141-9bc0-4219-859c-ac017a5f0386", "comment": "Malware payload (ConnectWise)", "value": "e0bd77d2ead457435f08dab600ca8358", "object_relation": "md5", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920883, "uuid": "8e60b124-589f-4314-9e60-008547abd39f", "comment": "Malware payload (ConnectWise)", "value": "acbfb39d48594d81cc84c6198fc74eeafe5327da19d9f455af54e07c1629fdeb", "object_relation": "sha256", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920883, "uuid": "c72b19b9-9f90-4db9-b98e-ba5317fbee72", "comment": "Malware payload (ConnectWise)", "value": "3030ec2877469784a7743a421d89d104f05c56ac", "object_relation": "sha1", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920883, "uuid": "12da0cc5-caf1-474c-87b5-c505d9deac11", "comment": "Malware payload (ConnectWise)", "value": "c2e6f012c8c80cfdf6b52db672ae9b4facf54d7cc78ebc69db9e8a023fb25e96977457d9a8a70f7e855cbd1a5bd21c9d", "object_relation": "sha3-384", "Tag": [ { "name": "247secure-us", "colour": "#9D7CA1", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hide04-xyz", "colour": "#4FC4A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920883, "uuid": "3e2239d3-cef1-48b5-b48b-5b4e01c20e9c", "value": "T1D4837C03B5D19C71E9721D3124B0C9615A3FBA111E348EBB639802AE5F341D1AE39FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920883, "uuid": "4c9f1887-1c56-45b2-a026-7c9b8aebb970", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920883, "uuid": "4626c600-81ce-4341-89d0-e4e2a13199ea", "value": "1536:9Xn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWl6V:dE3x5KBDYiKWm/iSw0fRMvygU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920883, "uuid": "f11afc5c-aa47-4317-994f-03bc4f20a33c", "value": 86608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920883, "uuid": "963175ba-007d-4519-b483-55464745a2d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920883, "uuid": "39e124e8-b509-4318-a402-6e2024894b51", "value": "support.malware", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36423f87-4bc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693903806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903806, "uuid": "302b6ae4-02a8-4029-816a-c63bb28193c7", "comment": "Malware payload (Mirai)", "value": "60efb0c190eae741a31d3bd43555a6af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903806, "uuid": "d35a38c2-aed8-4cb0-b63d-0093cf1df173", "comment": "Malware payload (Mirai)", "value": "ad0c39dff07834a302dd1f44bb682e26ceebcc77f31f124e955e7fc1f6d12bda", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903806, "uuid": "192bba88-1d79-45dd-8ed4-5413ed76e423", "comment": "Malware payload (Mirai)", "value": "e5eb74500c2f2ef10783912d2f788078c761f263", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693903806, "uuid": "47856917-bbbe-4120-a61e-2d2bd2f5c1cf", "comment": "Malware payload (Mirai)", "value": "b236ffb0926d1c56df83e2fa9f077c95166f0251b5e38093a7f1b022d6d12ef9e655cf19255f91c4b545d8bdceb213f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903806, "uuid": "026877a9-fb11-40e8-9075-221d7edcd65d", "value": "T17FC2E1BF76AA6A5BFA6C233EE031811F0364F51C57AE679763400033A65E41D7531CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903806, "uuid": "432e6f2e-0127-4fd9-83a0-1951bf666db2", "value": "384:M21DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHrPSLeR:vMwxdyoEUnDz+Y8tqHWXmLPSo0Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693903806, "uuid": "b14a78f5-3b24-4afd-b842-40d5aa93a83f", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693903806, "uuid": "83891c13-bb94-4370-b7bf-7ff8565ecc04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693903806, "uuid": "480f6d3e-a69b-4f8a-a5ca-09c00b9f35df", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682c9f40-4bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693912050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912050, "uuid": "47c38dfa-001a-4f53-ab08-f15646f4d9e3", "comment": "Malware payload (Amadey)", "value": "7a939924177e0b931b9fe2f1e2804dfe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912050, "uuid": "b9d0176d-a890-4978-bdbe-fabfff0f382d", "comment": "Malware payload (Amadey)", "value": "ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912050, "uuid": "5ff86d27-ec6f-48bb-8ecf-1b19a9de002d", "comment": "Malware payload (Amadey)", "value": "89c30e4fbe264df9ff25a2a9f4e60bd32bd03bcc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912050, "uuid": "931bb021-3e14-4243-9595-633d63ee90e9", "comment": "Malware payload (Amadey)", "value": "4f4c5f133582fbbde0339ab30a10ab3d010c89e6ed5ed575ec405c10bce7ed10f496da412052ca2c1a1b36f4e384c49e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912050, "uuid": "31d2e594-41fb-4679-a477-1b2e9200c0f2", "value": "T169B6F122BA41C431E4920578586BAB78457DBE208B75C4D3A7D43E6FF9314D32B3A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912050, "uuid": "cdfa8b95-6083-47ff-82f4-2244c83876b9", "value": "7ca2ada15fca9ba51b650e1414510d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912050, "uuid": "230756d5-d68e-488e-8171-07d1138966f3", "value": "196608:MV0I8onCri+vQRIq0iq2h3oeoYSeyB6vnKCD25kvmeh6vFF//aFcPezl9:ML8on2i+vUIqZHScvKCBtwF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693912050, "uuid": "0e89cb94-8cbf-4374-b60a-41f606660023", "value": 10765648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693912050, "uuid": "bcaa4fed-7334-427c-bd4d-657822447cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912050, "uuid": "560b2b28-4be4-4a83-be00-544feef92cd8", "value": "ad34fb2d07c3340e16218e86b663ec39717dfe30f8951bd3922603aeeb9a9f8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c526bd9d-4c08-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693931104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931104, "uuid": "0a2f6066-cd11-4d34-86e4-4a9fe872092b", "comment": "Malware payload (RedLineStealer)", "value": "e378011513caf38b9409b7d7b46a6ac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931104, "uuid": "42862885-c6cd-41d1-b403-1e429d8a7948", "comment": "Malware payload (RedLineStealer)", "value": "ae0e98bd0887c557672ae7f5133ed6c2a90ed48de351f22c9d27160ec2dee207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931104, "uuid": "494e7aad-fcbc-4026-99f9-06e06a8289ff", "comment": "Malware payload (RedLineStealer)", "value": "c6731c69c3a706d159bf599c27c4d95f10e7e255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931104, "uuid": "497a527b-d7f5-4f08-8111-f1f9721c5f04", "comment": "Malware payload (RedLineStealer)", "value": "d0e66b99933070df7291804cdbdfc3488ff4dd6dac7e10d6e32197b03b7eb31ef6c9c4ef99ad37d745858e85231fe57a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931104, "uuid": "b81b7df5-d3c8-4bb5-a444-d24921109383", "value": "T1700523839AD94833ECB11B7019F622930736BDA24DB5876F36D5A85A0C736C09E39377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931104, "uuid": "169bdd21-fe0c-4d1a-a14e-02fbfd423634", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931104, "uuid": "fd6c5ce6-f650-4871-b138-6a5a7f3735cf", "value": "12288:HMrgy90LGlvbjIMdIni4ix3KeurmP2KRTMXwp7oGXwy6BmiqLmtfO5zU4:zy4GdnKd4+K1MYoy3IJt25B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693931104, "uuid": "90798fb2-848d-4b40-a456-6dce41978f57", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693931104, "uuid": "df4004ce-243f-4bf2-8c81-42cf306d2014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931104, "uuid": "c4865989-0e12-4249-8e2f-4f8f00f8ef52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdcaea5-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926934, "uuid": "db62d1e2-2e8b-48c8-86c6-8d18048c0aa2", "comment": "Malware payload", "value": "7c8ea84aee7be65dd1e9c60fe5090349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926934, "uuid": "c97b815b-9bc7-4fe2-883d-364b5a909388", "comment": "Malware payload", "value": "ae70ca051f29b058f18ed7aef33b750ddec69d05d08801cf3f99b121e41c0c4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926934, "uuid": "c6b8d567-19fe-46ef-8ea7-a0c8897f1ab5", "comment": "Malware payload", "value": "78b632d69eeacac07633f1c0c46d8a0c71631cb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926934, "uuid": "9976fd02-e907-4af6-be00-35c3516c6055", "comment": "Malware payload", "value": "d97b2931e3c46f2fcaf4b0b05c12c81d63dbe170b6a9fceab7604bf9ad5519bdc8a5cba50a6e7d7df5040167e25d93ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926934, "uuid": "3069c6fe-b52d-4c62-ba8c-f3f6a294a13f", "value": "T128F047DF814191C2DC064D3983211B50E56D67211770C29A0B347821B4562AB0C1CD50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926934, "uuid": "d9509d4d-eb5a-4321-b582-c8949aeab2d8", "value": "12:Bvwncr4SHXgpb6QOcWCm1E/hrOFDJrjs7Yhh/BKBLKjwZh:Gtpp2fE/BGJvPh5KUMZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926934, "uuid": "cc66ebd6-43db-4806-863d-5e7b515cba44", "value": 655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926934, "uuid": "f246052d-8e4b-4b6b-935a-622b77b2d08f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926934, "uuid": "ff0db97d-59ab-45b8-ac3a-ba3423ab185f", "value": "ae70ca051f29b058f18ed7aef33b750ddec69d05d08801cf3f99b121e41c0c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb37566-4c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693945830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945830, "uuid": "c2161339-c30c-4aaf-940b-e77fe297882b", "comment": "Malware payload (njrat)", "value": "037ed731962c6068c36ba0030cff81cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945830, "uuid": "94f859d2-fe84-4e76-9d08-5193325eabf8", "comment": "Malware payload (njrat)", "value": "aefbd5ea245117beb355452e5b31e7d22430a1590a92ec20217f6edc9fdd46c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945830, "uuid": "f612296f-34ed-42cc-9036-90bf76ef61fa", "comment": "Malware payload (njrat)", "value": "b6262af7f3f3e4294e18ef58503832ce90d85c8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945830, "uuid": "424846e3-be91-400c-b01a-5b57d9f874ea", "comment": "Malware payload (njrat)", "value": "1c850279a0ca7aba14a9a6b6b809f30f7b7724584d1eb674b5d85f33b28f55d7df2817615aea5fe3e686feba2ade4555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945830, "uuid": "866c165c-938e-4ddb-83c6-ca6313032d58", "value": "T17D543A2D5FEE9D0DC3996CBC0BF4D21AE5F9C0565D3EC602CFB64C989A3A6C87981091", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945830, "uuid": "a972ee29-a8b2-43f7-9567-c3091aa6a325", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945830, "uuid": "9a4c19af-3296-4fb6-a86d-d356a605b142", "value": "6144:IrSkVj5r0siM8usCt1tza+6tnA86+TdiyN512F1:wHV9Q/2vda+QhiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693945830, "uuid": "65e27f3c-9fb6-44f3-852e-02c6b804caa6", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693945830, "uuid": "e2349f89-c351-48db-9747-7db4edb0a778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945830, "uuid": "4cab4c55-1848-4d4c-8f1d-4dae42f9706c", "value": "037ed731962c6068c36ba0030cff81cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b431a9e2-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913896, "uuid": "607860d6-5ff1-4ca3-a704-cae371f03b15", "comment": "Malware payload (AgentTesla)", "value": "7f1d0d7ef58880b772b83049a007d8ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913896, "uuid": "c5a05ad2-6fae-45ab-8441-20044c527111", "comment": "Malware payload (AgentTesla)", "value": "af537a52b562c27c77e8d864f7325669ecb4c296d2bd9c88502dab7aaf8bd11c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913896, "uuid": "d6b7d8e6-99fc-4dd0-8a08-b9f6f7c28655", "comment": "Malware payload (AgentTesla)", "value": "ceb2d611d72fbe9c3eb3a811b0930a59e2eb9386", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913896, "uuid": "04da11fd-9be5-42be-9d67-8c1648334003", "comment": "Malware payload (AgentTesla)", "value": "bd241fd6f87c3fb63b51d022f7da86680c635dd2a19cad8f2a95ea55c5db118e9c9cf456c05ab0ee4d6495579e388ff7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913896, "uuid": "6f87ec73-53ff-4de8-82a8-53969fe0d9a0", "value": "T1532562F3FB442FE285C24DACB9E8D233A9D406807551B67BBF69E901441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913896, "uuid": "667df563-12ae-418c-85f4-20a06bc9aab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913896, "uuid": "a0d1b12a-2535-4513-ad95-fcca40399d06", "value": "12288:vBwPWO7jF4+9T09Xl16mldqxOOK24fV7YTVAgPk:vBXqB4+9ilgxG24fVaVjPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913896, "uuid": "b84780f6-d59b-42a8-a25a-203c2dbb5793", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913896, "uuid": "f80e4633-736b-41d3-bcdb-ef616f78742c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913896, "uuid": "85b6eb1f-a65b-4aec-9adb-a1a7a93cd2a7", "value": "rPURCHASEORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c8ccf7-4bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ConnectWise)", "timestamp": 1693897985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897985, "uuid": "cd4c4527-8ff6-4d3b-bcbc-50f66ca6d681", "comment": "Malware payload (ConnectWise)", "value": "334df8989da06aff9a71ab0f6534301a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897985, "uuid": "4280d85a-6116-4ecd-95a9-f00982ce10f9", "comment": "Malware payload (ConnectWise)", "value": "af5a12a388a7bf416d11b3123251e422f5fd94501e893d11e4fa91de3cb13220", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897985, "uuid": "7b05113b-59ab-4154-a64d-be4cbb26cee4", "comment": "Malware payload (ConnectWise)", "value": "0a51c6c7555be78bba9c0dc24b00ac96a51930ed", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897985, "uuid": "677dcdd0-4caa-47c9-ba04-33cc244eee2d", "comment": "Malware payload (ConnectWise)", "value": "2999d69663083065ddc520911b8ddce889cfdebb15752044dcf84b1ddfa703661c6d3fac355daad0779d14e14bc24c6b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897985, "uuid": "8672559f-bed4-4212-b0ee-00b248bad357", "value": "T1A946F112B3D591B5D0BF0638D4795666A774BC098322C76F6394BE6D2D33B808E223B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897985, "uuid": "b225babd-9f92-4056-95c0-9b7c74a3c648", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897985, "uuid": "b727cbc5-cba3-488c-ab64-65d26f845da8", "value": "98304:ifmE6+6efPU3nWn4bGbq6adYdsrGLPygQfpBo:IMefPUoWnsPygIp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693897985, "uuid": "122a6cf4-cda9-4b27-91cc-94f93b87820e", "value": 5587728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693897985, "uuid": "b6f0747a-6856-4abf-a027-71ca1469265a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897985, "uuid": "c344479a-538d-4d62-be07-2e2fd67a1102", "value": "DocRecevutta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ff9db8-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891431, "uuid": "9efa0a2c-6111-454b-b9a7-4360f49d319a", "comment": "Malware payload", "value": "cffae1983b4047cc7442ea69a3cbf4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891431, "uuid": "c5fb7a6f-c9a9-4c7b-8ab9-41c76fc4260f", "comment": "Malware payload", "value": "af680e8343ebc374210f71af4dd678a228b2b0d2bc875dc8f54e9730a490324d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891431, "uuid": "7778868a-b5f3-4ada-9302-5d8991f5f7d9", "comment": "Malware payload", "value": "d37216dda782de416924b409f53168cf69262ab6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891431, "uuid": "039ec61b-e54a-43d0-9e2f-4f3d73a3cbbb", "comment": "Malware payload", "value": "f6e9c66caa0b3ed42320d7573fa7a03c2089f207e8ea5c6f242e70835581d59a4aa5cd413dedb1a774e2d15cdfd05404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891431, "uuid": "e13defb1-b042-40e4-80dd-64f5fa4b7d1f", "value": "T1A7B52301B9C28573D5B21A336B245B62653CBD300F698DEFA3E0256E6F360D09735BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891431, "uuid": "119165bc-b92d-40ee-805d-02c8741bbb15", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891431, "uuid": "ce7b9ec5-4dac-485c-bf69-a1b78de37ed6", "value": "49152:rLLp2QVJRzAzm0y3NfUNO1zIQSweY+2yC2OQSwQ0V:rjlx93NsQSw1+pKQ00V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891431, "uuid": "5f8b3b99-0e88-4e91-9263-c7a6367f0b75", "value": 2490524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891431, "uuid": "b3e99678-c70b-4281-925f-78021e0177f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891431, "uuid": "7412bf16-fd48-4be1-860a-c5acf36709ef", "value": "cffae1983b4047cc7442ea69a3cbf4b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e921ed-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905342, "uuid": "0f36357c-7fe9-4308-adef-bad668951549", "comment": "Malware payload (Mirai)", "value": "2428d7485cd10d951abadd009dc5c471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905342, "uuid": "12c70547-e3dc-4f41-96ff-64235c0ca7a8", "comment": "Malware payload (Mirai)", "value": "afd2a7cafac399a43b202588f912b1b139302cdf4ee6df73afbce91edbd4c6da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905342, "uuid": "d6d93c69-a258-4a79-8892-b242626938ca", "comment": "Malware payload (Mirai)", "value": "d5671f6a3487ff03302f082bc987c9406fdcdce0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905342, "uuid": "1bbc5ecc-7f1c-4147-a23e-4e875f5af147", "comment": "Malware payload (Mirai)", "value": "aaf81b7f9f0a36f76083bfb142fbf40c6ec73fea666c7968b0b6a62040407adcc498fae02e03ae3c37d2ebe131ed952f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905342, "uuid": "23f2701a-ee49-4424-a169-ca8433db7cbf", "value": "T135D2D02CD95DBD05CA9D3EBD60CE95B5394CB0C1A36DE68E17124458BA17B8BFC0B0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905342, "uuid": "c500256b-0542-4974-a223-461aeb84cc64", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN8GkGJbiWUc:1bDs06t4BEub4sU/MbU8GkGmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905342, "uuid": "857440d7-30b4-41ef-9309-bf8068688f96", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905342, "uuid": "becf7670-44ad-4563-bd5d-ae5972ca47c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905342, "uuid": "40c06847-77ed-497c-8cd0-293f1f0e7089", "value": "2428d7485cd10d951abadd009dc5c471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c411a2-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921715, "uuid": "b3154363-9924-47c3-bb98-d2f8dc4f2e32", "comment": "Malware payload (AgentTesla)", "value": "692723abb26b7faef679f8e90f48cbf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921715, "uuid": "fe5a7744-f69b-48ed-be64-5f770b7b9920", "comment": "Malware payload (AgentTesla)", "value": "b05a8977a26e96a6466c266dd1eaac86d6fb414dab89d5fc79f6143b08416fb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921715, "uuid": "44493b8c-40c6-4eb9-bf6e-7a4e665b170d", "comment": "Malware payload (AgentTesla)", "value": "9171ff881a4d8f7e3fa0f8dcf0cb6b14364773a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921715, "uuid": "2e351d6e-9650-4faa-bca8-a3ad2d0feb0d", "comment": "Malware payload (AgentTesla)", "value": "d98cc77dc31c28ff23340c9dd7bdde5e0005e18e1ae2455370701276362b4d016b86ef9256372671c535cdcb7bb4e2e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921715, "uuid": "c73637c1-ed62-4c17-8987-a8276220c5b8", "value": "T10C353C1CFA49DA3FD29C9C3950F9DB2B2AB99FA9D0F1E351C010527518E6CAD0DB6123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921715, "uuid": "721b0f6d-cc63-4d17-a987-f53b3f21f891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921715, "uuid": "69d9047e-253a-48bf-8610-b92a845c5b8d", "value": "12288:DuCX6cWaxT1SWr6P5au5OkxVohRH8xvR8AlAZ1ZIU4qNgAT9eIUV:DsTQQ66PjAuy8BRhEvIU4qNgAT9Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921715, "uuid": "df532556-a2b2-4d77-8e12-51a3d5ec7bb7", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921715, "uuid": "7f799151-a4e3-4a79-bed5-0eb9c21c44c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921715, "uuid": "70773fe7-6ca8-428c-8e2c-f48fbf752f4b", "value": "b05a8977a26e96a6466c266dd1eaac86d6fb414dab89d5fc79f6143b08416fb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780d22ef-4b85-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693874711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874711, "uuid": "0e350cf7-42e9-44c2-94b4-2d63737974d4", "comment": "Malware payload (Smoke Loader)", "value": "6b9d38d4c48cefbc61a02fe1901841ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874711, "uuid": "eac9a915-b453-4e54-8880-8dfc55f4b0de", "comment": "Malware payload (Smoke Loader)", "value": "b07f239481c03cfb14e4ed10dd4e2ee4a5e0f552d10bfcac29980afb565fbde1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874711, "uuid": "5de00067-3ca1-49b9-bccd-7056c3243a39", "comment": "Malware payload (Smoke Loader)", "value": "aca2eb2f88fb8d75d8be4c5b78953fa345040e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874711, "uuid": "23d2b829-dcb5-43d0-879d-0e891d1b07ab", "comment": "Malware payload (Smoke Loader)", "value": "e64f388f352e694feebbb88a471d90ed8fa82e8c3240a53e6b43180b1332d1f8c9aa16fbb9e8d371e73f5511bb4fefbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874711, "uuid": "78c37fc3-a16b-4296-afac-82dbd15ba62c", "value": "T15A24D022B7E1C072E07745306BB1C6E12EBBB83115B4859B27581B7E1E70BC15EBE386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874711, "uuid": "33aebdfa-02b5-4433-8662-f64c8fe8fee2", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874711, "uuid": "9acff938-7569-450f-a8ed-fcc2d064fa09", "value": "3072:wFNhxttOhBDV5+LMea3xb485lAOX0tk2zoMbi07EK364Y:kdOhBB5+LMeahx5+OX0tkpM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874711, "uuid": "6308d65a-8ab5-404c-ae77-e43cfce1a20c", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874711, "uuid": "c73f84cc-9270-4513-b04c-332b04d253ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874711, "uuid": "6b2a5a91-5a8e-4c8e-954a-7ddc58186d07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d081ef-4bd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693907248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907248, "uuid": "c7bf3519-f22d-4045-8e25-fa24c736f5f5", "comment": "Malware payload", "value": "641105080abce5491f7ba2fedfe4466f", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907248, "uuid": "fed3a455-18d9-4377-915e-da748ceaae93", "comment": "Malware payload", "value": "b08c9c6416ab236fa3ca56b53994cea8fdb8a4123601b75f368e6ed2b67a705a", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907248, "uuid": "8833f3e5-0e07-4357-a689-bc5091a6bbb1", "comment": "Malware payload", "value": "95ae795ea32946f14d56e4bd4468231ff336bd8a", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907248, "uuid": "c1880f5a-893c-4d1a-908f-fdaa1a66a1de", "comment": "Malware payload", "value": "42706e8985ee2ecae3262cc1045dbe8e36dc5dcf1e6b1766046e2e89445d99f1e324c2a85eea6e02d3f62433f8a09099", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907248, "uuid": "80a2401c-f1f9-4dad-8b98-c66d78570fbd", "value": "T16972AEB02FD0E610D49FCB7DA9AB73E75846AD4467F08CC5D2255B3E4A7C8090BD058B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907248, "uuid": "2672d1fa-aa6b-4bc9-88b9-46858d7cd107", "value": "192:FBkN8bwQHSPXsJmjoMAFdSepKaAY18yP2dAmmKmMeNVwoj:FBkcwQHqXsz3SepD1odAPbMen9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693907248, "uuid": "90b8089f-f253-46f7-bd93-130889862a26", "value": 16358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693907248, "uuid": "aaad19b6-8556-4b3a-9ab3-96dd2dc791ca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907248, "uuid": "7a26ab05-5bfa-47c5-844f-af3e5ce35352", "value": "INV_51957910_3005236_LT.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19af08a7-4bf2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921368, "uuid": "f16f48c4-cd81-4271-8c9a-8dcf45919bc4", "comment": "Malware payload (AgentTesla)", "value": "6b40e9188344c78891312e52c5b9ae48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921368, "uuid": "90d53d64-1abb-4f64-bff5-afb71cdb9b08", "comment": "Malware payload (AgentTesla)", "value": "b1b51101740c9c69a80633b946d8666c30078a9ae856ff54c82042de110db8d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921368, "uuid": "d165a986-4bab-41ca-bd2e-e59ca36e9aa5", "comment": "Malware payload (AgentTesla)", "value": "e8f4ef938c698125839fe2fd1614b988f3de2ce8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921368, "uuid": "5bbc5b6c-749b-4121-90be-386f067550dc", "comment": "Malware payload (AgentTesla)", "value": "58da06b5ceb5b0f4fc365f1c64119de57d666283f5f7c6970c96c63c2fcfb5aac31e6829483e51420365d11d32ceea81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921368, "uuid": "5b995b48-b176-4386-900e-53e3d80b4eb6", "value": "T1B1F4015A7BE8872EDD2C737DF0314225CBB8DC093026E35A8B88A91A3ED7751D5059E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921368, "uuid": "7bbf5235-a29c-4aba-8573-abe35b44ea6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921368, "uuid": "f3fa1801-600e-446f-92e6-243b4dba1f18", "value": "12288:+3aNif7ZVy9/XvV76W896zupZPMs7VA0rg2eXcC0/HSL/jDHUUIgQ4V:zNif7ZVS/X97A9DrPzu2Dpz/uUUIgQ4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921368, "uuid": "a1c0d60e-7dd6-432c-a0ca-3eb2e660f4f5", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921368, "uuid": "6a6a1121-f573-4db8-8b99-5cc8c24c8665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921368, "uuid": "a8f0f0a4-fe37-46ac-8375-f3ab23a90bef", "value": "debit note pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fd90ee-4bd3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693908317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908317, "uuid": "47dc6319-5adc-4d96-a48b-943fe7ec4950", "comment": "Malware payload (Stealc)", "value": "2586e592e0ab84c8ecbe7c557f379387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908317, "uuid": "332093ed-1a96-45fe-b26e-e45fe3803317", "comment": "Malware payload (Stealc)", "value": "b2000bfff069cd0554a923e50c2188184ec39b724a5a80fa45f33a5571c69bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908317, "uuid": "99046c2c-3d3c-4dcd-97e2-be134ac406ff", "comment": "Malware payload (Stealc)", "value": "36a039c0809cbd008a5ce757ebee4b6a82cc19ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693908317, "uuid": "ef606443-713d-4954-b67b-05eeae92695b", "comment": "Malware payload (Stealc)", "value": "f41d1d1196a59a6ba59a39dc8c175ab81a28e5e88f74bb5bd3ad5af18d2f1849a3cbc7414652df9616e06becc0a3c0a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693908317, "uuid": "7a4a13ad-62fd-4bfb-93fc-3580c5b24353", "value": "T18B445AD3A6D0BC61D51687318F2EC6FC771DB9518E497BE6A2186F2F28791B2D223310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693908317, "uuid": "cffcbb56-7406-4a97-b3ad-c9f1b0fb7506", "value": "e4fe26c348a216c8f499120b873de5b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693908317, "uuid": "0f219785-4efc-4283-8d81-3a263f084389", "value": "3072:976jje13UcVDLque6f0JsuHOVhEDrmuhY3135R3Ua0k8:p6213UcVDLbe6f0Jdoavmuh43Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693908317, "uuid": "b4347396-6850-4173-bd9f-57cb0db21439", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693908317, "uuid": "03b2d41d-8f44-4c2f-9eff-3a5d0c38f166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693908317, "uuid": "832419c8-ec73-4d97-8b83-ff7c788fbc99", "value": "2586e592e0ab84c8ecbe7c557f379387.