{ "Event": { "published": true, "date": "2023-05-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-01", "timestamp": 1682985781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f73e9542-a59d-49c2-989d-7d3480d8a4e5", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bebbcfb-e805-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682934603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934603, "uuid": "288d7e1a-1cb1-4b5c-8889-6d5c14439dd3", "comment": "Malware payload (Mirai)", "value": "0b01a77e5cbd3e573c68ebbeea78c613", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934603, "uuid": "adaf0dcd-dd48-461a-b777-c8f927cbfcac", "comment": "Malware payload (Mirai)", "value": "00ed53cef3499c5947e3b387dee128fa87927e9ed87d997ab1cb2e4ee5b9aa69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934603, "uuid": "94738227-3909-4598-be1c-d583a4db7be6", "comment": "Malware payload (Mirai)", "value": "a051da0fb9a61ec5cff51cf4aee2fd2fc5c24b22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934603, "uuid": "e47c02d3-7d3d-47ce-bcc1-2cdbfcefe25d", "comment": "Malware payload (Mirai)", "value": "82eafa56ec531928d85ed01b06ab9eee3a2d0b4f5175e9c8fea522470b3f194f98c41e6d43e364f3f412a1a9f9ce84e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934603, "uuid": "d9ab898e-69af-4d4f-9bff-e428f738fe56", "value": "T16D33F212E2721F72ACB88877E5A5014669C987BC60CAF7738248CADC4962F4BF05E4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934603, "uuid": "bbbd6fe8-925c-407c-8bf8-e766f29337cf", "value": "1536:bOIlMtSFSIhqUXKpdhi41Hf/ZVxLv8WHE:bOmMoBlapbief/ZrLFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682934603, "uuid": "659f0244-64e1-45c6-914a-146b56c27a0b", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682934603, "uuid": "f36658eb-f8ef-4784-a03a-1858c99dabc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934603, "uuid": "174715ce-c2da-4ae4-b3b4-038636ddc5d3", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ec0dab-e84d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682965329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682965329, "uuid": "e77862f0-ca76-47ce-ab76-823fe7de9857", "comment": "Malware payload (Formbook)", "value": "5a12ebf209b6d0827f172a121b4150d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682965329, "uuid": "a366a545-3de1-49a6-adf1-b93b0e3d86b1", "comment": "Malware payload (Formbook)", "value": "018c0b80b1914e2cbaf2de5b0e41a86e391fa88187fed25346adbec1eb5e3c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682965329, "uuid": "46167843-ce00-43c5-893a-9ab97a6feda6", "comment": "Malware payload (Formbook)", "value": "0af9e9f0dbab8abd979f48dc69992affa2003842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682965329, "uuid": "35d1053f-e283-4380-b529-957671bfabeb", "comment": "Malware payload (Formbook)", "value": "76884d8deb8ef7184c0d92880533efc3a0cc3236a0e06f306482ae262a254d7f0e9e5447b4b00a7062ecf52484c95022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682965329, "uuid": "15ed796c-c312-4f6c-a16d-ce3b1f4939fa", "value": "T11AE4CF4162A4CF6BF939CBF04464FA4423F2B87B54E5D2290EFA70C5D9B6F010E6496B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682965329, "uuid": "1746fc9b-2386-405d-aff9-36179579e02e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682965329, "uuid": "d9c1c02d-012b-4d3a-8c10-2ba8e1a699c6", "value": "12288:ya2iNvy7i4/x0w8+/GVdNyDxRT9dg4VGM+A4neSPmDTKKzy4rGn:/1ty7MBNyDX9ZG9AOeS+qKzymy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682965329, "uuid": "427bcbfd-ea12-4ceb-8a63-19ec5b9198bc", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682965329, "uuid": "7a909c16-a39b-4f06-a750-b589577047c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682965329, "uuid": "b27213bf-4b2c-47ae-9a7d-4606f001daf2", "value": "OVERDUE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509568a5-e816-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682941805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "a1e1ee06-35d1-4f01-8dd9-790127281b07", "comment": "Malware payload (Mirai)", "value": "91e737517e8235971e8c985971d57d0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "1ba66071-9c3b-47b6-a774-18033de7feec", "comment": "Malware payload (Mirai)", "value": "0a9349ddbaab4ff17a0a20fcc82ddcca680b866706a7b4650c69f1112bde17dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "83d719fa-0bc0-498b-99f7-391aeff46329", "comment": "Malware payload (Mirai)", "value": "9d2c16ac20ea674e0d429d60551e113a7a832335", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "1705d270-0f79-419c-a383-48e3ded75126", "comment": "Malware payload (Mirai)", "value": "6e9415b5d2ae19ee6424984eff01b57726be703dbabc5ddbf8bfee36d2d4ce31e84f72daceb196b355e0777397a38a0c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941805, "uuid": "9d19a5b8-96a3-4a4a-a908-774f9a156f38", "value": "T1CA230271890E8EF124303C76DB95979376F12AB1C6673013D6290A3C2FB57131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941805, "uuid": "23b67f4d-46e1-494c-827e-fb9380e1bbd3", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3Cj9q3UELbUXfi6nVMQHI4vcGpvt:DECFd+A6YHAx9LRQZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941805, "uuid": "2a8cbe87-e349-4f2c-8052-dec48ea0efb2", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941805, "uuid": "a139e1d8-881c-40ee-bdd9-5fb1138593d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941805, "uuid": "0a08715d-11ee-4631-85b9-f31d3c5811de", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860b99aa-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972819, "uuid": "55ae16cf-5d7b-4580-9046-1c7441de4dac", "comment": "Malware payload", "value": "3a2d107d12bdf8cddd677ebf008c8a14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972819, "uuid": "913833b9-3566-46dd-b7d9-a0928529431a", "comment": "Malware payload", "value": "0ad39d35ba9dcff65fe51329677acc9e8fe2f08e9e48e15361a132bd79d5acdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972819, "uuid": "ac4779d7-4f7a-4ef7-b524-7a02203ba155", "comment": "Malware payload", "value": "05d6b013583b8612a245ca36280d0dc5f5e7c2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972819, "uuid": "33e6c30e-faeb-45ba-be59-1f1877dbd210", "comment": "Malware payload", "value": "a9f02399617d7db75a3e9fbbf249a6a392bc750d9398bfca0c032bd408f1e7876a1d7c8e632f246d4c3619f2b14e2f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972819, "uuid": "ae877934-dc4d-4585-b1d6-a8483059adb5", "value": "T188931957FB46C6F2D40153B168B89F2B527BEC600B24ABD3E2D49F6B1DE12C24C3255A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972819, "uuid": "a73191d1-8211-47ef-8ac4-f713cddfc646", "value": "0db234c8cab614966240dd6a46dbf425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972819, "uuid": "df2ef189-e7a1-4314-a7eb-5f7c2fba125c", "value": "1536:q380Gi8scHhZEZ7HY+LNKdJ2221LpQNpHGPOoG0W9fonq+OeakVxX4:0GiTaZEZLVxKdoRbOoGVpmq+Oe3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972819, "uuid": "ad687c46-580c-42cc-8273-6ec9d3775511", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972819, "uuid": "7ef037cb-0aa6-4793-b2c8-dc56524bb059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972819, "uuid": "288f8378-6f34-42e6-bb64-ad6aaa365f69", "value": "SecuriteInfo.com.Trojan.GenericKD.46999749.27754.1345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8131d0-e7ee-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682924914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924914, "uuid": "01b0a67f-3226-4036-80f9-ba29ec0a4405", "comment": "Malware payload (AgentTesla)", "value": "e316549b7e09468e6b553e57400c376c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924914, "uuid": "8b4aa8a0-d136-401d-94ee-cac4c27317af", "comment": "Malware payload (AgentTesla)", "value": "0b9c0aad29e0956909add588b58561a539d44f02eb3a0aba1aa8f6978a159581", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924914, "uuid": "7ebac76f-7766-449f-b78a-f7cfc7b1cb40", "comment": "Malware payload (AgentTesla)", "value": "3df727d055704daac728a18e3aa12870a027e1a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924914, "uuid": "70c7e71c-9c38-41c7-ba4d-13ea508aeaa0", "comment": "Malware payload (AgentTesla)", "value": "c1cef3ab92a0688d50ea2fe255f451910581f4b72985356e9346938c3b05f30734e27692be4dbbb2a2a700996dd7d0d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924914, "uuid": "f8d64e7f-0d14-4a07-88b0-218f3f363139", "value": "T117D287C67A11E830516A5A16FAE226F49CCB479717CE9C3F578876A93B87B2405F303C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924914, "uuid": "60170134-8dae-4c5d-9fea-76c608e4c655", "value": "768:7tTiPbVsipXTipXjaVQKRKQr7lqt54joc3yXyalJHP4:JTiPbVsipXTipXjzKrrZq2J5kv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682924914, "uuid": "2cbd8b50-4751-4530-a04d-3c59ff5703c7", "value": 30817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682924914, "uuid": "5206ae30-48f4-481e-a970-49f88cfa6d08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924914, "uuid": "1fcb2d05-5d43-4f6a-a93f-800cfd0d3e4a", "value": "INVOICE TX 3931 2023 LO.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c8bcb4-e850-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682966837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966837, "uuid": "06b1fc2e-7f2f-4fbc-9b73-39ce2c3474ae", "comment": "Malware payload", "value": "1fff3cab02dc01191b69c49289685a5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966837, "uuid": "bb89c6e2-a207-46fb-af3a-1cd79f76a3a4", "comment": "Malware payload", "value": "0c60fafaf1c7b0309eac08f4e87058a3ab17bbfd1f856275cce8209473367e51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966837, "uuid": "40a67ac7-cca7-45ec-afd2-f39c03cd6aa1", "comment": "Malware payload", "value": "a45f8f731e9c477c7ed0f9e06898c52856289555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966837, "uuid": "92b7bb39-8b0a-4945-a9a7-060df7f4326d", "comment": "Malware payload", "value": "c1d0481b707d86f4d8988bb339a353f108d816cddc7576ba2925d39b8b6c03f747d6d60f1224235c47d0d699088a058f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966837, "uuid": "cdfcb30f-8dbb-4903-8d5c-b7979da3d08b", "value": "T13964F95382E23D44EA2A8B729F1FC6FC7A8DF2509E493779111A9B1F49B01B3D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966837, "uuid": "6cb0aa82-17eb-48d2-8c0b-46fec8d55de5", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966837, "uuid": "df322f0d-1729-40ab-9545-c95f8f030067", "value": "3072:TuV7BHOpU2RUP0UcqhE9QTTxEKBAzGa5Uf5z5DT7L2hd+uH:yV7BHf2IBL9B0PO532v+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682966837, "uuid": "1ae68f8b-8dc9-48cb-a3c0-ce243d31a07c", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682966837, "uuid": "3b589888-7173-415a-8e6e-e511c20b3af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966837, "uuid": "6cc9f1d3-2c20-4e82-af97-ac452d3a1605", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cfdf99-e827-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682949166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949166, "uuid": "dd9e93a1-2f44-4577-964f-c2da8498f255", "comment": "Malware payload", "value": "b82a923528d8b364332dccf1b3a8b7e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949166, "uuid": "474e4e55-4431-4cbb-acfd-cc48f4429d0c", "comment": "Malware payload", "value": "0cac5485e07dcc6d2d2545695811994d4ad4d8dc636d1ae010825fedf7db15c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949166, "uuid": "cb0bdfe7-5284-4fc4-9cf2-f9b9c21a43d9", "comment": "Malware payload", "value": "ef636800595d048973c5075ea18922ba5fdd20bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949166, "uuid": "5d6212c9-f421-42d8-b1cf-b9d9dcac229f", "comment": "Malware payload", "value": "a6705871038d354821e6f0788558ac908d12027680f8c8c3303e5616ded7852c7c1f7bc079819ba8d892d0c979ea7b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949166, "uuid": "72a2873b-281d-4a82-a981-7388edd5b47d", "value": "T15D3633BB920326B9AA10DF7AB9630850B2CD40917BE514360DDFCEDFCA37A51DC39949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949166, "uuid": "9c317015-780e-416c-88b3-a55bf7b4fef3", "value": "98304:z/P59auGdS7Na5DNcPSN4ILzRHYqQJBmAumVdDjLDZla4ggJZndVYhu5Ni0Ri7ML:l9B4S7Na5DKZwVuJB5umVdDHDe3gTd4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682949166, "uuid": "a3d09306-73e3-4c79-918b-1ee09509618c", "value": 5053836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682949166, "uuid": "e2427282-8ff8-4152-9f2b-cee3999c4b68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949166, "uuid": "ac191ca7-cc1f-4fe7-8203-6aa4319f97db", "value": "spirit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c71d7c-e7f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682928773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928773, "uuid": "76bff1f4-9a6f-4531-af3e-ddcb74210736", "comment": "Malware payload (Mirai)", "value": "98d74ca0175e352db484cf09b988c647", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928773, "uuid": "cdb484bd-3f13-4e61-924e-881b36fe3725", "comment": "Malware payload (Mirai)", "value": "0d5e9994865a5d7bb2229a4129a0b62264c0b9418a8171aeef60c67e281327c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928773, "uuid": "d496215a-f4bc-4f9c-bf74-d3961241cab0", "comment": "Malware payload (Mirai)", "value": "33ce4226e88bb6b79dcee22e5731dfe0140339ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928773, "uuid": "5bc499f9-6306-4802-8388-6162ad919f98", "comment": "Malware payload (Mirai)", "value": "4b779d1696d7b22e88f57b40db79ab5c4a1e7ecec942e14ee0ff32fb7b1e1e7f435bed7e18c4b7df696b5297017ac850", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928773, "uuid": "f3cafddf-869d-4825-b37e-239f47c695df", "value": "T14D63830ABF654FB7EC6FCC3749A91746258C641A21A93B397E34D828F24B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928773, "uuid": "7b256417-192e-4574-8814-d7ddd9f4cb29", "value": "768:I+xGiJEEYlDIR99UEhLin8sSCVc55AexeAkejzxoNxpkkd5zXirCMsnqU6:I+xGiJxYlkBo8kVc4YdkEz/eFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928773, "uuid": "6a9a4e2c-4f11-43a2-941f-41abbe6f8ccc", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928773, "uuid": "2650a876-c61a-4c62-afcf-2578fbb9c4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928773, "uuid": "3c72746b-695e-4d86-89a1-51d2b0ba0ed7", "value": "98d74ca0175e352db484cf09b988c647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18320656-e832-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682953737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953737, "uuid": "3be36416-9c57-49c1-bdd7-4d2cff80e4ba", "comment": "Malware payload (GCleaner)", "value": "d3ab6b9bc97019f87ddf791c4c916503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953737, "uuid": "9bc0c116-6d53-4738-a491-7b10fbf3db6b", "comment": "Malware payload (GCleaner)", "value": "121a989787cc300ec5239c8e4da3823e38d302604f0b14ccb1c560294b33f462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953737, "uuid": "74bd4bce-c3f9-4dcf-80d0-f868969d0e02", "comment": "Malware payload (GCleaner)", "value": "2619f0c95eaadf24dc3485073023920faf9a0ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953737, "uuid": "de53d37e-01d5-495f-80c7-ab8b40a4f437", "comment": "Malware payload (GCleaner)", "value": "cfde99e9aed8d590d39f53014396b188a3fc0402ee2e0e31eb9b1463823ad18f4fa8ecb60102bb7ef3582c11cddc4740", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953737, "uuid": "4631e43a-2748-437f-b66a-9642f0d2efe9", "value": "T15AC533405EE2C1F9E867DE325D4D8010A2347A13FCE9E0B59A686D6FBB3D5E0E4142DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953737, "uuid": "2df56a15-dccb-4215-982a-72d9a68bc218", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953737, "uuid": "770645ee-0746-4a97-afa9-d5c7fa9cf4f1", "value": "49152:gUhI7KpEJ43YHWboJcg1Qyp9yGXUhouP5MCrHHKUReja9GYc6csC8N2rVAG5ca:gV+pg430pyV897CouRTrHHKMe+92jHr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682953737, "uuid": "ad95d0ec-b599-4a6f-8a20-895cf20dc620", "value": 2670178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682953737, "uuid": "872c77f1-44ef-4753-88bd-418a0dfa6a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953737, "uuid": "652003e4-1ef7-4532-bb68-8060c5565b6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0214c79-e837-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1682956219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956219, "uuid": "dd5ae8e9-453f-4bb2-bfbe-9779f22f88ff", "comment": "Malware payload (AZORult)", "value": "333d2be08b5f29bb4a43de237a8ed995", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956219, "uuid": "a4c31bf7-e2fd-447f-948c-9b19b2d76b07", "comment": "Malware payload (AZORult)", "value": "12d3ec70f3a079ae0216ee7b56722e2369eb664de0036e1422cbf6c3e159d324", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956219, "uuid": "b365e478-c223-4257-80ce-c8c93a931417", "comment": "Malware payload (AZORult)", "value": "2fa842623721da69e2db608e81249d3c8bdc545f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956219, "uuid": "5fb1924e-0047-43d6-a0a7-5c4d1f3d7107", "comment": "Malware payload (AZORult)", "value": "b1b4b7370c1a6a2c741908bff11de106ae980b3b640fdf1049aa5bde4bde7cb6a1777162dee292404545f5de6b73c29f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956219, "uuid": "f564ddf0-e91a-49c1-869b-c30ceb0c8fc7", "value": "T16065233966818677C1630E36854BD2B6B63AF6044B7919CFB6CD0D3C4E3339A1E742DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956219, "uuid": "5812924c-0e7d-491d-9af8-8d7df2df7f49", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956219, "uuid": "779a609b-0a3f-44a1-8fde-6eaa9179be0e", "value": "24576:pAT8QE+k+7jcblaqMjiNsZGXvCYmYrg630iDVpDLOJ7C4Ey7ZJK7KhbaYmVU2:pAI+ObljMeGZGXKYmA0iJpDL4C4ltaDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682956219, "uuid": "f7bac9b7-c1cf-4733-b131-920a5fe6c200", "value": 1471947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682956219, "uuid": "5d179a14-5852-4f86-b95c-8730a25ab170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956219, "uuid": "e6850e2d-8ab8-4cad-abd2-5a7033d52cbe", "value": "12D3EC70F3A079AE0216EE7B56722E2369EB664DE0036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95edaf4-e7ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682923056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923056, "uuid": "a133aea0-b404-4f96-80f4-51be671ef25c", "comment": "Malware payload (AgentTesla)", "value": "4d411b68dfa16022bbad3d8bb5b93d2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923056, "uuid": "7da6b937-b50c-4b84-922f-1a5ef548ff1e", "comment": "Malware payload (AgentTesla)", "value": "146107edad390dc754e6b89cf8dff9669f3958dba1d1c5fe182c4c1af33d5fa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923056, "uuid": "26e0719b-4afd-4f9b-ab79-9f138e215be6", "comment": "Malware payload (AgentTesla)", "value": "3b35ccf05eda703652e764031fe294962d838604", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923056, "uuid": "f9fc5d92-fdb3-47cb-b487-1b2d0743f5c9", "comment": "Malware payload (AgentTesla)", "value": "bf8c733994ff2f673797af7d63d1fb321901b4f6af0a47a32b82c1a88c8adbbda14c769d7e2baf210274161270ebd395", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923056, "uuid": "c667ab23-2fc5-461f-816d-08b3b50b8ad3", "value": "T1BFD49D63F135CADFED7137A5C15DE7967E60E452E050F0A07E0A20C8DAA97E21E8C17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923056, "uuid": "5ac284cb-c30c-4ef5-91c0-0541725e6c30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923056, "uuid": "b8709f59-9c89-46c2-ad94-afe682225b94", "value": "12288:MwatfMyYEVfQk1Zxp/BC8Rz7GpfXmPxz9iO6/yBX5ay:xyYE1HtRz7GpAZzcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682923056, "uuid": "32a99662-186d-4ede-a84a-76851a8598cd", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682923056, "uuid": "d5d5e32a-ca2a-45b6-9276-de6ca62ac4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923056, "uuid": "e1a277b1-cdd9-4d2c-87e2-da4109408988", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e002c50a-e804-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682934315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934315, "uuid": "889dc26d-6e26-47fe-9c2d-c5e6f321f644", "comment": "Malware payload (AgentTesla)", "value": "fb866565820e451e791695f45df14858", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934315, "uuid": "8da812c3-d337-4bb4-acfa-df26a39a5453", "comment": "Malware payload (AgentTesla)", "value": "14a69b15aa430be2251215742e97972393b529833bdf771c0a4ca67b63bd999a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934315, "uuid": "e9d97355-d325-47c8-a870-8aed374e8d91", "comment": "Malware payload (AgentTesla)", "value": "f51527bb5d42c732516acd783654d745cca4e747", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934315, "uuid": "e7c0bfa9-cd22-4dbb-8a1e-8e5576862f26", "comment": "Malware payload (AgentTesla)", "value": "ee78570353725c6bceb9667b5244abdee7c376e6b174346f5c8711ecdba8f8eb4ac68088891b40f20e96c98a074c39cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934315, "uuid": "28c8da06-40be-49ea-87b5-7f8427cd22f9", "value": "T18F05D67C2578E96FC17AC5668AD4CC67F320906B3306CAE6AC9303594709B52B9C31BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934315, "uuid": "bc66fa28-4a3f-430c-a729-e3dd41162f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934315, "uuid": "ffc5ec30-8732-4a18-b1e7-f63d62d56085", "value": "12288:mb1tlZtY9CHZy4P6j+XHkqVn9TkNsZTzjOHOL7TZid:mNPY9CdPrxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682934315, "uuid": "1112e250-3fa8-4e14-b377-79d549d10e17", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682934315, "uuid": "1b32f314-1408-4f88-a7fa-744140000eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934315, "uuid": "3b5d7da8-4e12-4dbf-94bb-2eacd98eac6a", "value": "Supplier Information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615b70f9-e7f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682926801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926801, "uuid": "9eaa1ab5-0de9-4142-a41c-19e622187ab4", "comment": "Malware payload (AveMariaRAT)", "value": "492a35a4ed42f5d78888c5155f1537f0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926801, "uuid": "e4b17e53-3e81-46ac-8366-903062573aa6", "comment": "Malware payload (AveMariaRAT)", "value": "16068d3487f34999ff4eb45718a7259df6c056ea00c04a1bf46ce7c5a7d59557", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926801, "uuid": "c9dea910-70c1-4e54-be09-08272419895f", "comment": "Malware payload (AveMariaRAT)", "value": "e0ffbfcee65436e492bbfd275af3ebb6a9353b88", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926801, "uuid": "edaf748c-7489-4fe5-81e1-43bb544c2f58", "comment": "Malware payload (AveMariaRAT)", "value": "3b36f828ae6c45d486c886e4999f836076c52aa4a457b27e8c9ee7ce57fa60bbd7da564643dc7db96bd0b8de4187b2d1", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926801, "uuid": "4e2762fe-abb7-4232-86eb-fec6ec3676b9", "value": "T12245593CA9EE49E7D165F1B1CFBA8865F5A3C55372528939A5DB02484702EC336C02BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926801, "uuid": "f428f9f5-2511-4e4a-ac0d-7eaa0d3b83e0", "value": "6144:LDAaeuiNlzpPMNFWi4kpOFx+SulfPI5w5Tt5ElxPUWVR7yy4CBN:LkaeuiNltPBkpdS0gfx7yy4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682926801, "uuid": "d20c17ec-f066-4773-98e3-4faaf44dec15", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682926801, "uuid": "dbcfd140-6aa2-4fc8-bd7a-1bf44139183e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926801, "uuid": "ed111d82-0c02-4f99-bee0-916bc316c86f", "value": "609-26-04-23.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7238e2e7-e854-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682968490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968490, "uuid": "0be8d515-aea6-4922-83be-eebe54f7e6a9", "comment": "Malware payload", "value": "79e674ac89a2c699011c3972aad98e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968490, "uuid": "acdef0bd-1723-4a5d-a516-3d41c04167e2", "comment": "Malware payload", "value": "17ce5e353ef1009c35cde80c984fbd89f78d7a3d0ee1d8aef6db69622452bd38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968490, "uuid": "1faf9438-7ba1-497c-9790-c7dc6164b308", "comment": "Malware payload", "value": "ae7331e4f5f33b45032079b1df5ac95a42ecf597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968490, "uuid": "d2349018-8d66-4e7b-ad2c-ddc0a493e3fd", "comment": "Malware payload", "value": "bde8d391eb3db33eb9ca3c37bbbfc31544695ffb60e958bb85fefad4da43d45a980a49c44f498db9afdbad413ed0d637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968490, "uuid": "49e76533-09ba-4a38-a0ff-8f9a5a6934bf", "value": "T182051217A6D88933E9B617B049F217E30A38FCA26A3482E75348664F59B32D1DD31337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968490, "uuid": "bd633f9e-5984-4e9e-8c80-58275f98bcab", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968490, "uuid": "8cd2a0ce-c75b-44fc-9aab-0f6206bd57a7", "value": "12288:3y90gmtxe4IuPFe9HgGCLuMwBCx2dH+g7hbenLOKr3s501Mk:3yUptNe9HPCKMwB9+gVbenNtMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682968490, "uuid": "7e148623-80f7-43c5-be5e-44d7f061e2d5", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682968490, "uuid": "ba98f51c-cc80-40aa-97f2-1360d60c75ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968490, "uuid": "e4c41e2a-f286-48f0-aac3-997c160d178f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93512bc3-e837-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682956091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956091, "uuid": "f7896e1c-29bb-4c2c-bab0-eeded97f7ab6", "comment": "Malware payload (DCRat)", "value": "a6960aa33a466e0a7bcef7fc916217ba", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956091, "uuid": "a6fcf0e4-e32f-4ad1-8cf7-6a3c2f61c588", "comment": "Malware payload (DCRat)", "value": "17dd159d10d3a8577439e36480e9f6c90de7e964eea801181f8caba8a2f98b5a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956091, "uuid": "64284e15-6d86-4c64-a9fa-6faaf07c46aa", "comment": "Malware payload (DCRat)", "value": "18f40b250023d33a07be00fa3ce08c6e3a6c9533", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956091, "uuid": "eb689ad7-8374-45b1-b6d7-1f3adb6c7575", "comment": "Malware payload (DCRat)", "value": "1a50fd1777fbc4b8ccc2b154e225af16c60429f528867eb0332b5b6e73f3452c3f8fb7a6cd7e04ad6ecd38f4a584b539", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956091, "uuid": "b9a8ad38-16c3-460e-87c7-56d3e379c420", "value": "T1D925C039067D5737D17AC3B98AD04413B3E0E85BB621ED996CD603E60753A863AD323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956091, "uuid": "32f8aee1-941c-487e-a573-c62e82b7aa2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956091, "uuid": "6702dd97-1298-4800-a59d-8181fb4f6949", "value": "24576:QOuezNitWoK+OkfqJBner4kcUbZ58CWgj/YtgstNJ:JnNQW1ZS2UcU59/Ytgst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682956091, "uuid": "b4133890-c6a7-4e0c-86fc-c0ff07dabcfa", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682956091, "uuid": "464b7667-d27a-4b03-81a2-f0fc238a1365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956091, "uuid": "52a96430-c5f6-4de2-a072-e3d961e881e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282aa181-e812-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682940019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940019, "uuid": "749823f6-c719-4275-a2dd-86b622981f3e", "comment": "Malware payload (Loki)", "value": "823b97dcde9f11c8b30ebe746cf0840a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940019, "uuid": "cf4b9340-4c03-455f-a84a-a7f16777ed55", "comment": "Malware payload (Loki)", "value": "18186678890d761ad89242a8a3b30f85afb41455b05b589d27dad9e188021e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940019, "uuid": "104e0d10-07e0-4da9-a341-e4337f30ae9b", "comment": "Malware payload (Loki)", "value": "d02973d34f0427a53ef771492a1bf9a336733b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940019, "uuid": "943b9352-4dcd-4a29-b708-d82342313855", "comment": "Malware payload (Loki)", "value": "5c948da25b19bce8d0b2dc560cd31506816ad4ad218f79fe9249b12c846cfba792592e9814ba4ddbb0c55ac5dfcda39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940019, "uuid": "4f534309-f781-4aba-924c-90a202c6adc8", "value": "T11C133183F3CCBDB6D81A03728F7989F12026AE6945B5863E315BB316657335334A2DC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940019, "uuid": "63173e9a-c720-4336-a69e-304a76afd2eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940019, "uuid": "e302279a-cd5b-47f9-a59b-75784082fab6", "value": "768:IVo6QIRFjOC0gSWq111111111113tmh5:ILRFV0+q111111111113O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682940019, "uuid": "1259c815-03ac-4e9e-8586-020fb20a9dbb", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682940019, "uuid": "1f0c5379-674e-4b8f-b6e3-29d4820a1bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940019, "uuid": "3aceeeda-a44d-4dc6-9d93-1c4834411c27", "value": "IMG1608167800pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed436e3-e82c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1682951520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682951520, "uuid": "1006e658-2e7a-40a4-8723-4d2a0f907818", "comment": "Malware payload (DarkCloud)", "value": "8a437b5f22a40f6a67e3482d572a1ee5", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682951520, "uuid": "b36fd0ce-083b-4df1-a740-a0e5a77a5765", "comment": "Malware payload (DarkCloud)", "value": "1818d06ab0cd3441de35fa14c0c981451bfd1139dec6edb7e8699e7d0f9ac8c1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682951520, "uuid": "3eae0914-de91-4b36-9b5d-7caa8e4e5e87", "comment": "Malware payload (DarkCloud)", "value": "b901960026dfc17af9d36b3bc4d254d88712e90b", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682951520, "uuid": "9d91d68c-6ea2-4c2e-8e9b-1ff15f10b36d", "comment": "Malware payload (DarkCloud)", "value": "65c394b0ed7268927b07997fb162be1b6d102d90506bbc039cf2bacbc7170befabcd052fdbd1f7c0edb2fa0d0d6524e2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682951520, "uuid": "f3d3b247-2f70-4830-917b-c0685f724ad1", "value": "T12B759D7C2578E96FC166D5A28AD4CC67F320916B3306DAE6AC9307584309F52B9C70BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682951520, "uuid": "3fbd3b35-3a4a-452a-b561-7353fba84e77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682951520, "uuid": "fc88cbad-4a7d-45c7-86f1-b92882603d6e", "value": "24576:4Pm1kT7yByn1KTLTHsVsv9lFajXfrZlt08JvtY+3TBD6l2X:jWTRSLzsVIjerF0se+3lDS2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682951520, "uuid": "bbc5ea71-dbc7-4c0b-9ace-431288ee2348", "value": 1698304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682951520, "uuid": "321c11c3-f1c2-435e-bd24-8eb9074f536c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682951520, "uuid": "e2eca817-03f9-42fd-a4f4-6c2c997514df", "value": "Quote 1345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cea488-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972817, "uuid": "4229a35c-35de-40d7-8321-b2b6ff7fe674", "comment": "Malware payload", "value": "87a08d5031d00f5af27ef9951df08fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972817, "uuid": "55b883ff-9df7-4326-8b2f-b550a763460a", "comment": "Malware payload", "value": "1837d3d8aa0c3773a4711bb5f9a8765701b9467c916b3a61df18472ffed57944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972817, "uuid": "bc7c78da-07d3-4211-886b-7de0cbc93388", "comment": "Malware payload", "value": "95ac9757cd2809016128280ee767bb8a2029929f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972817, "uuid": "68ff427e-1447-4d34-ad43-cb45205b46ab", "comment": "Malware payload", "value": "6b1714836133f26023df0e1e94fea8f158fd1714b71c61b6d9720dc0e24333e83c81edffe55518446b5e1a4b7326867b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972817, "uuid": "373480bf-eacb-4948-9bf0-0ee69284c9e9", "value": "T1F5C32923B7C689F6E0455BB1A978D31B9335F8710B1013D3F3C98AAA5AE62C64C735C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972817, "uuid": "1cb8321f-2ed3-4fc3-804a-92504d26b211", "value": "6d8ae21536650bb74f684bc4e9ccd39a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972817, "uuid": "676f241d-e08b-458a-88f8-ff93adf034ac", "value": "3072:jOKZX12lq/U/bAcy2NgEM5qUOg29eb2pBGf:iCFXUTjgEsqUOveCYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972817, "uuid": "b4995abe-63f2-433e-875a-6d86bd8bae1b", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972817, "uuid": "948692b3-c4cb-4594-b097-f6dd7df55cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972817, "uuid": "f3d3ee38-b1e5-427d-b4e7-5b042d99fde9", "value": "SecuriteInfo.com.Trojan.Generic.30541011.21971.20311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6f52ae-e852-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682967462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967462, "uuid": "85019316-c459-4ee0-827f-f1452a2b52de", "comment": "Malware payload", "value": "dd18a455e9d700d656ce6965cee1a068", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967462, "uuid": "a5eca54e-159b-4d8d-ae45-7392867a0b0f", "comment": "Malware payload", "value": "18643a9a6e4b61e967e428fadb2d4bb52dfed8a949b4a39cb461c2e3a8e6d207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967462, "uuid": "dc687088-7667-4788-b2c8-aa6037e7626a", "comment": "Malware