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a6e9c6-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693890028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890028, "uuid": "b293a8a5-bff7-401d-80f5-4c7881dcabf1", "comment": "Malware payload", "value": "42f190ce42f7247367e50d530222b647", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890028, "uuid": "c284f682-7751-4c3b-87ef-a7af2b0570ba", "comment": "Malware payload", "value": "b2a1af0a6d97409cfd8e7a7a1ddf4e6e479f38f75a0f74986350bdf7995e4cef", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890028, "uuid": "1061b4f2-8bb1-4a4a-819b-e746d5c6819b", "comment": "Malware payload", "value": "d0fd681cb1e738896cd98ccb123cdf46ee54746a", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890028, "uuid": "4f08552f-0db3-4142-b4ab-008c0c51edb8", "comment": "Malware payload", "value": "8ff998067546a54fcfa39c82c9219844916d18e246454522006d72e804c534e3a220c7509092bad8c30183e71b8a0528", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890028, "uuid": "5b24e587-2f98-4df2-81a8-0b6b1fc3f010", "value": "T154250103A8448BC7E41883F87E53B9DE0E4DBF19B4C169DB05667F8B7A31A73495A01E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890028, "uuid": "91aa6fe9-077c-420a-ba42-6bef404cce2f", "value": "24576:SWQmmav30xDrWZyjw6VkrYLvQYLfXAwG:XQmmQ305rAD6VkrYbRfwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890028, "uuid": "d0df34e5-2d22-4b56-9172-d9e6b9c42b6c", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890028, "uuid": "ea0506fb-bf2e-458f-befe-28c65f50b039", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890028, "uuid": "d9a3dcd8-4f85-4f61-a9aa-6872fa0ddd93", "value": "ENQUIRY No 67543.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80bf2ca-4bf1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921231, "uuid": "b53fd285-b3ed-409f-9089-705b1929ff31", "comment": "Malware payload (AgentTesla)", "value": "a68e0be63cdd5493b46b473ae78362af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921231, "uuid": "cf5bd468-eabc-45bd-b394-a6184afb53fe", "comment": "Malware payload (AgentTesla)", "value": "b2d18cac5285a2c310201406da79d48fe55ee436cd2f995b69b1adf28175ae15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921231, "uuid": "e37dcb1b-a46c-42b6-87bb-8e3b212aaad9", "comment": "Malware payload (AgentTesla)", "value": "36e28875d27a4f477a72827b4607fe25d892212d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921231, "uuid": "01570500-29c4-422b-8b1a-095bcc2a39d9", "comment": "Malware payload (AgentTesla)", "value": "7013dd13234dcd25ed0face87d2583c792c7616ced849d456c97b173e038c8faa968f5b4b7e39258ae321f987bb04ef5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921231, "uuid": "e9241de5-fc49-4a56-b658-8c34a81a53c9", "value": "T16F34FD03BE48EB15D6583937C3DF6D2453F1A0C70A73960BAF48AFA129422536D6E36D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921231, "uuid": "0a042779-9c54-452b-b115-2f85396b3163", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921231, "uuid": "a821cf22-e134-4f67-bdd1-04281536c6e3", "value": "3072:uRuVpime8DjxisB6UrUYVbSBGuOeKi7PRXLhZ:LVPeMjxis8UrRbuFKijj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921231, "uuid": "096d7673-cb79-46c4-bccc-91bdd8dc0e0c", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921231, "uuid": "58c8ddd5-f5bb-4018-906c-81bc380dca7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921231, "uuid": "a8083d36-c988-40d5-8c15-26cbffc1a913", "value": "b2d18cac5285a2c310201406da79d48fe55ee436cd2f995b69b1adf28175ae15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13332570-4bba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693897305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897305, "uuid": "41e97b90-f4df-4b0e-87d5-a84eed873ead", "comment": "Malware payload", "value": "9e6a2914a35256dd450db549fb975f45", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ScarCruft", "colour": "#B3BA87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897305, "uuid": "ed976a4b-fa49-47a9-b14e-9a7e51071d8d", "comment": "Malware payload", "value": "b31b89e646de6e9c5cbe21798e0157fef4d8e612d181085377348c974540760a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ScarCruft", "colour": "#B3BA87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897305, "uuid": "2d2ba1ba-2e6b-4f49-809c-2aef68dc597f", "comment": "Malware payload", "value": "a7398bdf6d742d8f76219b92893b8c4317435cc1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ScarCruft", "colour": "#B3BA87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897305, "uuid": "13c134cd-82b6-4a53-93e9-e958121d5abe", "comment": "Malware payload", "value": "adda0b60cf5ff0b3caabc8f94d128593b1cc9238a2820eaf63a5259c3d539934a327e259ab2eb2789e46b6f94ff25371", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "ScarCruft", "colour": "#B3BA87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897305, "uuid": "5f85e5bf-ea7e-4550-9733-16a1fff323a7", "value": "T1C3425E6469110318E0369735CFCE118B79313CA59D1212B3A36FB32E5BF881C73A6457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897305, "uuid": "0ad28ed8-8a1f-4eed-8b73-a5ed51d1f8a8", "value": "192:JrqjZQWdxljcR5rBrJV6yoDIDnFzL6sZgn1:JrWndfIR5rBrJ04hLI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693897305, "uuid": "745a19f3-e947-4226-8549-20e0ba3cdcbe", "value": 12915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693897305, "uuid": "999e281e-90b0-4861-a1f3-247f18365cba", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897305, "uuid": "5fa15ee3-9896-494f-a3ec-2f68d63f2d98", "value": "1.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f242535-4b94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693881031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881031, "uuid": "39bf2c8c-bf30-474f-a657-8b607d1664b4", "comment": "Malware payload (AgentTesla)", "value": "d25e807d63faddd13272d2d276419214", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881031, "uuid": "74307733-b554-4485-ab34-21451a4f6022", "comment": "Malware payload (AgentTesla)", "value": "b356dd47eba95c4343a483091a1c27261a12fb0819c4899ffbe8f7b138e52329", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881031, "uuid": "5ae5c8e7-5ed2-4087-b9c1-26db2481df81", "comment": "Malware payload (AgentTesla)", "value": "f9b56828d9984cb5da04647148fb0d79c219f93c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881031, "uuid": "d0c04e00-6f99-4125-bf0c-961675929c68", "comment": "Malware payload (AgentTesla)", "value": "ee0d39f84fa104409201349384627b31adf282b83d1e0ac646685cb5c479f8db63738c5c311611c9e5d902fd5acdfce1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881031, "uuid": "9eb6dc20-7a0d-47f5-bdea-c91df28f49da", "value": "T131D423C98B588663D0BD67FA901D436897F269BA26F9EB4D8CCAB7D141C334705213E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881031, "uuid": "4a793232-2e2e-4d81-a481-c5c28f3413dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881031, "uuid": "0f9f264e-b07b-405c-bf08-72b5a0c99b8a", "value": "12288:ry9/XnWYyRNuc8h0Nx/Exc39yCpEHWIJXdDLjzYlervE:e/XnlkQONxT9yAEHD5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693881031, "uuid": "9e0d7b20-814b-4dd9-9a56-13eea4a28b5a", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693881031, "uuid": "58523cf7-0292-4ccb-a6da-1649ccadcd65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881031, "uuid": "da91bb03-6f4a-4e34-b76c-d9e495da1ef1", "value": "SecuriteInfo.com.Trojan.PackedNET.2314.13925.14940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9910c2-4bfe-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926820, "uuid": "a751ae15-6fb9-44c7-9680-acb265dad2b1", "comment": "Malware payload", "value": "3a5b0570ac1a19c1faf43c57ebcc930a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926820, "uuid": "4836b54f-e9a0-4ce5-94b6-d675d7f518ad", "comment": "Malware payload", "value": "b4cff65d6302a95c994117fa1ff4450f3781d6bb443004081e7f77d4b6736c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926820, "uuid": "0de62250-87fa-4ee9-953e-ea2e1ff4d3b0", "comment": "Malware payload", "value": "1c849e80f7b7f0b90a147174b62907401fce317e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926820, "uuid": "847241a2-f9c3-48df-b188-1466db7a185e", "comment": "Malware payload", "value": "f7b26e0a2b82de9cb5a200c7e4f5f5824ac9bad0692b4dc230f4491756451eac195b463f96f22ccf546ee979d8798e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926820, "uuid": "264f7628-8502-4068-b03a-474b588710a0", "value": "T19B332B1AA29840F4E1AF9238ADF2DA05E6B378051B3AD7CF0744451B0D727D1ED3A6DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926820, "uuid": "58520bf5-ce04-40c2-80dd-3c284c596b92", "value": "98b5349113fa3ed0cc56563f3c11005a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926820, "uuid": "e877172f-60fe-4d2d-918e-3a9ba9321265", "value": "1536:bJwMddcs8XLYCsGYuL7aoYD7eBdyvBYor9h:bd8bYC5VL7aXDiyvBPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926820, "uuid": "500eb00b-bccd-441b-956c-35e8352b1199", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926820, "uuid": "856be333-6429-45c6-a33a-3e3c6fe7a0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926820, "uuid": "f400f891-0150-4d83-937d-f93e3efae97a", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559bf9c1-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1693891403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891403, "uuid": "8ded3177-08e8-4392-a7e9-80bc23c60196", "comment": "Malware payload (AsyncRAT)", "value": "8e17227d496580ab3015b0196442e49f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891403, "uuid": "699944dd-2f9b-4330-b5e7-55397afc90a5", "comment": "Malware payload (AsyncRAT)", "value": "b54e02001dee93fe19986fb1fd3a1dbc5a69b1144c00100448dac0db0786a381", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891403, "uuid": "7f98a46e-501b-43e8-8939-4a06c524105c", "comment": "Malware payload (AsyncRAT)", "value": "c252bcfc488756adc5a2200dda7f5eca66b82b87", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891403, "uuid": "879d2c60-b477-4e82-b444-725f2063aff7", "comment": "Malware payload (AsyncRAT)", "value": "957725847fc5acc34be95dd75a7592024960fe7f2eaafd4c4f1c840f5e886b35acd947721665997f64c39c43ead80f89", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891403, "uuid": "30a47bf0-779e-4141-9c10-fc1da2b5b89a", "value": "T1536308053BE98129F3BE8FB469F2668445F5F5AF2D12D91D1C8901CE0532BC29942FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891403, "uuid": "416d2762-bc89-429d-9df4-8b81aeb00bf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891403, "uuid": "c024b03f-af1a-46a8-bfcf-ef8b7b9b4024", "value": "1536:BmfWSqHdykrVMKuJUYFu3mG+JPbJ5dugLNTrQTGhx:BmeSqHdykGKuJUYFuWG+JPbJegRTGSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891403, "uuid": "b6c15b89-b581-4788-ae3d-5f8035503377", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891403, "uuid": "1ade2ee0-41b9-43d0-9f90-78f401d35159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891403, "uuid": "49e57249-9b97-49b1-954d-f7300310d4fd", "value": "8e17227d496580ab3015b0196442e49f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1e9efb-4bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693919602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919602, "uuid": "9551a160-ce91-48c4-9dfe-00b0c7795932", "comment": "Malware payload (AgentTesla)", "value": "17ab22ed2e156d958fae57c7d5a525f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919602, "uuid": "a8bc5712-7121-4253-834f-28fb26dae813", "comment": "Malware payload (AgentTesla)", "value": "b5978c0f3d5bb9169425ac3b141e6f197fdff05be6adf8d5753bed0ef86eb285", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919602, "uuid": "5c6f2eab-5795-468e-a74e-8d808a5bee28", "comment": "Malware payload (AgentTesla)", "value": "69bc5946c1c6973b64327a2ec00103a0f86c8d6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919602, "uuid": "8d2a38ef-05c0-4caa-92f1-68f666e3c401", "comment": "Malware payload (AgentTesla)", "value": "6a0cd4aa89337aa1c147e3000a7e74bd3000cf8e5565f783d43d0308902a372ea2d64de9614e1d9e440765130ea23c08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919602, "uuid": "f67accd1-153d-4d3a-a07e-aa5abab7354b", "value": "T177F4AD85EA5496A5DD1CAB34A932CC318323BDADB839A61D1ACD3D273FFB3935011463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919602, "uuid": "3dd2999d-3c12-495b-90a6-580a1b243bd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919602, "uuid": "109b9b37-3ce8-4958-8fca-ac2f61a30fba", "value": "12288:jUTL7gVy9/XuFw7w55gAk1hRDAuGVAIxAU9XK1ZTP7r9r/+ppppppppppppppppF:QTL7gVS/Xuc2Eh5DGVBgZ1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919602, "uuid": "b7417637-80cc-4bf5-b195-322c82e89988", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919602, "uuid": "f4bec650-8d90-4c54-8af2-e24d6444d10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919602, "uuid": "8e39d7db-ea7c-4d40-9ea2-8e1c29962fac", "value": "PO#EOIM001054 - PO#EIMG_501367089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f891c7a8-4c01-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693928184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928184, "uuid": "098dc481-57ee-46e0-805c-50b779a140bd", "comment": "Malware payload (njrat)", "value": "6e2c0187369c3fb4def5a6559232da85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928184, "uuid": "4a1fda7c-9555-4d3d-9a63-842a3c697229", "comment": "Malware payload (njrat)", "value": "b7eefe2cb795292f6597322b81dda96e5d18f3de434c4a6c5a11f94c73c35f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928184, "uuid": "b3dbc431-0cb9-4bf7-8548-f01af7db2b88", "comment": "Malware payload (njrat)", "value": "b7cbe2b8ea14ee36ef076a9b1e787aa9fc905049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928184, "uuid": "fae19840-35ed-4c2e-b701-ce0bd2d56566", "comment": "Malware payload (njrat)", "value": "0fd8b6951649b1739361bcc14e0e13b4c484d17cab45a80971a6d78e61bdab79bc84983acdc5df0ac658635d8eec70b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928184, "uuid": "76d9c641-5ea8-4502-9d82-03acd46de58d", "value": "T127E207467BA68219C6BC6AFC9CB313110772E3438572EB6F5CDC48DA4BA76D00641EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928184, "uuid": "00ba67e3-fb3b-4650-82b8-d96416f8fee9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928184, "uuid": "3be0fd08-f3ce-4ff4-8a21-40e57a05cd6a", "value": "384:Y0bUe5XB4e0XuOllDANuiEO0YaBWTatTUFQqzF4yObbo:tT9Butl9guiEYqHbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928184, "uuid": "b0987943-48da-4300-8ede-b5e772673bb1", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928184, "uuid": "6678f0d5-7bf4-461a-8cc8-56ee86d06570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928184, "uuid": "e040b88c-384a-438e-ac6b-a3fa4fc99b94", "value": "xRQAtbecOhoj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63169ba-4bc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693902813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902813, "uuid": "fb9c1b08-d299-4030-b5b0-7601b47edbbd", "comment": "Malware payload", "value": "7d67a39fdb01fcf50e3cb0b385d37ba2", "object_relation": "md5", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902813, "uuid": "3b50495d-c2a9-4afa-9efb-658fbb884650", "comment": "Malware payload", "value": "b84f83141e3b56a610fe0c3dd672fcf8f0846ec973d22e8b56e306aa2739e040", "object_relation": "sha256", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902813, "uuid": "f16844bd-b066-4944-aa8e-f7d248c4c216", "comment": "Malware payload", "value": "912d6ac12b7be744aa3b3b805c03857c3e43925f", "object_relation": "sha1", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902813, "uuid": "1c97048a-cea1-49b1-bf81-086b4c7e7e5a", "comment": "Malware payload", "value": "4e2c6806ee61f1caf17dca0c46b61e324924147795d074ab35bce5dcf168f1dab11cc108ac7f5a9dce5912512efaff41", "object_relation": "sha3-384", "Tag": [ { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902813, "uuid": "5a6293b0-bc56-488a-abb1-9d0cbbca9662", "value": "T1F033E0297A2C514CD8CA08FC3C0E06E6DE4F86203E6E89677DC156ED70AD5F0BE416A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902813, "uuid": "9f8ee2c5-625d-4bd3-88df-43a46383258a", "value": "768:Vrj36sMWccuxctBPPPFir1y43HjLLLLy1ZTJwTJwrVR+MPmOaavmp5+B5sE7svE6:Vrk7+t7awejLLLLAZL7+MPmO9unkpUE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902813, "uuid": "91c7d9d6-2535-425f-960a-4551145c805f", "value": 50498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902813, "uuid": "47ba2cfd-5424-4ed5-bdd7-7529bcf56d31", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902813, "uuid": "b02a44ba-8cd0-4970-bd1c-3b793f7518a3", "value": "Fattura 2202855RS.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed171b31-4bdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693912703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912703, "uuid": "e6492cd2-d651-4716-bd5e-b00bb595397c", "comment": "Malware payload (AgentTesla)", "value": "4ef30334f5009b12450dea0125c049a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912703, "uuid": "c68eb6fa-551a-4894-adf6-459477c909dd", "comment": "Malware payload (AgentTesla)", "value": "b9e6a7078c1b45fe46c4a67b4911aa9d14f4c90f7b1eb7e24c89f12deef44450", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912703, "uuid": "20436287-852c-4000-b285-848b2cee249b", "comment": "Malware payload (AgentTesla)", "value": "af9ecd466cee4e3348b9cfd8fa97b1883099418f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912703, "uuid": "57b68714-503d-4f08-92d9-66621a80aed0", "comment": "Malware payload (AgentTesla)", "value": "3662a74a88c4cf765011aa3f88f50f1c0c74d0b93c221a0584797dfef30e791fbf49caa8cfea47021c016da3d9b2f809", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912703, "uuid": "1c537b06-3aa0-4189-85aa-a3322cd67bf5", "value": "T149D4231532B95E14D4F89FB866A09E2F137A62A1763BF3EE5D98D0CA0033B60C5517CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912703, "uuid": "3d8011be-0e0b-4b70-8cd3-0c88ea1aa660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912703, "uuid": "1a00220e-5d55-476f-be72-65e662081613", "value": "12288:8Gd04ufkJrtZlS5eRnoC29DA/AxiCMn5tUxgGtkXJW6O4R:Nd+fatZU5eRnk9Dtxih5tCy5HO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693912703, "uuid": "fd2fb445-b57e-4b77-8ad4-9fc8c3843efe", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693912703, "uuid": "1f290e5f-d146-46ca-afdb-b0fbc2637402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912703, "uuid": "1824a177-fb70-4cc1-9cf6-609a84af6127", "value": "b9e6a7078c1b45fe46c4a67b4911aa9d14f4c90f7b1eb7e24c89f12deef44450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4d0ff6-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693886047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886047, "uuid": "e06b1027-85ae-4725-8212-98d6df9102c6", "comment": "Malware payload (Mirai)", "value": "d3f2300b0942c81b82d5105ecccb31ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886047, "uuid": "8ab9ed96-fe9e-408a-8ff4-4d7e6ba9795b", "comment": "Malware payload (Mirai)", "value": "bb2921758c641a1f8ceba302a11e355c2ea3fbdb804a17e01c006f205055665e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886047, "uuid": "a258b8da-8f44-40bb-aa80-fce0b8c98af2", "comment": "Malware payload (Mirai)", "value": "4a84c226fbb331dba65400ac5d3f298ce10c641a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693886047, "uuid": "80fff995-fbbf-4755-afb9-341738197d44", "comment": "Malware payload (Mirai)", "value": "44f952f39ca20e43eb7aec84b19f10b08fa34f0b0ff23905fb9bd8eba5393a7b96e210439309ddbb90a9959f52c5035c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693886047, "uuid": "5a25973a-5cd2-4511-bc54-c2a6ea54eec1", "value": "T10C534A25697A2F06D0D0E57A12F7472472F1629D3AF8CA2E7D330E4EFF2464425932B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693886047, "uuid": "9dbfa6f3-9a4c-4745-84aa-6018abb07b1e", "value": "1536:RnOkiHp1OkFRFdSZTk9+2kl+ySFUx+D9qcp+:NNxEZqBAD9N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693886047, "uuid": "01a407ce-3f8e-48dc-b4da-b2db2675f482", "value": 66388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693886047, "uuid": "4f5f4444-c0c4-494f-9c40-a274b8118d0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693886047, "uuid": "a2059de6-1f55-4715-9b27-0293f62a2dd1", "value": "d3f2300b0942c81b82d5105ecccb31ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e7090e-4bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693912107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912107, "uuid": "36bb7656-fea7-4d8c-9cf3-6652d98ff652", "comment": "Malware payload (LummaStealer)", "value": "9d9c7f57036ac510aaf87baed41ec50e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912107, "uuid": "2bd05b07-ea7a-4e4e-88fa-e1964486ea19", "comment": "Malware payload (LummaStealer)", "value": "bb51422c11080e388fbb7dc7a7bfdb6cc01235d8ccb65fbbf726c230db357be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912107, "uuid": "97813ec0-c55c-43ab-8708-f155b73d5691", "comment": "Malware payload (LummaStealer)", "value": "ddc8bf9c2577eb31d51bedb80ea073143b4e5081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693912107, "uuid": "60eaadae-afb2-4bde-8cf6-a7261d4dd576", "comment": "Malware payload (LummaStealer)", "value": "6eee99978b6400104608e374df63018786054833a55a0c04dcc4cee2da41eaf9bf9d480e665f03ba784e606900bb4b94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912107, "uuid": "310fe73c-78f8-4f9b-91a0-ab8610b73d42", "value": "T159F6C021758AC53BE66711716A3DDAAB51697EB10BB254CBB3CC3E7E0B704C21232E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912107, "uuid": "4231155d-80cd-44e9-8fe5-48e4774e4684", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912107, "uuid": "f1dd3bc5-4600-4973-95d1-1000f8648e2e", "value": "393216:bRYsAKBfMEOSiBNz1eYNpzdzYN5/8b/qc5VLO5WvGGf0:9YsA+MHS2egYN1Wqc5VLEss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693912107, "uuid": "5fb84310-08b8-4fa7-9a5d-29d570ce528e", "value": 15521112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693912107, "uuid": "e74652cf-b59c-4512-af95-9447d1c19ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693912107, "uuid": "793f4a7d-040f-4a3f-87a5-8437b4892a5a", "value": "bb51422c11080e388fbb7dc7a7bfdb6cc01235d8ccb65fbbf726c230db357be6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659aaa48-4b9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884558, "uuid": "a2b1d594-923d-48ab-b728-afd8483d3dc8", "comment": "Malware payload (Mirai)", "value": "9c269431c7530fb1a7ff46db188deb05", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884558, "uuid": "9077a101-54ec-4a7b-a34b-383db33d69da", "comment": "Malware payload (Mirai)", "value": "bbc9648e0b8f80e08b56e51ed75eee7c23059b058a2acdcd840cec45c1b7e163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884558, "uuid": "b186d3f5-77b4-4e7b-88b4-92bdd1f55738", "comment": "Malware payload (Mirai)", "value": "6d2b8612cf4b207514b672b99a77c92d19cec6b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884558, "uuid": "c9cebe8b-ab57-442c-bfd7-a066dd476d59", "comment": "Malware payload (Mirai)", "value": "e55990394d5959f53d63d9a0baa8bec805609ad3320b07c67f36de2bdf1294c1b923adf89df56c1d99294b249e2d73b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884558, "uuid": "c49983e7-4e63-43fb-b613-a01ad120276e", "value": "T14303F13026129EFB8DB18CB1DCF503C6AA914F75E0EF21F91AC4D86D36C75992632903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884558, "uuid": "c6a10b00-f347-4c80-ad12-79a2f76b1c28", "value": "768:xqWLEqO8cWUm09Wdp1vub0DxBdqB9pO9q3UEL7g:TTcWR0921vub0Dx+pzLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884558, "uuid": "060d6901-3ee1-4595-b753-a865c790f497", "value": 37932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884558, "uuid": "e734ea33-1dc5-4855-8b4a-902f483d8ebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884558, "uuid": "b5ff91f1-c702-4cbb-b083-239cdf75a6f3", "value": "SecuriteInfo.com.Linux.Siggen.9999.29894.32055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90dbcb2-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913904, "uuid": "a19d0564-b60b-46f8-9a9d-977ef6b40b62", "comment": "Malware payload (AgentTesla)", "value": "385e3886709f6ab6b96b33f110ef13af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913904, "uuid": "349e2833-2f17-46b0-9fe6-d4d86f46c337", "comment": "Malware payload (AgentTesla)", "value": "bc55b6200b3e9aaa96564fa774c0318c6340220fb31959ee217ec73adb7f3670", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913904, "uuid": "9c47f0dc-8e7e-4877-b139-d6977fb6b2ff", "comment": "Malware payload (AgentTesla)", "value": "3595ed858d84bb7c627a2e51e5bfc3bd619d8843", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913904, "uuid": "413d5098-9eec-4038-93fb-a9240ff7c616", "comment": "Malware payload (AgentTesla)", "value": "8724693dcaeae2d92c94d77ec79de50e78efc1ccdef0507fc41c9b5e2c091c4c76821c8f4f872e43ecdb36779a076ca9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913904, "uuid": "939195b9-a268-4193-9400-54d20025f732", "value": "T192E41260B7B84721E17B4FF9A5A0055403BF763E5E22E78C0EC375CA2976B618216F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913904, "uuid": "1b3633ea-0d6a-49fe-8df7-b3bd609e89ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913904, "uuid": "4fe27de1-ce71-4bc8-8d43-f7eca9d1e352", "value": "12288:rgD9AkDwMD883+oJi7wuHbETCIQnrBV7hfvKpaWEuF/PU4G0eSXN:rgpAkDV82+oMVHbwarT7hfioWvh/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913904, "uuid": "337b56c3-33ce-41e8-bf33-5da2db1897cc", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913904, "uuid": "68cf677d-052e-4e03-89f7-ac1561e6a5b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913904, "uuid": "84b767fa-266a-4eb6-8ae1-82578ffca9c7", "value": "z14CurriculumVitae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dfbcae-4bf0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693920505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920505, "uuid": "d9e95a88-1c53-4773-aba3-2778c325b3f7", "comment": "Malware payload (AgentTesla)", "value": "c7f16a994c3b0d4567df0914ccf66081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920505, "uuid": "99f86d8c-cabe-4089-ad80-21b27bfaa888", "comment": "Malware payload (AgentTesla)", "value": "bc6ef720c1527d97fd6e023c527d193a32f5bf22c2686d33463bbc63ca767390", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920505, "uuid": "2af13ed6-eebb-49b3-8b61-55df50346229", "comment": "Malware payload (AgentTesla)", "value": "0efe5a6603e96a1e010d3d582b91c986e0858094", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920505, "uuid": "6a7dfd5c-0a64-4ae5-8557-f2edfc195513", "comment": "Malware payload (AgentTesla)", "value": "317d67156b296830b33289d556462b6f6532c0b07fbea25eb10dc369c344dec0aa5297f98ce9199f08e63ca94dc64cc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920505, "uuid": "571589f2-c19a-40d3-86cd-c4adc5ffb33f", "value": "T10BE49BC6E9B6E6D3C46597F4609620008F393FDA3469D2901CA631D63AF1B1437A7A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920505, "uuid": "2fc9af08-6a37-4fe5-9923-c3f4a0dc5b79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920505, "uuid": "01881723-df52-47a7-8b18-f239a319175b", "value": "12288:eSaa4lrrdVhhEoAI7Kzj1U+cTZYJ5XHAN7fnpkNpJy0es9:eSz4lX3hhEoAIuf11cNYvXYfGzJTes9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920505, "uuid": "7645e4c2-0419-4a1e-97e6-8e179a395aa1", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920505, "uuid": "2107658b-330f-42ec-b04c-1ddb228d78c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920505, "uuid": "1020deaa-d332-4e71-8a8a-ea10493ca223", "value": "bc6ef720c1527d97fd6e023c527d193a32f5bf22c2686d33463bbc63ca767390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374e4116-4c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693929578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929578, "uuid": "067f5ab0-d3a2-4c1b-8629-95b6f893fe42", "comment": "Malware payload (RedLineStealer)", "value": "9570f88b0d26dc22d7296fc8140bb144", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929578, "uuid": "eedf43a6-54e4-4c9c-99c0-b9f5d9d75450", "comment": "Malware payload (RedLineStealer)", "value": "bcf662aa97bdab1d39933e37d605535e9c5cef852fdd2fd4ea0ec865f9fc7f07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929578, "uuid": "1f85e900-8fb7-4ec4-9ac8-372fac682050", "comment": "Malware payload (RedLineStealer)", "value": "cfd3393ddea3b98887d96fde1dd27b4a0d820750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929578, "uuid": "ae06fdb2-864b-4409-a9f9-0ce1eea08bc3", "comment": "Malware payload (RedLineStealer)", "value": "23cf7f28ebd3923104fc529242aa2a45e66ae68302f47c988f1cf10a0715561d733709a2ded2503b78750aec55a8e7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929578, "uuid": "c7e4c9f7-df98-4e4a-b429-06f2547e2a2c", "value": "T1EB84AD9362D0BD71E9214B328F1EC6EC375EB9518E597B9AB3186F1F18B51B2D223301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929578, "uuid": "8fc06570-3d31-4429-a91a-5fd9cd10a50a", "value": "cd74dd88bfa053259aaabed77401f3a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929578, "uuid": "f31167cb-57d1-4e2c-90d2-480b3d15a960", "value": "12288:ppvdo8ncf3UUwJjDJ4B4O/Ovq4++G0G5jESpjoxQ:3vdo8ncvcP+B4FCqLGZESxoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693929578, "uuid": "b025bec7-824b-48fb-80f1-d6bf37b49501", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693929578, "uuid": "fbb68e7d-67c2-4837-b4f0-473196a4fe81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929578, "uuid": "26bb115d-a6a4-4ed2-9989-33f00edea8b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a822068e-4b95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693881663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881663, "uuid": "c1486316-d696-4f86-ba7b-90ed57446bf9", "comment": "Malware payload", "value": "f9738d2e68ebcdc3f5b982867c7d232f", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881663, "uuid": "cf318b1f-b841-48c7-a820-7b2b411d9eb2", "comment": "Malware payload", "value": "bd3ae41147c48bcea273f742ae19c229ad76c4a75895253e01a58bd4f3c2b9d1", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881663, "uuid": "fd763d60-0a2b-4279-85a8-8b7e10e125ee", "comment": "Malware payload", "value": "f651e10a0c340ea9efd74cdbba7cc1eb8d242c1a", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693881663, "uuid": "addc8c82-544b-49a3-8b1b-c304bf5bd308", "comment": "Malware payload", "value": "d385956a6e7d50c8efa50a5eee5eead98a90efa47ccaefb9c0136c7d1b6a0771a34186b314aa193fb09579ff7aba9eae", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881663, "uuid": "ba3db9ef-754c-4190-80c6-7efcd092e625", "value": "T14566BF31328AC42BD66305B02A2D9ADF5528BF750BB154CBB3CC2E6E5BB45C21336E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881663, "uuid": "1d1d4020-a76f-44ef-91b1-5a57be9c23cd", "value": "21314122cd4542a6b9b297f52a87acbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881663, "uuid": "501ee7bc-3d98-4930-9821-34937bba619f", "value": "98304:ptfl0kYax0dMiNsqWGXwtyImWspl7Gw6S4GPgAH8751S3RIZ/bpZt:jfl0kYa0bJz73uGtKzS3O/bLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693881663, "uuid": "2f0e5103-0d8d-4d40-9338-a2865231a03e", "value": 6550144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693881663, "uuid": "00b592a9-8dc9-441d-9afb-574a5f99baf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693881663, "uuid": "4890028f-f0a0-4e06-80e7-5650b8ac7150", "value": "Flr\u0435f\u043e\u0445 lnst\u0430ll\u0435r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204bf0f0-4bfb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693925244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925244, "uuid": "6b995115-fab9-4031-9df1-04d0927c6474", "comment": "Malware payload (AgentTesla)", "value": "67de26c7c8b8c9fb42dd280078283f29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925244, "uuid": "65f6b8f4-265d-47fc-8fe1-115b0ed1ce02", "comment": "Malware payload (AgentTesla)", "value": "bd757613d417aa5fcbca3decb07a44a69e68f74bc35c26bb2f8a3c008343d931", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925244, "uuid": "973b6645-de7a-44d7-a55e-49fde680bf1c", "comment": "Malware payload (AgentTesla)", "value": "892a0bfd5e955ba19554cc18cdb8694ff284757e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693925244, "uuid": "c4e54612-fb28-43a5-b3e6-e7e18f51ab82", "comment": "Malware payload (AgentTesla)", "value": "2d8fdb1365adc9138c1fdb0bc72512fea348057dfac480333b94ea7722c8aaf6182295cf61fe7186e586c7de51072111", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925244, "uuid": "ea24588f-d324-48c7-8b94-d25e29b2ece9", "value": "T1021541F3FB542FE285C24DACB9F8D233A8D406803551B6BB7F69A905405543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925244, "uuid": "9088c5df-954a-494c-bb45-97370ca89342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925244, "uuid": "b6924dbd-e818-4d3a-9638-ac699c4d49f7", "value": "12288:Sh0SfBb4lqJjnUErlP3OoFK39bH/+APSTberB:2FZPlUklP3FFK39bmAWerB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693925244, "uuid": "cc19dbbf-860f-45f4-8ec6-2ec3ce7d100b", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693925244, "uuid": "3b456bf0-706c-48c1-9d64-bc4f947b3836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693925244, "uuid": "28db8ad3-beac-44f3-aacf-d8482c148a4f", "value": "SKM_C33501911071023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d4cbe1-4ba4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693888176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888176, "uuid": "33dd2c3f-6fef-4bbd-93c0-01d7dc14db77", "comment": "Malware payload (Formbook)", "value": "e36b945399e50bd581262c1489814de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888176, "uuid": "54b1a042-81cc-418c-9c20-39ab52c36bbb", "comment": "Malware payload (Formbook)", "value": "bee949c5192f46467c2fb76490dd2407f4206639c2e5e824c74e879c02fcc342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888176, "uuid": "7662787d-fd89-4695-8277-865872f3f612", "comment": "Malware payload (Formbook)", "value": "eba071cea4f14b415f399bc948071cb5a7741049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693888176, "uuid": "e2a9a759-9396-47da-b78a-63dbefec33f7", "comment": "Malware payload (Formbook)", "value": "9484ecb4dacf613a0609a846e6799bedd6219f985112b6fcb8d6ac160ff59585b786807376e9ee6083502558d70468cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888176, "uuid": "0d133623-f63a-4c2a-8c8d-2a9f2dcaa50e", "value": "T100D4F1ADB9BD3E27C77E19F44481324803B641695843EBD96CC260EFA2C1BF647C259B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888176, "uuid": "e9ab9004-24d6-4915-a173-5382e15cd8d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888176, "uuid": "9e3df819-6881-4c75-995d-aaaed9ffec82", "value": "12288:eLRgNGKlku4O9MyqJieWXtWFUqPhuo+4KXNXrKBceHqMGSXkDwMD8Hl2:kONGKKu2W92UWhuolCIBh8SXkDV8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693888176, "uuid": "00b41cb0-30da-4d4b-ba63-fbb8c00c419c", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693888176, "uuid": "ef119d82-ac65-4074-8876-40fdbd0738ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693888176, "uuid": "f1cf49f6-3658-4fae-b062-b95154d6a89e", "value": "SecuriteInfo.com.Win32.PWSX-gen.28880.143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65072c9f-4b9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884557, "uuid": "c7651a08-8233-4c4b-b557-3d6238e9aaa1", "comment": "Malware payload (Mirai)", "value": "7678f672b9fde0537d6514ac53971b16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884557, "uuid": "f9bbf57f-d5b1-4fb7-823b-1929d81102de", "comment": "Malware payload (Mirai)", "value": "c072eaff14d3fcb7b8c61478409ac4e9cb863380dd58f52396ae30c8e55fd7b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884557, "uuid": "c15e48e1-05e8-4fe5-a99f-c217455d410f", "comment": "Malware payload (Mirai)", "value": "ccd540dedb18fc6086814aa06a4f059f2085b82a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884557, "uuid": "bef3b3d9-c0da-4102-98e2-7afc0809cf87", "comment": "Malware payload (Mirai)", "value": "f43154fb5de18b5a38f4842a28df0d0e28cf8e88190231ceef0d4c17cd926b072989c879f75f6f93aff47c38bc1a3407", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884557, "uuid": "360b62f9-912b-4689-9980-13574781feeb", "value": "T139E2E1287C0105BEDA1BDAB213C59B822F314EF79812CC5F2086DAA79D475FA6C077E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884557, "uuid": "4529c27f-196f-4001-9b7b-a796d8b88341", "value": "768:ASiGbX2fBwG9SVSQcRQfua3bA9FMbe2UvjCf8dJgGlzDpbuR1J6k:0ffB2VSQcefuOOMbWvefCVJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884557, "uuid": "7b9930dc-26e4-450c-83c2-df070dd8dc5f", "value": 33460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884557, "uuid": "9b208bd2-f2c9-457e-9b79-4b7237c42eb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884557, "uuid": "25dc0ca6-02cf-4b27-980a-c97e5d2384bd", "value": "SecuriteInfo.com.Linux.Siggen.9999.22201.31614", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3389a31c-4bf6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693923129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923129, "uuid": "23d71946-4ad8-4c4f-9cfd-c366036fcab9", "comment": "Malware payload (AgentTesla)", "value": "dc60eddfdcc1d2c919a057a3e5e43ff7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923129, "uuid": "e5322dbd-bc1a-499d-9d70-996cc024e546", "comment": "Malware payload (AgentTesla)", "value": "c14cf2077de0f4e6ed3e925c72350a570006f62fcb7d63cbd2c1063afb5a0c26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923129, "uuid": "2f507746-4be3-46dd-aff9-c8aa9691afe7", "comment": "Malware payload (AgentTesla)", "value": "9741c1cfd0d46c0c31156444e1dbede8449a9f6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923129, "uuid": "d01fd381-42b3-4f10-a4c1-4307d656b964", "comment": "Malware payload (AgentTesla)", "value": "201f693a662f3675b3f65eaa841596f30f98ab2c37a2eba43bcf2b34a38bcb6e5164e3d95e4a774c3efdc2e83363446f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923129, "uuid": "d39f4f04-2970-44d0-a322-3ddcbcd06837", "value": "T1FE7322E3E12608D6E9B507B2DD3B8D0521976D7DE8B2262E51FAF5619EB32D30017C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923129, "uuid": "0d809289-02b6-4c3e-9a38-bc2834ea57ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923129, "uuid": "eceaf65b-7158-49f5-9e0c-83ab12398762", "value": "768:ZKJN/YJaReNRTB9lveXDOJ2CpjKGnBBQx:wzwJaReNRTrlveNCldBix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693923129, "uuid": "c29e9c86-cd43-4aed-83da-4e270b04389c", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693923129, "uuid": "01eb9365-1d1c-4a7d-b0d8-aec6237630cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923129, "uuid": "fb9cf47a-20c6-4d05-adb5-837b79bc77a1", "value": "Purchase Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72dfde0-4bef-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693920397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920397, "uuid": "b28ea9a6-d742-4bd5-8251-09beffd09088", "comment": "Malware payload", "value": "32446fbe734bd46a865dae4bee515858", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920397, "uuid": "bb33193c-48db-494a-8c6f-2dcf3c3ac09a", "comment": "Malware payload", "value": "c24a576c2292f24ca9d3a597e2d89f6c48b70343ceab0945627a21650fe9b3d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920397, "uuid": "6116a296-4a80-4a22-acd7-2fabdd4f355b", "comment": "Malware payload", "value": "7c324fee288d4be97b53f9204327352f34ae8ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920397, "uuid": "aa059732-918b-4fca-91dd-f27136c8c786", "comment": "Malware payload", "value": "943140f3407947c020fbbe99b18b154e215b4a0b11274d139d701d408c3a96deaeba07f4ff804e672ade65c2d08c72f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920397, "uuid": "f491d2ee-e4aa-43c7-99d5-b9acbd4161df", "value": "T1EDB52303B6C444B2D92329321F65AF25A57D3C308F719ECBD3D4596E9E321D08736BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920397, "uuid": "b5cd478b-8406-42d0-9ff1-007bda3856ec", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920397, "uuid": "f6a9f4a2-9deb-49e0-8c79-5da19e4f45ca", "value": "49152:PaqbTKklCiK8oWuonf499y9VjD16oD7KSoHNCP2W6n:PgKCiK8DuofGUD16KKxt7Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920397, "uuid": "345c44d9-5cd8-47e2-9e6f-7d550e51ac0d", "value": 2485861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920397, "uuid": "38f0002c-e865-41e1-9943-89ffe46ebe5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920397, "uuid": "73d996fa-feb6-47e3-a0ff-fcca8f562589", "value": "32446fbe734bd46a865dae4bee515858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151fd3ac-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885712, "uuid": "576c5b16-0157-49d5-b812-808877813c7d", "comment": "Malware payload (Mirai)", "value": "4944ff01b816ebee891daba5c0c4b4e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885712, "uuid": "abd255f9-55da-4eb0-b70a-3efc9a72a569", "comment": "Malware payload (Mirai)", "value": "c38db1fb6fc077b091b6ef129410da8de568ab110d719e07f4bace91dc818a8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885712, "uuid": "1a6470dc-4786-4144-a782-dd71d60086d8", "comment": "Malware payload (Mirai)", "value": "c4d062ceb5076f67eb74b1f01367cedc2d903ab6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885712, "uuid": "c5af8031-1d3a-4a34-8c59-966728239ce8", "comment": "Malware payload (Mirai)", "value": "e121ce497ffe43643a5962beb09c12f7ede2bc1764705ece5fa9b626cf2e9fcfa353db544a1b12fa2d95c6481748a6a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885712, "uuid": "85a9d725-e1c5-4b51-9e8b-d997ebc5d9bf", "value": "T1B9C2CFAEE9183E8AC9CD087C81A513917D9BF2C1544F5ECCD6318C944F6284FB49F8B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885712, "uuid": "c61948e1-d88f-4c76-8ab0-edfe7da74833", "value": "768:IMfCuj1RtaD4i026VuRPvCN40vwjFPjWMaE:IMfCuj1RgD4i0Nuc9EFP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885712, "uuid": "b654ad26-081d-4ac0-ab38-a592fe97972f", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885712, "uuid": "b65c00aa-c019-4fb3-a334-bd4344f93c09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885712, "uuid": "8f189623-9575-4fb5-ae1c-1c72371b00ed", "value": "4944ff01b816ebee891daba5c0c4b4e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a797c3-4b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693877463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877463, "uuid": "5db784da-900b-4d69-b26a-c0e778ec86b3", "comment": "Malware payload (Mirai)", "value": "5aa938ffaaacab4f8e81913a1d35a4f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877463, "uuid": "d98328d8-8232-4686-8833-b3a31728a52c", "comment": "Malware payload (Mirai)", "value": "c3d1e51357e1fb46e93b8590490943a6de764aeda65fa05e6c92ffdc4ba06a1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877463, "uuid": "1cff1282-f154-4655-8368-c12ff1112c85", "comment": "Malware payload (Mirai)", "value": "86b5c5a1a6725f6f0bd085bac31e4e11d8319127", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877463, "uuid": "c58895f7-15cf-449f-befb-d5c1e0aa9b14", "comment": "Malware payload (Mirai)", "value": "03f484a71fa510b01429f7971ef1f067e03298dbe16e641e0484c19bf2d0627583b16d462dcfaa82f23200d856e8cdc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877463, "uuid": "5fc45e0d-0ab0-49f5-942a-caa11d912262", "value": "T1AA432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877463, "uuid": "7aaf0af2-2151-4253-ac41-90cf73098249", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwX:RqtmZPuutfbltZFBSJsBcfDSTFI+BEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877463, "uuid": "6ecf3f95-64b1-4915-b518-a62848c95ed9", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877463, "uuid": "be86b315-ebe4-43e3-94bd-555b7fd4bb04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877463, "uuid": "baac9cab-95b6-43b6-b1ec-0cf7c58636d0", "value": "5aa938ffaaacab4f8e81913a1d35a4f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032ad388-4baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890406, "uuid": "8fc0aa70-78ee-4806-8e10-91f73c55eb77", "comment": "Malware payload (AgentTesla)", "value": "a3dd2c3453a08c5fe94da02b3b1d8574", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890406, "uuid": "42678f07-9e52-444b-aae7-3b41d5bfd0dd", "comment": "Malware payload (AgentTesla)", "value": "c505d90440e6cac97b2cb1ce0d2e3c169279f7c4c79cce58648b8daf0bfc390f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890406, "uuid": "3788a89b-f7e8-44ca-9649-592f4baea902", "comment": "Malware payload (AgentTesla)", "value": "89f6c59fd4e7b22122142570036584be80d11874", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890406, "uuid": "8c4c85a0-5717-4ee7-b11d-a03cdeeae7be", "comment": "Malware payload (AgentTesla)", "value": "25bb6b75821f53afb8c3c4a28dbc75237a0f764747c8c06e89aa91c6537ccaf4169d13a074493baf503cbde5a2da1ecc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890406, "uuid": "3407c8ef-3b42-4e64-bca4-77402eb51449", "value": "T1AE3583F3FB442FE184C24DACB9E8D273A9D406807541B6BFBF5AE905441543AF25E8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890406, "uuid": "32dc046c-15fb-40fe-80ac-7c63860ff112", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890406, "uuid": "118a55e5-5747-4d51-b200-1b975a75eb92", "value": "12288:mf0c7YR02cD1xPo2LnwSNCeQqlnncu+J1H0rkog0f9xFcgQ2ClSWrEP:mf0wbQ2TwCQyncuj2Gh/Q2CA6EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890406, "uuid": "14dee609-ec01-4bd9-9387-5d91d1c93087", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890406, "uuid": "2294e4de-fac9-4b14-b385-08683be436d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890406, "uuid": "80f29af3-f459-4ce2-b8a2-cd78a7c05fd7", "value": "HSBC SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b52e36-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890187, "uuid": "44b987e8-55e7-488e-b691-69e8e3d0d3a6", "comment": "Malware payload (AgentTesla)", "value": "f5d240f747f893bdf12a73d0a8567d64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890187, "uuid": "9f881663-fb45-47c0-96cf-6caab3f924d6", "comment": "Malware payload (AgentTesla)", "value": "c6cb24c15cf6a92d26315019e86a0dfdd67d25a9fd25d7ad309d5d36c3c21bdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890187, "uuid": "d4fc6d63-9f52-4018-8f16-e0fec6606bc4", "comment": "Malware payload (AgentTesla)", "value": "fda4523c43d905605bfe9c7b4c00cfab9fce03fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890187, "uuid": "5e8faecf-b606-4d7e-9cde-51b10ae3c2b8", "comment": "Malware payload (AgentTesla)", "value": "3fb49919ec10a585b6a0a2fbc35d98cafef96f344e00e2479a28165f99ee03a350b9bd3c50cdcbf2fe96a5aa261334da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890187, "uuid": "51aac03f-9e35-4f48-bbcf-7aee4f4a392f", "value": "T1DEE423A9C6D3A74F8E548ED3C35DE89C8896C7F6D1C35D8630F06BBB54FA850069B884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890187, "uuid": "1dc9380d-b007-4b3b-962f-643a3cbae7ec", "value": "12288:vVk+hhde5qb3XQH96vIhXk/UdktJnDObwk4Gv/MzhnI3O+JF/3l9EtgOyOA:93TOAQd6vIy4kznK34m/xO+zV9KpyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890187, "uuid": "3b4d6f8a-4f75-4b5b-8729-cebd592b04da", "value": 669976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890187, "uuid": "8a51d066-9968-4480-91ce-4cb4b1d278ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890187, "uuid": "cb1effc8-9167-4023-a2bf-725250fd9d5c", "value": "Orden de Compra No. 20181.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10758e13-4be4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693915339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915339, "uuid": "328b3530-a599-4b05-a73c-7fee0a87ee91", "comment": "Malware payload (RemcosRAT)", "value": "d756741e05f6e3d96e0572c4596ce17e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915339, "uuid": "5e5d1b98-5431-42dd-8ed3-76c236099f44", "comment": "Malware payload (RemcosRAT)", "value": "c71e6276c2546902446a7ecb9507dd37504f5a6fa017cd20c510cd00198e6165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915339, "uuid": "6fa5f39a-1807-4aa1-8e15-edea5bcb5cfe", "comment": "Malware payload (RemcosRAT)", "value": "972c694bb01f7f06a39a4a0828b5ff62e127288b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915339, "uuid": "b08a16a4-262f-41e1-b847-bf4daaffccb6", "comment": "Malware payload (RemcosRAT)", "value": "db3ffce52de98e93ba0808d7e78ef7434a3023912f2965916f31ae27257e5357421b8c0f3b18d70f8df18c243c1b2817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915339, "uuid": "11d3ebe7-a312-44c9-86f9-101d23cebb73", "value": "T11DC423350891C9B3F5F717339E3F95797FF2A202AA24C2161B896F4831929845B8DBC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915339, "uuid": "abadb48c-bfd8-40c2-b44a-9b3e3866a9e4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915339, "uuid": "a795c0ad-6248-4f89-8cb6-9f1c6acd75c8", "value": "12288:vY7Uli/Qxf6fmsjXiZVS+AA0IejrQ2Vs+4YrXDFvf4+:vY7UliDfN7+V3AdIwM2Vsirhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915339, "uuid": "94c13802-35ff-431b-86a6-19c7835426ab", "value": 566465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915339, "uuid": "c75e44e9-9abd-412c-aaf9-672df0215d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915339, "uuid": "f14783e7-d92f-4cb6-98b6-e63e10e7e167", "value": "c71e6276c2546902446a7ecb9507dd37504f5a6fa017cd20c510cd00198e6165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e2c3fb-4b86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693875345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875345, "uuid": "55de4fe6-ff77-4b78-86dd-7e0b4fb4313d", "comment": "Malware payload (Stealc)", "value": "ce5cefd9ea035c41a5ebd4dbb52d34f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875345, "uuid": "0b553522-f1c3-47a7-901b-ca83b3fd7660", "comment": "Malware payload (Stealc)", "value": "c73449a6acb51f440dd1f4228ac5e537eb3653b903fab608b9c4fc427b893c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875345, "uuid": "67ab61bc-b104-435c-b829-cd9c5349c3ba", "comment": "Malware payload (Stealc)", "value": "e91e1afb736ace4a94f29f42def489316b5cda87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875345, "uuid": "506a2e7b-761d-41eb-940e-8c553c7a537f", "comment": "Malware payload (Stealc)", "value": "e92987ce9b98407046d1ad7707d73d2088db009284aaeec11e45a1693e37632204b0b66f59ba4f1e1dd704a9dc0ce7bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875345, "uuid": "85a4bf74-ece1-4cab-966f-17967df89cd6", "value": "T14624DF21B7E0C032F0A3953055B4C7E1EE7BB83215B5949B77680A3E5E727C09BBA356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875345, "uuid": "c79e832d-5d6e-4e80-8c9b-3b408bba6389", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875345, "uuid": "a34cf4c2-5884-4eaa-853e-f030d3b55e41", "value": "3072:fgMhUttOh7eVeLC+H2x2FLsGasBPrYZdUz6mj73vwYa:ozOh7AeLC+HCSLXProUz6mj73vna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693875345, "uuid": "ad344972-1649-48d2-9df8-85c6f5d5c139", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693875345, "uuid": "c2e71a60-c6ef-49f6-9293-6a2f65819457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875345, "uuid": "43aea9ec-2cf6-4518-97da-f429d8c494ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0a0cc4-4bed-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693919492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919492, "uuid": "48abd01b-4279-41a5-b0eb-36a55d572d5a", "comment": "Malware payload (AgentTesla)", "value": "76bc277c0ca7cc671aad0439576a0261", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919492, "uuid": "739d0fec-6a88-408b-8e0c-c770a2382362", "comment": "Malware payload (AgentTesla)", "value": "c74e0ff43aec86ebf78328a3ad0540af860a662f37081e87ccdb393f29e61389", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919492, "uuid": "7f76e6bd-439d-4d44-b315-c049c68b226f", "comment": "Malware payload (AgentTesla)", "value": "adc56729653f738673d1554c16647ec8fcd8b3b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693919492, "uuid": "cf758a5f-f894-4513-8160-a8eeb97831aa", "comment": "Malware payload (AgentTesla)", "value": "510f546e5a659f76ed606d457c0e46f72f4210e167a235d15f1fdc07f23d90d65e8de9f3d1c9e9fe6640246e2a07f840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919492, "uuid": "8d113aa5-e05e-4095-8443-09d89b735784", "value": "T1AFE4E0516620CD82C0D0D6F2A9B2C561BEC5EFFCE5A0DD0731B53A5B76B01A0F77AA90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919492, "uuid": "f5bcb815-47b1-49d5-92ad-a8dccd06e898", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919492, "uuid": "f9bdece8-8bbb-477f-bcab-2d3048584458", "value": "12288:nTKNhKBtTo5XV6H4P/x38yUTRz/5x9AN4Y5Z:nToKXToE4x81Vz/5xCN4Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693919492, "uuid": "c9a2170f-2e04-4c60-aa79-126c140d1beb", "value": 668968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693919492, "uuid": "51905f0c-5126-4a7d-88ad-5518baa3de01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693919492, "uuid": "1b4f7980-d29c-40dc-a8c3-9c45f25593aa", "value": "SUBR002409261040923_ppwk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9d088a-4bf7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693923626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923626, "uuid": "655d4fe7-9be5-4d98-8cf5-24b4177f85c2", "comment": "Malware payload (njrat)", "value": "0d002397195463d88d188ae67b83de8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923626, "uuid": "5bef19f8-354e-4bb5-a549-d4e288d63cb2", "comment": "Malware payload (njrat)", "value": "c7e788b5c5ce234fe7443bf397582a80e14a615dbff35085045f78840afe3456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923626, "uuid": "ffbc81c5-17f0-470e-a0ac-3431ac82afb1", "comment": "Malware payload (njrat)", "value": "c2a9b93f2b246b093eec80308dde4fd9dbc414e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693923626, "uuid": "41a9622d-60ec-414c-8d51-1d818a3c9ebd", "comment": "Malware payload (njrat)", "value": "8971a64b8a638bf33c5278fab4d533cd47ea249f5a36a66491b57a014536a394979b3d83d19cfa89fb1dd4890cc8397f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923626, "uuid": "8ebc9b5d-392c-4db2-b829-5eb77dda35f5", "value": "T1C393E84977E52524E5BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923626, "uuid": "8c9a9801-2f27-4b9b-873f-3ad68b0bc568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923626, "uuid": "ce72946c-aa95-4367-9412-ff4f8f18451f", "value": "768:VY3FUnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3psGj:SUxOx6baIa9RZj00ljEwzGi1dDZD3gS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693923626, "uuid": "811d7e29-5134-43ac-9f1e-65d936c29dc8", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693923626, "uuid": "3a4ce9b1-3d77-4912-9338-e720f501fe10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693923626, "uuid": "cd83d30f-eafa-4df9-8991-164bb6fb28e0", "value": "C7E788B5C5CE234FE7443BF397582A80E14A615DBFF35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988bfd1d-4bda-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1693911272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911272, "uuid": "966877df-b3b4-4cc7-ac0b-560acf5a00ee", "comment": "Malware payload (Heodo)", "value": "4084a1ee82e5b35f32b602b2cae545dc", "object_relation": "md5", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911272, "uuid": "09bb0075-6934-4fe5-aa0b-ea2dc3a6d771", "comment": "Malware payload (Heodo)", "value": "c83dfb98c699c0fae247c3634435626f573da90c0d5496b8113360eacc34539a", "object_relation": "sha256", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911272, "uuid": "5866037f-3d46-410f-b15c-25698feb1c10", "comment": "Malware payload (Heodo)", "value": "55a8d03ff34e2f8577e9cad4ce5d52912b3d1efc", "object_relation": "sha1", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911272, "uuid": "74e912b5-e9cd-4338-8e3a-4b921720f447", "comment": "Malware payload (Heodo)", "value": "99a619cd650b9e0f0342e6c21e5071446a82f7fa986f49e95ec3ac51d3da9f2be6644eb4930a9117233348c5f796ce83", "object_relation": "sha3-384", "Tag": [ { "name": "45-12-253-137", "colour": "#9FC848", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911272, "uuid": "6f73dfb8-6e4c-47aa-a1b5-301821c70982", "value": "T10CD5012132E8C529E2F71B38E93A95F16939BD24DA23C10F53647D1E2971E808A77373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911272, "uuid": "a4299199-e5ec-4ebd-8fc7-082bd77687d3", "value": "49152:LHEujqkV51C7XRLxxfhLdEP/d4dYdJS2G4IN4O3T4tL+jw/q5HRw1gp:LHEU5KXRVn2nOdYds2G3IijwiJRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693911272, "uuid": "2d963fee-2e24-4489-96af-752bd99872ef", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693911272, "uuid": "a5a887d8-b416-4315-a716-ac99af8d890b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911272, "uuid": "63f2eac3-9620-4685-81a7-13188f558ff7", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e713c8c0-4be4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693915699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915699, "uuid": "44af3236-3fef-4253-8011-8b87a8c0f0ac", "comment": "Malware payload", "value": "70dfb0d4226e11b310dfdd6937078466", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915699, "uuid": "f2d262d4-4872-4f65-935f-d3cd38c30d1e", "comment": "Malware payload", "value": "c9c548835a80254ecf647008cbae8907fae55a78ac1d0d7b2a4b690fd8c562a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915699, "uuid": "b0f4c9c3-9031-42a4-8aa2-a2ca8f6a0b3f", "comment": "Malware payload", "value": "71a6d9e8b1ea892b7b491c4108d48241980b4bc5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915699, "uuid": "5c3ffdf6-ba3b-4754-8e89-8f90b277b1cb", "comment": "Malware payload", "value": "a19b499d9c637b9fb110e4df91dcbff2f755130e47a01682a7b346cf51bdb5d4cdf7d0f4994d5d38f76905abcd0675a8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915699, "uuid": "4ec63e9c-19c9-4d17-8d43-65f8f7129b73", "value": "T1EFF5334CB8C881CBEE4132336A9BF5112799AFDC51E2B8C3B9B1125B16F76C50FA56C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915699, "uuid": "4aff5138-c72e-41f8-b7e9-d60de124a728", "value": "49152:jXQBGVgJMgBlSPgDRc+bpmw41x0V/7el8Mmb9D6X6ijGZafMMQ2jJuoYwrx:jX6GgBlVc8VaOjexm56XbjGZAPLjQkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915699, "uuid": "cef7a0d9-47fc-4b67-9e53-bc8c523b28b6", "value": 3397814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915699, "uuid": "d9a0b2a9-e8a3-4227-b570-7b16cbb250b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915699, "uuid": "999275b5-983e-4dc2-9890-e6a5829e828e", "value": "ID-FactLFCTXBNIQJKOBJRzinxl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ec199c-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693927047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927047, "uuid": "7f249f1f-0cbf-4a26-a9de-fc70b0df1c3f", "comment": "Malware payload", "value": "696c7aa2878a9e9492c24219deb9aab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927047, "uuid": "da4652b5-fee2-4672-902e-7c0f2ff4f1b2", "comment": "Malware payload", "value": "cafd2c237325bffbcce14e1504c80265da8b64dae04eed2d66d84e518ab817a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927047, "uuid": "17391079-ec12-4431-af4c-cf13d2e097b0", "comment": "Malware payload", "value": "64750c8c2448063c4634a779d24b3412377dcbc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927047, "uuid": "389775c7-aab5-44c1-884d-b52f022d70da", "comment": "Malware payload", "value": "7ad19f5e53d101045879ed2be07af18d519ee7742c87f81d935c1001a4bc43d683ea20b49fd7947823331688bc706ceb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927047, "uuid": "b7ca06e3-891d-4482-b40d-dcf1fe701eee", "value": "T10736331FE5F0C9EBE5F54634D42AEE236A315CE71A0244138E11CBA669A0F449F3F627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927047, "uuid": "3a1ecde7-5e92-4525-a3ad-9ca014a76875", "value": "98304:HZCRScDTjTiNLOGcsFZcXaM/iVWr3y1fLqN7+x9YQmNoy:ANuLOGcsvBuiVB1fMKx9Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927047, "uuid": "e550d194-1798-4de1-b7cd-096f8fc72c2a", "value": 5009944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927047, "uuid": "5614e5c7-0c37-4fd6-87f0-125de7d98ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927047, "uuid": "b3ceda41-e5da-470f-99b8-d97d0a32e9a4", "value": "cafd2c237325bffbcce14e1504c80265da8b64dae04eed2d66d84e518ab817a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e6d798-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926923, "uuid": "e90e5dc5-b03e-4d09-a62e-a7b79df59540", "comment": "Malware payload", "value": "82b9d61c95d5ef563229d6768a7206e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926923, "uuid": "cecf2b3d-28d5-4c8f-a707-3299145ce043", "comment": "Malware payload", "value": "cb8d3fe305a2acaa34ebd37472fe4a966ed238e09d7f77164a1f53d850ea0294", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926923, "uuid": "1be52d69-727a-48c2-9641-d80025f48e4a", "comment": "Malware payload", "value": "1831d3936f2e358c1e7bb6115c4148a0169185e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926923, "uuid": "9ecb6a98-a90b-4bda-a024-7a37af91b8ae", "comment": "Malware payload", "value": "9981d25a1b1e4089bda74288c6cb9a2fb94fb049effe5700387240ea4e0d8253fcfa71496ee0c390059c3c698b791eff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926923, "uuid": "86300b2c-6ef9-41f5-a366-2af29f69607f", "value": "T189E0A94B1F294BCBF0E0803A4BD927241F73FAAA0A940B4269720A201D4E1278E7D136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926923, "uuid": "38b1fc61-2231-4be7-bf66-433613a9badd", "value": "6:BnX//In8/r1MEtOlu5uStE8astMMfaUvLha8Bahazdca:BvwncrrQU5DtE8as/rLtSazea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926923, "uuid": "31ee8d3e-0c91-44fb-9226-cf484f5d68af", "value": 305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926923, "uuid": "6746a460-4ef0-4bfc-bb4d-368b2734213d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926923, "uuid": "3b0e80f0-69df-4241-bf0f-18f388b51402", "value": "cb8d3fe305a2acaa34ebd37472fe4a966ed238e09d7f77164a1f53d850ea0294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4de541-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "df8fe4f2-bcfa-4048-8060-16dd7bdfd02a", "comment": "Malware payload (AgentTesla)", "value": "4e589d16881aef131eec79e761f77b09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "c81207b5-f111-4f4e-a473-1bbae6a9fc3b", "comment": "Malware payload (AgentTesla)", "value": "cbd0c7c12647b3d90abf2fd5b59680ff1a1e3df7e288a17e517d2e0f7d1d2078", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "ab198526-f516-4abe-9ef3-a4c237f8c7ba", "comment": "Malware payload (AgentTesla)", "value": "8135a73999c972e484b4d9f7c5d8a9fed992c4d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913966, "uuid": "6df1215d-5d70-484a-b980-bae5223c98f1", "comment": "Malware payload (AgentTesla)", "value": "a244df2884af677e77b41b4145a8c4aa8daf42cee288bbee95172abb9ee37e4bbaae1c9e90c30c2bc6a87a626cb0f80b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913966, "uuid": "e38b8fa4-041c-4280-84cd-49ff97468b45", "value": "T11603B592661C69D6FE6D22B3B87F89C605902C7F8BE0186D758FF62244B2313451FD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913966, "uuid": "a63ee381-1ebc-41d7-ab64-8f365ed4cd18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913966, "uuid": "161d7b1d-85f6-4b2d-962c-a06191e09e75", "value": "768:QgYJDRDK3EaC8l2hP3SScNY8cfRqTuM+1+A:C7DK3Eaqh36G8BTugA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913966, "uuid": "d23a6f43-37ac-453e-802d-6b06164b2818", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913966, "uuid": "27d64517-1e95-41d7-bac7-bd9874f646ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913966, "uuid": "19ee83ff-7f7e-4e95-81bf-d85bc676ccf2", "value": "SecuriteInfo.com.Win32.DropperX-gen.3244.24994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ec2c6f-4c15-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693936776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936776, "uuid": "857a09e9-ca62-45e3-baf7-5b86649055c2", "comment": "Malware payload (Gafgyt)", "value": "bbdab0db713ca208d75779ad5abca747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936776, "uuid": "b328f503-51f8-4487-87a5-264f87b5c31f", "comment": "Malware payload (Gafgyt)", "value": "ceab0fcb8a0d38293d113a4d8002d0ec594c896571eeb69e73d198c1c0ea0024", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936776, "uuid": "03d3fad7-91dd-4308-a41e-9073bc667b11", "comment": "Malware payload (Gafgyt)", "value": "1c72730967e08672e2e19848fa740817bdf7f7c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693936776, "uuid": "f9e39655-e936-47fb-8e1e-e1a1d43d7b05", "comment": "Malware payload (Gafgyt)", "value": "5bf70723cefd292db02f156a1134997293f11f587d9c50fcf7b7e810c8c70ad20602fee513cd96b0cc0de914e58e2219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693936776, "uuid": "95a05808-ff7a-4281-a4c7-10b463fd0260", "value": "T16CB3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693936776, "uuid": "7960c78e-ffc6-4f67-9391-fd106e644180", "value": "3072:R/4tNF9U4vv1Kw6J73x8UmkiSFxfKxbXe:BUNFK+18T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693936776, "uuid": "9bafaf16-6a12-4479-81e3-080d2600ea01", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693936776, "uuid": "48d8b6a5-ff8e-422b-a708-ae26018ed733", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693936776, "uuid": "114e3602-9c0a-4ba1-8a87-22938692b22c", "value": "bbdab0db713ca208d75779ad5abca747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf2a5f4-4c07-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693930500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930500, "uuid": "fbe0f286-7e86-4c89-b07a-617678595240", "comment": "Malware payload (RedLineStealer)", "value": "dbcd1be0e42b4bd9c495dd269e1e4053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930500, "uuid": "a1c56f93-40de-4c29-8cc6-e224c8805438", "comment": "Malware payload (RedLineStealer)", "value": "ceff42108efa88bbd15535f6b6350794175c0f16bd4dce6f3b48d11996075a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930500, "uuid": "eabaeb9e-c89d-4543-b93d-5bb867f25f69", "comment": "Malware payload (RedLineStealer)", "value": "d3e40ad5941543831f6d7b7a402edc1606039d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930500, "uuid": "5f59524e-752d-448d-bbad-da8f25a8f28a", "comment": "Malware payload (RedLineStealer)", "value": "3bf696081b3d80837a78ac90d2d020db98f22e2776843d612d98393f5d6212d74359c91537c8b083820d60c1e834e509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930500, "uuid": "dee9f8b6-936f-40d2-9c70-e1f51ce27926", "value": "T120645ABA32FBD832F09205BD45335A5B08E9D9B078A05637E60B11F1C91BD86CD9FE58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930500, "uuid": "c895d2d2-df66-4651-9301-7aa075d14e75", "value": "59e9016f955a6d31d640ba2784453b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930500, "uuid": "bd0b0349-073c-45fa-b3b6-9d82c3fbf410", "value": "6144:Xr/L1istcmL39OQt8xx+udZOw18n4i3qCnL5h:7/L1iC9d8f+4Z/1q7nL5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693930500, "uuid": "d33156a9-55ed-4729-bc09-655ae939c688", "value": 307576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693930500, "uuid": "de9dd0a6-49c2-456f-bf94-ff39ea0457b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930500, "uuid": "16e5d44f-0616-4304-be6a-85419b8e5eb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84791330-4c09-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693931425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931425, "uuid": "8024b550-33ea-4ebc-86a1-9f121e50918e", "comment": "Malware payload (RedLineStealer)", "value": "2b064c9cb52dc5f39f62668a3f3e53d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931425, "uuid": "10f14a50-51e3-4d5f-b73e-7933907b55b4", "comment": "Malware payload (RedLineStealer)", "value": "d001ff23b9bbc6412fedc0f81395a5000a2d9873fd942954d08be046d58998e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931425, "uuid": "f02f6a62-d0f5-422b-87db-78f8b4f20e7a", "comment": "Malware payload (RedLineStealer)", "value": "91772e0416c0b9f1bf32b78d8851f4dccc2e2801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693931425, "uuid": "d9aa74e0-63ae-4464-aff5-450b30aad76d", "comment": "Malware payload (RedLineStealer)", "value": "e578cf16fbe7f5d36ad799011bc8aa768c52a02a51771f890c8dc6f4034c005db29f1856cf6f9ac2599a441a4e2d90d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931425, "uuid": "af61de2d-8e3c-4270-8b7b-7930ec7c44a7", "value": "T18494BE97A2F0BC61E525C7318F1EC2F8771DB8518E59AB96A3187F2B28751B2D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931425, "uuid": "d5db3ed4-477f-4860-82ba-fb5f263fcd17", "value": "a5090fe27b113adbae2a8696a75fe6c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931425, "uuid": "b627df83-9be8-4848-bc7c-220e7bb091e2", "value": "6144:Jb8BLM3Qouk1YoQt7zXwe3M7+1FwZB1dA+uXnhFa:Jb8BI3QoHY/t7/39FwD1dZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693931425, "uuid": "1d8e4969-675d-4c10-a8c5-86f6211c0dbb", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693931425, "uuid": "5c6111fb-d8d2-4f21-b603-e21974fed3af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693931425, "uuid": "5788a0be-173d-4bd0-acf5-130589190f68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c21fe2-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921925, "uuid": "7d7a6908-4aba-4c2e-9113-50e27b779b8f", "comment": "Malware payload (AgentTesla)", "value": "0d11b1472437b6e6f96fd3c238eb947f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921925, "uuid": "61faca0a-cc5e-40b7-8601-d64026c11ce6", "comment": "Malware payload (AgentTesla)", "value": "d01903480e2d2cc9a33d4318568d77ee3e04531e74b91f09cfff9d1d99d38b6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921925, "uuid": "ec2e01fa-0ddf-4ee2-9ce8-44b34a492a04", "comment": "Malware payload (AgentTesla)", "value": "f29ac2507c018089c28dcfa52484b9fb17bd23e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921925, "uuid": "1957de8c-2329-4594-8b41-10b39b3e03b7", "comment": "Malware payload (AgentTesla)", "value": "dc9b79614af158b8067791d6af1f82218f49e5bb460ae82fa200255c31350a11719fff4e1bb04862b8bb1f96054cdc1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921925, "uuid": "4ca03aea-26b2-4d24-a3ef-ea831c862723", "value": "T13E34EE037E48EB15D2583D3BC2EF6C2453F2A0C70673964BAF48AE6526466436D6E37C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921925, "uuid": "56aa4660-dfd6-4719-bd0a-2ab5f0476f9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921925, "uuid": "2fc6ca6c-0be7-48b6-9f8c-4dc6d581f2a1", "value": "3072:fBu8risGi2EKKz7gbFCzXPy9mCIun/YUhWo:fBu8+i2EKKobSXPYngZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921925, "uuid": "0210ffd0-419e-4dab-b231-2fb5fdf995ed", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921925, "uuid": "792eef14-f594-4225-9de6-d026c1f38802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921925, "uuid": "c750dce0-97a6-40b2-be62-410f8f0f5f9d", "value": "d01903480e2d2cc9a33d4318568d77ee3e04531e74b91f09cfff9d1d99d38b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26141df1-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885740, "uuid": "3f280bbf-8d6f-42b2-a2e8-45dbeea63bdb", "comment": "Malware payload (Mirai)", "value": "b3f34dcf3fa727b08b2a005a0bb99944", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885740, "uuid": "b086a2cf-d5c2-40fd-b5ab-740c73a4094d", "comment": "Malware payload (Mirai)", "value": "d0756b837d4be915df39c3e1e76065880683c074bc1646b29e42037c91e73932", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885740, "uuid": "f3c7502f-7c74-4a16-a296-8766a7d0b8f1", "comment": "Malware payload (Mirai)", "value": "0629a2210208d45ec461e970134c0a4c61433918", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885740, "uuid": "4e6057a5-dce1-4da2-8df4-07bf3870f196", "comment": "Malware payload (Mirai)", "value": "aefa3fa402e3e498ad2cd7e26867705a717930a58b15db1449d071afbd261af99dbe7046a4536d987630655aa3712ced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885740, "uuid": "0a849e40-3dda-4d51-a23e-ac5a0c91e1ee", "value": "T16EB34B73CC256F68D665E1B0B0B18F796BA3A950818B1FBE1567C3758043D8DF60A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885740, "uuid": "88765c8b-e4f0-4612-98bd-535fc733a1ca", "value": "1536:0a0UAv2DSWAiKeCHKeR11+0al/WqNWS3mqDNb9K+:09yS1iKere1aldNWGmqDrK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885740, "uuid": "b96db680-fd7c-4f2c-96e9-5afbb1bb72cb", "value": 109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885740, "uuid": "2854c964-f79e-4216-9d60-0bdd010a9e19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885740, "uuid": "5ba49a7a-64be-4666-9c14-b5a62af62084", "value": "b3f34dcf3fa727b08b2a005a0bb99944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8cbca0-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874025, "uuid": "a15085e5-5627-46fa-91e5-9aebacfa27b6", "comment": "Malware payload (Mirai)", "value": "218be52c2cd11fba947a208588de9e86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874025, "uuid": "a9a5c145-a8b5-4a40-8561-dbe71842f4db", "comment": "Malware payload (Mirai)", "value": "d106a5a4295146d4c5d88bfdb8407acd783d6cfe772bca2d3f7745d670207f75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874025, "uuid": "c934273c-e1fd-48e2-a99a-0736ce8699d0", "comment": "Malware payload (Mirai)", "value": "d3991990427fd7c500d3f9ffae41c466216fb425", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874025, "uuid": "44db7359-4aa6-4611-9a05-727166dde555", "comment": "Malware payload (Mirai)", "value": "fd1ddd7c59c24fe8f80261d1e5461a5f765691e1b1d92ae7e97b9b722754da5832058075a2910cbc2ac496c1fab642ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874025, "uuid": "f0b6ae80-7d9a-45c3-a929-3b8bea2a2d1d", "value": "T1A4336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874025, "uuid": "355e990d-c962-4ef5-b755-ef6ce3a1f1a6", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874025, "uuid": "36430ad3-c4d0-4186-a598-a815881801ea", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874025, "uuid": "b8a56202-6866-48b0-99d0-2d92a0902915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874025, "uuid": "e4f46c27-8a69-43db-a546-24d3e1780825", "value": "218be52c2cd11fba947a208588de9e86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f619223-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693926987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926987, "uuid": "0d567467-4bb5-46ac-9f13-70c701f34d0e", "comment": "Malware payload", "value": "66dbba5557fba25dc8732d3e5bfbd141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926987, "uuid": "0967393a-55af-4207-b54a-4c2838ccd5ff", "comment": "Malware payload", "value": "d13fd21514f7ee5e58343aa99bf551c6a56486731c50daefcce233fdb162def8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926987, "uuid": "f1677310-8329-4453-a142-6e024f220597", "comment": "Malware payload", "value": "9854573a96a6f0e2b1eb031bf7254ba612ca251c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926987, "uuid": "6ea91b9f-7c93-4e08-b938-93f8068ce0ba", "comment": "Malware payload", "value": "90eca116ee1c20c468812ea049009896b38fc46b133332c3fbad00eba1eabfc6af26b1f6d5295b9f1103a2330535f2f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926987, "uuid": "574b7458-9d01-44b7-a675-c1db2eda599a", "value": "T181E26F4DAF50DA2BCD983335C4EA07243731C5899B5A4B8762DCA0743DE3758DE2B68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926987, "uuid": "8423b302-c917-442c-a9ee-ac56e47e15b7", "value": "384:/kwNtWEztMplH7K3DeXl25bBzoYlzJch8ScrBwlpqZHVx1:MwNtlSt7QDY25bBzoUzJchE+lABVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926987, "uuid": "a81b92fc-57b6-436d-ae0c-56f24a55308f", "value": 33472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926987, "uuid": "5727d6ad-3a7b-4113-b028-fb4f10ccf1e4", "value": "application/x-object", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926987, "uuid": "dc4d0cad-74e1-4c5b-bb11-dfc0622fd509", "value": "d13fd21514f7ee5e58343aa99bf551c6a56486731c50daefcce233fdb162def8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be739d56-4bcc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693905323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905323, "uuid": "91848e09-8534-49c6-b875-f0c81047de94", "comment": "Malware payload (Mirai)", "value": "e7b3a49fb4e34bc47e8ccd79984b6d95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905323, "uuid": "3a02690b-0e68-48f0-a195-74ba3a68b143", "comment": "Malware payload (Mirai)", "value": "d1eeae10cb0d111334401e509e60587ef0d47384211838e6613c0444c9139961", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905323, "uuid": "6d5fd692-7169-47f7-bfab-32d7b7f9f30f", "comment": "Malware payload (Mirai)", "value": "3a73bd7a3a921775db45ec7130d7bd160e8e4e88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693905323, "uuid": "c3b68f5e-b031-4bd0-b872-98d39a3b2978", "comment": "Malware payload (Mirai)", "value": "1d49dbebe5cd9ad89dcb47b546c55e6d2b95dff04d24821dd0276d439f4bcf9e140810db3b5c491dddf3bad876fd2539", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905323, "uuid": "78aadacb-6c33-45f3-82f4-f9a2cc663339", "value": "T191B2D1A486916706C1B0B436A37CCFA36E3716A0C5F63927176092BCD95685633FCACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905323, "uuid": "74698c2f-0dd2-4e07-a162-51d13b3bf9c1", "value": "384:4GHKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BsE04ThRhymdGUop5hu7u:4GHKQFH0rs3zWoDDRsjt7LB9U+Bp04TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693905323, "uuid": "1e0cb3d8-bc38-40fd-b7cb-05ebc0d01acb", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693905323, "uuid": "459f57cb-240c-4249-b9ec-d26c491f4294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693905323, "uuid": "0559ced5-9dce-4de3-ac7b-0b05e0dd6837", "value": "e7b3a49fb4e34bc47e8ccd79984b6d95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab01be5-4be6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693916591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916591, "uuid": "c8c9c46d-0bc3-4e17-b5ae-25fba33581ce", "comment": "Malware