payload", "value": "bb23d970e98a6a6ec178fc6c9c82689b3e92ee7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967462, "uuid": "36a6ba2c-008b-49fb-86b9-2ff076cc3899", "comment": "Malware payload", "value": "3366efb91c69910bf1624257b2eb0025c0281d6f1ea3eae6cf9d27aac26f121af02f1453bcd4401a714290cae5a82663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967462, "uuid": "3edc78e4-3f76-48a8-945e-8fcfce2dc931", "value": "T11B64F81382E13D84F92A8B729F2FC6EC7A8EF2509E493779115E9A1F49B11B3D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967462, "uuid": "a9ff075f-7ea3-4c71-ae92-440ba06babe4", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967462, "uuid": "ca794d3d-78e0-4c99-8842-8e93c1e6eff0", "value": "3072:duhpDHOnUv1WfCBuL4IdkVDJNhA+GHRIBiSp5z5DT4zknffhd+OH:shpDH9vEfQQrdkB7Fi05ykn3v+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682967462, "uuid": "201cf2ef-f41e-4086-b71e-02e8a4f3ab3d", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682967462, "uuid": "d8e12af3-feba-4354-839a-81467b87dfa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967462, "uuid": "194127cb-3dec-4437-888a-9c0898a397f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52c9af0-e825-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1682948390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948390, "uuid": "1a3f4451-d0eb-49b8-a446-6046bdb2d470", "comment": "Malware payload (BluStealer)", "value": "581f51fd35e943a69a4c569fa8654736", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948390, "uuid": "16e1bc92-df41-43c6-92d0-716d94b45b4f", "comment": "Malware payload (BluStealer)", "value": "18d8044858441edcc126e76dab8c868a23acabb9abf7bab966e4c3eb24f44043", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948390, "uuid": "7c97a55b-5550-4e3f-8fdf-6d2ec844da57", "comment": "Malware payload (BluStealer)", "value": "610e7579a996ea788ccb688a9dda9d4855a40a2d", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948390, "uuid": "5c6eafd0-f77a-4547-a450-d185c3c2415f", "comment": "Malware payload (BluStealer)", "value": "e560f885d7d5a1b514de3f7aa5fa1b6f644b8857bd0bbe86dfece4bbb17ee116f4f47280f517bf9d6127a8f29370991a", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948390, "uuid": "ba679962-ee91-4bab-8bf8-acf4fa0dfc71", "value": "T1376512131055CCAAF91ECB74D428FBF422B97DB3E4E1D627267A3C85F9B9B01094C64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948390, "uuid": "cd7c2b69-6091-413a-b6f0-cfe2fa8a7576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948390, "uuid": "6efb11e3-dbfc-4665-bccd-b704c6f45a92", "value": "24576:Xbj8B+M73OglQfGmzu7SulbydbwcLxTDkU9tMMkB5lO2dMqtX1uP:XX++tglKKPwbwcLh4otmB7ldMg1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682948390, "uuid": "72662162-0db3-4062-8db4-6ea49fcdcc4c", "value": 1541632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682948390, "uuid": "75205884-509b-4b06-9c2d-b209a869c080", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948390, "uuid": "ee4b17f4-cfa6-4493-90ff-c66f0aa04708", "value": "Purchase Order 202319876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856e9881-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972818, "uuid": "e9baffd3-a14f-4a49-b3c9-498f7b2030d0", "comment": "Malware payload", "value": "df764bbce19470005edc86c95e855b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972818, "uuid": "34a4938f-dd9c-4ed3-be16-191ae7f6f38d", "comment": "Malware payload", "value": "193ff40092196249fe8170b1a6dbd4974e7cb5080f9603d014b27b7f87102fac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972818, "uuid": "ff1d51cc-3698-4edc-be8b-a3b0e41ee912", "comment": "Malware payload", "value": "7d27ef84d46d97102a51701847f09def75e6d35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972818, "uuid": "e820887e-14dd-48a8-814e-2d0866e2ffa1", "comment": "Malware payload", "value": "14b6006c71ecb184bd466e795f3628f4314dc60a1338da3a9e82ab554eafc19b33f33a683cc02793f5c7727026b5cf50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972818, "uuid": "0c1b5f0f-928a-4530-bd74-f1ed0b6c20da", "value": "T16CD33B21BBDAC9F1E44753B568687B2B4139F8B00B5417E3E3D8DFAA1A591C3093319B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972818, "uuid": "e2461d39-b352-4d0e-9091-feec1a06e1b5", "value": "7b5991a88e23a3005a6124d3b99e6be7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972818, "uuid": "f7500ee2-1d11-406a-ac59-01a9dc44de10", "value": "3072:6Nuczj9S4BV4D2ZiTINB2rYsdL2UqXOeqie:6Nuj4T4DjcerY8qXOeqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972818, "uuid": "94e731bf-792c-4bce-9958-fc19fa3d4dac", "value": 130048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972818, "uuid": "a6750d61-bf4b-4cfd-a20d-6d9e1ac4297d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972818, "uuid": "41bf29c5-3393-4857-bc4d-da193506bb9f", "value": "SecuriteInfo.com.Trojan.GenericKD.37609233.5373.28760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea26b168-e7f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682928748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928748, "uuid": "1e907eb4-ae9a-4992-ae59-6cb408904f3a", "comment": "Malware payload (Mirai)", "value": "c8e085a0358232ee141c177fbac9b394", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928748, "uuid": "188c82b4-f319-4cd0-9f58-dd87ca39cf19", "comment": "Malware payload (Mirai)", "value": "19960a6395662cea2bd52f776f9c82fc5f2bb856e572796f366d92ac5374cd24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928748, "uuid": "86a92cfa-6ddd-418a-9a21-84be0952ded2", "comment": "Malware payload (Mirai)", "value": "da92dbf04777d18651032461035742df6280fa15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928748, "uuid": "fbd6e74a-21f6-406b-b089-9887fae16b13", "comment": "Malware payload (Mirai)", "value": "df920d91fbc9ce384ed138be3930a01cd1d5916c07e931d7957697d1adc180324d2e07b07fa05f67908c526356dd099a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928748, "uuid": "3014b3a1-8511-43e5-8015-396113e9fbb1", "value": "T12653970E3E21CFBCFBAC863547B74E219658339626E1C584E15CEA015E7070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928748, "uuid": "f1e94866-4572-4001-b0f3-034713e52b66", "value": "1536:HeNYKsDua5/Ek/BTzUhI4/AvjdAaqH8TVq6yKXHhkhJ:+NYNDf/pUR/ABkH8TVqXKXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928748, "uuid": "057d2600-e503-412a-b1dc-a122003d6e90", "value": 64620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928748, "uuid": "5964d4c5-a4e6-4f81-bb5e-9f2703632342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928748, "uuid": "b383b650-d698-4737-ab4a-bb0b44b094d0", "value": "c8e085a0358232ee141c177fbac9b394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d3d78e-e800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682932233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932233, "uuid": "6d3f8a05-b9a2-4fc5-a0fc-77928063b6a9", "comment": "Malware payload (Mirai)", "value": "7d8b410fbb9f17c2922a3f13b750faae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932233, "uuid": "ff60f7a0-20f6-4405-962a-d0fcc1fe2545", "comment": "Malware payload (Mirai)", "value": "19c1fdbc570c91ab641c42e142023ed2f598662aea1c4c769bb4e5f10e1a954c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932233, "uuid": "605a51ce-0e52-4d3d-a07e-7f52a487f9ff", "comment": "Malware payload (Mirai)", "value": "fc4a79fe855cd46e75abc3b14c0171a626cad18f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932233, "uuid": "24dbebe3-2753-47ec-aa0e-d849d3cb5a34", "comment": "Malware payload (Mirai)", "value": "8fcfa716307b7b2c3550e167cf2b83562fec23aacc9ee573d9a794aab590f731cab4966ce859f5cf6c1c37d43ff7a45a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932233, "uuid": "8d418dc3-38cb-49c2-aa29-fc5372f487bf", "value": "T16683534E6E318FBCFFAD823587B75B20924933A627E1C544D19CE9011E7424E742FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932233, "uuid": "059ceb38-a1f5-4bbd-98c5-ac2af9d0f9aa", "value": "1536:MQnOFmg1zaF1xh7hV6cBxIYB15DX4q7zjw/lrlAVBWIZ:7OFmg1zkxhP6cvB15DXpzjFLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682932233, "uuid": "8f46b82e-0245-4dda-a03a-483b0f86ec5b", "value": 84236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682932233, "uuid": "3f6ab9f5-e440-45ca-a5af-1239129402ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932233, "uuid": "4b11dbe0-c4aa-4672-b461-e4fd59ce2b17", "value": "7d8b410fbb9f17c2922a3f13b750faae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c94a7b6-e849-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682963703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963703, "uuid": "3045b521-0f37-493a-846d-ced741e3b4ec", "comment": "Malware payload", "value": "b357e1ce45eb8fb84ff549824810934e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963703, "uuid": "f7f2f442-444b-4eb8-b478-25e75761e149", "comment": "Malware payload", "value": "1af9c32fcfa38c226892163d6182b42507f84c353af84ed659aa0ed6be8522bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963703, "uuid": "4080d26e-6897-4541-9d2e-21e822044561", "comment": "Malware payload", "value": "8a6ded6852d7e58a3a235ab3eb6bfeb6aa9affb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963703, "uuid": "1158056d-ca5a-459d-91fd-8bd365546bc3", "comment": "Malware payload", "value": "7be0686d4ac2ab25e4ffaadff1f5e07d6f09164fac240b6f5c0dfecb55a35548a01e99532890eae3cadfb33e8a017d48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682963703, "uuid": "65a6aa22-cb34-494b-9586-ccf6cdea5ce3", "value": "T1A544D042B7E48B91C65C44B5D0E7042807E3B6CB6273D2867A4853DA0F817E8FDCA79E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682963703, "uuid": "4e0cc2f7-98b5-4546-bc8b-baf814029e51", "value": "6144:riJjbsFbEvJMLsseFPU5FOhtHeuJ89YTwhann4:rjGJUs5PCMht+umCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682963703, "uuid": "9ce7dc09-6e63-4c3a-abf4-e5adde3ec97f", "value": 258120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682963703, "uuid": "e3f08761-5594-4361-96c9-10188120a9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682963703, "uuid": "a6b7fb85-7f5b-4510-9d66-9bbfdd78c00c", "value": "Request For Quotation_0105023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3ac639-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899254, "uuid": "a81977d2-c44b-473a-be9d-235948f71bff", "comment": "Malware payload (Formbook)", "value": "2b1256c6c3c411e2942eb855b3030b78", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899254, "uuid": "0d29809a-a7b5-46b4-925e-51cbb7950aaa", "comment": "Malware payload (Formbook)", "value": "1c3f610e3091b73653d8d48e4409f5dc9aa73ff251b1baa962e362df4ff1294f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899254, "uuid": "cccc6907-86a4-4edf-af5a-97cd4f40fe35", "comment": "Malware payload (Formbook)", "value": "637c591dfe9b37979e98bbe60b4f35a62116daf0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899254, "uuid": "70e080af-ce53-4dc0-adda-63d3b4da03e4", "comment": "Malware payload (Formbook)", "value": "a166d06a13ee3f8990a8275b8c1125b1531519d8012ca25b057a8ace7f3044ef8924672c81555085347f3d4317be422e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899254, "uuid": "9eb06c16-ef5b-47cc-a264-3fd0d46c3534", "value": "T132A42310C0678D62FE16E66978AEC0CEE9D41B344D18AE3C3E13735DA9B9F09F9B2544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899254, "uuid": "0dadaccd-560c-4c88-81ea-a828426a5b0d", "value": "12288:9qwsKLVJlCLXV8ir6oYYNW0eg8/Sec8mkIXamimo:tJSLF8ir9NQeeV/mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899254, "uuid": "5706b2c9-0fbc-4bb3-bb1f-9d317f5c9157", "value": 478652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899254, "uuid": "d9c8ad9e-f537-4910-98aa-b0ee33f7724c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899254, "uuid": "8e2fc7a2-8345-4ddf-adde-dcd4b67b14ec", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dae63d4-e85d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682972268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972268, "uuid": "a4b46c70-382b-4440-ac56-35478a8dafb4", "comment": "Malware payload (Formbook)", "value": "1b92df39d3abd08b2d627d0d545bc391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972268, "uuid": "648b6aa1-bf9f-45e3-bc00-d60bd18bebca", "comment": "Malware payload (Formbook)", "value": "1c50b01cbeaf831465322319b5697cea9f857dc113127439230c86c68ebb6698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972268, "uuid": "c2923a0b-10f8-4790-82b4-5609960b9f8f", "comment": "Malware payload (Formbook)", "value": "35f0a75b8a0d975b46977cc7124890f294eb3dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972268, "uuid": "8e4ac2a4-21ac-43ec-bebc-813a5d85e7e6", "comment": "Malware payload (Formbook)", "value": "bd1639d7109686ee2fea926c70fc39b87f58c5d0ba340421c9b2f0735a95392a43b1b2eef814fe1f5fa9a3f96a3ff240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972268, "uuid": "bdc8d865-d223-451a-9a57-5d300f04d8e2", "value": "T16CE4D00662B1CF2BF939CBF01464FB0427F5B43710E5E1681EFAA0C9D9A5F050E65A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972268, "uuid": "66c97f6f-976f-4a20-a4a0-ccfd48087afd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972268, "uuid": "ad602cb3-0edf-4d3e-ab5e-d5583badf0f3", "value": "12288:Tcym2iNvVdHy4vCWIFCNUXsgrf+ncaNdR/yXldNWj65QO1qTw1A:Rm1tnXMF0lyGnN/yJESb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972268, "uuid": "b37a9222-de68-4545-b523-3c2d0b738c31", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972268, "uuid": "226062a2-108a-4a62-af04-33eb09ce3d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972268, "uuid": "16389238-9079-4be7-8e97-0abe914050e5", "value": "Quotaion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc69c6b-e823-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682947300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947300, "uuid": "37d378ad-b38d-4ed3-a22d-21427d826b50", "comment": "Malware payload (AgentTesla)", "value": "cb4a28318fda86104cf6ea602304f9a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947300, "uuid": "6b90cc7d-1b3a-4590-8ce9-1c6e451a9d5b", "comment": "Malware payload (AgentTesla)", "value": "1c5cc71cd847d8a2679ec629b631b4d7e1082e7126022ab26ff015298d93a61e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947300, "uuid": "f494275e-a7cd-4db7-b28f-d98965a27c53", "comment": "Malware payload (AgentTesla)", "value": "8318ac109ef0c527d03dc57a891392cf05e086d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947300, "uuid": "80982fbc-5761-4030-bf4a-7a9765a592ee", "comment": "Malware payload (AgentTesla)", "value": "11d1e2c607718c81cc9ae449da465399c7b699fdb57ebcf78fa8465516e8cde74e829373420601173ee61a7f0f0d4a9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947300, "uuid": "2d2dca88-3bc7-4c66-835c-76da24909a05", "value": "T145E4DF132059CD8AFD1D8B39D464FBF022B8BCF7E9D4862727753C89F8B9B41094865A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947300, "uuid": "15867629-dcdf-4a3a-b9be-21201cf71364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947300, "uuid": "e5d388f5-44d4-4c98-83c4-82e4fffb47ce", "value": "12288:GBdQ8j8eT9Ci9J/IUEoPcc0f2z6gkHEE6b4067rhYW+fQ:Mdj8p+J/IOPcc0fI6Dd6Hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682947300, "uuid": "4c6821a4-8560-42ae-b53a-6e766d43c319", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682947300, "uuid": "bcda3393-ca34-4a03-a3c6-841cb21ff26a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947300, "uuid": "dedc6df4-27df-4bac-b416-0a70b48df2d9", "value": "QUOTATION-23050002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da742980-e84f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682966518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966518, "uuid": "1f367e74-ecea-4b63-bd17-1674191e6f73", "comment": "Malware payload", "value": "358fa157d810e546c424049fbb7e320c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966518, "uuid": "6f30b00f-9ecb-4038-92c3-2a098e0c5db5", "comment": "Malware payload", "value": "1e733f7dd81f0f7ca342286e81d655255b1e9ac221a99e630d4bb28bd5d7c175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966518, "uuid": "ce1b9eab-9100-43b0-bf64-279ea7ef5606", "comment": "Malware payload", "value": "bc280247d4c893b934fad0cf7cf8d1c4e87b2286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966518, "uuid": "52191185-a96f-4a39-8333-f1e2d3ad7171", "comment": "Malware payload", "value": "4c8c0aef4247b9babb5bfffabd03e611d24889b5521a0f5f84c6b4ef87e54814c39549b0188d2c9a89890455efd6bcbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966518, "uuid": "55469d6c-84b2-4d13-bd25-9c8952500d99", "value": "T1037523036ADC4273EE7407F449F582531A7ABC625B2547E7734C4A6F08B26E9883637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966518, "uuid": "6ab70c60-7635-4d3d-8842-feb81f184055", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966518, "uuid": "5d5dd3fe-0e45-4074-b234-04c1ad3ea60b", "value": "49152:UqILL5CGMhHo9//pwjrF89sRd1xFrvHTT1C:vgCfKxxwj58aRHxRvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682966518, "uuid": "7b172a3f-ef9b-4c21-a601-af5a57407f19", "value": 1579520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682966518, "uuid": "fb1333c2-60e2-43e4-a0ae-8549f02f2ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966518, "uuid": "363a8c70-8878-405c-abfb-f97cce171304", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a55561b-e7ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682924964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924964, "uuid": "e5c001ec-0356-4060-8474-733f0d21220b", "comment": "Malware payload (AgentTesla)", "value": "bdb510287b067b28c35dc83e07284ef4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924964, "uuid": "f225a65e-411b-483f-b250-bb23c5d4caba", "comment": "Malware payload (AgentTesla)", "value": "1e8c002acc55e236ccf1881d41dbb5e7426fbca0b4a7b0e75d0807550ec14337", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924964, "uuid": "be71ad2b-c90c-4d19-b0e6-78a2c0ff3bea", "comment": "Malware payload (AgentTesla)", "value": "78b1206267bc864c4b0c4c74d3bc244bbe30ba66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924964, "uuid": "a97e3e38-cac7-4942-bbd6-91ddcd5ca4f6", "comment": "Malware payload (AgentTesla)", "value": "502eeb40b0038a98d029a020005596651c5d4f669e740ddb46944f6586c7b8da129e6e57c86646eac93247a13ca68a86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924964, "uuid": "3cadcd5b-cc15-4d86-9aff-d33dfab71ccd", "value": "T17ED287C67A11EC30516A5A16FAE226F49C8B479717CE9C3F57887A693B87B2405F303C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924964, "uuid": "b895e589-1d2c-4961-86e6-8968a293cd1c", "value": "768:mtTiPbVsipXTipXjaVQKRKQr7lqt54joc3yXyalJHPf:ITiPbVsipXTipXjzKrrZq2J5kvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682924964, "uuid": "041497c6-c2b3-4439-9950-90753a313bb3", "value": 30827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682924964, "uuid": "93f9c14b-4ba3-434e-8991-fa04823ffa60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924964, "uuid": "af18f345-276a-4782-80f9-8a39f429c4a9", "value": "PACKING LIST TX 3931 2023 LO.