payload (AgentTesla)", "value": "82f9c3ce02550ed32dd852d361052fd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916591, "uuid": "6467601b-3c35-422c-9153-1e5707c7760a", "comment": "Malware payload (AgentTesla)", "value": "d290aaca4e77c3feb234265c1d95395c3d3699f6f3803ec8312c651e9a29d908", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916591, "uuid": "5256747f-ea3d-4e35-9b52-272477bb2e27", "comment": "Malware payload (AgentTesla)", "value": "6e6a5cf1c7cd2972218875106b78daaba66d2227", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916591, "uuid": "0cc23c5f-f99d-4b46-9e97-6adcc419d921", "comment": "Malware payload (AgentTesla)", "value": "597debce035a47da2beee33ad4c0590048615ab6afc2a4ce32c43986523b6b7cb01ef720af762e5533dc77837212657b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916591, "uuid": "d6e4e01c-c3af-421b-90be-2e38cef663ad", "value": "T16C2551F3FB442FE284C24DACB9E8D233A9D406807551F67B7F69A905441543AF29F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916591, "uuid": "65365f24-eca4-4a1f-840a-c823ebff4b5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916591, "uuid": "acc144f4-7c9e-4852-9ae7-809c19a3eb12", "value": "12288:bBGc7YTVyPePn2KSL53vKjE/MKzYrxW451vewMT:bBDaVyPePol38jKzYr4c1vePT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916591, "uuid": "bd34c34b-142e-48e8-8705-e622eaec740e", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916591, "uuid": "3d0d9754-cad2-4062-b7d8-2149ee4e1780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916591, "uuid": "1758529a-112b-48e3-9eab-c56798829c8c", "value": "Scanned POs AllComps EPDA & comp POs, PSB-17398902, 84789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3a4104-4c34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693949744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693949744, "uuid": "d83c1e27-52fd-405a-a0e5-9b25b19ff0c8", "comment": "Malware payload (AgentTesla)", "value": "a2937fddd1379478133891a580f8fb53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693949744, "uuid": "37cce6c6-c321-42fc-ac6a-f5ef09042e75", "comment": "Malware payload (AgentTesla)", "value": "d2ca4fbb0d048c9fcb71ec6146e9a8ef2f648191b4bc8cec3d05f5afa2f0ed5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693949744, "uuid": "6b676cc2-9c6a-4649-b548-d5a4c83c62d0", "comment": "Malware payload (AgentTesla)", "value": "18d7f84299fa923d5d78f4584cd502f2592a493a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693949744, "uuid": "b723888e-d8c8-468a-98d9-3bdb3432bf72", "comment": "Malware payload (AgentTesla)", "value": "9a72aed42ab1493d98940672359e2361f4a669ad313b1019230b16c41f5d7eefb0c462e65615e8a10fcc9b6ff7a0dace", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693949744, "uuid": "0a6c8c3f-0c4b-468d-97d6-4ac4629a74de", "value": "T161E4020677E44E32EBBE433461542244CB7111A7967AC618BEDF35ABAF397200B13E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693949744, "uuid": "9ec374de-5d6f-4631-86ff-d31abd1cdfff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693949744, "uuid": "4ec61929-0a34-48b2-9823-40751b31695a", "value": "12288:Tg+/DJGWTLLqD6vyQ2XkoHoIeUL04/pH7pU1QGiObvSo3YNrQ0XCEg/LN:Tg+/DDLeDbQi3oIeTeN7lGp6YYu05Wp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693949744, "uuid": "f7c81964-8273-42f7-bca0-0201895c606e", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693949744, "uuid": "545d9b67-7bfb-40f9-93e8-3932b0fd9620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693949744, "uuid": "9e7920f1-9457-4345-9c13-8c0e476d2b4f", "value": "SecuriteInfo.com.Win32.PWSX-gen.3274.9582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9594751-4bd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693907945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907945, "uuid": "8bf89d0b-55d9-496c-adc2-db08fba2060b", "comment": "Malware payload (AgentTesla)", "value": "5f5c88ec386401878ac21b86c27327a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907945, "uuid": "dd98fa6d-f11e-4709-9ceb-4e6cba584e26", "comment": "Malware payload (AgentTesla)", "value": "d5355b793fcc2385f6bd53eda51b1049bcfeae47eff6def179fe8693ea7206f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907945, "uuid": "5b981900-f300-4d56-8752-5805d795eded", "comment": "Malware payload (AgentTesla)", "value": "c7d19f78c6db25c3b19665cea94f141f61b78974", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693907945, "uuid": "ccd4704a-8a65-4042-ba09-2f9396bde36b", "comment": "Malware payload (AgentTesla)", "value": "0648929ea156860d58f4b26030c597f14c28a4c9e28ff34c1b1859ed649aca69ccfc9184b1e1cce504166cba921693be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907945, "uuid": "b394a101-54bb-4b37-bb5d-07a34064a845", "value": "T1A7F3397992DA4D11D33E4078C5B113480AB2A1B796DBE75DCDB1ACFA3D0A7C3332A865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907945, "uuid": "18af2322-cc20-440d-81b4-9f88a154136c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907945, "uuid": "9f3e0f3c-808e-446b-995f-084d03f6898a", "value": "3072:RWf4PoRNHMjTtXxjMpT59fNUBXk9orMnjBeHt:6RajTtByT1XAMjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693907945, "uuid": "7b39aadb-7008-4b0f-afda-2fd197e29670", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693907945, "uuid": "c09343f3-0ab2-4d91-9882-5ebf9f9fd6f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693907945, "uuid": "f96778e5-b78f-4c7b-b951-5278a5742c37", "value": "16939079447b1c9006c7add571bdd2a25d493cc49b9c70bc7d097f0d56ca631f94f84e311d409.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d64e50-4be3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693915289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915289, "uuid": "35cf7b33-53ac-4221-998d-4bfe4dbcbf51", "comment": "Malware payload (AgentTesla)", "value": "3836c4114d08d97d51ea28d1cbdffea8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915289, "uuid": "893b4267-14de-4c2c-b913-ed274c02141e", "comment": "Malware payload (AgentTesla)", "value": "d5620fed049aea0ab3c166426bedc65c14666f164177b9e697be71ea873226ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915289, "uuid": "2313238c-36ec-49b4-a509-abd8f48e65cd", "comment": "Malware payload (AgentTesla)", "value": "ad04889d7af393509478f78fc2c211b4b2543cb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693915289, "uuid": "5a60419d-5de0-4507-acf3-c3a7d358605a", "comment": "Malware payload (AgentTesla)", "value": "cb706162a987462c337470cec983d309da5757a3aef80b6faa156e7d02357e68b29263b82f955f14720993bdee561f60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915289, "uuid": "e639ebc5-323d-4463-b9da-f859c964a152", "value": "T1A9254F6840F7564484ABE49CF756767A027B8CCC42BE0AC3B3D6BE7C74C22A7991C51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915289, "uuid": "9d13a9a8-0db2-4e5f-bbf5-db6b111e8c39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915289, "uuid": "049c741a-6660-4706-8994-7531bf9cfe17", "value": "12288:KdCBBtnm3n0He9DlpzIpk1qaxbxQxkT4/rJw8flwykcnM9lPuTO47QpilQP/dUBX:56OAAl96kz9FlH9Ole", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693915289, "uuid": "4f07da03-c3f7-4b8c-b821-4f9b4aa87088", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693915289, "uuid": "fae1823f-23c2-4e47-81f2-53efef90532d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693915289, "uuid": "8a08513f-4d3c-48c9-8861-dea2d4e9cc7f", "value": "d5620fed049aea0ab3c166426bedc65c14666f164177b9e697be71ea873226ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6784ecf-4c02-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693928476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928476, "uuid": "59a25d78-31a6-4841-9293-68e3c34468fa", "comment": "Malware payload", "value": "976ede8e894fa24ca976cc6357c64478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928476, "uuid": "c22ab55b-bb53-4682-85be-dbf0a1c1dbd8", "comment": "Malware payload", "value": "d5a20a0f07a175b2edf0f794b162b1c94f1d2168e254c45d45e1f1ad0f1e9425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928476, "uuid": "4f57dae2-7994-47fb-a976-066d2eece11a", "comment": "Malware payload", "value": "cac898744d86edcbdf1a7016ea9c0e405f03a5d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693928476, "uuid": "fc5ebd0b-1b03-480f-9b10-afc88ffc59f0", "comment": "Malware payload", "value": "086a741b0c26aa4d58c9ae53bb4758562e752750465694d698ae5af95db5e281746705792afd686395ffdee1880f8258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928476, "uuid": "72a1b7d8-1258-45c7-9153-3d7a7dc85d5a", "value": "T1C7745B17A1EA70FCC297C03013EB9AB36D61B47912303E7B56D0DE722A62DD0176DB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928476, "uuid": "72fbe54a-6815-447e-b111-28380a79e4c8", "value": "6144:+ENeIeMKsm4oHZi2PuXRf1EFjHy0rI6RMKMNaa+EzkAoDPwPGOc0N9nAL3t16:ReIedsQuXRf1EFnRpM+EzkAoDPwPGOc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693928476, "uuid": "19e0506a-5641-4397-a20e-30a405c72927", "value": 369234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693928476, "uuid": "2b159fe9-3370-4133-934d-780e5bbdbca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693928476, "uuid": "40d744cb-0c67-4b15-bfbe-3044b231e228", "value": "d5a20a0f07a175b2edf0f794b162b1c94f1d2168e254c45d45e1f1ad0f1e9425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5ac95b-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913936, "uuid": "4cadf15e-88d8-4a63-bf0b-a0075bf1962a", "comment": "Malware payload (AgentTesla)", "value": "0e3109d40354b5a6185f8700514b78ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913936, "uuid": "21ed9d0a-685d-4835-a7a5-00c527e20954", "comment": "Malware payload (AgentTesla)", "value": "d697a1fdda6c410bd4ed4c8df767fe4a785cc949de2143f5b366654a7fcd6aa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913936, "uuid": "41e7f681-799a-4fc2-8ecc-9689c1a6d3eb", "comment": "Malware payload (AgentTesla)", "value": "5c39af34b86db9b7db0e2b91b864cd5bba0948f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913936, "uuid": "e9533a02-a9b4-44d3-92ef-61afebe2269b", "comment": "Malware payload (AgentTesla)", "value": "798b5467d5693b78c0f8c216fcf2b7f5c1470c430c8244236b5aa5af6c42bce4e3296f74ac87460a8237a663f0819ac0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913936, "uuid": "cafebee2-d83f-4ef8-8fe8-63cb07e4f143", "value": "T10725A403BA4B89E2C549177AC5970C340372DD807613F71AB98EB33969B37B66B49D0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913936, "uuid": "d1ccf53a-dfba-4b9d-b643-d4b67598e553", "value": "12288:jklBLFweUzGsa/XkIlidgSOS5h6ek4GFOZCjEcvdZ9AvwEbjDR9eWU:uB5Uq/0IgdNOI6f4GFOZCjLVPAva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913936, "uuid": "6a8188a1-f2af-40e1-9ccc-2cd51dc19b0d", "value": 999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913936, "uuid": "26ea3128-5b9d-4694-998d-9f6428345088", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913936, "uuid": "94be1919-d01f-4f4e-974a-13be4f0d04df", "value": "nOC 1609 SOBEK Ingenieros Chile 20230829_PDF .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00dcda5-4c2d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693947067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693947067, "uuid": "f04e3f8b-b9eb-443b-9286-767ebd8c2292", "comment": "Malware payload", "value": "87eaea6fcb2175ea55b40e8f98cdde33", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693947067, "uuid": "2d55ea08-3d44-4a72-bbe7-504829a78002", "comment": "Malware payload", "value": "d6d36755376ebb3ae564b24a1d51124cc0717093489de5ed984340d4fe989b4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693947067, "uuid": "8a7c992c-a23b-4e31-bbf2-8557daf6b6c3", "comment": "Malware payload", "value": "4c275697358269ad182bfa9bf8e5f46d5be1805c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693947067, "uuid": "3486e301-534f-4a9b-b5ad-39b352aeae4d", "comment": "Malware payload", "value": "f20882d170176169ee74e80863ab23910061d9d1ffde934356cd197f4a733a5d307a78c40ddf1d92b83ead1be1919a72", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693947067, "uuid": "fd2e503a-b706-475d-9352-8efdd2be9782", "value": "T13825DF86E813540B4AEC90343E9D91CD0E6EC2A1CA7A4FECDB6FC2559C43D5D22E976C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693947067, "uuid": "5c3477b8-6e17-4d01-bc59-99aad42e55b6", "value": "12288:4H54Qir8B+K0KWoOUSmlE/PiwF7CYNTpQWOEdHuvJNsfVSZdik0oMFEvCFktva20:O+QGIR/Ot3P5PTpTOdNSyb4fQmnZDAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693947067, "uuid": "22b3db28-fbb9-469c-887b-fc57a87bc396", "value": 990452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693947067, "uuid": "e9ab36a8-13e3-4318-8cfe-322776ea226e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693947067, "uuid": "4c567b05-9c8a-4a69-a538-3c7a6314d8bf", "value": "Fnvtdhenaps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd7123c-4c03-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693929028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929028, "uuid": "c0867f3a-c5e9-4eb1-b654-f00d735a0e2f", "comment": "Malware payload", "value": "1355602ce26fceed05fcae0b07a643e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929028, "uuid": "5809c9a8-6ec0-40f3-a926-d1c65c49a54e", "comment": "Malware payload", "value": "d7b1fa404b586b22e0181d3f8b6990a069b08bb349c9580060904a3710d6dc02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929028, "uuid": "2c220ab8-0d2a-4556-8221-4e091b67f9f2", "comment": "Malware payload", "value": "1facddc9b0aa26b0a202bb6db234a219c1671806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929028, "uuid": "0cc8f8b4-c6b5-4d92-84fd-cb0f5dafce6a", "comment": "Malware payload", "value": "3d737392fa342ed1ba6d92a6a5595095fa052cc6ed4b74ea4763ce488cc86b743057efed93da9926b3eeca1e014dff88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929028, "uuid": "65b11a67-e393-4700-87ba-35055b5ed90b", "value": "T15942082197F84071EABA47322D3697418B37EE578833A95EB24C501A3F3271183D37B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929028, "uuid": "78b99c12-a257-4efa-be8d-fa0b0627cdbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929028, "uuid": "e06d2f4f-2b8c-4f35-960e-f7e666eebccf", "value": "192:Dk6V6ROuS7dQbPZKEeQV4oAD/e8fzhyZE84Ycek3ur0M1Y4:P8ROuS2bjeQV4o0NfUmrYcKrFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693929028, "uuid": "a529a423-8446-49ca-aba6-f320e3816e3f", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693929028, "uuid": "67cf4367-142b-4861-91e6-fc7680bf3b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929028, "uuid": "b35a1df6-2318-44e5-89c5-8cf7d4a481fe", "value": "d7b1fa404b586b22e0181d3f8b6990a069b08bb349c9580060904a3710d6dc02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5301549b-4be6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Grandoreiro)", "timestamp": 1693916310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916310, "uuid": "d12eee1c-a7ec-476a-8887-6b0039a3cec1", "comment": "Malware payload (Grandoreiro)", "value": "9d92f7814b61d4aea083c391070add19", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916310, "uuid": "b2dc6894-324e-4127-9418-bfa14a60d345", "comment": "Malware payload (Grandoreiro)", "value": "d81f0e3f9634baed444fa5b7ee5fa6001c4b89c33dcb638cb8eea88384a0f413", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916310, "uuid": "19f8c64e-0f54-4f24-9934-5686bc165dde", "comment": "Malware payload (Grandoreiro)", "value": "89ebe0943e0e064ae29b74eb38a9bb065fddc101", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693916310, "uuid": "3f3b3fcf-9027-4802-b286-bfccd343ad65", "comment": "Malware payload (Grandoreiro)", "value": "da5bfd3477c0c07e38731c385405bfb42099252f4c87051d68e6654403e6d16a77e68b748c70699006bf3e7e5b69f887", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916310, "uuid": "d3c24a04-e963-4649-98eb-4925c126c26e", "value": "T15B263391B8068F57D9502731E2B31F1703BB0B4520F39297E6258EA94DE7B9BD690CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916310, "uuid": "0d1071bb-8948-4549-9ad1-e786e846e368", "value": "98304:1ok4TT57zPZC4puECGggnDJUF3+AcO/xzuwIONtrNx:1oB35RCvECGg31+At9ufODL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693916310, "uuid": "c6f2430b-25bd-408d-a3db-0e5901e38671", "value": 4677346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693916310, "uuid": "25e16ef6-d369-44f0-8e04-1e97aa103403", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693916310, "uuid": "109738ac-d68b-4f04-8d73-c4b25db50a11", "value": "ID-Attatchment_PYYXORBLFUVKMKGlusgy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee215193-4b8b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1693877486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877486, "uuid": "d268b012-9242-4a41-96f4-46fbbc864f6a", "comment": "Malware payload (Gafgyt)", "value": "fa481c772ef959247b69ab7ab5a7eafe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877486, "uuid": "79402458-75b8-4ec9-ba77-7ab4a7a1a0bf", "comment": "Malware payload (Gafgyt)", "value": "d957ce3c60b93fdf77291b4e832db72d9445758b5885c7f23f75824ee68accf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877486, "uuid": "0cca2069-cf2d-4ff6-813b-c38356842bc6", "comment": "Malware payload (Gafgyt)", "value": "23357ae50af0cec2a69dc7fd2eb7865cea1da640", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693877486, "uuid": "8f2b3f8b-8fcf-4af2-b1eb-c8f53a8bad10", "comment": "Malware payload (Gafgyt)", "value": "c9de8e4413ae14f04b885a001bb96e0b29175faeeff19c748c33d8603d6cb743ea5abc7a580efe303e3594f265e357bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877486, "uuid": "fdcae5c7-50d4-4448-9219-cd6e55dc2c02", "value": "T151A35AB7CC356E58D658D5B0B0B18F79AB939A2181470FBE25B7C2754043D8DFA0A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877486, "uuid": "e6ae2f71-eca2-4036-8457-b33bf10d62a1", "value": "1536:/anovc6eVkKeCPaKNuE5t+CzHLvzWPtzsQZ3IRVkZ/9Vs3:/wuKeUNaCHzWPl7ZuCLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693877486, "uuid": "cd019a6c-61d4-43e8-86e6-94c35b32c1ae", "value": 101004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693877486, "uuid": "69ddd3e3-4434-4a87-97d8-c7a1bc04874f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693877486, "uuid": "e181dcf2-7f26-4bb5-9303-100862c9ad4c", "value": "fa481c772ef959247b69ab7ab5a7eafe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1258d9df-4baa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890431, "uuid": "5ffca1e2-d1df-4899-9d6f-834026ec3315", "comment": "Malware payload (AgentTesla)", "value": "42b10a640f5226faaf7aa7e02bac4ad6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890431, "uuid": "ac988679-3cfb-4abb-bb79-cbeb29d118cd", "comment": "Malware payload (AgentTesla)", "value": "d9819797562fc37901466523b731e2114efd43d2395887cf44116e7b208e7d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890431, "uuid": "316c8706-9e53-4050-b1e7-287f8541fab6", "comment": "Malware payload (AgentTesla)", "value": "ab9572c26a732c9b9e7b2c400abb9fbcb33b486b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890431, "uuid": "07cb279e-e4a7-4a16-a815-ca7a793cb37f", "comment": "Malware payload (AgentTesla)", "value": "b311a6083c9a1106b737f94972fa8e1f27e5f7f7b32770e97be7d166a4c6ed857f5f13c3b7f409316e9b5d2d329816a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890431, "uuid": "7d92101f-5d4a-4918-9b85-fe5bf2e0c4ee", "value": "T1D4F41250B2FD9B43D7BF9BF24418511407B6AC1B2531F7980DD3B4CB2AA1B914A82F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890431, "uuid": "160c48dc-2e8a-4034-89c6-078c81251418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890431, "uuid": "c92cc20c-06dd-4886-be10-8a30de5b7a81", "value": "12288:zoGR3PYWSlPgOH9HMqt8qTeHLEaqZulhuN8N5Zmai8A+PMWiy9kDwMD8H:zoAQWWFf8qTcLEbN8XDi8HPL9kDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890431, "uuid": "6cdda11d-ae82-4a65-a73d-41e7496725c0", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890431, "uuid": "ab2d4231-e842-4e6b-a413-0fa39cb73ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890431, "uuid": "3c75b313-4a93-423e-80a2-f302a726414e", "value": "DHL Express_28015809822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff249471-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693922182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922182, "uuid": "dbd7ca72-dc47-4c25-bfc2-209f4a0f4f7a", "comment": "Malware payload (RedLineStealer)", "value": "7de0410848632563aca7c8f1d1e394b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922182, "uuid": "12f2dbd9-0241-491a-8b73-f3cf133c0cde", "comment": "Malware payload (RedLineStealer)", "value": "d9f8e6363adb499d6bb13458861b5078526982dc293b920fb859ce5a410d4a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922182, "uuid": "0ce483b7-2371-4ab8-b518-54426edb1bb1", "comment": "Malware payload (RedLineStealer)", "value": "b684ca30d4057c786d2484eb81aa1bc57aa23743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922182, "uuid": "a1ba475d-9ef1-4aaa-99eb-890ba07b7b43", "comment": "Malware payload (RedLineStealer)", "value": "584398dd96e286dfc942250071279b45aa5d21433e5fdbddd6e8191d53e4c7bac5131db7c8b563bdb3c690589c0e1a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922182, "uuid": "09d8aff0-e1a0-4f24-a414-70e4974925b9", "value": "T14C94AD93A2D0BC60D5358B32BF1EC6F8761EB8518E196756A318EF2F14791B2DE63310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922182, "uuid": "bcd74260-2daa-4104-b773-c1c32907adbd", "value": "cd74dd88bfa053259aaabed77401f3a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922182, "uuid": "2503ca6c-a865-4cad-9365-797575ebb8ab", "value": "12288:OpfNE4acO7wEKV4zu4O7FuGRaDPfVDmUurm:EfNE4acukopKZA7fN2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693922182, "uuid": "0a965834-2839-4420-b3fe-8618909f5b59", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693922182, "uuid": "bd9e6312-2440-41ef-866f-c593b8daed83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922182, "uuid": "b20a624e-d8f4-4cab-ad40-1b6e1302dfd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439d32c6-4b7f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693872046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872046, "uuid": "07453ca4-2bc6-48be-813d-2fb0e8915f26", "comment": "Malware payload (Amadey)", "value": "047b3ae83ab4510ef53e3af0b82bcde0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872046, "uuid": "3d2ba7bb-c65a-4ae5-b76c-ae79a4efa3bb", "comment": "Malware payload (Amadey)", "value": "dcc6aa589f7a073fd0940639664ec0b469508cba915fb7b48d71bc7865ca9397", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872046, "uuid": "af96022d-3b02-4e50-8d85-56569311a206", "comment": "Malware payload (Amadey)", "value": "02efbc39fbbe352efa68da12267ce879e6ec4c5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693872046, "uuid": "230a8bbf-6d0a-4cd5-ae84-2b04720915f3", "comment": "Malware payload (Amadey)", "value": "ba521a9606a32f38cf2fc38d014bc7828d13e0553ab0f6b7c45d443f734b1a9218bdaf5d81fe172ef0c0e6d7a94d6044", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872046, "uuid": "f71769d7-415a-4438-a56e-5f456c06f770", "value": "T1C96449417912C032D961A1721AB5BFF2C59D68249BB049DF7BC00F76DB212E67A70F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872046, "uuid": "f203c926-1350-4f43-b17b-d155ca80fb14", "value": "44e769941d2c6ad88bf42ac4adb36135", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872046, "uuid": "5627605a-521e-498d-973e-e5d588edd778", "value": "6144:zR/tsQnf6X0M6+koYhXMxjwigfwfgbePu97rrAOQ322222KTq:zRlHVckoaXMxcePu97Hg22222iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693872046, "uuid": "14342361-9728-4438-92f7-308234505666", "value": 322143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693872046, "uuid": "3c00fa4e-2345-43c2-b341-083ec651ae04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693872046, "uuid": "bca16310-0252-45c3-9239-5c4b3f51d690", "value": "047b3ae83ab4510ef53e3af0b82bcde0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245425e0-4bf3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693921815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921815, "uuid": "50aae943-7d3d-41e2-b2f6-7d1a1d4b2927", "comment": "Malware payload (AgentTesla)", "value": "36161249eeaa8ac3924bf1980c71d7ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921815, "uuid": "2033f4f7-51a2-488b-9a7f-2d6d54b3d393", "comment": "Malware payload (AgentTesla)", "value": "dcfcdb66f1f51d0cd1ffea03c8d04ba475f1c1a7b5fd871ffbf06ffbec87b11c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921815, "uuid": "07910330-2042-4a5c-9f64-888b421d9711", "comment": "Malware payload (AgentTesla)", "value": "c3375817a8c242c72ad27cfc78bba7abd63f2eaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693921815, "uuid": "e8389eaf-9ad7-47bd-a9be-9652576cc7d0", "comment": "Malware payload (AgentTesla)", "value": "6419376762cbe298e537f4c6d7e98cb83eee66847f8046dff5ff2fe00b716f606e015066d1617ea5fdfaf2e2ce480cf4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921815, "uuid": "800e22b0-ff5e-4b32-9e03-9978e4c4196b", "value": "T1ED55BE023645CF61C25F1B72C59682F40367AE41EE42EBCB758DBF993BB33A65802647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921815, "uuid": "e00218a4-fc2b-4574-8469-6152a27a8119", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921815, "uuid": "be3574c1-afe5-49d9-bfc3-a6ac0b6360c4", "value": "24576:ZYvYt5svHoyWqUGMyHyEnW62McDpSgXsK8lWkix6F:Zpt5iIyWqBygx2M9ysH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693921815, "uuid": "1435f08c-f009-4067-b4d9-6e2d8718844d", "value": 1349320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693921815, "uuid": "e218d173-761e-4aee-a981-78191e28ecfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693921815, "uuid": "281b667d-18cb-4d5b-ae7c-a5f34de8ad93", "value": "dcfcdb66f1f51d0cd1ffea03c8d04ba475f1c1a7b5fd871ffbf06ffbec87b11c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb945571-4b87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693875683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875683, "uuid": "cb3e5980-5a04-4ead-8d0e-2608079d2763", "comment": "Malware payload (Smoke Loader)", "value": "a617e5d41cea88d016499613fcb34e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875683, "uuid": "1fdaf192-a419-49a5-b9ef-5a0942344df2", "comment": "Malware payload (Smoke Loader)", "value": "dd2709d3893549f324510e0367fa840ea0ad3c7463402daa232458b9acbc8273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875683, "uuid": "0c078fe0-1052-4290-9e96-16c12b704cea", "comment": "Malware payload (Smoke Loader)", "value": "7feb4ab5e7d1e4e9d1217d32c2d7a98a924dd527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693875683, "uuid": "b802797e-f858-4c07-a383-6e68c97058f6", "comment": "Malware payload (Smoke Loader)", "value": "9c87d0a17ee07bdb00027d67be55c77bf5ac52725143a0bd3551d7e8d3cd4fae52e28849fba5bd1ff08bddc66253aca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875683, "uuid": "20e9f43f-01b3-4f76-916d-bccbdf100e6e", "value": "T1A924CF11B7A2F032D06745701471C7B23EBBB8722A79858B27580BBE5E74BC06F75396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875683, "uuid": "ea9bf2fa-c928-4e41-8951-11f84b18b888", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875683, "uuid": "ceeaaf14-9005-4281-8e67-255d6c68a669", "value": "3072:yMjdKtpOhxHtR/fh1BVhosMA43xpi5+y68+2GWDQ/o:LkOhxNR/fh1/hosch2nQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693875683, "uuid": "9973418e-2c0e-4907-b9a0-385f03cb7e59", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693875683, "uuid": "d9bee51d-993d-4b20-ba8a-c3675d2df361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693875683, "uuid": "4183b8fc-3280-4ce9-9b52-6c8e2bd9a2a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7b9e7a-4be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693914634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914634, "uuid": "37d61f58-3fb9-4062-8411-a5097704aa95", "comment": "Malware payload", "value": "d73042f58f89ed2847fba7716b2ae2b0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914634, "uuid": "7f4cdcee-9f88-4124-b0f6-637ad9162bef", "comment": "Malware payload", "value": "dea4d545e53b723931da1fde5e694f28d6caa3500835e860e23a687c0a0c89b6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914634, "uuid": "97b08dae-1132-4d57-9b63-bf92e808656a", "comment": "Malware payload", "value": "38260cd44efee8d66dcd2dff3d955a8fabd10e8d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914634, "uuid": "587393a6-acde-4f5b-aa02-8934b2ba2169", "comment": "Malware payload", "value": "71307d9cef025ce658d02f8c99ad8e9e524b90e702e0377b1a4fdf82bb7a71f3d14873037a5a1f907931fbae70d86b6b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914634, "uuid": "1b074fdf-faff-4a96-a3e3-5b5ca29b2fbb", "value": "T1AA33D0697A1C911DDCCA0DFC6C0E07D2EA5FCA203B6948132EC652DDB09D9F1BE85267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914634, "uuid": "6c4527f2-db60-4405-bd0e-c75a321b9aff", "value": "768:ARj36sMWccuxctBPPPFir1y43HjLLLLy1ZTJwTJwrVR+MPmOaavxrZecYePGU/34:ARk7+t7awejLLLLAZL7+MPmO9zefSqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693914634, "uuid": "ebef8cb5-c6c7-4b06-ba4d-5fb05544d6f8", "value": 50517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693914634, "uuid": "b610b5de-0c06-45aa-8742-1ef2a455abbf", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914634, "uuid": "10b15b2b-e1d0-46be-9ede-b601d6006303", "value": "fattura-non-pagata.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdd824c-4bf4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1693922499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922499, "uuid": "e1fbd910-059c-410b-9f17-b2e7548dddb1", "comment": "Malware payload (Smoke Loader)", "value": "82bcc0926c496ddfa208e129a20de424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922499, "uuid": "d5f4e24c-e742-4788-b67d-6e1aed837785", "comment": "Malware payload (Smoke Loader)", "value": "e088c9001b5aa8aefb4adc1d2d330e329421cb38207ed632f50caad5309e1d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922499, "uuid": "b3c4e5cd-1947-4e9c-a8a4-cfc49303ceab", "comment": "Malware payload (Smoke Loader)", "value": "dfc56bef10190e4f125cc5cfabe7c876a4ad6f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693922499, "uuid": "d4bb4b0f-c95e-4e59-a7df-f8d785981b96", "comment": "Malware payload (Smoke Loader)", "value": "f30dce307601edcf3da2c61f57224d65bcfa7a848b11aa7d15a251bfc8bca00ad8fd18d4dd8dd98466da06ac23e486e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922499, "uuid": "1c0dea1b-dc55-434a-b58b-d36e43a21c03", "value": "T110545AD3A2E0BC61D92687319F1EC2E8F71DB8518E486B96A3187F2F147B1B2D563310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922499, "uuid": "0811fc4a-ba36-4914-9f7d-f2d1db05ab58", "value": "cd74dd88bfa053259aaabed77401f3a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922499, "uuid": "d39305c5-ce5b-443b-9593-03b83bbf80a1", "value": "3072:uDwpmdIu9PuG1EC7LuB8obLstgBU+CNg9O0Sa/SUs0uQQh85loI9a0k87:xpaPuG1E8LuB8oXsm6+Cz54SnQQGoma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693922499, "uuid": "7233128b-a572-4746-b65a-c5866bd00f73", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693922499, "uuid": "26f35e86-3b86-47bd-8833-afc6e0043794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693922499, "uuid": "100f8a41-828f-4062-b946-5227021f7625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa2caff-4c0d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693933127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693933127, "uuid": "ec6fbf00-13d2-4701-8288-a2d2da096e8a", "comment": "Malware payload", "value": "aa6b9d741cf277c49a908db25109183a", "object_relation": "md5", "Tag": [ { "name": "chr", "colour": "#B7A11C", "exportable": true, "hide_tag": false }, { "name": "eval", "colour": "#46C825", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693933127, "uuid": "7ca2e2d1-afdd-4596-b06d-7a879d7afcf3", "comment": "Malware payload", "value": "e08a8eac37ed86419f7bd6fddc94036de9b8543275b440577282b95119282480", "object_relation": "sha256", "Tag": [ { "name": "chr", "colour": "#B7A11C", "exportable": true, "hide_tag": false }, { "name": "eval", "colour": "#46C825", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693933127, "uuid": "d6dcb4ea-8897-46ac-937a-ebdb9c734c2b", "comment": "Malware payload", "value": "dad4f72a5108076ba13357a2484e2d65ef302dae", "object_relation": "sha1", "Tag": [ { "name": "chr", "colour": "#B7A11C", "exportable": true, "hide_tag": false }, { "name": "eval", "colour": "#46C825", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693933127, "uuid": "75b0bc6f-2225-4c22-ab1e-6ca26d6b2a19", "comment": "Malware payload", "value": "5ce850389951f4038d1278582b6e368abf225b91aa821d30a5c3fb2a160e0786fc12e88e13d04acae3e6d1cc98c3b76c", "object_relation": "sha3-384", "Tag": [ { "name": "chr", "colour": "#B7A11C", "exportable": true, "hide_tag": false }, { "name": "eval", "colour": "#46C825", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693933127, "uuid": "5bef0f3f-37d3-48d6-a847-024d9d1de99e", "value": "T12992E19D54294D328757E877B04DFA754FE8002AAA740BBFE20404E45AF1B6C8C9D37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693933127, "uuid": "a1d65a1f-7ad4-4f01-b205-51d2e511c54c", "value": "384:kSC9N22xfxKTP3ko00XqeZHVE83BqjPrRHEyAfZ8mXs+FYwN4ZeapN:kSCXiTsoJJpyPVHEzxjYwN2RpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693933127, "uuid": "8dbb0fe0-f336-4abe-b839-b77af937e73a", "value": 20131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693933127, "uuid": "b51e9d3e-d5cf-4706-b363-1aee7ddffc3b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693933127, "uuid": "20f74dd2-2a17-4a10-a8a2-7e7ffd3e1869", "value": "original.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50de633b-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693891395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891395, "uuid": "3c6eb783-a42c-40c3-abe4-1c1864617c4a", "comment": "Malware payload", "value": "dec5f86e2a3a12457e0bc16c0f1f7182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891395, "uuid": "97cd1a13-8a8d-4b53-b508-8e15439b9a5b", "comment": "Malware payload", "value": "e0ce6299b508833c68ddc0ca654e483627dfdadb7a86ceea6a1b79951c1c947a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891395, "uuid": "2785f69d-3c8d-4cef-8d84-c0e9230586dd", "comment": "Malware payload", "value": "c55e685da1080a41b57412c2d100e8e33eb17fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891395, "uuid": "4d029b2c-cae4-417d-9da0-8bc7436242a0", "comment": "Malware payload", "value": "a0fd026aa3b8a26fa8ddfbbeaec0898b735e372244f27d4d62e59cae8058a5f876cd056b616e35354143ae9ad82917f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891395, "uuid": "f32d59b9-72cd-4e2e-aa30-fa165f176485", "value": "T1F0653342D1C6D837E27299B41CE9EE42923BF4962B3860155BEE1FCD1B3ED7086153A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891395, "uuid": "54018c5e-6e3a-4880-a6cf-e7ebe5fac6f8", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891395, "uuid": "20dc91d7-fb74-4ace-8294-88bedb32da90", "value": "24576:tI39dgOp7RataUAfQwxF6uaqfhr6hip5fCNikRI78khDTq1z5yFV/uN4vxt:t6dg+ua3Qw/6xqfhr6AzNku7Dpq1cuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891395, "uuid": "ec175fb6-50c7-4a05-9b40-0ebace5012e2", "value": 1442253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891395, "uuid": "902cba6a-1b1f-4692-a947-9ae49edec5e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891395, "uuid": "8fa58706-774a-499b-b969-d46bebbe5548", "value": "dec5f86e2a3a12457e0bc16c0f1f7182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f5cb87-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874068, "uuid": "94a83624-eded-4ada-a0c6-0afa9eaf34a1", "comment": "Malware payload (Mirai)", "value": "bd8b7d636acc5b98331c3733aa7cffa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874068, "uuid": "bb1f6ec3-7d0e-40ac-a700-1b852f85f342", "comment": "Malware payload (Mirai)", "value": "e159e51e8a45cb9a671dd5a901833a30235f8a91275b79240cb4c596bb62d69a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874068, "uuid": "aa79953f-f11e-49e7-a6f0-e9aedfe27a90", "comment": "Malware payload (Mirai)", "value": "8a1d07f62b453fe0da4b14bdc2446046ae7ba6ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874068, "uuid": "6adada7a-0339-41db-a611-6528f25d4d73", "comment": "Malware payload (Mirai)", "value": "0a3a79d03a515fd2b6b0069921b5b56bffd704be13b08d7d13344d019b3ce03473c4e17f1b50ee80422071e322974093", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874068, "uuid": "21e2e9c4-98ea-4c27-8e61-d1b8dd0e50c7", "value": "T198330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874068, "uuid": "59ce4a27-ddcc-4267-ab38-2dfc7d409303", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGD:r/hqaJMDg9eqK806MHdkfQX6HuCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874068, "uuid": "7f04995d-9543-4870-8812-5ba3a7f43e8e", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874068, "uuid": "7b872c07-4c27-4b88-b2d7-cedd814ce95f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874068, "uuid": "b4d7a4a9-ec02-4a0f-a983-08c27e48bcc4", "value": "bd8b7d636acc5b98331c3733aa7cffa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b10a082-4be2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693914632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914632, "uuid": "433bd94b-ab0b-46cb-bab9-7a4917b77740", "comment": "Malware payload", "value": "df4072d8b47dcfa6d90a92f10ec9501f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914632, "uuid": "f5770f7c-d41e-46b5-966b-ba3899b7c486", "comment": "Malware payload", "value": "e1f62049635a13b05a3b6015522d5eb72c1acc53ffd7395e5c2b822d7ace0d2f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914632, "uuid": "26f76e73-ea7c-495b-841c-dd1d2ed551cd", "comment": "Malware payload", "value": "bb15114e21873f9af4326575b458569318f5946d", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693914632, "uuid": "92745c0c-2058-44e9-b84c-4f20f9588b9f", "comment": "Malware payload", "value": "e7f540b78d62287fc68957531380e030fecd61b67f526507b79abf32ae5f67d36ed7f209b29176719bd403c2c5dfe482", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914632, "uuid": "3ec32124-2320-48d6-8a9a-c9c682caf4ae", "value": "T13DD37C8CA8A5F049D436EBF17B84D5D3C84F53871A444836729F5BCE1F01EAAEE47886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914632, "uuid": "ab201fad-82d6-4f68-8706-0dfe3b845a96", "value": "1536:LWKbJLgf/aDSfWh4WAaqjLLLL+Tk7+tOaw6VxkqvCyEX5SJ9Jz5CBQFhhSScZL7O:FeiSfWh4aqiTltC2CSHy7+6d9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693914632, "uuid": "e108aa58-6215-4ff7-afdf-de83e5c37210", "value": 132632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693914632, "uuid": "0869ea45-8cff-4fb3-9a40-07b24d8e1bf7", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693914632, "uuid": "28641251-4c9c-4310-8151-a8656c209d7b", "value": "Conferma di pagamento della fattura.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc7f985-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693874046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874046, "uuid": "8bd625dd-56f9-4cb3-bb17-4e10ae6efac1", "comment": "Malware payload (Mirai)", "value": "c2d3b5d2442ca7c7a2785fa83679f78b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874046, "uuid": "a453077d-8a96-48ca-bc1a-e7fae0427d6a", "comment": "Malware payload (Mirai)", "value": "e232332e4e67635046f5ae22f84252bd383fa09a47829ff4aa93076f0084aa34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874046, "uuid": "123870dc-1a1f-4a6a-8e85-ef3bc6e5bb7c", "comment": "Malware payload (Mirai)", "value": "597bc5d7e23f21bd3f9f601fc60d548b3daca0ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693874046, "uuid": "ff471235-78de-415d-b242-effa88d5bd30", "comment": "Malware payload (Mirai)", "value": "6f04bdb164901879f41c599cf05439f9211e65ece99ee2a43278da3c3d59c62136f7c842c27a38002b044e4f98c6df4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874046, "uuid": "838cc3be-869f-4f77-9a9e-5b04d38b8e35", "value": "T1A7B2C0CD65843184C98D7C7C278D4A664F6CA1D0BAED9F16E350CD98B3BEA4B3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874046, "uuid": "62e49020-ea17-4693-8a35-5dd38f85ba1d", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpXZqSWvF:4QlS07FUXqIYSXQKqupqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693874046, "uuid": "e4eb8110-9070-4f5a-9670-4772ba86cf2a", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693874046, "uuid": "6e56d4ae-8ea6-46d4-bc62-f2300bdc6a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693874046, "uuid": "9c8fc597-5b43-4c59-a32a-6140050a94fb", "value": "c2d3b5d2442ca7c7a2785fa83679f78b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b9a8d9-4bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693895428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895428, "uuid": "dfac14d8-09b3-4557-a205-aac90ff5a79c", "comment": "Malware payload (AgentTesla)", "value": "5bb7c8980a07595257e06f248af75b75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895428, "uuid": "3d2f521f-ccfd-4f84-afd3-d77c50c63c06", "comment": "Malware payload (AgentTesla)", "value": "e291ad8fe1a6aaf3d753f22e062a0ba688c772216896dfe78c2d2306d49cf346", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895428, "uuid": "9c98554f-b069-41b8-9f23-618d0c03df7c", "comment": "Malware payload (AgentTesla)", "value": "3da94e2ebd651f32891f4cfe6a5dcf13d0824612", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895428, "uuid": "1e615ca6-81aa-4278-aeff-c4387f50ec33", "comment": "Malware payload (AgentTesla)", "value": "157aa860f0a306bb226a9663461fd539528a43ee31d899c322c4f3a7de0a59653ece3d08a768769f3adf84ec58842c96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895428, "uuid": "35152af3-f59f-428d-9449-8fcd70c122e8", "value": "T15E452382DF241722F0A893F709B20159C3F1696A127BF6683DEE279653C73065E526F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895428, "uuid": "48895279-da1d-4d8a-8dfd-aeda0e016db7", "value": "12288:29/XWUt40JHDj+tRCaPaqsppFCzIeLVZ7ATszq6Wk2UHeI:e/XWUt40pj+tLPKp/CdPkYbWZyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895428, "uuid": "8e720217-ce68-4fd0-a087-d2df11c83a3a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895428, "uuid": "e126a06b-69cc-4e8f-82b8-4af7318afb27", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895428, "uuid": "1975bb85-ace8-40c3-9b56-ece12656a371", "value": "PI-MADENA__PDF.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1002cfe-4bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693895449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895449, "uuid": "8ea9a9b5-143f-4895-a7f1-a16a85e5f4d5", "comment": "Malware payload (AgentTesla)", "value": "6e404c997acc229e808998af1979d380", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895449, "uuid": "0419aa18-93ed-421e-bc8b-63a4dafda88c", "comment": "Malware payload (AgentTesla)", "value": "e3c87bb901efec0a467a4bf11d493960f47e73b24a26d4520390b393c14ccb1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895449, "uuid": "28e55f3f-887e-4c59-b909-c384f1efa268", "comment": "Malware payload (AgentTesla)", "value": "dbeedea37fa7371ca8e8ddb6e1abcb2285f14847", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895449, "uuid": "1d40cad6-bd28-4ab1-abfb-166c1be623d4", "comment": "Malware payload (AgentTesla)", "value": "2258daba64688f8b42fef6b4c07d208da149f5e79dd70359cacee30890235aa246440e92d98e524fa0bb35a4aeeca7ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895449, "uuid": "349884a1-6346-445d-bd6d-3b1ae50859a4", "value": "T13B1540F3FB442FE284C24DADB9E8D273A9D406807540B6BF7F5AA905441543AF25F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895449, "uuid": "92a47386-1d86-4c71-ba10-1a0c62b247fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895449, "uuid": "a0181000-314d-4fc0-bc0a-2949fa417ea3", "value": "12288:sf0u8YR0CVSWrFAmnVhCbSsqHuQmTwj7amiw1Xv7jHV2qILg:sf096FAecGHuFTwjJHV2qig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895449, "uuid": "9f112c59-aa88-489f-87bd-204353857b1d", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895449, "uuid": "bebf3ccd-3c05-47d9-89aa-5774663c4118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895449, "uuid": "0b7c2861-9dae-4147-a285-042583beac5c", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3976a288-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693891356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891356, "uuid": "6a3e8ce0-c63f-4705-80b1-27ab74160722", "comment": "Malware payload (RedLineStealer)", "value": "ce3e1acd04cc0b9381310809b641422d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891356, "uuid": "1b4c6757-ccbc-46bc-b485-11f8d624f4b1", "comment": "Malware payload (RedLineStealer)", "value": "e4e29bdb50bcacff016ce87ca68f26d3afe0514692197230347e6c3bb50f4a76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891356, "uuid": "7111b59c-ef3b-4c4d-ac4e-3212b0b8a669", "comment": "Malware payload (RedLineStealer)", "value": "0101bade207e2108bd68a9f8b7b43d717caac05e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891356, "uuid": "59a31f85-93d8-4497-9ea9-b690bc2d189f", "comment": "Malware payload (RedLineStealer)", "value": "97fe16712ee9a7e4bdb01b4c6fbf5b07ea2632c02eea7868f586b80bc95edfa31a6b2499451a4704f53be43551861024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891356, "uuid": "3c00b377-eabd-4d25-8e51-43486dac4cf3", "value": "T100051262B6E84033D9B61BB554F713A70F3A7DF05834816B3705A86E0D33A95B032B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891356, "uuid": "ec80bd10-1375-45ca-9ced-692313a5f8de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891356, "uuid": "886fddef-f435-4ba2-9e0d-6b1f974f6f0b", "value": "24576:pyBBwPoYJiN9tc70qOqnolNBh+OwoYrMjcpK/:c/wxJiN9tcYVqOhRYo4pK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891356, "uuid": "f6c98ac0-f48d-4278-8020-12012be73c42", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891356, "uuid": "5be4f543-1d3c-47c1-87ea-265a2c322e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891356, "uuid": "9082613c-2284-46e9-b2f3-1f534f9ba1f1", "value": "ce3e1acd04cc0b9381310809b641422d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ae69b1-4c04-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693929271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929271, "uuid": "38bd0453-5768-41cf-b13a-09b4f5d7c9ec", "comment": "Malware payload (RedLineStealer)", "value": "1170cc6fdf56f6994884afde333465aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929271, "uuid": "82fc0bf4-124e-4506-9a03-f59c7861f69c", "comment": "Malware payload (RedLineStealer)", "value": "e79fff220e5b914ac939c7db318754c1eef76a534370cf8903f7c4d6960afe58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929271, "uuid": "d40e7434-380b-4d2a-bba6-829f4e58e871", "comment": "Malware payload (RedLineStealer)", "value": "ebc7d68ca3b656bf4e68405331cd90d833d1f43c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929271, "uuid": "1c953e72-d390-4472-bef9-60edd946c43f", "comment": "Malware payload (RedLineStealer)", "value": "c258a73fbca01a1c9ccd1188d278dae22aecb98c00c1598fb4ca1f75daef1ffe98b8acd805187f6c2d0e9ffad925c50d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929271, "uuid": "02e081f9-0a71-499d-8f36-6b40dd73ef0b", "value": "T1AD355A2178859561DDE713F78AEFBB2D416CACA0373545FBC3880AEEC6245F12A325C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929271, "uuid": "64ef3357-99c7-4a37-a0a5-f725c596ada8", "value": "cc257ce195817d888112be65000338ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929271, "uuid": "32c78d4f-1bda-475f-84f8-e36d5df79669", "value": "24576:VptwGMFmBbbafjxCdEKpxPmtG085fGnjF3:1LbbafjxcUMT5fwjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693929271, "uuid": "decc12fc-a28a-4663-b250-d5fe361e8234", "value": 1137664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693929271, "uuid": "0503e6bc-6954-4246-aa1c-dd08e52a239f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929271, "uuid": "0bd5c5b7-baec-4f06-b988-4ebf7ea5013f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c24399-4bff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693927074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927074, "uuid": "8f3673d3-31aa-4a8f-bdf2-92fc1019b4b1", "comment": "Malware payload (Mirai)", "value": "d5f2781e497d498ea2acfa1d1155d850", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927074, "uuid": "afc38746-74a9-4273-bc74-5c9f4b03502b", "comment": "Malware payload (Mirai)", "value": "e8d0a81b2ada3ef2a4dcdda8e5b50d683703445b51b91664f08da23b25df6cbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927074, "uuid": "71cc192d-cd6f-4809-8be2-8e92f94a740c", "comment": "Malware payload (Mirai)", "value": "b5f76b69a1a5062d4ba91e636c434539de40a673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693927074, "uuid": "68d17444-98cc-4123-aa5b-1678cd95aafa", "comment": "Malware payload (Mirai)", "value": "8325534286614efcd6dee3a31e95aa7336cfa1928760af456db21a45abe08ea3e3f0da02e078bf15aa3c1fdb1e5e96a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927074, "uuid": "155f92f2-38a0-487e-ad20-96b878b3809b", "value": "T1BAF55B27A9A250FDC1FBC07047AF9673BD3074A95230397F12459A312F6AEA0276DBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927074, "uuid": "6a1a6e71-8eb2-4829-a071-6acaac32e7bd", "value": "49152:VVNB6utUKlqq1iRnWuIyMmRvm24TDhN2tarubrpr+sX/bkkse3Eg8S5ICJrUNqA:niKpipomRO262tcubr7zue3EgX5fJo4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693927074, "uuid": "23f46925-d771-430f-a840-726f5c87931d", "value": 3538944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693927074, "uuid": "8e8b1930-1264-453c-8a19-f77b07a88c6c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693927074, "uuid": "52d8d6b7-e682-4235-b97b-91ffe02a5ad9", "value": "e8d0a81b2ada3ef2a4dcdda8e5b50d683703445b51b91664f08da23b25df6cbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edce74ac-4c05-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693929884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929884, "uuid": "a61d7abb-ca38-434e-b1e1-31211d9ae431", "comment": "Malware payload", "value": "df2a3a7a6d893f11d96558960098e5f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929884, "uuid": "94488f95-01d0-4364-ae53-8eb3af643d41", "comment": "Malware payload", "value": "e98360ac2b2e51024e6ed3b09b43660e8932a5cfe18c7d75ca4be4f38e1b2183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929884, "uuid": "302cb795-01c3-449a-b90d-95590fa604c6", "comment": "Malware payload", "value": "2806ba5f7ad4893abc87b5b833d4729732ec0822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693929884, "uuid": "8d0681ef-75b1-4c54-8261-551eba259ca5", "comment": "Malware payload", "value": "ca64723ff0c84b70527b371282fadcc2b66018b002fe5992eed406f84256484c5143150e00daf3883cb6276866288fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929884, "uuid": "56eb6f7f-c218-46db-b19a-6c66b6f6802d", "value": "T19D542883A2D0BD61F516CF718E3EC2EB773EB8508E596796E2186F1B14791B2D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929884, "uuid": "22b48f5c-bc96-406c-96f4-aa6c672aafb6", "value": "a5090fe27b113adbae2a8696a75fe6c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929884, "uuid": "20be8635-f6b7-4fd9-9b45-2ec5c5107b57", "value": "3072:0Eib1ag5vPEfpLlG/a86ISqOIhjD5Be5OgWjJVTJHet51qa0kTU:BAEfpLlG/a/ISqBeGVyqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693929884, "uuid": "fa0f5218-12b0-4ace-8a61-6800d09ce3e7", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693929884, "uuid": "f093bd6f-f8bc-4238-a5b4-216593d47fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693929884, "uuid": "8a5e887a-a411-4c9b-8b25-379537c22448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1be699-4b8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693878315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878315, "uuid": "4bb98c3c-6dc0-453e-9de8-ec58ea632922", "comment": "Malware payload (RedLineStealer)", "value": "6e64feb1e6e3022a84dd321f1ea5676d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878315, "uuid": "0380d698-13c4-431f-b0e2-4f716b78c646", "comment": "Malware payload (RedLineStealer)", "value": "ea8195b1f980decd123cf82834c6c8a56e5df085ad1dc44b7b87774ab159a744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878315, "uuid": "ae37aa70-b33f-43f2-be09-8c3b6d055955", "comment": "Malware payload (RedLineStealer)", "value": "3a8ad52d796151382d1837bf874caaa408494025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693878315, "uuid": "ee9b636c-8542-4387-a309-e88e51e122d5", "comment": "Malware payload (RedLineStealer)", "value": "7f53e6663404e405738aba1804592b0e96086c7b20a8c685caffd752c15e91d31d3c6eaa6a89fa4a99b34cae878debe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878315, "uuid": "bc3f6a05-13bd-47b1-8e29-437067c42572", "value": "T11184022177E1C072D257427409B4C2B52E7EB8212A7BC46B375C0D7A5FB4BC06FAA396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878315, "uuid": "bf156fca-0d84-416a-ba31-0395b3aa7921", "value": "560ade47cf330e07b01243fb5f60f57b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878315, "uuid": "ec6132b6-ebce-44dc-b606-ff6f90c7d205", "value": "6144:OiOh2fkcQkIw6yQkMlPAMt2kOseN9ID9KpNwBOfJrlhgv2rbZHeXcjUlUDc:ODhTcQ1GQkMRtvO5N9qBUPhrbZ+sjUlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693878315, "uuid": "0b0e7ad2-a641-46d8-a972-18e99c06b4b8", "value": 385536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693878315, "uuid": "db9a3da1-41fb-4504-bc73-cdef614eebe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693878315, "uuid": "9f2c3361-6b3c-4bd4-8c30-0d8312bc5a3a", "value": "6e64feb1e6e3022a84dd321f1ea5676d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62e75d5-4bfd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1693926328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926328, "uuid": "b33230a7-4549-4a65-9b7d-d04a0fb847bc", "comment": "Malware payload (njrat)", "value": "14c5d317f63bc1245abf42fd39bcf801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926328, "uuid": "e7a863c0-03cf-4e2e-ae4d-467807ecedf8", "comment": "Malware payload (njrat)", "value": "eb09956cedff5df1d0ca5faa154959c6bd10e5ffadbe94676d5fccbb756d5f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926328, "uuid": "f35cecf0-9e1b-456b-b752-743bc66b8262", "comment": "Malware payload (njrat)", "value": "00ba5f43dbcaf2e8d2d43c0e563a36d0e7cc3695", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693926328, "uuid": "decf30d5-c390-47c2-8277-3861015a18ac", "comment": "Malware payload (njrat)", "value": "3e62227add9ca5e159869df4df8c983d6566c0b47c5f2a559db563b9b82d5f43f972c743c3ceb42467746368afc8ae60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926328, "uuid": "abd6b733-dd47-448f-a0e2-88979feb3196", "value": "T1B303294D7FE18168C5FD057B05B2D41207BBE04B6E23D90E8EF564AA37636C18B94AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926328, "uuid": "c995019f-21d8-4803-94b8-05d1877523d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926328, "uuid": "0c27b6b7-c0e3-4839-8051-bc72441ee627", "value": "384:YyTMUiDHblmJEpRGyEfBffXuKCYyEAnrAF+rMRTyN/0L+EcoinblneHQM3epzX0G:1TqHpR9EfBfWKClEOrM+rMRa8NuIct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693926328, "uuid": "a4cb307c-469c-4416-b555-154a285dd671", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693926328, "uuid": "c14a6ee9-278a-4245-831b-7a81b3c831d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693926328, "uuid": "ac2fed43-3e4d-4093-9c99-08e386b977a1", "value": "14c5d317f63bc1245abf42fd39bcf801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8a43eb-4b9b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693884246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884246, "uuid": "25a48fb0-4fe6-40db-9d63-5b91c8a6ecae", "comment": "Malware payload (Mirai)", "value": "62c1d93ee6884d351f33a6779dce43bf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884246, "uuid": "e1548f65-ef20-4481-8d88-ecdca7c959b4", "comment": "Malware payload (Mirai)", "value": "eb1638396243abf5d82c66b2d339f8f5ebe7435c18c4277bf7c9664efb865ca5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884246, "uuid": "54e37db9-b539-458d-8941-bc195c4693d0", "comment": "Malware payload (Mirai)", "value": "ca4c85591f4d472af510a93ea709395c4c0e9be1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693884246, "uuid": "7b841bf5-122d-41b0-ac8d-9d77c066f77a", "comment": "Malware payload (Mirai)", "value": "ce80194fcadd8f6d31ba9f85879f92d78db292c517ac9e592e9f7cd3a8a019e4e532b82f9633834cc6c9442102c2d44f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884246, "uuid": "24157a99-7948-46c5-ab56-068f23371aab", "value": "T10CD3291775D1D4FDC8E9D5B44F9AA13ADA72B02C1238B16B27C4AE272E8EE305F1D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884246, "uuid": "44072ae1-c150-4576-870d-e73585cd17bd", "value": "3072:PntX7NM6wQ4sjiuaogvXpmQXx5pMV9FFp:PntXYWCXZWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693884246, "uuid": "6d25c322-89a5-4417-a9f6-e1527906d746", "value": 131384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693884246, "uuid": "0f4f3449-be17-4c1f-ab77-d1c81f4ebdd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693884246, "uuid": "c8e3508e-82b0-4e6f-a758-7eca2d81503d", "value": "cundi.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49d5ef3-4bc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1693900179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900179, "uuid": "7167a6b8-a0d3-4e0c-a8b8-7d3f4d8d9ce5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7145e4f4bb03067bee409a80fb47c601", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900179, "uuid": "309e6378-b62a-4ff7-bd20-138103a0e688", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ebca811f9da30028f61da7eb4e4d842eec9558a0c0b9e6c172c70095cbc8f4b9", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900179, "uuid": "e5d10493-4eca-469e-9bff-92c15e94a5b1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "90a771d019541f0317b97315e11b7991e9e96b95", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693900179, "uuid": "78cbf7f8-1e2d-455e-9b5e-9c4483fc43b1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "3c4538e0c683c756a6aa45e9bc1e8481e51c2c58d2c55015add0bd4840e9bb3616463021a81d1fc067cc0a8fa32d6fd0", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900179, "uuid": "600182cc-3f66-4986-a09c-faccacf71123", "value": "T125653356BF4246B0E2A0A3B13C66E419843AFA628D31550DF39D4FEE5F231D0AD5E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900179, "uuid": "2f2711a2-91a2-4adb-bb1a-a8f32a965148", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900179, "uuid": "1d0f3590-b66f-4434-9e09-6c73b59ad30f", "value": "24576:KI39dKFcaX8dVpic++Mlm+7KqklzLbgk64GybWzt0JdAyL8KFOxqauI9O/TSAyF5:K6dKFcug9qkdLbgk6xyKJKAyL8Txqaug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693900179, "uuid": "fafa2e03-1320-4778-ae09-cb7b434471cc", "value": 1413587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693900179, "uuid": "35d7baa6-eb9a-4abc-9d3b-e4732fd1c1d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693900179, "uuid": "7dfeb94d-2067-442b-96f2-5e20e28a78f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6c8322-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693891438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891438, "uuid": "b235f4be-fb5c-47f4-af0c-4f77aba0a66e", "comment": "Malware payload (RedLineStealer)", "value": "c9b2a893f0a97d00d1e00714434e796c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891438, "uuid": "f65ab382-ef61-4fc1-b32f-3be060616fdc", "comment": "Malware payload (RedLineStealer)", "value": "ebef06cea93474ad22c962b3c42403df203f4142f0c2b2211066d17ce9b68c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891438, "uuid": "7831be2a-1981-4cc3-9497-7314203e7e2c", "comment": "Malware payload (RedLineStealer)", "value": "9a5ffb359fe4215005bd4ac73bba8ada4bb32b46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891438, "uuid": "4e9e4414-d726-4159-9bcf-019168d03f73", "comment": "Malware payload (RedLineStealer)", "value": "3fb516405e42b79d31dae662c67b578abccdb48210daf2386743eda82f75e9e0811b4eb6ee1715b0988d69e2693cbef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891438, "uuid": "f21fb93b-f0a8-46b0-b4a6-e96307dbb0a7", "value": "T1A3051201E7E9A073DCF427B025F606C31B3BBCE66D35861B2785A9074CB26A1A47573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891438, "uuid": "0ceedfff-b277-4342-a167-253922bf2efe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891438, "uuid": "79865c14-68b4-46e7-b147-b486624e2b1f", "value": "12288:NMrgy90LwMG0YZ4ZOoom/8R1X17uhHU+H4xMGTkOeV8Q15ji+K+gF0RzG8wyi:tyW3wU5/8/l7uh1Ylkb8I1i+7jw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891438, "uuid": "33b258e4-5eba-4e0e-8f7a-0f8d708ffbb7", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891438, "uuid": "501973b3-0d2d-4830-92dd-88197282e1b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891438, "uuid": "3d37a392-a41d-4a67-86c2-b066f462ce6d", "value": "c9b2a893f0a97d00d1e00714434e796c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f44103-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693910011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910011, "uuid": "2b9d43d4-9ed0-4bbe-a849-2f818cc75877", "comment": "Malware payload", "value": "1bc55db7c3c028a61c35ddc5ab80deca", "object_relation": "md5", "Tag": [ { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910011, "uuid": "84a83ed3-c9e4-4834-a741-336189856516", "comment": "Malware payload", "value": "ec4f44d55bc18a44f3c0986dfeb723b7140d7d5845cb39b15a0e958585c03805", "object_relation": "sha256", "Tag": [ { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910011, "uuid": "a37d4299-1248-494b-8c22-84d5523b4dd9", "comment": "Malware payload", "value": "b68b83f3dc71108df81cde76acc0fe56c3d12213", "object_relation": "sha1", "Tag": [ { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910011, "uuid": "21e1cf1b-d458-4974-a2a9-fb1e8ec303a6", "comment": "Malware payload", "value": "cff33f8bda7f49175c3fb29f42b95917dcff9b893846c3ed6cd13cd0c404ad9dbcd00e427010db63805e76fc6881e213", "object_relation": "sha3-384", "Tag": [ { "name": "tautvydastijunaitis-com", "colour": "#D1244C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910011, "uuid": "008a2a71-023e-430f-ba0c-c19fc5a53592", "value": "T19A026D3072208120E00D8B37FFDA958B75247D42AE94851B300EF75E49B9E0E5BB05EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910011, "uuid": "b81f0967-fabd-4492-ac3f-1c818ad7708e", "value": "12:Xm6ysNMqiNMvyc0Ke0l6eohI+KKe+KjK9zh+KlE/KlEvt+KlEvdX:Bx5yc0JQ1V2FlEClEvt1lEvdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910011, "uuid": "7586d573-b5fb-422e-9834-e795056af7b3", "value": 8590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910011, "uuid": "20a1817d-40bd-4e0b-a718-fdd1422b2cdc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910011, "uuid": "96134e38-e77e-4315-8917-39cba5eb992f", "value": "hh.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6accae8-4bbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693897982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897982, "uuid": "43e37a87-264a-4d74-8653-35eb1e1ffb46", "comment": "Malware payload", "value": "a047bfe20c52c21bc6060ff0f763c235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897982, "uuid": "069b0a98-e61e-4ec7-aa71-e69f13756afa", "comment": "Malware payload", "value": "ec67af31e0d4ca7f7b449a52468f8b206f5ac0703f5d745499b4e863c4816607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897982, "uuid": "452447c3-ab9b-4733-918b-7caa718fa252", "comment": "Malware payload", "value": "cd300c6a2c22a95b4e5f990ed32b8f429b532328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693897982, "uuid": "fab2fd69-f1dc-452d-bfae-3a1f469d2065", "comment": "Malware payload", "value": "f58485d1c54534ff58aaf75156fa16ecd17cac169f365c8bce94046f1b5c6e66d1a04371f54f0e9368ae326e96c5ee7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "instance-m73xwc-relay-screenconnect-com", "colour": "#E76876", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897982, "uuid": "116778b8-e48f-4807-897e-3d3e5c201fe3", "value": "T164E1721067E84722FEBB8F36BDF7A7421675B6688C73CB6E1454510B6C3A6048523B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897982, "uuid": "8d13fef4-7b30-4e91-a258-4c0a1965da6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897982, "uuid": "85e2b1b0-41fa-44aa-8dac-9f711a14dbf3", "value": "96:ss9WrR4eO5Ye2HO6+JlkqW4VHPmBFv9ZIeHVGGmQlOjBnhK9ZzNt:ssQR415YemvsJtCZIYV+jBhMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693897982, "uuid": "dda69fbb-b791-423f-92e1-6fe3627cb84a", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693897982, "uuid": "2fd30125-4f39-4a4b-b134-7d0859ccf8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693897982, "uuid": "f5c3be4f-3eb8-4910-8bb2-0bc552824c42", "value": "hgsuhfs.jbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d806519-4bb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693893967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893967, "uuid": "ca4dae16-2e24-4941-982d-fd7a4267f6d2", "comment": "Malware payload (AgentTesla)", "value": "a31cdab9f9a5355fce8b0c144825b5a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893967, "uuid": "d159718e-7623-4eec-a7cf-644d3a7edef1", "comment": "Malware payload (AgentTesla)", "value": "ecc7eaf66af67a95b00a9ed1030b779043987b135e2e09f506b8e668cb33c816", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893967, "uuid": "1d411889-0f22-40d1-9654-0081a1ed9868", "comment": "Malware payload (AgentTesla)", "value": "a1567427bb866779ec82e548ad192f6e794792ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893967, "uuid": "e213b714-4219-4934-86d9-4e1678f0e4f3", "comment": "Malware payload (AgentTesla)", "value": "664d3adaaae79e21926c9a259c28940c4e69c8cadbdf46553f5361cee9dcc1f30962dfb005f40c6f9b6cfb791ff758d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893967, "uuid": "94dcda38-c9b0-4804-8c4e-583e494a3cdd", "value": "T192A4232575E6E817E4A147705E69DB3A2BBCAC2429505F0753F07F2F31792D1A80EB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893967, "uuid": "89734f12-7044-4f76-8bac-e374b47931d6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893967, "uuid": "9b2c94e9-453a-40b1-ac1f-170c1391f01d", "value": "12288:2YYrlK0b3DMnqw2bB1XhlC8mvD4eFXvnDobl:2Y6lf3DMi11XnmJNnDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693893967, "uuid": "f1962718-bd08-4828-87dd-ed7957d5170b", "value": 468342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693893967, "uuid": "280b0fe8-f37c-43ec-bdf4-f330508bfedd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893967, "uuid": "edfbf3ba-ebc0-4dde-b093-3e5baed50f9b", "value": "a31cdab9f9a5355fce8b0c144825b5a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c82341-4c36-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693950724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693950724, "uuid": "883734f5-c0a7-45d4-b808-7e9f1fa66c59", "comment": "Malware payload", "value": "36dc636912c89abf0e921572e6ddf94e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693950724, "uuid": "99493e50-5fc6-4f2f-8af7-3896e2cc7fba", "comment": "Malware payload", "value": "edecbdb327a945070e5efb7cfce58089e47363e7035d45df6b1f46a0f02a091f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693950724, "uuid": "125f491c-4d43-44dc-81e5-5f402d43ec76", "comment": "Malware payload", "value": "8ae8eeb7fac562266b930ff7155922080bc199f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693950724, "uuid": "8d97780a-9551-4ea7-a03d-109dbc7fd803", "comment": "Malware payload", "value": "c97b3ffdf94049176c2e5581695e4d88bc30b28407f10ed0b0bef76c54b9200696943b324045b2e4589e12d091d15cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693950724, "uuid": "8b987b86-42bc-4941-9d46-e6f3602141f4", "value": "T1C1754FE3F7095AE1C9C30CBCA8A4D1A379D10680B9F4B27B7EE5A50541524AFF25E8F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693950724, "uuid": "6341bbc8-4007-4d1b-ad37-a998fd7e85ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693950724, "uuid": "3274e188-2aef-47ed-83de-71bcd778ef88", "value": "24576:yB9aVZ6s/kVb8e39OKgOGwK1+WKO8ppJBWL:WaVfCVcKRGwVR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693950724, "uuid": "e457b298-8c1b-4a62-9c07-11a9508a069b", "value": 1624576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693950724, "uuid": "1e96a868-5cc3-4ddf-b8d3-a15037e8d706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693950724, "uuid": "ad377fef-4374-4626-9f90-9af45dcd54d7", "value": "Invoice for Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c2f000-4bac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693891454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891454, "uuid": "a481e573-5b99-4b01-847c-078081961dd2", "comment": "Malware payload (RedLineStealer)", "value": "d380b0938e0c4d703856300e946f9750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891454, "uuid": "ff5a32e4-35d5-426a-919e-5b5a64a694ba", "comment": "Malware payload (RedLineStealer)", "value": "ee41c8051858bf19453021af2287454b30c6d3625443b6f726f82095e7e1f0ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891454, "uuid": "a84a14eb-13d5-4aed-ba52-3c4d16daccd1", "comment": "Malware payload (RedLineStealer)", "value": "f7299f56daab31749f71a5b72e44de9151cc6ab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891454, "uuid": "1a9af3c8-3026-4136-866e-e68360078b2f", "comment": "Malware payload (RedLineStealer)", "value": "c780593a9cc94e93d7b4a23cdbdeaaf00501c8480d51e5c3f876b0f45576ceb47b79568b1a1da1c212f9fbedec213c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891454, "uuid": "524a3c41-e09e-44de-b0c2-6703bb33a56d", "value": "T1013523A7B7E05061CCF22BB088BB219B163AB9B19C78515677815C590D33E88B4763BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891454, "uuid": "e9f66176-ff91-4966-a17a-8774e56fef9e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891454, "uuid": "4d290fbb-ce31-431f-8ea3-23719c971543", "value": "12288:oMr1y907nfLcq8INkfwD6WTkTRVqtzrmjkkKSAyp7Yvxe6tTYV16tgiW0HaHVC4z:tykfLwlfN0JrmjWSAyVAo6OWgKH4Czq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891454, "uuid": "55b20548-44bd-4036-89b0-e2803270ee2d", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891454, "uuid": "02df4e3c-5df9-46f9-93f3-50a17ed2271a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891454, "uuid": "d9abd20a-334f-4ee7-aeab-a50fadb779f8", "value": "d380b0938e0c4d703856300e946f9750.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a98a11-4ba9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693890165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890165, "uuid": "54406ccc-7757-4ac6-8ed7-82ecea0cb81a", "comment": "Malware payload (AgentTesla)", "value": "c18dfea43882d5559a2bd2dc6f159832", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890165, "uuid": "1ad0064e-e6bc-407c-b7e7-cdba5af093ca", "comment": "Malware payload (AgentTesla)", "value": "efcfc634c5c7f22eb1e2631e5c9b95812e218b8e949f7d49060c237ce1ce6050", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890165, "uuid": "0d9afb0b-3e8c-469e-8489-d944d8fb1ae7", "comment": "Malware payload (AgentTesla)", "value": "8172f17ec8048a8cb0bee79591612f0a92be4a9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693890165, "uuid": "0c6afd1d-e30d-4fec-8cb8-e0b15ad825cf", "comment": "Malware payload (AgentTesla)", "value": "acfbf1c88a674799a3ee4945e07f77f83c219ba844fc4babdfe240502d4f97a105f790b20c59f22efa7f870d3e7e3685", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "chi28--awelleh3-top", "colour": "#A4B0ED", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890165, "uuid": "0cc3be87-c0a2-4e8e-ad8e-db7c5c5dd866", "value": "T1C1F4333E874103CD837448F2A2B82C13914D72BE619FA66A3D95436876ADD1736DAFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890165, "uuid": "37807924-ddc0-47de-a8c7-3d33a571c796", "value": "12288:LMELE3HaappwANoXgAJ0/vcDYeEUXOj+eyVbxvNeBU0SthM:LMyMaaDwANoQA0/vcDTE5lsbxV6U0SfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693890165, "uuid": "f89cadf2-3e18-44fd-a70e-df51c2449175", "value": 752952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693890165, "uuid": "5238a46e-0a03-45fb-a18a-c409a3578686", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693890165, "uuid": "3fd46ed5-4c2e-4d17-a396-e98121cbc25f", "value": "PURCHASE ORDER .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cb4102-4bdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1693911942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911942, "uuid": "14f60854-c910-4251-81c4-2bea936bf321", "comment": "Malware payload (LummaStealer)", "value": "bd72a0c67baff28def74145713368086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911942, "uuid": "c4ccc50b-4874-4665-8bcc-dd1a0ea84e35", "comment": "Malware payload (LummaStealer)", "value": "f053d7dfa216679695b7a4956df3f2fc1aff73b5c34e54e118cf1009cc4c6465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911942, "uuid": "59f228f8-d1d7-47aa-af6c-fbe602f98a66", "comment": "Malware payload (LummaStealer)", "value": "d524a6905cc1c5714ef031d1fa1189c77580d1ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693911942, "uuid": "e4e993fe-fa61-41cf-8aed-d410deb271a8", "comment": "Malware payload (LummaStealer)", "value": "3e755fe5370da85b57ab0fc0424c4445e15d502add3cd469f5bcebf054e17dff254b17a34562a24473d46c21befcebdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911942, "uuid": "3e8117f8-57a1-4b58-9745-58a0c1c59225", "value": "T13C26BF22BA41C071F5D201B954BEEB7E493DAE204B35C1C397D43D6AD9311D32B3A7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911942, "uuid": "af3d90fe-7e75-4c60-b036-d7a9654d0df6", "value": "7ca2ada15fca9ba51b650e1414510d44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911942, "uuid": "7d38a99d-4468-4a07-9f03-b05fbe187763", "value": "98304:Lofd0pf+LYAx7iuXLm41kGK4SC+vPIrukyfo:kV0I8onCrs+vQruto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693911942, "uuid": "2e032685-c388-42f0-9432-c661331ac117", "value": 4671336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693911942, "uuid": "1ef7d006-971e-4eb3-a084-ba57f7069882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693911942, "uuid": "1bb9abf9-7f70-4854-a661-82cee7b2829b", "value": "f053d7dfa216679695b7a4956df3f2fc1aff73b5c34e54e118cf1009cc4c6465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2577e5-4bd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1693910638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910638, "uuid": "18878424-3bf4-4b46-bc04-b574f52d4abf", "comment": "Malware payload (RemcosRAT)", "value": "ef75ce18c3508b6ae35aa6d78504fd7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910638, "uuid": "9ce1bec8-fa38-405c-9714-6daa43e98515", "comment": "Malware payload (RemcosRAT)", "value": "f074628ca022b3fd4b365cce192a3a4daec86eb13bb078164e57f7b147cb813d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910638, "uuid": "f28ea65a-ad48-4a28-9f95-300019de8c3b", "comment": "Malware payload (RemcosRAT)", "value": "8d46db00ece884771aa1482058b7b4e1353de580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693910638, "uuid": "f551c7d6-c6c0-4343-b80c-807fe69e3cb3", "comment": "Malware payload (RemcosRAT)", "value": "8d485d0a7c3f503f3e71af0786ca43a939f2be16b2b56349df2a0fbbde2e861ebac4c0cddfaa5072b6db358564c5e82d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910638, "uuid": "6d682da3-4bd8-497a-ab06-e9786d12766f", "value": "T1C6D4F1C5D9C08195EC196F7121776D2993ABBE3ABDB8650E8B0C35B07BB31D34036A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910638, "uuid": "d46f8c2f-7948-4fe4-acd6-c968abbb58ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910638, "uuid": "a5c63352-8603-4a09-b5d7-0e4157d74341", "value": "12288:QYR1AbTEojMtKFgxutnwZ1fdiN2I3Oy3/Gcdzgw5eYxCu+f7FOAG:QYR6bTEoIgSxutwZ1A2I3OyO6h7Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693910638, "uuid": "9ee4b27c-b85c-4d55-b5f9-398bc4156023", "value": 610504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693910638, "uuid": "502a2126-d5a2-492b-a9a2-9b1d73c11854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693910638, "uuid": "165c55fc-1efe-4683-89d2-26c006404262", "value": "f074628ca022b3fd4b365cce192a3a4daec86eb13bb078164e57f7b147cb813d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd94868f-4bef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgnianeStealer)", "timestamp": 1693920381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920381, "uuid": "d6f61a01-05cd-4725-a0c9-bb0351dfa875", "comment": "Malware payload (AgnianeStealer)", "value": "6001560e7fcf13eb1f1f4eeaaf7799cf", "object_relation": "md5", "Tag": [ { "name": "AgnianeStealer", "colour": "#1F7C99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920381, "uuid": "44123326-234a-451f-b804-dc3ded0d2b6b", "comment": "Malware payload (AgnianeStealer)", "value": "f131ed3f634405ae488ed4164f8e3d856bb55a71764a0cbe16f42230fc3283a5", "object_relation": "sha256", "Tag": [ { "name": "AgnianeStealer", "colour": "#1F7C99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920381, "uuid": "61fedb18-9ef7-4f7c-af8d-5f928c0f9626", "comment": "Malware payload (AgnianeStealer)", "value": "569f6b1e40d83946db3594d604155bbc9240852d", "object_relation": "sha1", "Tag": [ { "name": "AgnianeStealer", "colour": "#1F7C99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693920381, "uuid": "9e779946-d89b-484b-9ee6-67e18e9a679d", "comment": "Malware payload (AgnianeStealer)", "value": "3f0ad43e059a543c816d5f378ff8517463b5ef6c1e05980fb61055f07ad800fabfcf1099240232a697a858af2f259843", "object_relation": "sha3-384", "Tag": [ { "name": "AgnianeStealer", "colour": "#1F7C99", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920381, "uuid": "330289c6-2e21-460b-b891-1ba64882dcbf", "value": "T18A348353FD612C33E92EE77313FBD67909082795112A3CA60767379C8190993AE4D8AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920381, "uuid": "ddb3e118-db88-48f4-94ed-b99e01cccdf2", "value": "42a881513039e37416778f46caf53ae1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920381, "uuid": "6b8066b7-5492-4ac7-b7bb-43b5f0156a62", "value": "3072:HwtrEMpgVttttfDKbQygut+qzTx8hmmFanM4UOYpExCO/Qzz8EZ:H+PKNDpG+qhaaM4yExCO/Qf8EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693920381, "uuid": "abd2470e-61c5-44fd-9a79-4a0202ad6330", "value": 250408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693920381, "uuid": "f1e5d4bf-0fd2-4bab-8fb1-4f8c5efc9404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693920381, "uuid": "901b5433-6188-43c3-9eac-5fd7b29a01cc", "value": "6001560e7fcf13eb1f1f4eeaaf7799cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91b0703-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693913958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913958, "uuid": "c4a87a08-6055-4b50-a6ee-7f0e156c85fe", "comment": "Malware payload (AgentTesla)", "value": "7841a51018e35e0b14d5677763ad1a28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913958, "uuid": "78a1559e-5241-4206-ab6b-9780457ecf98", "comment": "Malware payload (AgentTesla)", "value": "f280c31df409e8dd954ba6f42a2150bad54a7085db6975af17e8fa6c1eab2eb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913958, "uuid": "ea8e278a-95ed-4cdf-81db-fe26cd1c4ef8", "comment": "Malware payload (AgentTesla)", "value": "aea561099e83dfbd7a3d4a6b37477ce0e5ce91e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913958, "uuid": "0e92226a-b58a-4cd3-bcbe-e151d31e7d00", "comment": "Malware payload (AgentTesla)", "value": "7ed0475f92550b46dd6e51c5aca5248db92a61a8f7a521561c44641f2b64d4e3e57720fc288e39074d514076f1c9e932", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913958, "uuid": "a8be877f-d1e3-4fb8-a332-330c524a8299", "value": "T135D4120267EA6F17F4FAD7F511024A6043F4381BA5A0E32C5ED353E73AA0B0A9576B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913958, "uuid": "7776b2a0-2861-41ce-b741-0822eb919543", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913958, "uuid": "392cc3f9-c6b1-4601-a2cd-057c5747633d", "value": "12288:3gC0h+DJw792WejS+IXHxJkin8UFGItmqeCgKzx/J1UPbeOaa8aR0:3bS+dwhPhJZ8UFrtmvlc/AbeOaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913958, "uuid": "f00a9aaa-ae14-44ab-a9df-141a879eec6e", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913958, "uuid": "5aea3c32-1051-441d-abc0-fe4a4a224a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913958, "uuid": "c924ad33-5384-41dc-ac93-a45756c17771", "value": "rSOAAug.2023USD4625.00.