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e27412-e7e3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682919911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919911, "uuid": "47831c1c-b133-4a7d-815c-72599c8fc84b", "comment": "Malware payload (Loki)", "value": "156610561284efa5bedc19ec4677f66e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919911, "uuid": "3b8f3acc-65ae-4904-a01c-2c09815fe20a", "comment": "Malware payload (Loki)", "value": "1ecc2a4139ce825a85a02bef3426dbcb6a37cc2577dd665fe7c41a73fdd58370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919911, "uuid": "c536218d-fee2-4990-a211-d8b31dfe5dbe", "comment": "Malware payload (Loki)", "value": "c6bbcc7cf0c9f0e69c14edb9335bd5c11a4e35d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919911, "uuid": "df0e807b-0c19-4934-ab60-181cfb7eeed2", "comment": "Malware payload (Loki)", "value": "c8bf04860785443f290e6b5505de81fe17d342e52f85eaaa85110b116113de5ce0fe261161f0eb3efe082d8cf4becede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919911, "uuid": "7b9b91a9-52d4-4262-ad1f-16cfd31f7657", "value": "T1C3D4D0162019C98AF92DDB34C474FBF462B9BCF3E4D59127277A3D85F9B5B020A0C25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919911, "uuid": "3af24bf9-d798-4c7c-b80b-6e2917fdef62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919911, "uuid": "06ff36be-3021-4b0c-a8ed-b758bcd5e74a", "value": "12288:uZJdSmj8IovLHJEFKKIgR6Bg04Ac87sqIAmwu:0Lxj87vLHJEFn0j71pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682919911, "uuid": "35f24b57-1f14-4875-b408-99713f5182d8", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682919911, "uuid": "a4cec55c-374a-4b7b-975b-27f9ece5645b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919911, "uuid": "903f24b1-da86-4207-b66d-f98192b39707", "value": "DHL Receiptpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51158f70-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899286, "uuid": "18a2b12e-c4fc-4527-9246-d6fb6a143f98", "comment": "Malware payload (Formbook)", "value": "18f76587541972bca9e7951bfb1a21c3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899286, "uuid": "e8ebb320-fc3a-4bd4-b342-fe690b674bd5", "comment": "Malware payload (Formbook)", "value": "1f013fab6a7273f3a7e1f6c07e62b902874b529946152fd865d02589c482e397", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899286, "uuid": "77a9aa19-50b0-411b-8357-381679f4aac3", "comment": "Malware payload (Formbook)", "value": "88e3aef78f3100289543de39a846585c4296a930", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899286, "uuid": "f47cfce1-c64e-4797-afba-2c1a4938acf7", "comment": "Malware payload (Formbook)", "value": "7339e33a11860bd7ca37b6e76814900fdad20c56f2025909314597861ec230ede24d20c2c0af72cc45467789a91ee014", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899286, "uuid": "e6ba743e-2475-4a07-9305-370aa8676d97", "value": "T1F1A42339EF1D9E35A643E1B5EF5F535E490E12ED3C888A26ED37A88245D8DC01434AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899286, "uuid": "c825b303-b50a-41bb-acf5-d631e8d37b05", "value": "6144:Pi6m5AW9nQWsYT312N/ltdmeey9YjPU+CraidGlFkgLrjZLWhzQEdVRyfgE1GuJ0:a6mqpdYT312T+o9EnCuFkgLr4JJeISzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899286, "uuid": "04062d5c-152f-4f82-a55f-69d46f70327d", "value": 472466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899286, "uuid": "90b406aa-f7fa-4be5-9b23-95a900f3a535", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899286, "uuid": "4438b4dc-4e76-40c9-9281-df82ce11bb22", "value": "new order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39360bf7-e842-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1682960664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682960664, "uuid": "7eef75a4-7840-4dd5-afc4-133cd200572e", "comment": "Malware payload (GCleaner)", "value": "4d2ca738a128120fdadacf97ac705c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682960664, "uuid": "f93b3e96-5cc2-48aa-ab84-d3d52509538b", "comment": "Malware payload (GCleaner)", "value": "1f1b940f06d3fd1e8659cb3f56c980f100e7958639553917eb08db940825799e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682960664, "uuid": "732ec19e-958c-40ea-b30d-453191e0017e", "comment": "Malware payload (GCleaner)", "value": "aa5b566abf5f241840b35f038caa0ad4888f8bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682960664, "uuid": "08cc379e-ede0-4a39-8701-c7f655e20d40", "comment": "Malware payload (GCleaner)", "value": "f7dffd5fc8a81456c9ba30f604c8e38b8277deab0fd528d0cffbeb7675b3bdfb0e5d6865413cd88538d763af5f38c77f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682960664, "uuid": "8612c02f-ca86-4294-b642-2c65d07340b3", "value": "T1C0C533646A8715A9F3318F710C795B550E7730CAB820E44AFFC9120F6FB964B1F9E292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682960664, "uuid": "01d25e5a-24d5-4ec1-8b7b-b226689fe2d7", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682960664, "uuid": "2a8f991f-c2a8-4fd6-adbc-cb3a9384a478", "value": "49152:Y+As6BFOdB5r00cx/6JhVdM+7y4U/5IbOwM+ef/+ouQl7mAG5cJ:Y9IdBh1d5eVXoefmpGmXcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682960664, "uuid": "4d341356-7ea2-4db1-9aef-a995893d9459", "value": 2541365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682960664, "uuid": "c4e395d8-5823-45b1-9dd1-93cb85750c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682960664, "uuid": "4e829860-3d36-4b87-9335-8631bc1e3e3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9258d02-e7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682923485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923485, "uuid": "01a911d0-da13-4e41-bc94-6d47dd2757c8", "comment": "Malware payload", "value": "698d87f4871fd6097a1478b8a86f388b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923485, "uuid": "144972cf-a26b-47e5-bee9-ed777d3e6482", "comment": "Malware payload", "value": "206cf7f76d942f76446000bae0dd494d810eb65e8a28d43efb9b6d3bccd07fb8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923485, "uuid": "3d3248e5-2c7c-42f6-860f-d3eda5946685", "comment": "Malware payload", "value": "7260861dbde1604d41281dec3fab1bb9b50c3325", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923485, "uuid": "157af2c6-1551-497c-8ee3-0dca4c3e4f80", "comment": "Malware payload", "value": "07f1d95ec5fc84e72c8f32bb0acc870e6db08fa5f959046b0835738b4ab2e880734cb6083eb24f900d9c4746c9c0062a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923485, "uuid": "bf78930b-b53c-4b69-aa42-5422835a0777", "value": "T1A2E02DC3FE2EF80F90CB833420272381868C10023A2054CE9FCEA8523ACCA950DB402A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923485, "uuid": "eda284a0-4b6e-4073-aa52-5267a11529c8", "value": "6:udVySmTk6+u5aLZDZNAMcAFWdXj1+jwMb5sXltLMXzhY5GfGGkvmiF3l:oVy/iL1AO0N1+jvikXlffgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682923485, "uuid": "7912043e-607d-47db-9c27-3586919c62ea", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682923485, "uuid": "b946921a-cee4-417e-91e5-d9491d12b004", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923485, "uuid": "07a6ad10-4dc7-40ed-9e7e-594ed02342c2", "value": "QUOTE .rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa833c7b-e7fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1682929930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929930, "uuid": "158222eb-6ed7-47bd-b5d8-a141291df369", "comment": "Malware payload (XWorm)", "value": "38675f2f12dc21b95f2dceb645d7150e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929930, "uuid": "4ed2ded3-2bd2-455b-bad2-33db70cd7271", "comment": "Malware payload (XWorm)", "value": "20f5555ef17b832d87ad56c5363868b805c4e432e8f68bfbe4cefd69e6f7dc85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929930, "uuid": "c6e08f84-1d8e-4182-9e76-d907bc139630", "comment": "Malware payload (XWorm)", "value": "d764f0e0a8f9f718748eb12c6114acc81b9e79f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929930, "uuid": "d1ae4525-1021-4ad9-a6d7-b02467e9d8d5", "comment": "Malware payload (XWorm)", "value": "08ef1f427d74fed906506c64dbe1adeb2213a73917d01f9d6ab52ea714c8f1334bed077af5d349b00e1514d6e28bd7f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929930, "uuid": "72bb787f-5f53-4d6d-9bf7-28ef4afb92d7", "value": "T1A1A4B15A0AE93C10DC9FC52DA76F7EAC4392034E5A0274A906FF4C5867396CF21E5DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929930, "uuid": "69db621c-d4c6-4c24-93fd-d41ee0e00661", "value": "341ef3eec107cf8949a849080b1bfce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929930, "uuid": "a5806f66-0dfd-4776-b585-2992994668dc", "value": "3072:pJvmvsblZNbEdWGcEvk5abofPaYaoPsY2AW43ljF+907rbMg9IV6LgDodjkM1QgL:uUlZNkY5akFSri+SUmgUdjgerc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682929930, "uuid": "06fcad30-332c-438a-8c60-d0eb59f72c9a", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682929930, "uuid": "71680bcf-f6d7-4096-8127-e5db55d23d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929930, "uuid": "a0379fc2-0677-4ac7-9b23-42d5fedbcc2f", "value": "asas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8751261d-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972821, "uuid": "2c9d26ed-b881-46f3-8dcf-0dc85cea313a", "comment": "Malware payload", "value": "8eddeda61a4c7f152fcc2edde5d829b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972821, "uuid": "70c650c2-4122-452f-9a8c-ffbf5d9b1e98", "comment": "Malware payload", "value": "2160d7effc7ffdf2b572b693c4585ad9e21dce3e57c1ebc00f89c4e16d5422ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972821, "uuid": "c83865bf-f772-4e4b-ada2-d8aeecb5d321", "comment": "Malware payload", "value": "6c8fd3cf13620951d55128d6aa10e67c6d91f88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972821, "uuid": "0e747c08-40a8-45b6-9350-407949a32255", "comment": "Malware payload", "value": "abef619b987fa1b3d63f67f9567f80aac5c470c9cf76dec27ec35eb858a00fffc3bc64de6ac798116bfff6c7ae4a37c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972821, "uuid": "ddc53cac-7410-4302-b487-79ea8853a88f", "value": "T1C3157C66FBC58F93DA1304328CEEA7381639D5142782F7DBAE99D27C9A47354AB4340C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972821, "uuid": "39e26b4e-0128-41d0-bbcc-849a9b248c7b", "value": "f4f2606e8db3888a7cecb3ec3d542bbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972821, "uuid": "eeb4a518-b70e-45bc-bc2b-05119a712f09", "value": "12288:u06+mdWX+eVo+XKocjKkb6MNHwnfjn8G:B6DdWuknXHcjKk5Iz8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972821, "uuid": "d123cfdd-acf3-4380-944b-c55b76944355", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972821, "uuid": "b9c06f94-8c60-4a64-a9df-69fd60d7af29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972821, "uuid": "7318f454-3180-4e16-9f6b-71e216ba2482", "value": "SecuriteInfo.com.Win32.Trojan-gen.19394.32663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ec8f8c-e81b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682943826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943826, "uuid": "1a999ac5-8c1f-4efe-9d67-f2c7af1a38b6", "comment": "Malware payload (Formbook)", "value": "c2855f1c6721f12db295ec53b0b7de27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943826, "uuid": "5a2bddd1-c0f5-422c-8067-1fbdd24576a4", "comment": "Malware payload (Formbook)", "value": "234d425a3c85a27252fa477d05a387a30a6e248f1ea17b2e7fcaac13cb9c8db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943826, "uuid": "6e236c45-bd03-4484-9e54-82d4cfbaf0ce", "comment": "Malware payload (Formbook)", "value": "1fd7d75d3f8a54f329ddba0ead08cc1479078dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943826, "uuid": "1bcd7978-ff6a-434e-a941-20e022635ab6", "comment": "Malware payload (Formbook)", "value": "af2c0f6e55b8f01f03ec9c96945973be872d18e1efeb8e1bdbb3a7d0387aa2b1e397ace56a9cebaa9707e7fe3c3c05ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943826, "uuid": "113db5d8-1ab3-4dea-a0e2-e506aa21b9e9", "value": "T162E4E0132059C88AFD2DCB34D464FBF426B5BCF3E8D495272A7A3D89F9B5B01094825E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943826, "uuid": "2e88cd8a-57f2-46f0-a201-b95c559b96a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943826, "uuid": "610ca9e5-94c4-4890-a280-24914ef560d7", "value": "12288:vpdYkj8CFtxtIT2BenxiJC7vokQwpP2zk/fb3I3UTvJrDE6x:j9j8anIHGuT4kcEvq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943826, "uuid": "d54b42a2-bf47-41f8-9fc4-1db63aba5a02", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943826, "uuid": "fa83a274-8b43-4c95-9242-c14d97e449bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943826, "uuid": "0b3ff258-964e-43d9-9dc1-965621cfd43f", "value": "Quotation-pdf-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474cfa1c-e80d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682937924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937924, "uuid": "abfb5a21-82c7-45bd-948e-342fc45298c8", "comment": "Malware payload (AgentTesla)", "value": "91edb3907bd2af571243a75a32dff88e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937924, "uuid": "d0300092-9d30-4d11-9ba1-b13339189643", "comment": "Malware payload (AgentTesla)", "value": "2463a1d5e35dde5253c9706b07f3eef1166488a56437dc94c816a269770f8073", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937924, "uuid": "06de2533-cf01-493c-a9fd-0ca210ef0b24", "comment": "Malware payload (AgentTesla)", "value": "86756c462d15bb4b8896e169a78e81031e48c713", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937924, "uuid": "27c8aa60-ca51-4ffd-bd28-b5ed83511f65", "comment": "Malware payload (AgentTesla)", "value": "9b5df11b276139b76b7966080b989aa0d721e2725a4c0084d58d798e157f01b6cf03921c8806c2619156b69af8f177d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937924, "uuid": "fbfa62cb-0b3e-494f-8260-02efecb85187", "value": "T13EC47C3C29BA5627C1B6C3798BE58827F1509D6B7011EEA954D733A60353B8339C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937924, "uuid": "2e6a9914-0c9f-4a2f-86cd-fabef48b2ed0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937924, "uuid": "fc075f91-48a1-48ae-b609-fdcb554117dd", "value": "12288:YgVBKqnAolGx4WJZ2nvpW4JwOc1C4HoZt:YgV/nQxFj2ncoBAoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682937924, "uuid": "d385dfa9-de2b-43ef-b6e5-0296be04a230", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682937924, "uuid": "c941d2e9-0c85-4a3b-804f-b335109cdb98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937924, "uuid": "dbc3461e-fc79-4bfc-ba54-390000d01368", "value": "Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fb8dd5-e825-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1682948284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948284, "uuid": "6d88c9d8-dd01-42bb-ab35-810adb1b2bd0", "comment": "Malware payload (ModiLoader)", "value": "d51332436b02a5a9a5ca3e0f3d70eaea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948284, "uuid": "be43ceaa-d052-4838-8f72-2f5f412cfa0c", "comment": "Malware payload (ModiLoader)", "value": "2477b5a375ad154feb56435202a0861bc1b87f90cba6e025831417cdc174bd74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948284, "uuid": "1f53f5c6-b83d-4207-b660-311af9e3a0da", "comment": "Malware payload (ModiLoader)", "value": "87a5561dd0ad2e85f671c7d3961a33c790c9d20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948284, "uuid": "6e956bb7-4525-4389-ae96-62c67d87f8ed", "comment": "Malware payload (ModiLoader)", "value": "e532ab443a1e98133dfc619d7748c9e93468a93b43293f60dffc2ea51161a32628b4b7057ffa0256bdbfdad1d84e3c64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948284, "uuid": "1bc13a64-7e14-45c5-98ca-2eebd5598c48", "value": "T1FCE48E2291B695F3F1371EB88C1AD7A9885E7D103530A449BFD73D8CCB3A292B41D297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948284, "uuid": "2500aed9-bb57-47ed-bdb3-c213356bf9c8", "value": "14c2c0324d381453e3053afd5d3171ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948284, "uuid": "6f7a5c8f-f8f0-442c-9b35-b336b68a0a51", "value": "12288:gkI303av+MZO0bfKIosoFwewOfyaEzjOol:gkGv+MZOxpFLwOqaEvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682948284, "uuid": "5667d7db-5e2d-4bd9-a5cf-cc66b5a46f2a", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682948284, "uuid": "d87418d9-8fb2-41ea-9012-45578f4138f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948284, "uuid": "cbfd20e4-9153-4f08-8531-2b506e1b5204", "value": "PO-278122212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb66c78-e805-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682934605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934605, "uuid": "60aa4d5d-81dc-4abb-999f-49ab6d50bbb3", "comment": "Malware payload (Mirai)", "value": "4b5fef3f78114c889d2952c95a2fe65d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934605, "uuid": "af50d76b-fb70-4b37-a886-92aa494d36ea", "comment": "Malware payload (Mirai)", "value": "249399f5675bfe30a9336957886a75c2dc243ce4d25d15a58c7307d5e3f2bf7c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934605, "uuid": "97467b14-f4fa-452d-b584-ba640805c931", "comment": "Malware payload (Mirai)", "value": "685f2c5b15a5e126b2132caa0eafde3ab0b0c01e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934605, "uuid": "deafa9e7-49b8-4d17-a04e-153ca1441a73", "comment": "Malware payload (Mirai)", "value": "ff8af6b9edd28d19e4d3f309dc384bb69426751dac2ba91b242c57ec2ba24229ae24954a12b4d80f89669de07b576ead", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934605, "uuid": "f0152ef3-ddde-498d-9aaf-458449a63d96", "value": "T1D8D2F1F8EF798B8BD0D5B73A4C9D8C0E75ACBDA71AB691190B410D226035E60E5E8CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934605, "uuid": "245a2039-ca43-4de2-b7ca-4b8171d3948a", "value": "768:2N8fWlfoQmQAXV7EAQciiRcrHKOu3+fqs:WMNXFl7NNn4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682934605, "uuid": "b7c012e4-b139-4c61-8467-cb99de2d8e1c", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682934605, "uuid": "89d8cb10-524c-442c-9a78-72a98705c2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934605, "uuid": "909bb3e5-ba08-4557-bfe0-c7f58da575b0", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0344bae-e82a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (FormBook)", "timestamp": 1682950556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950556, "uuid": "1013ec2a-6315-4683-98a9-5ae462717208", "comment": "Malware payload (FormBook)", "value": "f5bccca6f16c275e30b2bbd2732c19bc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950556, "uuid": "d9243c62-a30e-4c2d-8be5-bca347099bd9", "comment": "Malware payload (FormBook)", "value": "25c58bf051df8e65c188ba0ae6a183ed8e8fc129543d2c2fd0ebb511b7459327", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950556, "uuid": "37e9fb36-e6b7-412b-bfb8-5aa4fd460ef8", "comment": "Malware payload (FormBook)", "value": "027df3d04362f7c45943ff2ce77b280ea402e002", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950556, "uuid": "ec54c7d8-d685-49ae-a700-f33b5cadf9b9", "comment": "Malware payload (FormBook)", "value": "6e9c5ba8058bf6c93a3fa7957128f790d09dd38b3456ba6a732c9ef401851f721dcc30b0477db6077f3cda2ada4edfa1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682950556, "uuid": "3eaeed1c-e145-4ebc-9a54-53f3e989df39", "value": "T1C46423FAC490D2A73FACFDF67438183DF25BD01220944539D5A112A1BFAA38F6195753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682950556, "uuid": "9013699d-191c-43c1-9989-b28ec8042a31", "value": "6144:5m4sH0YdOw41y15q6h7t6+sv2ezABFVjIJTQPZYKE3Fti0PDVcD7Ghj:57ixOw6MZtrkaYQPW5T/PBcDKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682950556, "uuid": "9290195d-4011-46c0-9d7a-f707f044c585", "value": 306816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682950556, "uuid": "20a0fd45-f08c-4880-b940-7d866f676c08", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682950556, "uuid": "e6c5a1dd-dc80-469a-ad4c-52d9f6565e0e", "value": "npedido de muestras de productos pdf.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcca518-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682935972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935972, "uuid": "38b7591c-5436-408c-a9d4-7d3dfc8dd9c3", "comment": "Malware payload (RustyStealer)", "value": "dbe942c9647b3f3b2c6a10e2d20b9f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935972, "uuid": "aec498fb-f48a-4908-b31a-c2a316e6293c", "comment": "Malware payload (RustyStealer)", "value": "261a217197fb8a33b8d204d4e9e7cb33e011d0d692d93c3bb2f86eada35108e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935972, "uuid": "e8df3f6d-884f-445c-a329-1080cc92b4cf", "comment": "Malware payload (RustyStealer)", "value": "8e6e22883da9e35ba288dbdeb23730cb357d5c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935972, "uuid": "31cbf364-4a12-4b32-995d-e224512aeb27", "comment": "Malware payload (RustyStealer)", "value": "03ca3e82360f61d0c140124650f392d2fd8937ba46dd405ec273291142aea0dec5b0820e5b59e6f53306f30836beab2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935972, "uuid": "8f875958-30ea-424a-a1f7-abd3db9771fd", "value": "T1F8168C03FA9546E9C06EC274861B5223E772BC4A0B24F79B17D45A723F23B605F6D398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935972, "uuid": "4a3895a1-0328-4bdf-a4f8-316251ab4374", "value": "867f8d99a619345d9a11a8961527be79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935972, "uuid": "63cc4da2-44b3-4118-adad-392b5efefebc", "value": "49152:NTJqn7uJzN5rIhtbpgHNwH5PheeQgFMJ/65bSM/XOH0q+Gm1hMN8mwuVt2hO249w:fqnEOt1HNhNXAR9yDhvTnvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935972, "uuid": "f29c3547-b164-40f9-b5ca-cbf5805cd4b1", "value": 4044288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935972, "uuid": "326d4f01-e22c-4eca-85d4-09fccb8799cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935972, "uuid": "87c9a387-0153-466e-80f9-d833720ed5e7", "value": "ZLN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca96cf8-e7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682923491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923491, "uuid": "f9f89732-0316-4341-9775-ae5945d3c4e0", "comment": "Malware payload", "value": "3709f8e63270a6fe4e741df700bd2196", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923491, "uuid": "05d77714-23b4-40af-ac8f-368304a8817f", "comment": "Malware payload", "value": "26419600b50ac2a83f8d1549990b9b65092434ccb3e8d055c4eda47fcfee7fd5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923491, "uuid": "24339c8e-5cf7-4839-aa1f-20ce20018b32", "comment": "Malware payload", "value": "7ab892997d6f9028e3cb34b0eff16a8a4ee90326", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923491, "uuid": "785357bd-a7c8-4d61-bc06-503e2f34edd4", "comment": "Malware payload", "value": "f08d29f561de4ce8ba7a4e59c18d7b05afc6085f3bed5b6d33c4d4efd39da70e3696a2e1f0adf9c41636f3138b528adb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923491, "uuid": "51579807-d23b-4f25-9ff3-8b367b36f103", "value": "T199E07D6B711C3605C17D98E0D8686BC0B431D66D7F877ED322C526350D8936C45C7C2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923491, "uuid": "94163e2d-0108-459e-9dc7-1c03da968dd6", "value": "6:Q0eoLftLYVJ2/CxVDGGIOyYn7G8GSLh8uWfBNupjKC0Q98GLgu/XziX2ktww9:QwZYVJ22Vyk7G8pGuYBNyp0Q98Qv/XzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682923491, "uuid": "1d0d80c9-4292-49a8-bb80-7ca63c276220", "value": 330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682923491, "uuid": "c3271b1b-8f2e-4e5a-be6c-4a39f1b54aae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923491, "uuid": "f95c23b6-e370-403f-8919-7accdc30ddb5", "value": "QUOTE .bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9753815-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899971, "uuid": "d02c1b89-2a2f-4cd5-8e1e-8ac8166d4776", "comment": "Malware payload (Formbook)", "value": "90ce75efee733bc3cc555a32a54c6c69", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899971, "uuid": "62baa20a-4e02-48aa-a032-7eca7851e79d", "comment": "Malware payload (Formbook)", "value": "265c8eb78f4de3ed982e4dee9e6eb0c3b5542bc0e035a36a2372ee13713d7e77", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899971, "uuid": "712cd0dd-eb76-48a0-9f0e-972483107c45", "comment": "Malware payload (Formbook)", "value": "7c549f14cdb8f20384007ea47d688ae24ac3644c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899971, "uuid": "1fba7a5e-a495-4da7-84ff-19584b73ed14", "comment": "Malware payload (Formbook)", "value": "25373d782ef553336c3e5fec8f928121005b99914dc10921e9f6556a86f71aa65bf44aed38b491ee0650df1d725e9ed3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899971, "uuid": "0c0deda5-4f54-433b-b4f4-ed7b53c08032", "value": "T1C8B423A59742CED3BF23595DF8036A5E0BD1034F29468D2EF0F1A78ACA4D0C6F686685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899971, "uuid": "7eb464f1-def7-4564-904f-43870a5e6e82", "value": "6144:BpqGyQ91sbiHFLlZWNL/yIReVv/gtE7KUzi/AKJyvO2dDi74yj1n47Mi9EEMXbPH:791s9/yTwg6/Zyvv/NYlsHUIofs3Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899971, "uuid": "37677b71-e25f-4cd5-9c6d-6e1bda5a44dd", "value": 494343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899971, "uuid": "b1c2c7b3-5411-48c1-9c59-ef5bf01ce09e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899971, "uuid": "abbf5a0d-aec1-4a90-8010-c18b8e110cfe", "value": "PO84100036.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce78906-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682899682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899682, "uuid": "f39bfb2b-82ce-4c9e-963c-29850749b664", "comment": "Malware payload (AsyncRAT)", "value": "1726c93d4637663db8f67637d6dd0d79", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899682, "uuid": "d578985f-9ac1-4728-8d73-00ea944c48fe", "comment": "Malware payload (AsyncRAT)", "value": "28fc15e7bca249fb06087752e76cdcf1ec4089aed345d0636ddffb076cdbf780", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899682, "uuid": "3b1cc140-4401-4757-b810-8a2f35176f99", "comment": "Malware payload (AsyncRAT)", "value": "44466e25ba71301f020a27e5300ac83dee998065", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899682, "uuid": "1b72bf2b-0e07-45bc-ad84-396880fecdc5", "comment": "Malware payload (AsyncRAT)", "value": "db6eddd8419d2fddada9c889dda34b7704e08e782adcdaf057f4c2ba78edd7e7e7b4ea17ea65c05f4677216f4fd0b862", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899682, "uuid": "7def48d2-3a5e-41fd-a43f-e3048c699502", "value": "T175C51215E848B2A1F94AC6740AB02DA113E95CF8126B47C13BB1711F9B77E9E1FB9D30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899682, "uuid": "f6506d97-3c2a-461b-a2dd-33ccb720788c", "value": "12288:8hBHJnyAnIw+9bQfIpb5o9GstFA8Kzxy+3b11wvzNKSO:8hT7nIwQnlarA8KFHJizNKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899682, "uuid": "f42188d5-6a90-4f64-94b5-075ddef863b3", "value": 2524799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899682, "uuid": "7f920526-1de3-4c9f-9867-4daae90f5845", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899682, "uuid": "f7cf45a9-1a19-4c05-a1b1-05ebe5ddca96", "value": "Ta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68634fe7-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899325, "uuid": "07c309eb-3071-45b1-8295-a07073f788d0", "comment": "Malware payload (AgentTesla)", "value": "a8d299c18ff9be19b0de702733b4ef7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899325, "uuid": "b4cede0f-4a32-4727-ac64-7fe9f9e27dc0", "comment": "Malware payload (AgentTesla)", "value": "2a9a80ee83f176993fa32170d635d153fc0666e93a350cdfb18741f80dfc9e70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899325, "uuid": "0212922a-ff55-400a-a65b-66c8e74fafae", "comment": "Malware payload (AgentTesla)", "value": "3d8a5c389145f206df1f2a9edf547d80422e56c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899325, "uuid": "70686525-fffc-4073-9bd3-b353f481cbd9", "comment": "Malware payload (AgentTesla)", "value": "b1077af6481ac1e0d8142da7875f19368c781049149029915e7423f46e571715e9870cabe35f9eaac4d02c01a570b9a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899325, "uuid": "71a35a89-e9b1-4ec9-a6cf-a78aecc5f758", "value": "T198D276CA7A21E830417F0A26E6F22AE55CC786A716CD5C3F1784A96A7B47B3405F703C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899325, "uuid": "feccb7b3-ab44-400c-8301-186601378eab", "value": "768:+kSEVBLBLi6VBLi6VIa+YS5GidDbbwEgWeC5LfuHVfCU2CPYL515qk:9SEVBLBLi6VBLi6VRS/NeC5TuHVfCQYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899325, "uuid": "7467ea3d-f278-41e2-96df-5c67db3f65bb", "value": 30831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899325, "uuid": "9cd7d865-6a34-410e-b38d-2dde4ac2b199", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899325, "uuid": "2cb2bd72-4128-4b71-858d-258c76fdc25d", "value": "PO no. 5909121522.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c0d0c3-e846-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682962342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962342, "uuid": "98516707-0098-4e78-aec4-3ebf01b4a96f", "comment": "Malware payload", "value": "84037e5a56db32e636db640840cf8b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962342, "uuid": "17f18785-03d4-4408-a39f-a164b56dc3bf", "comment": "Malware payload", "value": "2b2f4945244472a57bce76055101bab1996c538ad2c6bcea5fe6c11733f23d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962342, "uuid": "0b609d1c-7942-46cf-adab-c95d1ab4fdb8", "comment": "Malware payload", "value": "be1cf06d38d1736a71d309298342b6e9e04c3459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962342, "uuid": "acc83738-afd7-4434-b529-7e20cdc738a6", "comment": "Malware payload", "value": "468f08ccd01e87b66e3d493f7b4f8a433224a68f4914b068017c439d69a0a07a9cae03814fb6cdf4f7606d3e033be674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962342, "uuid": "57ec0efb-c985-4fd6-9fa0-ca34b3a4da03", "value": "T193235C0276E1C431E4A303701AB8D6625BBF7D629B74819B3B9C065D6FB13D05A3D397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962342, "uuid": "82dfa2c6-f2a3-42cd-b759-4755945d2eab", "value": "b79142f1df6c12c1bc1cb268b4f995de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962342, "uuid": "e6c7ac88-764c-488f-9c89-839c9cc437ad", "value": "768:LonhkHDSYGd1jwqrcTybYGfEM/tPNK9W04xxmVs//:LohQ+veqrcSV+4+y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682962342, "uuid": "ce7d2ec5-6ec9-47da-8b48-7c3e21a072e8", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682962342, "uuid": "c02ee848-d9bf-4fb3-bbe5-937dc402de05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962342, "uuid": "fcf13039-d366-48af-8098-de05b39e5ddc", "value": "SecuriteInfo.com.Win32.AdwareX-gen.2559.16231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989ce0ef-e80b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682937202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937202, "uuid": "3ff80601-4fe7-457f-a9db-d0e85b8fea6f", "comment": "Malware payload (Mirai)", "value": "f314cb43e371197dcd4603dbf6e02a2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937202, "uuid": "8cef5d7f-fddd-4bc1-8b78-aaf450b88a91", "comment": "Malware payload (Mirai)", "value": "2d21d68e12ca6c36bdfdf86334ffdcd05f7001af6fb76363b3cbad03884141e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937202, "uuid": "f8e9d9fa-fb4e-4f45-b96a-8fa248234a62", "comment": "Malware payload (Mirai)", "value": "d3693aa4ecb551acebc136d559e34a573408b4b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937202, "uuid": "4443783c-ccfc-4c30-bb7b-aae2e80c6fa9", "comment": "Malware payload (Mirai)", "value": "7ea18b4be75544660973aeec0dcc5062087bd86fb669d27264a168c70f4adaf71b5141c8ed9fdafd536e47b783f71e01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937202, "uuid": "7b462a88-4ded-4e4c-b0da-bccd9ee199db", "value": "T142C2D025170B6435D2F04078DAA0C29561AF57ACE2DBF23638540F3CB96691E75F8F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937202, "uuid": "840421e7-317d-40bf-8f85-896ab4148468", "value": "384:qdk751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HASShymdGUop5h5N1:qy75KMu5z6sOj4qos3UoznT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682937202, "uuid": "d016761c-208a-460e-bad7-0fa93b8a80dd", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682937202, "uuid": "a722a77c-f0ec-4a28-ad03-63ddb8dcb641", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937202, "uuid": "3611beb9-72d3-4a80-92cc-2889d3a663f1", "value": "f314cb43e371197dcd4603dbf6e02a2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1847aa5-e80c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682937753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937753, "uuid": "06bd34ef-ad8d-4084-8817-cda0958472a5", "comment": "Malware payload (Mirai)", "value": "517ede52b3d936a678334bded0cb3dcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937753, "uuid": "f5bea237-3b3e-4693-bb6e-01cf0591763e", "comment": "Malware payload (Mirai)", "value": "2ec53c177beebf380c31259b05c6f8976fc1599254ecc107d325cc298a3b0b16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937753, "uuid": "fc2f0dd0-80e9-4409-8d5e-267d3eb1ade2", "comment": "Malware payload (Mirai)", "value": "b3cb06ee0f96225a7e158d9afb2e9bda8ba78a54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937753, "uuid": "76ba4fe4-c62a-44a4-9ddd-96eae9f71a3f", "comment": "Malware payload (Mirai)", "value": "f7783881d23f4115bc7cb0c4e3985a5878a55216c71878c1d45d00024219737a30a671e4b538a3e169d536689b7161c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937753, "uuid": "81a254a2-32c1-4c7c-82af-a74fac247732", "value": "T13DE2E05D68A83CA9EECE4C3D52DD0519E9AB2499430EDFC6236248C0DA2FC2DD1DC87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937753, "uuid": "7308f17a-258d-4cc2-9fd7-ff712baefdfe", "value": "384:e3fpCLrsjHIX69URc+hmnulY1qHprFKt6zNJpRwD9MH+Duviyg49xRMa3lRWGVCZ:SfpWcehzJFYKn7gMHRfg49ka3TW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682937753, "uuid": "07552021-74af-4cfe-8ec8-da9dedbf7e85", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682937753, "uuid": "6775c814-1b52-47f8-88d5-b97809b88fb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937753, "uuid": "2608c4f1-9423-4645-bd63-60dadd52ebd5", "value": "517ede52b3d936a678334bded0cb3dcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cafc76-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682935850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935850, "uuid": "7b1443ca-019a-4069-a929-55c0c5648bc2", "comment": "Malware payload (RustyStealer)", "value": "ddfc26a5caba2d8a083226d0e5c3fb7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935850, "uuid": "2eed895c-f4a0-4f1e-a5e6-6ac2e9de0aca", "comment": "Malware payload (RustyStealer)", "value": "2f56728081b16f3e5e556ab72bcf274bed23a4e3b4b58819c6e71988feeb13b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935850, "uuid": "ff93622d-bb80-48ee-9b9f-7fdcc1bdec77", "comment": "Malware payload (RustyStealer)", "value": "4b372ab1a72890ff2d45bd6829f550a973465559", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935850, "uuid": "e784a732-45a9-43f0-b6f8-33942942a2d7", "comment": "Malware payload (RustyStealer)", "value": "0fdb95edb00293b97adcd63717772c20b5040246eb63268f4ea9368fcd9459bc447a9e36a08bcac4a36e880264cf4515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935850, "uuid": "8a7aa23b-838a-45f0-a5ed-6e0062811b11", "value": "T1BB168C03FA9546EAC06EC274861B5223E772BC490B24F79B17D45A723F23B606F6D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935850, "uuid": "40110090-aa7a-4957-ab69-45aaf3702f91", "value": "b0f138b3518b7d35d190f478825445ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935850, "uuid": "9ba44935-41a6-4646-af21-fc846ec59997", "value": "49152:QczZwCxNB/lPEVE9hB2mrDdWfLXDdP+vtNGlxSdKAZj2u/2F3Du5xjPUlHFgpb6Q:VxW+TBmxSIAZ6fY4g2TlBiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935850, "uuid": "0c0ad5f3-5ebe-4d5d-b531-20f5ae3541c4", "value": 4060672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935850, "uuid": "e7412e57-a272-4ee7-a292-36c9c945559e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935850, "uuid": "f3580f58-2b46-4ca5-9ef9-a1601e99f48b", "value": "LXIX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6962001-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899510, "uuid": "17b7eaa6-a02b-4719-a8b9-81a07e365996", "comment": "Malware payload (AgentTesla)", "value": "9e10326d3a0fb15366a0d86362edbaee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899510, "uuid": "552ea029-9fc8-4442-b4e7-f48cd363febb", "comment": "Malware payload (AgentTesla)", "value": "310cca45875cb77640bd15ff405af55de5a00828088722da1681aaa2cc90c931", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899510, "uuid": "62095cfb-1d35-4721-9e46-cbcdf6514ebc", "comment": "Malware payload (AgentTesla)", "value": "97d9ad43c67e142a809c30aad0c7cfcb1b3f1748", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899510, "uuid": "c5bbd2ce-e62b-47b0-ac49-0603855fc902", "comment": "Malware payload (AgentTesla)", "value": "a35bb9a9985bf53b0a6887acb51fb2850586485b2594c694da305d75e0301603a1a41174582fa51ce52e22edab46fd2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899510, "uuid": "3f3d0a6b-638c-44b8-b970-053dd42eb9e0", "value": "T118D4AD535065CD5FFE2ADBB0D1B4FF45A6F1F0B364D1A0241BB9218ACAA9F021E4C52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899510, "uuid": "5f08b42d-10f9-4704-bc51-f30e42be911c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899510, "uuid": "e95284b1-ecea-4301-ab57-067bc0ae07b3", "value": "12288:qqnMOztzX9enMIR2FEs5or2n5Rjg7OHG86ic16MYzV+hufeqegQVtZ:qy9XlIaE0w25Rj9z/zMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899510, "uuid": "1f7e67bd-726f-4eda-a2ce-67ea25d50918", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899510, "uuid": "00302050-a70b-4457-8e85-3ecb2a3bcd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899510, "uuid": "c3719049-4129-4ce7-bb1f-5d4388891cf0", "value": "57m\u00b3 LPG SEMI TRAILER 7 NOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb59842-e7f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682928758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928758, "uuid": "509f9ce5-1dd3-4709-8c19-e515a6ae7e8f", "comment": "Malware payload (Mirai)", "value": "f70b64e9357047e61e4acee7264c94b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928758, "uuid": "717c2ef6-168e-4ed4-bb34-37288e321ad6", "comment": "Malware payload (Mirai)", "value": "32f217fec907cc674d36f0a32c450d4426bc2109eddaf31a93c7e069add50960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928758, "uuid": "7fd00119-4133-4bc6-9318-d4ef934649f1", "comment": "Malware payload (Mirai)", "value": "796e57cd79146b9540d2ac92e91a4e0138eb2249", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928758, "uuid": "707c19b1-1b04-4167-913d-96694ee4a971", "comment": "Malware payload (Mirai)", "value": "dd935781fd35fd74d3cf53880eef3a03574f00b203f3556be34863257f454d3ca1a79fc7e3a148f425ac7265174c0d07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928758, "uuid": "934ceda1-330a-4f7a-8f55-d71b1627b72c", "value": "T109430842B8818A15C5D412BAFE2E11CD33136768E3DFB2139D106F257BCA92F0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928758, "uuid": "74d8068d-188b-4ccc-bc9a-8f9642c372d9", "value": "1536:IhnLPLZF+6GtG+iwW/ul3KTKIsbRkJLqI3itX+4KWj:UD+Ng++WlChsRX+4KWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928758, "uuid": "18ea13af-b97a-485c-84e8-335eb01286ef", "value": 60052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928758, "uuid": "152ec6df-d046-40ce-8dcd-c3ed5392eaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928758, "uuid": "3ecd4526-12cb-42c2-a424-aa9b97ed19eb", "value": "f70b64e9357047e61e4acee7264c94b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d52fcee-e800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682932243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932243, "uuid": "63ef5d9c-1cdb-4929-a886-3e1a8f37537c", "comment": "Malware payload (Mirai)", "value": "18affce752643ca3b478ed6f5f72c3ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932243, "uuid": "3f2b77e8-4555-471b-af96-83ff38c422ed", "comment": "Malware payload (Mirai)", "value": "3343196db0d45663f0a483456557aa4d336b55324d0f84697a9c4e61fb5096a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932243, "uuid": "d33b0327-a907-469f-b411-39924f1ea803", "comment": "Malware payload (Mirai)", "value": "52810967e33fb6d83094a0706b3a008ed093788f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932243, "uuid": "3e2d5d5f-99d6-4859-a2c3-19121540bac2", "comment": "Malware payload (Mirai)", "value": "4e9dc1779ed50283fdce4bb2ddc331e48db0dcaa3663c07a6f9e3d5a00621f350716d271fe658df07fe3d5d444a2930d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932243, "uuid": "dbb3ff20-64a5-4699-808d-aa2cc295b17a", "value": "T12D7319782585F22CDAE680B8F4532AE519120A083FDC81E36887143BFF70B5DB56DE5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932243, "uuid": "c8deb37a-391f-4aa6-b49d-fcc057269139", "value": "1536:0Xr/KCEaJzUuv4++aP9ilVRYJf/VBIVCCfy0K9eU:yKCEmXlC4u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682932243, "uuid": "76441ce2-4341-4e4c-b784-dea02ca7632f", "value": 75136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682932243, "uuid": "e29dec35-2dd0-4a85-b53d-f7ae59b2eceb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932243, "uuid": "52915a39-b68f-43dc-bfa3-80a6ad159e25", "value": "18affce752643ca3b478ed6f5f72c3ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeee6b6-e83c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682958063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958063, "uuid": "84d8d8c1-d088-48a5-9f8a-1880a503eeac", "comment": "Malware payload (Formbook)", "value": "7091d1c589edb0feec441cb110ba85ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958063, "uuid": "e882c441-18f6-4e28-aa12-795baa8095fd", "comment": "Malware payload (Formbook)", "value": "338a1b0f3f980d0b4d68a108bdf9b2c950d12e7a86a11e116a73f9cb801447f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958063, "uuid": "cf03aab2-bac4-4ae1-b9ec-fa30da10149a", "comment": "Malware payload (Formbook)", "value": "a8e359532abcadf568f9edec8b3efc8c8693fb94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958063, "uuid": "2a10db6a-90aa-4997-8e02-c8f037bd9576", "comment": "Malware payload (Formbook)", "value": "cb2494051f88504fe2808618ad5851c8453ca9ffe757eb4b5646b6458725a48fd6d7b5d72c7322dd0229f8bb9c91c14d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958063, "uuid": "9e4bd43b-033a-4f91-b50b-8a238195a9ac", "value": "T1F25413186BB0C5BBD97349311D3A0B5AAE6E9D261AF023572314A54F3A12FC3BE0D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958063, "uuid": "c003ea66-4f10-4a70-9937-22ebdc3bfecc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958063, "uuid": "2248043a-b19a-40b5-93e8-e9ab57c49cd6", "value": "6144:jYa6xzRB2Nn8qjZs0WrggEA33WvUz9YAdCk1FRBbl27UutNWQt:jYvzmN82s0WrTtfz9Ym1FRBJ27UIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682958063, "uuid": "cf32a650-5981-4207-baa3-dd90a596dc86", "value": 301297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682958063, "uuid": "b5ce4ec9-ddd2-4e7e-a910-bce692377a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958063, "uuid": "8f7a7d96-5c19-4ff8-a30d-18830aabd44e", "value": "Order-54545454_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7a0130-e86f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682980159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682980159, "uuid": "aa914afe-b4f8-4da9-a450-c29f596d5882", "comment": "Malware payload", "value": "0cd6310abe723620a28c470c32c73f8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682980159, "uuid": "8bb31fcd-bec9-4acd-a2e5-aaf237d25208", "comment": "Malware payload", "value": "34341bd570b96a442fb4b11e3e2ce27ba73289e9a77b2e3f57e3f5d8de72b7d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682980159, "uuid": "3c399bf9-1e08-48c3-aac0-b8cbdfd831fe", "comment": "Malware payload", "value": "ab3ac51a718feadc44ca0df090c33d89c8c8d47e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682980159, "uuid": "64549525-4cee-40c7-afb9-1087cf97432d", "comment": "Malware payload", "value": "3b85096cbaa10c2c76f5486f6b30e2a51aac4dae1f8067e20f520590142e46f3be07a2701941cf589fa17f16010a7750", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682980159, "uuid": "d54488d8-fa5f-4c1d-92a2-4b516c6f04ad", "value": "T1E717331CD340D17B2C146EAD54A89D0130165CC496FBA31BAAA771E831DCEFDAB66EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682980159, "uuid": "0b89a643-60b4-4088-976f-56bc18379a53", "value": "393216:UW+ev03qlYxbNTvLdju3CD9RHK6rwE4E6qXHBabMI/eMcwwc:ZLqeguSD9RT6qXBaoWKwwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682980159, "uuid": "ee7e2ed6-b018-4831-8d3a-2592bac4f30f", "value": 19122766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682980159, "uuid": "47ed81f0-a05e-41ab-b28f-dcc72851422b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682980159, "uuid": "50939e43-2bda-441c-8ffb-8d16a6d70aaa", "value": "Evolion.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b485b7e-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682899652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899652, "uuid": "5b3b62e6-d753-4aca-94d0-5c92d05fc42a", "comment": "Malware payload", "value": "1def2fdd0f1810a50fb310240a2d2b18", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899652, "uuid": "6a68e338-dc61-436a-91b8-1b9a0c5b39e6", "comment": "Malware payload", "value": "36335f068bb39a55cde671eb398ef3619c70080686d13544cd0e2be4749254c7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899652, "uuid": "4457ec47-592d-4740-b2bc-5ffd7b337869", "comment": "Malware payload", "value": "219c6ab10d04796c1009fef145193e83c95af0f6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899652, "uuid": "347c6e78-5e38-4862-a08f-1543f400cdb2", "comment": "Malware payload", "value": "6617a90762dca9ce181c5f08891ce9cde8ef8802a57d23b8273db42396ad6634e917c6df897b2d8768722d987c2c23dd", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899652, "uuid": "93c7b26c-06db-4279-b5ee-0759ea332ec2", "value": "T1FCE0262B621C3606816CA5E0DC98A6C5B422954EAE8A7DC122CA2626190A36C52D682D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899652, "uuid": "588f05dd-f458-4da2-8665-b6e650caaac3", "value": "6:Q0eoLftLYVJ2/CxVDGGIOyYn7G8GSLh8uWfBNurQV18fQ98GLg+XSc7w9:QwZYVJ22Vyk7G8pGuYBNYQVAQ98QF37u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899652, "uuid": "c8574b9f-d757-419b-a7eb-3939e5563e85", "value": 325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899652, "uuid": "4fac4af4-c07b-45be-928c-e3623e18a136", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899652, "uuid": "e496e405-743a-414b-966b-0339e77fc646", "value": "PAYMENTXSLIP.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3e9fdb-e7f9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682929292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929292, "uuid": "19ea70d6-44ef-470a-9fec-4538e2c62024", "comment": "Malware payload (Mirai)", "value": "ec5e28cb61b7b576df72a8c6ddec81bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929292, "uuid": "7f1f1057-b342-422c-b680-3b6d0b5250c1", "comment": "Malware payload (Mirai)", "value": "36cbcff9485daeb69ba2ca14d846151a6b09ad63068e71a3bcfb5ac7d6192077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929292, "uuid": "389f3cd0-8fac-493b-849b-dc1ef40157dc", "comment": "Malware payload (Mirai)", "value": "48fac58cfaff238b770f3f48c3611ba9644c7b95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929292, "uuid": "73cf2377-b0f8-4e40-872b-0192805c5316", "comment": "Malware payload (Mirai)", "value": "cb1d9516ffd8474cf7ab59d81b095175793a8696cc7ae695ac72a1afbc3db144a3ff1d79604f33dadf33e8497d7f983d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929292, "uuid": "8cbedaeb-6679-4e2b-8b36-ccd9925b9d28", "value": "T19C13F856BC829E2AC6E063BBFA6E418D331163E8D1EF3257CC142B047AC951F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929292, "uuid": "fc2f5b2f-0f5f-4b40-8598-5bfa4a29f0db", "value": "768:PgiM6rEAqQmx6vkXAbW6GBJJamkHrx1HG4AxDoCerC4acOt9PvYP5b/hHp30JOEo:PgiMmEGmNwbW6tg4ASaBPI5b5e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682929292, "uuid": "b5afb18f-42e2-4d84-a1ac-e18d65c8555f", "value": 43252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682929292, "uuid": "3a3a6a08-69af-43fc-ae0e-effaa051b672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929292, "uuid": "d8f34b7b-6c2a-4cab-9e5f-12f6e4895fa1", "value": "ec5e28cb61b7b576df72a8c6ddec81bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bad21f-e819-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682943101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943101, "uuid": "d5d5ac46-1650-44f0-b57e-52e4b6dae96e", "comment": "Malware payload (Mirai)", "value": "cef3038a6181c684add1f073497d7ecd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943101, "uuid": "d1101bad-cb05-4f1b-8ed1-da2ccd59d682", "comment": "Malware payload (Mirai)", "value": "398bf8c8fe5bb6b9ceda5b8f7f7722c2558d0a6b4366fa8498a44ffbd3498b9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943101, "uuid": "563f34cb-1ce5-433d-9828-9f698ec04fb6", "comment": "Malware payload (Mirai)", "value": "82a691aa85f1618d1f7201fb80d66a02e889315f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943101, "uuid": "0943453f-95ae-40a0-9b44-20a9f20a848d", "comment": "Malware payload (Mirai)", "value": "3505ab5f8558ba7c2017ea6aa675888279dde1379dba43baca40a49b00dbd5d5061a9da3c76c96b0ed6055e0ace8eb33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943101, "uuid": "d22003a8-f19a-4fa5-a971-e87ad173e70f", "value": "T1F7B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943101, "uuid": "dfa26660-87cc-4f0b-a382-d641e2980200", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg18/LWy:c9sSyzz36YaWWgg18q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943101, "uuid": "ecc9d330-cafa-4907-ae62-0c6ecd6d3357", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943101, "uuid": "7e2409c1-c2fa-47fe-8cca-4e1bca170469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943101, "uuid": "66b7a2a4-6109-47d4-a90e-3f88a4686223", "value": "cef3038a6181c684add1f073497d7ecd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124ecaf5-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931822, "uuid": "f7e288b3-64bc-4dc8-8276-40f74a4efa98", "comment": "Malware payload (Mirai)", "value": "69e0307ae84720fa0f3c6ad2f29b58ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931822, "uuid": "88c1ec62-c190-4159-af82-4276c748bc77", "comment": "Malware payload (Mirai)", "value": "3ceb9c9202aa1cfd2dc391cf9f2226b982a7a9ed73795185b8d43fd369bc140d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931822, "uuid": "9101d539-4af6-44a1-9239-f97519c3b0ed", "comment": "Malware payload (Mirai)", "value": "d33a4c3f1796910b889b927864a56e48f67d88cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931822, "uuid": "b1696d6c-9875-4ff1-8256-ccdf0eb6ecff", "comment": "Malware payload (Mirai)", "value": "624275271d0669446c20db6e98d22b2905047a50e4c656bd922f0738babe5551bda075615086e092f3c74bc46d05700d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931822, "uuid": "48e46f2a-d336-42c7-9290-08fcb330b959", "value": "T179536C8AE687E5F0DD4609B0207FFB39CA36A8353134CEB7D7C4B957ADE2642905126C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931822, "uuid": "08b6b2af-4bc1-4f9d-8b9f-3841a2208934", "value": "1536:tf4f43n7qfp3yAfHOU3lpuarESpr2HiH:tE43n7iDHhr/pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931822, "uuid": "55931661-f6fe-4736-a53b-8a2b63c15893", "value": 62524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931822, "uuid": "b2a5fedc-1084-4d54-b362-cb1e3c28d9a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931822, "uuid": "86ea1c00-401f-412e-9000-0b4adc187864", "value": "69e0307ae84720fa0f3c6ad2f29b58ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049fdeff-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931799, "uuid": "420f3040-693a-4bd2-934d-0e58e96f440b", "comment": "Malware payload (Mirai)", "value": "87c1968e6828648946344b8575847800", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931799, "uuid": "5e848d46-93fa-4b22-83f2-2834677396e2", "comment": "Malware payload (Mirai)", "value": "3f367c07ff0412c16b565f9e88bf3bde1d02314a6f1458ad5049aa4bf4c21eea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931799, "uuid": "89f37ec2-0582-4ac9-97e1-b5caab8f5514", "comment": "Malware payload (Mirai)", "value": "f92dcf034f9cea97f74399f684e96a45b5910d7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931799, "uuid": "9aae90e5-c45b-4f6b-a5fd-94ab0273edcf", "comment": "Malware payload (Mirai)", "value": "931424507fc78f0edaf8f626a69293b716e63f71cf8acddf0541f70cdda54376a27d6db641a32bf6fec26c14b8b60bb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931799, "uuid": "3fa222d8-af7e-4b5e-83d3-1e1efc3a62a0", "value": "T148530999B401AF7CF86FDAFA4126490DF821720161830F27677BFED36CB20A59953946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931799, "uuid": "f802f120-286f-4392-856d-4a4495c89aa3", "value": "1536:R41jh2OVCr/4XIambQdHWteFWft8fNA8tw:OjdCr+IXbo2d8lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931799, "uuid": "7cbbd3de-7026-49a3-a0a1-d2fbacc8679a", "value": 62480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931799, "uuid": "4bc81604-09ea-40c2-9b6d-4652167b203a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931799, "uuid": "15792bc2-e1e4-4935-9048-c2bc3a523e4b", "value": "87c1968e6828648946344b8575847800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761877f5-e82e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682952176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952176, "uuid": "ae42215f-15a1-40be-b8a4-e27598dd8d49", "comment": "Malware payload (CoinMiner)", "value": "15c433a7e6150e04513dbd9aa9ce0ea5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952176, "uuid": "95b59a2a-1a1d-48c7-8905-68f47588d21c", "comment": "Malware payload (CoinMiner)", "value": "40b0e0661a26bfb921904d98083adb5952df372fd0ff6395994a330b256aeea5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952176, "uuid": "64c04565-c926-4438-b940-629c91543628", "comment": "Malware payload (CoinMiner)", "value": "2a58d957ad9151106999f52a53f8cddca34fc592", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952176, "uuid": "d3ab1f5b-0315-4398-af3a-ed110c066942", "comment": "Malware payload (CoinMiner)", "value": "a98353ef93b6ec3c3e655421928cae11f936fb034b6293eec8d36b8dc6ab8412585dea8ad02b3df3a1be1945ac406008", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952176, "uuid": "265f8520-420d-49f1-b825-a79298e3245e", "value": "T19464BE037188C031F867E8388EDA99709B6D747127AF68DBB7CC1A258A153F075B536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952176, "uuid": "0048e1ab-da29-4523-82df-b8f44dff4edd", "value": "3ad594570c1b191fe2c6f5dfa23638cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952176, "uuid": "2ac661f8-4224-4982-a418-ccbc05384800", "value": "3072:M3X8eHHhvvCBTc2v9UMIbhl0HRjNyehRhtxuXkXZrqL0JrXZDwTFQ8U2+jY9txPh:28eHBvvsf+bhlC7rRpqMrVaffZnsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682952176, "uuid": "90c42173-60d1-44b4-a32b-45584d9729db", "value": 316240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682952176, "uuid": "bba3dc66-736b-46d2-af9f-3e58109293a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952176, "uuid": "7956c7a0-9624-483d-8cd2-e72741e70861", "value": "vfdcs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f20ca3-e822-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682946992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946992, "uuid": "bb4512de-8797-460c-b65b-fe55d7ddfff1", "comment": "Malware payload (AgentTesla)", "value": "b83b85485dc606af059d89ecc742ffa0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946992, "uuid": "fe0af08b-9095-43ae-bf86-37893e2eac36", "comment": "Malware payload (AgentTesla)", "value": "42fac947ed7be43e589d194a49aef65b306055ad3d42ee3b7c9a2b03cda99cd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946992, "uuid": "927bc5dd-ddc8-42ad-8641-05b916994fc0", "comment": "Malware payload (AgentTesla)", "value": "5797a2bc7915d5b83d72451e3320e27c546a6bb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946992, "uuid": "22456aad-d2ee-4792-878f-c0f6c8017272", "comment": "Malware payload (AgentTesla)", "value": "0acb536133a612d0de00989ff6a3fc8aad564ef6d84deaeeed5aee4d14fd3d8e0bf107f152c4a6185dbb56d4a81c7763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946992, "uuid": "9ed04ba2-2704-4f4b-835a-1981aba872ec", "value": "T1B4C47C3C19BD6627C07AC3799BE49923F154AC6F3021EDA5A8C373B60752A4275C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946992, "uuid": "c1fb44a8-85ad-4efd-9ecc-69efde5d8c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946992, "uuid": "5cb889f5-d7c4-4a54-925e-57cd9bed318d", "value": "12288:oRiheKqnAoKnf/U0Ecv57aZ2/q8S2AsSh2nPLk4buB:tqnE5vDS2AsSwLRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682946992, "uuid": "64dcbbdf-bae2-4816-b943-278dd12e50f7", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682946992, "uuid": "c161b307-8c5b-47b2-911b-d62cdf75257b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946992, "uuid": "f5d57376-c4af-4467-a07e-7624844bbb83", "value": "olori.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb09622-e7eb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682923517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923517, "uuid": "cf42e8c3-4bf2-4382-8058-23599b1b062f", "comment": "Malware payload (AsyncRAT)", "value": "541266cef785b743100ad94b12ea7ab4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923517, "uuid": "42d7cb75-306d-4736-b369-daa468f754d8", "comment": "Malware payload (AsyncRAT)", "value": "442efcd3a8be27c0471c1ad7861f92b7741af55ee9f56f7906c1e59989583880", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923517, "uuid": "2b74798f-f823-4cdf-abf5-ae471bf24d58", "comment": "Malware payload (AsyncRAT)", "value": "193d0a5d50fd5162921d5b7e17c64fad0d09d908", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923517, "uuid": "2dd6ed72-12cc-4f57-8bfe-802ab9fc6123", "comment": "Malware payload (AsyncRAT)", "value": "5f16ebbac39001eee152e628a97ae907a81903d6cbcd5d3acef3c5d5fbb4cd027c4f5c67ea5f74027d4516d9f465e84a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923517, "uuid": "389b862d-f609-497f-b3a6-e9f3bb238b50", "value": "T162253A4BBCA040BAD0A9D23189B651917B31F8591B3227D73F51B2B83FB27D85E39364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923517, "uuid": "0e26b205-83d6-4b78-b9d3-93144a5415dc", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923517, "uuid": "2cb221d3-f971-4ef4-ac40-59ac3d5b0304", "value": "12288:y4mT/RcXtvyJdBQhXVQpoDv4alfZqby13caYgd2DiJOWpoZg1:y4C/6XtvWBmQpoT4gcaYgdNOwoZg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682923517, "uuid": "8de937c2-9759-4af8-b18c-def5e1153e9a", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682923517, "uuid": "729683b5-c88f-404f-9198-9caae465b6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923517, "uuid": "fb127498-d393-4fca-9a55-4cf57b4af469", "value": "Ta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f41fe0-e7f9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682929300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929300, "uuid": "06a9b507-5d98-4596-b861-c75fad510cee", "comment": "Malware payload (Mirai)", "value": "520d16375eada066ec895c28cc99dfef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929300, "uuid": "238ce7e6-877d-4eb4-b564-79f032c7219f", "comment": "Malware payload (Mirai)", "value": "443c053ba5762f2b0f98dd91a8a074476a0885a044a05864ed0b46e978a89760", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929300, "uuid": "415a2086-f79f-4405-9103-c6d8953c0da9", "comment": "Malware payload (Mirai)", "value": "a57c26746543901e0c725023f9670cd0eb557b28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929300, "uuid": "ec1e10a0-dd7b-4df2-917c-82aeaccecf09", "comment": "Malware payload (Mirai)", "value": "e19ae55b6a430ec94ccb30ca84e596a6e9544464b38307ffc5e4713a9ae5991033c461f377a00532c5fbade10e7a1168", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929300, "uuid": "968141d4-34c4-4002-9bf8-c680829f6d23", "value": "T118332A51BC919A12C5D4637BFA6E41CD332623A8D1DF33079D262F503BCA82F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929300, "uuid": "6a9d2552-50db-463d-b7f2-c2780ab483da", "value": "768:omso9sEallYUxBTcJ3qbxJ3USFlvG4UbPUWTSh05anSRZvYPvT/hcB3D8nRRePNj:2ooCUxdr04UdaqZIvT5r5xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682929300, "uuid": "39a7b670-3886-4097-ba0d-4709a989c23b", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682929300, "uuid": "ed3ad4f3-ffbf-4efb-9bfc-757ecd1ff780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929300, "uuid": "bd50dd18-550c-4994-a54f-6efe276ed8c7", "value": "520d16375eada066ec895c28cc99dfef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b735c0-e814-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1682940871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940871, "uuid": "f77f4045-40ba-471e-9785-35f7eba3c03f", "comment": "Malware payload (GuLoader)", "value": "de26cfa3b8284bcc180da445870afbb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940871, "uuid": "49be9455-14eb-4d21-9b79-de05db61f268", "comment": "Malware payload (GuLoader)", "value": "4590b8d9933fdb27ee938f2a74b173e7bb923398648d7adbd73991b84b8e69bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940871, "uuid": "d2aa809f-1cdb-4114-8ba1-ad86a83be32d", "comment": "Malware payload (GuLoader)", "value": "aad8dcd4fc174b5d6d3f5332a28365eb8823b139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940871, "uuid": "6944a151-c402-4d0c-ba88-ede7a9c00a6b", "comment": "Malware payload (GuLoader)", "value": "f56620f15a326a1420bbb3e5e73f8ad02b4dcaf2aed246a5432116acbf66dcd8c9307c45107d5ef86cc3604e6706dc73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940871, "uuid": "6b35284e-eb17-4ef1-ba61-72f152dc8cb0", "value": "T101B42320EA20D936E767D17218361DAF4ECEB720A594274B03402F697D35792CE7732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940871, "uuid": "7b0a6205-985c-4efe-af47-c7227f8840a7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940871, "uuid": "8d6b0a7e-8ce1-4027-9d64-31de52a77da0", "value": "12288:Nbbth9ePnK9DgJhi/Q650LrRDrrhCJgkcQ8KYMV:Nb5h9ePK9+cSrVygDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682940871, "uuid": "73b4b3ff-dd9d-43ed-9fb6-02456df03bed", "value": 506360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682940871, "uuid": "88939863-3bd6-4896-9c8f-86d3d4f3c4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940871, "uuid": "38f00243-5d03-402d-8a90-998caa59d65e", "value": "Purchase Order -27 0652022 February 2023,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ada15c-e80c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682937735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937735, "uuid": "926b5131-146a-441c-9d7c-59c1a06896d6", "comment": "Malware payload (Mirai)", "value": "f8bc17bfa2868b43dc115f3650776a54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937735, "uuid": "9ff41b88-0690-43f2-86fb-340a7921e18f", "comment": "Malware payload (Mirai)", "value": "45a1177dbf842550c3614ee2591de64b5ce93b3d501248007df0705b989556b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937735, "uuid": "8f58054f-c96d-4948-8843-1e297a4ff26e", "comment": "Malware payload (Mirai)", "value": "bbdf9ac75b62c58fbbc3b31c69e231533254c74b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937735, "uuid": "8a709e8f-e298-400a-8204-f78ca0c1450d", "comment": "Malware payload (Mirai)", "value": "889460498d51ef80727c3fd52ab8af12528dcd3e0c04f7d5670f585c414aa3e2335728a8034fa5be771dbcb58409dce1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937735, "uuid": "6afb8aa3-db24-450f-ba6f-670a770fdb52", "value": "T186534CD9B4119E7CF9CBEABE88224E0DF821221154931B27BA6BFD937D32194DC52D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937735, "uuid": "3aca9c4d-aecb-4680-b9aa-ae9bdca42b46", "value": "1536:j0aRfwJ/mebn9ykMBx7l88g1pTGtF5LR5kSF/zlqs178X:jk91y8xpqXlR5Vqy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682937735, "uuid": "1620fa6e-a004-4701-bd07-678497d4c55b", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682937735, "uuid": "e0b43353-6d7c-445f-94f2-e9aa557c108f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937735, "uuid": "fbb356d5-5e8f-4d76-a09e-51dc4acacd6b", "value": "f8bc17bfa2868b43dc115f3650776a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982bb4ca-e7c4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682906707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682906707, "uuid": "8d5f6c45-74a6-4924-92e8-38869aa0d637", "comment": "Malware payload (njrat)", "value": "b1f0b5a3061e262de69957471a31f9c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682906707, "uuid": "b4ad7ec2-0298-463c-b6ef-94537fb2d2cf", "comment": "Malware payload (njrat)", "value": "46f7ea749ee61e7399bc5c44fab5bebbe3583ca81a007df09544c50474aea17b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682906707, "uuid": "fcf10dc9-61e8-4bab-9618-436208995f49", "comment": "Malware payload (njrat)", "value": "1654ce13f0254d54dd4446eb6494df16870f7fa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682906707, "uuid": "3cfa0de3-89bb-4b33-bdae-e1814f386bfb", "comment": "Malware payload (njrat)", "value": "488495dfae5169a93f50aef203e34c5576aae4530f606580c337dea58a7240ac80df29f0d8c84f039555c0e84a75e85a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682906707, "uuid": "5a5ab789-501f-4b17-9fbc-4290596163a2", "value": "T17E033A4D7FE18168C4FE457B06B2D41207BBE00B6E23D90E9EF564AA37636D18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682906707, "uuid": "bd11e325-0d32-42fa-9cb9-616c1fdaed76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682906707, "uuid": "7b5eeb90-a1e9-4726-a817-3d2fff8a88ea", "value": "384:424fVSikmT0NVtv/Vey0b02f1MseiXCZrAF+rMRTyN/0L+EcoinblneHQM3epzXY:VYXO1VV0b02mVisrM+rMRa8Nuxe9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682906707, "uuid": "468fbbb7-face-4025-ac9c-54657e792200", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682906707, "uuid": "2f8c41e6-4edd-4119-a002-4079013813e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682906707, "uuid": "f823fc67-5099-4c88-b733-6dabc586868e", "value": "b1f0b5a3061e262de69957471a31f9c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e194d072-e821-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682946773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946773, "uuid": "6a7b38d6-014d-4dd4-a54f-d90fd2271e4a", "comment": "Malware payload", "value": "69fe3ecb06e11e09eea26b20febe6027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946773, "uuid": "1f10e29c-fff6-4104-8617-ef2e104bf4be", "comment": "Malware payload", "value": "47051881b278348d22bf73a388788f982b247b98ee43bc3df25360da8a5583da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946773, "uuid": "f6691235-029f-4fb7-9690-10f25ac01431", "comment": "Malware payload", "value": "dafbf3e60df7a36096d9316f04c041817376899b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946773, "uuid": "899d7c47-e033-4498-9057-b6ebf61610bf", "comment": "Malware payload", "value": "7e850677822ec839416dbfae25328fd0d0b40771a1697f8451eb419d9a9f4fc72cb3c4e5e87844e92983774510b4194f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946773, "uuid": "d91d604e-8136-4b27-8974-b0f57928fdaf", "value": "T14B268E03FC9195E9C1EAE230896292937B71BC895B3163C32B50FBB92E767D45E39314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946773, "uuid": "82adec58-2dfc-482b-bd04-624bb44ae6e9", "value": "49152:uPk/qiVmarb/TFvO90d7HjmAFd4A64nsfJRkEIoE4v1hX0qus5EzaWZgY4CAnKQ+:/m71NEOqQrgHmOsGamHJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682946773, "uuid": "9d195eb1-c74f-4cc5-8955-44a159ddcece", "value": 4704683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682946773, "uuid": "8bdb5edb-8570-417b-ac77-7e8f2bfbef1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946773, "uuid": "3dfd704c-b0fb-4514-9449-1f699cfa0609", "value": "blid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e050df5-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682935842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935842, "uuid": "a7356634-5764-48cf-b59c-f057ccfd28b0", "comment": "Malware payload (RustyStealer)", "value": "66d9c9420d69991674c5ddd2e7767f74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935842, "uuid": "62dd2f8b-ba6d-4f1d-adaf-811cba12f35c", "comment": "Malware payload (RustyStealer)", "value": "475933d5a366f52fcf46423b47b3c42ea53c43174a42cab1b9f65db0785c71d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935842, "uuid": "a7b3fd51-6992-452f-9c1c-d807109878b1", "comment": "Malware payload (RustyStealer)", "value": "856c51cdc2c779cff7b7b2e9ff410f5874b88ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935842, "uuid": "354bbbde-39db-4c6e-a9bc-e8d01fbfdf10", "comment": "Malware payload (RustyStealer)", "value": "059da77e09b1d12715e3aa9395bfb868805ec4fa59446e7b46e53d28b6d15f8e2c7f143f13efe9ccaa0d9c8bd49b6ed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935842, "uuid": "d215b531-7b24-4e36-9c5c-18a115675781", "value": "T122069D03FA9546EAC06EC275870B5223EB72BC4A4B20E79B57D45A323F13B605F6D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935842, "uuid": "98012da8-e7f1-463f-a5de-5674391042a7", "value": "0fa6abd5edd1ea3b4502eeb25b682f8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935842, "uuid": "46f9e4a1-0e35-4154-a90d-2ed5a0af6911", "value": "49152:Nlsdz8EuPBVJiprvXSRzPuPj0g9480SOrQ7wGVhiXiyVvU1+8FTmlJs85nBxvsXH:XsdqV2vCR8QSOMSXD+FeJsXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935842, "uuid": "e7fc7d1d-8095-47e3-a5ca-305d71897ed5", "value": 3971072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935842, "uuid": "0aed025b-918f-4508-a5fd-cad7d46cdd7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935842, "uuid": "9805fa4e-d513-4498-9e79-37eb6cdf72d1", "value": "Lxixxxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37eda4c-e81a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682943770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943770, "uuid": "a10ada71-e28f-4a48-9fd3-fc80db1cf2b1", "comment": "Malware payload (Mirai)", "value": "276b97b22902dde478534f60aaeb3105", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943770, "uuid": "40f3dd27-aa04-4853-a11b-356afce022b0", "comment": "Malware payload (Mirai)", "value": "4a885b1ec7b57c5a19e75fcd59891889c858b9c775ea2e0c7f37d9167196c487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943770, "uuid": "7ce4dc9e-c524-4f09-89de-3087a04c748a", "comment": "Malware payload (Mirai)", "value": "72b05e94974d6bd55f873a129ff3dd4fdcf8349f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943770, "uuid": "0acab910-7d68-46b2-824d-688248c010ce", "comment": "Malware payload (Mirai)", "value": "afaba68e9eba4e2c388870de4508394efc138296ae6245a00574b3623504e8c4a34085bd531266d2460869b42cf0331d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943770, "uuid": "1aa277e3-476e-437c-aa9c-ce93c6788c37", "value": "T1CD432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943770, "uuid": "cae2c576-e1a4-4aff-90cc-558a9b44f4b8", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwN:RqtmZPuutfbltZFBSJsBcfDSTFI+BEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943770, "uuid": "283a94a5-659d-4b69-9274-a9c155f31dbb", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943770, "uuid": "03660105-de77-494b-8b0f-4ae3327b81cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943770, "uuid": "71b87e61-c875-45e0-a14a-d908ce09f58c", "value": "276b97b22902dde478534f60aaeb3105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00869e18-e7f8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682928786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928786, "uuid": "93a8fc4c-4882-4681-ada7-3752ea239841", "comment": "Malware payload (Mirai)", "value": "bfde08578515eb73436901b9dcdc2b39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928786, "uuid": "8d3b1f5f-c7ad-464d-aa64-da5049e287c8", "comment": "Malware payload (Mirai)", "value": "4c0dba39563490f65cce7d175064447c0173c0f6d7116b1a7147e46409062ee4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928786, "uuid": "13fdc44c-a53a-46dd-a8a4-2012119a2d4b", "comment": "Malware payload (Mirai)", "value": "b68bbf3b0519215851974845f013332154bae209", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928786, "uuid": "deeb33c9-de36-41e3-bfc4-6820b30f5157", "comment": "Malware payload (Mirai)", "value": "1036cb5ab1fa06438c4815b7107b7d950b61a59b88195001b29698e8b7d5666d1fc99dcb033da68859dac3c176dcd2fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928786, "uuid": "12ae38ca-86e6-4644-b69e-8819ce41bd87", "value": "T1BF137EA6C46AAFD4C11446B4F8358F781B93F4008B676FF65A8985A28053EFCF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928786, "uuid": "7e93095d-5129-4765-adcb-4e9cc94e5450", "value": "768:Aaf+ywtYjrNqGFZFeVNOa3gri3HJJ/qdCboL4ZCC:AaWywtwDIEri3Hr/qdf0ZCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928786, "uuid": "0d0a3a90-d257-4141-af77-6837dcccc699", "value": 44736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928786, "uuid": "d0bd2bf0-7ed1-4f54-aecb-aed4ef35a52d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928786, "uuid": "e6da6347-237e-4da8-915c-c9d468becc01", "value": "bfde08578515eb73436901b9dcdc2b39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1e976a-e81a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682943788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943788, "uuid": "fb904f68-1c0a-413f-9aa8-ece15b4c351f", "comment": "Malware payload (Mirai)", "value": "06e0a8e0782dca5937da25b7203f5433", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943788, "uuid": "bc99ac76-3249-4df0-8767-f1c61bad59d8", "comment": "Malware payload (Mirai)", "value": "4d034d11eb110f0c232938ee17d08c7685c405f4862612a2acb76d33e3d1d69a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943788, "uuid": "2d675444-f5ca-4bec-a909-320aabed9aba", "comment": "Malware payload (Mirai)", "value": "c037d2a1d42967fc521cc3d40a0e028bf99963da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943788, "uuid": "d86464f8-0cf5-4997-a705-478093c320c5", "comment": "Malware payload (Mirai)", "value": "8b3885226a2cacafdd6cbcd17b28b6002252ff6e870f2c654e595bcd3c4b038bc898ed1bbd977e56dec0aea99219a503", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943788, "uuid": "3c6507bf-8d21-4794-a038-85c73939a3e4", "value": "T178336B36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943788, "uuid": "89792398-aca3-4059-a5e8-ab2297838903", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943788, "uuid": "d921555d-d5c3-4257-be41-5fdd73de9030", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943788, "uuid": "a433e034-e811-4f92-b5cf-ea8022fff364", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943788, "uuid": "09567209-1621-448d-bd3c-e11c42d85144", "value": "06e0a8e0782dca5937da25b7203f5433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671079fe-e7f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682926811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926811, "uuid": "d6ea31ad-5dc3-4cc9-9db0-7860e027d222", "comment": "Malware payload (AgentTesla)", "value": "66575f3e66a7ad6eebb6d4d8e0a89119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926811, "uuid": "28c8d8c5-1d61-4650-b776-58fd89c7f66e", "comment": "Malware payload (AgentTesla)", "value": "4e2f902a6157d7799507b7f68c908c9a2527faba55d4a8b5491906b8b27742c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926811, "uuid": "b47a05cd-55cd-45b2-9b05-7b8428d52834", "comment": "Malware payload (AgentTesla)", "value": "49940689ac09189eb4897ef76454da9aa4fcd5c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926811, "uuid": "e396e59c-f436-4bc1-8656-c5a2582edca5", "comment": "Malware payload (AgentTesla)", "value": "f2157719321a795c782d7e2ad658486a79301f4f4f1c84f515e09f5792da30b7f56b5220fb13f6bf755b0ed6a866982f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926811, "uuid": "b8f1dce5-bb42-4a18-8d17-a9cfb94b7a76", "value": "T1CE05E67C2578E96FC17AD5618ED4CC67F320A16B33069AE6AC9303584309B52B9C71BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926811, "uuid": "ca47243f-01b5-431e-8337-913d51a7448e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926811, "uuid": "f5adbbf3-87f5-4e57-946e-67fe2b9fa0a7", "value": "12288:Onl22iQSkHZWMGqrCLQTLPtcY4UC7/DgsdSmUdgY4QuIK9Yg3XMU6EAl5:fkWZqmWtMU2/Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682926811, "uuid": "d6cd09e9-51d0-49f5-83d5-e8c8aadf51e1", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682926811, "uuid": "76b9997a-2a6c-4230-9095-1b57b7e12412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926811, "uuid": "e498b98f-2d9d-40e9-869a-bdc7e35264a4", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19664237-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931834, "uuid": "5af2ab9c-8478-47ee-97df-3837bfe2644b", "comment": "Malware payload (Mirai)", "value": "44ba8a2e1c8e27f0dc3f62571fcc008b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931834, "uuid": "d0112154-2fbc-4e53-ba73-aa06ca507c90", "comment": "Malware payload (Mirai)", "value": "51b16f6ee47efacd522d0b43ec5164ae259761bdd213b2b3880e69da8707d6a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931834, "uuid": "c06fd8e1-c23f-41df-9393-90ebdc5ff7e2", "comment": "Malware payload (Mirai)", "value": "674cacacf866d4322c967e50462fb5ac9b150072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931834, "uuid": "ea14428c-3b61-4ec8-8cf4-9ade2edf9c23", "comment": "Malware payload (Mirai)", "value": "502d458f820060b08c831de137d4c6a5c5992d3267206eb4d29993e6a8ea23d05891b73e48ee76764012289025e3779c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931834, "uuid": "0e5d27f9-22ef-4ce4-b466-85313c547ec2", "value": "T1C7537C16A8391E17C0E4A5BE12FB8B69B2F4364E04A48B9D3E360F8FFF515D4A907174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931834, "uuid": "197e08f2-d7fb-4cb9-aaf5-ea27ee45cd37", "value": "768:u9s7aZkaQTo4+6sNIaejhjTLGmB46SavbiGSy1B1SeeiuH7DCqyIUOwhQ1cgbHXA:7cQTb+6sNIaejhj/GEOGQOeX7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931834, "uuid": "2705e718-eb24-4c83-920b-984493460af4", "value": 66568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931834, "uuid": "124ad8f5-373a-4267-b58b-68e5a0556c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931834, "uuid": "70f220b7-e1be-4d2a-8536-a9bbf374f173", "value": "44ba8a2e1c8e27f0dc3f62571fcc008b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf242c14-e7e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682920516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920516, "uuid": "38fb7870-3c82-400a-b0f8-7f42e5e80304", "comment": "Malware payload (Loki)", "value": "c8551525cc288ecb695607c9d54bd9f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920516, "uuid": "cb3487cc-ed0b-4b46-8eed-293ae714f67d", "comment": "Malware payload (Loki)", "value": "54ce28992dff46801741011c4bc6f2f893dd21cb5cabe7d59214e584279a7fda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920516, "uuid": "0887771c-b494-4488-8e80-28aa152572fe", "comment": "Malware payload (Loki)", "value": "51e38e08e922c2a729a08b9c075f4f22e0264178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920516, "uuid": "ff674121-3427-49e6-adf9-f399748b7d68", "comment": "Malware payload (Loki)", "value": "98cdf8f5c0dea6d989095f1ad6fdd4afa32e0c418a0fab182b4d6b050f7f3a72a567532b79b3d6bfe371abdf9b2ba4f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920516, "uuid": "271a3a19-8b4e-4dc4-9a53-31a757e9b332", "value": "T187D4D0532014C98AF91DC735D478FBF062B8BCB3E8D59523277A7C89F9F6B42190825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920516, "uuid": "7098e4b3-120e-483c-bbb1-3881a641cf8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920516, "uuid": "b8a5671f-3f50-4631-a189-5846330f39e5", "value": "12288:Gmtdo0j8hi7jqnn/+z8D1Qa+4zckgUenOX:P/1j8Qw9Kh4f1G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682920516, "uuid": "5d3c24a2-9a65-42db-b996-232c9eff5c09", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682920516, "uuid": "b4cbf44b-6ef4-472b-aef0-b8a46d883e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920516, "uuid": "22f2d103-1ad4-4f59-a5a8-8a80d663a82b", "value": "7120820INTRACO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe392dc8-e84e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682966148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966148, "uuid": "de29421f-d2f8-4f2e-8e5e-204662a3f38e", "comment": "Malware payload", "value": "f5a37d4f36a2e659071f8f188fd454cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966148, "uuid": "cf7c44e6-b465-4046-ba22-17e66f22308a", "comment": "Malware payload", "value": "55038b0ce36e4b2db39c3e41c14e3f05e128ea81f976df55916b2b77e47e041e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966148, "uuid": "