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643a4774-4be0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693913762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913762, "uuid": "56cc4d1d-98e2-472e-97ca-82938881c7b8", "comment": "Malware payload", "value": "b38de62db0045fe12e4ce0b9f21ce454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913762, "uuid": "cd448451-3605-411e-92c5-fec5ffef2291", "comment": "Malware payload", "value": "f297a5fef28b7ef8d576a4067c7addebca7dfa495a92e4f1b90f9be64d7d8ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913762, "uuid": "6a92d132-8e2b-434c-87c2-7105bf898a18", "comment": "Malware payload", "value": "35958f7aeb558a0d00499abe4a332aab8429e31e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693913762, "uuid": "652c578d-800e-47c4-ae94-b47cf402c0ff", "comment": "Malware payload", "value": "b2e09883faa2fb8421814b0a7a16eda407e0f2b1e0d8dbc3622bdd98e24e75753d493d3e857aa5c174b4e177509c869a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913762, "uuid": "651a451f-1b28-4def-a450-114d39c3379b", "value": "T107251243AE96B4B1D66209331938A71D987E3D1C3EF4DA5FA79C3D6DCB311805122EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913762, "uuid": "08af7f18-9978-4c15-aa8c-7bee7a1a4913", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913762, "uuid": "e4e9bf07-868b-4427-8d86-8e3cffcba2c0", "value": "12288:ocrNS33L10QdrXz8dnSvgQ4Pby+nMZxYue3sVLvaTZ8cS8nO/2EG1wVLuUcGnsia:bNA3R5drX4d00YecVWTZfOujEL4omM9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693913762, "uuid": "990c07e9-fa30-4b24-aeac-af36a7fdcef7", "value": 1039902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693913762, "uuid": "a51e91d6-75a3-40ae-9d32-36b4736d4ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693913762, "uuid": "85444af8-dd6b-42bc-829a-6317c01b1976", "value": "ruihtder_sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d817f6ca-4c11-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693935001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935001, "uuid": "ffb68856-6c2d-4fc2-ab87-fc98ae9dfd75", "comment": "Malware payload", "value": "faf419d6c5e38267a4575a75d40d43be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935001, "uuid": "08c24b90-6700-4706-9d77-342e127eabb3", "comment": "Malware payload", "value": "f3d2fdedb285c4f5d918814ad9f64951231ca1dc8a7a2497e4c8c5a1382e961f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935001, "uuid": "87b61ab0-2fce-47a3-9687-8fc113293eb6", "comment": "Malware payload", "value": "f147964ae67fed0d0f4b88dcfb019888c28a7025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693935001, "uuid": "7c91b192-9275-420f-be0b-3e59a16b4189", "comment": "Malware payload", "value": "69dd8dc6fede16e48b8037fd59bbbac24e581f3477071db4cce109b31fb69b7a256e8a06a3c82fb1e687ceef3467d937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693935001, "uuid": "e4c3be8b-8685-4bc2-978f-2f83d275450c", "value": "T17D1531F3FB442FE285C24DACB9F8D133A8D406803551B6BB7F69A905445543AF29F8B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693935001, "uuid": "7a631971-f366-45d2-94dd-e582ecb2c9d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693935001, "uuid": "3d8b75a9-f4c3-454d-a7b8-1ac81dcf89ac", "value": "6144:dlEJxbLtQySyWv2tQySyWvN5ITH5yGhpfdPKgMWmfd78ZiUKEXeA6SeAGh0QguLs:dQkSj5XtMDdYo5pAENbWCF8JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693935001, "uuid": "dbdcedf6-a3c6-4dfc-bd3b-ae9877f5cfa0", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693935001, "uuid": "a6beccd5-190d-4ce5-a89c-86fb65fc664a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693935001, "uuid": "a873ae72-c66d-4349-b296-f1537f3fc468", "value": "SecuriteInfo.com.Trojan.PackedNET.2317.22546.10019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6172cfd-4c06-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1693930193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930193, "uuid": "078b18ae-f5c5-4cab-bd3f-aec1efc12304", "comment": "Malware payload (Amadey)", "value": "d59bc479dd19be061a94c53d6ab4cf2a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930193, "uuid": "ebbaaeb3-ebec-4bcf-b09a-d28727c397f8", "comment": "Malware payload (Amadey)", "value": "f4d948be63b2227471c652ded17c94fe97e2a271fc0b2a806ac58914ae95e3dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930193, "uuid": "6a647143-1a07-4802-8362-b296eff74835", "comment": "Malware payload (Amadey)", "value": "8e7eb0f321dab2c8f1651dad93c6645806f6259b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693930193, "uuid": "89db7a29-98b0-4d4a-bd7a-879855b2ec35", "comment": "Malware payload (Amadey)", "value": "720d16f3ffcca341428de39b372ec2158842aee6a18350d6c130c2c7dc1dd8b97d37e3bf592ae418f56d349450fa4467", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930193, "uuid": "9c45c182-a4a6-4155-b4ed-5815de83ceed", "value": "T105545A9362D0BC61D5268B718F2ED3FC371DB8518E597B96A2186F1F28790B2D363B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930193, "uuid": "ffebb59c-681d-4852-907c-322ca574edd7", "value": "a5090fe27b113adbae2a8696a75fe6c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930193, "uuid": "066083eb-ea76-4478-a17e-b6db45181134", "value": "3072:bEVj1qBv4JEsLNDmbflnXmTPQniJtLH2R9rPrHFYnkQ51Ca0kT:4lEsLNDmDlWEn0tLW3rjKXCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693930193, "uuid": "11c0964f-7f16-40dd-91c0-6a4eb6f0e484", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693930193, "uuid": "c0ffab15-481e-4c8e-a532-944258e0b269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693930193, "uuid": "3ce7cc7d-6f20-43d5-96ed-bd5ac6915147", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06873e9f-4bd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1693909739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909739, "uuid": "eb61063d-cfb2-4369-97f9-eadd8aceca78", "comment": "Malware payload (AgentTesla)", "value": "d67a20e6235e59f19531d96d2c1bfef1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909739, "uuid": "48189da1-161c-4e73-8394-2d1026bac894", "comment": "Malware payload (AgentTesla)", "value": "f5f29e2401ff3309c8c73fbb601845f92349017aff38822b467556796b2c9553", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909739, "uuid": "b321cf95-4e4f-4e0f-a820-3010b79d8f39", "comment": "Malware payload (AgentTesla)", "value": "38355784104e72a16bb579e15c84282e59ded263", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693909739, "uuid": "55dd0b5c-81a0-40f7-a649-cd0e8e07c454", "comment": "Malware payload (AgentTesla)", "value": "e2cab9a17f0426c1299b5f5e1d2689b24728e2b3451d54ab14967e83e9c49bf59144e7947e36277fc4903a6452b206af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909739, "uuid": "8c7fd4f7-462e-4b40-bcbf-305ddc605553", "value": "T1768412AB7380D0D3FE8C1232DBE1D6B4C625B5B10B6C62518CB466DB7CBB3B49B48159", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909739, "uuid": "44b3187d-2bc2-4b2b-9bea-1d9b6e512515", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909739, "uuid": "75a8238a-104c-4ad7-ba63-0612de2fadf1", "value": "6144:skN5DqDn24KC9C6t5ueohZ/C7eBHzDzFd6gzJIuoLQDWPQrYdt2Iu:VN8Dn2nCE6yh87eBfzFdtJvWQE617", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693909739, "uuid": "88ef790c-2d6e-49c5-98a5-4115760cd6c1", "value": 395024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693909739, "uuid": "51288d19-8569-4bd3-b9c6-57d7cde00ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693909739, "uuid": "4c4f0655-d304-4cfd-b9a7-256f8eca4906", "value": "QUOTATION_SEPT7FIBA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8efc2f-4bb5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1693895552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895552, "uuid": "bbecaab3-aa02-49d6-9f5c-f36519de45f6", "comment": "Malware payload (Formbook)", "value": "ddb24acd185c63512b7ec313dda4dbf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895552, "uuid": "85b7a905-7d2f-48a3-8e5f-30949b2a1f3b", "comment": "Malware payload (Formbook)", "value": "f72a8d106b976bd572e54e14f09ac3faed9c776395680f5689e412e62239409f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895552, "uuid": "3c537a79-df46-4c6d-aa7c-a8fac8c51dd5", "comment": "Malware payload (Formbook)", "value": "52e6868f871485e0f81dd3f6a3a114ecd42df0bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693895552, "uuid": "00e18651-9795-422d-a3e5-f953d3a6f36d", "comment": "Malware payload (Formbook)", "value": "a747b3d3e06bf512b857b61b575d45bbc855fa01374981642b23de7ab25dbd7714941998365ceb98cfe1e8c42ac4ba60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895552, "uuid": "84f4d1a7-0de1-457b-837b-118b9986ee89", "value": "T142056BEC325075EFC967C976CEA82C64EA5164BB830BD603902315EDAA0DA97DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895552, "uuid": "3eba1604-ba46-4b06-8303-459d48c744b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895552, "uuid": "c3fa1b1a-ef27-4bf9-bc6d-8bcb8b93207e", "value": "24576:EfOqJLYR0wH+LvvxRMgN8iIrsKyydkkDV8:ETU+DMSHIrTyuJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693895552, "uuid": "558ab66d-6d17-408a-97f3-6fcdbeea33bc", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693895552, "uuid": "3629e49f-bf74-47dc-83f8-a57d1f42ab66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693895552, "uuid": "0473346b-2729-4630-bc68-ea8476a43ab0", "value": "SecuriteInfo.com.Trojan.MSIL.AgentTesla.RCK.MTB.3191.21128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28403cdc-4b91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1693879731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879731, "uuid": "62e2e650-4046-4dd5-b51c-0c6683edb555", "comment": "Malware payload (DCRat)", "value": "0d0cbd8b11e2bbe939037e4182a7b951", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879731, "uuid": "470f58e4-ca74-4477-85db-26d247e117a4", "comment": "Malware payload (DCRat)", "value": "f7c3d2971549106f2c2aa449210164d7c5e80d3beeb867e5092b7087d3a160a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879731, "uuid": "ef7ba087-c784-4c4e-aea5-b17849b55249", "comment": "Malware payload (DCRat)", "value": "c7293dbb015713168ad96ad809328fb6190f005d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693879731, "uuid": "43b6dbdd-163c-4477-9461-4191a7fb1c82", "comment": "Malware payload (DCRat)", "value": "1070856b284889a713f7a0dc1f42b2de1b1b285f4d3258817ebd46cc44341f3321533d1f7ed1baeadba521cd1b78d434", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879731, "uuid": "ed7670df-bdf1-4a87-8597-223b99e6bcb7", "value": "T115858C017E48CA61E1191633C2AF955447B8EC122AA5E31B7DFA376E68123E33D1D7CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879731, "uuid": "92717242-3041-4b71-a357-f903af10f667", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879731, "uuid": "56247d10-c454-4278-84ef-57cd7a1eb909", "value": "24576:P2G/nvxW3WV0wot5dYjknv/MynA1A1ozB0T83/YtH5Kzjd+ipdxQ49GI:PbA3fXaovYOSOY3/+Lsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693879731, "uuid": "b8dfd45d-5777-48ad-9e8e-5a9ed08909f1", "value": 1761395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693879731, "uuid": "445c2ef8-25b7-4204-ac22-16d24e46c8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693879731, "uuid": "b53b5e2e-a656-402c-9a1e-9655023fd9fd", "value": "0d0cbd8b11e2bbe939037e4182a7b951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49119002-4bad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1693891812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891812, "uuid": "9c906fad-f8d8-44c2-83b1-21f0cd6daef5", "comment": "Malware payload (RedLineStealer)", "value": "01833eedf4254f51ca0d8a35d722beb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891812, "uuid": "5197b3e8-0b20-4182-8119-ab291be8171f", "comment": "Malware payload (RedLineStealer)", "value": "fcee00a7009dda3937a738de342ffeb20edd556116777756766c872ab67acfe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891812, "uuid": "3750be64-65a4-4bc6-8391-4a0d14fe5161", "comment": "Malware payload (RedLineStealer)", "value": "2b03b997454244477e4a7cc8ee076bf7d1f5c4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693891812, "uuid": "ef026c34-a005-4307-b250-8c6bb6736f2f", "comment": "Malware payload (RedLineStealer)", "value": "772e6660826ba2a7854a5b03fea3464b3ec95af6bbaa29719170e9faeea6520c2d634e97834be348c8a6ba06161c34fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891812, "uuid": "fe10f49a-0630-4de7-9044-5a7243f0464d", "value": "T17D949C83A9D0FC65D50187318F1EE6EC772EB8629D69AB5332D83F6B28711B2D653310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891812, "uuid": "a9923289-26bc-4617-b5c8-2383db2ab28a", "value": "2ecd68902b681b798a1768b60fb38fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891812, "uuid": "df86d4bf-d796-4ddb-8f93-3ae61780a825", "value": "12288:PNSrLyHU6PxYAoT5GEPgCjKJnBXzpcsN:F82PxBa5tTjOXzWsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693891812, "uuid": "22b2e9f7-5da0-406d-82aa-f1b078a61fb2", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693891812, "uuid": "7bf8435c-e4d8-47a6-92fe-61f075f320bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693891812, "uuid": "69dff1bd-bdcb-4b9c-94e5-15036f67f283", "value": "01833eedf4254f51ca0d8a35d722beb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e65f9b-4c28-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693944713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944713, "uuid": "5bab572f-9bb8-48e1-b8f8-2adf53d2d7f8", "comment": "Malware payload", "value": "3687b5165e6ed75e3b9ac5519b524dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944713, "uuid": "945e38c7-f0fe-4df5-b168-28e76f5922f5", "comment": "Malware payload", "value": "fcf7b7b8aba8c56f80838c357f40331f74f9d3a5ddcc0a763b8209624aa1798b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944713, "uuid": "206c75ff-8929-42e8-b1b4-e0e7ed15fe20", "comment": "Malware payload", "value": "4f17dc94f72d4e8546bd0ff53c33834070ffcb44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693944713, "uuid": "cd183fe8-55b7-495d-856f-80efe68df2fc", "comment": "Malware payload", "value": "d0fa642d5a9dabec9839555691d465f71caf3f3ad9bfd777689c11f061d93a04b809c0139f9fbb0424663a5c7554ecda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944713, "uuid": "6be0e0c5-1083-4dd2-8b45-b39e7f13b6e1", "value": "T126768D921A7494BDCFA6A07C8B0A4FD6D761F48613383DE703806DD93F9A5E0197B368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944713, "uuid": "20da3df7-ec54-4076-9192-1b3f24d6a5e1", "value": "c956bfa6c49ecf82abb9526e91192743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944713, "uuid": "89e2771a-cc27-4883-a7aa-3f1bfc3b1c08", "value": "98304:F90UVwrQkNPs/RRCTwVaNPWujTH/rn2oKensvFfjlrfOPW+A:j0UVfOk/HCUVzujTH/729ensfbGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693944713, "uuid": "213ab941-5e54-4918-a7f3-d605c7c4d947", "value": 7589888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693944713, "uuid": "16ab4113-e040-4cde-9626-283702b91e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693944713, "uuid": "67d47032-ef54-4250-8a11-c3464b9ea363", "value": "5DnrjvgvdLOx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af12d81-4b83-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693873830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873830, "uuid": "3798f6a8-6402-47b7-9cfc-da597e76182d", "comment": "Malware payload", "value": "d24fdba7858b72c54d96335f37627026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873830, "uuid": "f72d4b5b-fb94-4573-9509-3c814a82122f", "comment": "Malware payload", "value": "fd1c0ccbda97135c2ad51edd39ce16a14ea1368db932b8f394b11a005a2f750d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873830, "uuid": "3a8049c2-2107-4e22-a5d2-9a56fecf62a6", "comment": "Malware payload", "value": "e6a431c30124ccca730f5f535c5dd9807e7e6ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693873830, "uuid": "b2ddc88b-2349-44e0-ac91-06b38dac2638", "comment": "Malware payload", "value": "174e8e21650b81d6df22d613b46ec69d6c011373d7e9fbbe0a623d0e5a270827c4ea460267f05647253b4384b3c79c30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873830, "uuid": "e38fbacf-9f15-479c-9d15-2b58584ba176", "value": "T119C52302BAC4C4F3CA635A734B755B36667EBC300F6286CF53C1685C9A716C14B3AB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873830, "uuid": "d0503ea2-8be4-454f-974c-3139b5f976f8", "value": "30d1665d4c796f53fba13defcdef7cf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873830, "uuid": "4c360a8f-3ea0-4d61-9b32-f98f65a97ce7", "value": "49152:2WhlHLBfJXAE9BfqqMAQATc7HVJpfWw6IN1Ytph2d2YJvsaT57zS:2WhlrBfKEyqTA/ALI0/krdT9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693873830, "uuid": "f7940cf6-99cf-4319-ad07-fdcff9cc2946", "value": 2565494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693873830, "uuid": "c0c5d46f-ddc4-4a9d-836a-55d3fa7d792f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693873830, "uuid": "761bf2da-cebe-4798-8d06-08f6b06a2061", "value": "SecuriteInfo.com.Trojan.Ciusky.Gen.6.32137.31351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198eec9d-4b9f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1693885719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885719, "uuid": "8dc702db-5574-43ef-921b-9af8b06c35bb", "comment": "Malware payload (Mirai)", "value": "1c65e8ba826bce534f61b505ca739709", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885719, "uuid": "5f3b1ab0-44c1-4a23-8c8c-649dad639069", "comment": "Malware payload (Mirai)", "value": "fe66c850e6cc440e964f5e189c2911e5cff611a02ec21f565d721fa0d464b866", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885719, "uuid": "5a30af3b-65fa-406f-8610-00b8578f4d09", "comment": "Malware payload (Mirai)", "value": "69a5dd49fec6e2412d7618708a5cf0c2db97d621", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693885719, "uuid": "4499c919-3de9-46df-b0c0-93f6dc09b4ea", "comment": "Malware payload (Mirai)", "value": "b1768027c300c6acb6ba125beef5464db61ae473f08338a5d5e4826576b6fa426323cf0c52b95ca71ea6477cc051f3d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885719, "uuid": "07e89918-84f3-4249-b8f3-dc6ef7aede86", "value": "T1ADB2C031F268ADD6DC6BE5794CF58AC037F0A59AB48C84F66114FF46D500672C934ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885719, "uuid": "487894fc-dc04-4166-aa7e-9c51a021f35f", "value": "384:EiBp4/P4BvyXKlBovwq9tagujiZ6KxjP7bMPrFyhtQnC9eZaO1m3WZ3cKG9NTC6o:hBu/P4Z/lBZqdEKxwPRItuC9eZzk3WZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693885719, "uuid": "e8ef359c-a259-4a3c-b456-a397f4ca725d", "value": 24136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693885719, "uuid": "38c24459-af8f-4e01-87e4-bb06191e9396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693885719, "uuid": "d1ba595f-5bd8-43b2-bb2d-facb59b763ee", "value": "1c65e8ba826bce534f61b505ca739709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acdc006-4bb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693893023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893023, "uuid": "289a7fd7-a961-4528-84d1-89c02f23217a", "comment": "Malware payload (Stealc)", "value": "d52e2b17ad171aa5242abd28becca04a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893023, "uuid": "30b9aae3-db6d-4549-b645-2e273ce3870e", "comment": "Malware payload (Stealc)", "value": "fe67f1ecbe9abfe88f81ddf03e32195a00a188f1944309308ffd115d1792e343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893023, "uuid": "dcd60cc2-fedc-42b3-b80c-67dfdbd75446", "comment": "Malware payload (Stealc)", "value": "dfaec19c399ad1eb655ebebb26574c22328e6dd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693893023, "uuid": "fc4c9b68-15ae-4bc4-b26e-fb8e28f27559", "comment": "Malware payload (Stealc)", "value": "a37c3f5b7f500c46b1cf8a1b9b626f53208b9ca578d6336c316d613fbf55f959af06c971e680377c5bc6413c84918886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893023, "uuid": "61ec8972-22e7-4a68-ad8b-8bfe5c023715", "value": "T16D54268365D0FC61C51283358F2EE3EC772DB8529E19AB9736587E2B28712B2E753310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893023, "uuid": "33149903-5eb9-44aa-ab54-7a9259f337f3", "value": "2ecd68902b681b798a1768b60fb38fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893023, "uuid": "b1585d3d-4fab-46b4-8de1-2ff3c9caacca", "value": "3072:LCNmdcqdL+k9JCsZYYFW4yR0BGRbsV0n1mDy/y5x5spTLh:WNNqdLx9JHZXFW4+RbsVty/e5spT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693893023, "uuid": "021f3533-eae1-492b-ad13-e4d5a909ec5d", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693893023, "uuid": "cf0d162c-3039-4ce2-9d34-ab8198330414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693893023, "uuid": "78ff80ce-0df5-4fb1-80e7-a4927ccfb705", "value": "d52e2b17ad171aa5242abd28becca04a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e356996-4bc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1693902021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902021, "uuid": "f9a74b58-c575-4a64-ad8f-463bcf7ade9d", "comment": "Malware payload (Stealc)", "value": "3b17576498da3c209ab711888ef5c66a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902021, "uuid": "859ef9b8-928b-42e2-bdf1-b2b28cb87ac0", "comment": "Malware payload (Stealc)", "value": "ffb49a4f796a33f6bb50a4ee3c71ec12819852ec25c2e6be4220e4cf7728c5c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902021, "uuid": "f7061f6c-d938-4df0-bf49-36d84148128c", "comment": "Malware payload (Stealc)", "value": "47efe392821de995a2110494fb873db44d38c1ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693902021, "uuid": "1af28bdd-538f-414d-b0c9-387a04bc4933", "comment": "Malware payload (Stealc)", "value": "3c8d1d58f7e860c9e0b4f40ea43cd5aace04cfd55d223ce3121be4237bee3eac11a8d5e6a2da6c8ae6dedf75443aeeaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902021, "uuid": "d5a7a9f1-97ad-4c97-a4b2-820b2259d3a5", "value": "T1CC442683A5D0FF71C91343358E2DD3EC772DB8528E59AB56265B6E2B28711B2E713310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902021, "uuid": "da67f631-82c7-42b0-8c18-3e6d6551f90c", "value": "2ecd68902b681b798a1768b60fb38fc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902021, "uuid": "2366574e-92d9-4c27-ad25-d0c1d13d15be", "value": "3072:QCNM8HvELjBE9/LwZX6tuwI3eMangL28wX5QaW/GuzkRo5xNMspTL:jNJvELNE9T0XYu33eDfJQ/euzDNMspT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693902021, "uuid": "bfe26888-7920-4d68-ae7b-2a8274d94568", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693902021, "uuid": "2f7b543f-0dc1-4144-a36c-064e5dc30a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693902021, "uuid": "79c8608b-9585-4f64-95ee-7c0a4313bf18", "value": "3b17576498da3c209ab711888ef5c66a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4367c0-4c2b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1693945826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945826, "uuid": "363b95ef-9d9e-4823-96a7-36acdb9f2cae", "comment": "Malware payload", "value": "91ddaf1628da8f0c1d532cd217a7f26d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945826, "uuid": "8c632822-69e0-42d0-8129-0a320c19e026", "comment": "Malware payload", "value": "ffbad73a1985b3c26c98579c62c74496e9f76a083e7dc4d2103258f03fddaed5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945826, "uuid": "7c20e1f3-6bf0-4a01-b5c3-acd339918ee6", "comment": "Malware payload", "value": "7b067d8c1949ae7320f3e6ed48c478ed2b2b6bb6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1693945826, "uuid": "9b75521d-429d-4f7a-83cb-4028624965f8", "comment": "Malware payload", "value": "ca82e39e2c234e65a5bfb638c4a951e8ab9fa4792932367c16635e681bb0afb569da666fdafa418d26f661a345690281", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945826, "uuid": "5c1a8de1-9a5a-4741-bf2f-17d5539eb0c3", "value": "T10095BFF876047DE6266F576BCA96ACDD03A617239ACBA4CD8064B7C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945826, "uuid": "c06ab7e5-a16d-4f39-a050-33d0c81abf59", "value": "24576:E+hZ1VgUJNMOdzvrmrjGBCiaScLUT284cZUUQxfbgbvEEQDPd90Exv9ePlrcnOaM:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1693945826, "uuid": "7f6bd945-52d4-4152-a8ff-4a491c0bee11", "value": 1962913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1693945826, "uuid": "20e0e637-e8ff-43b3-a930-2308badd64f8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1693945826, "uuid": "f0862f22-8f12-44f3-8371-c6a533b97282", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.30330.27062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }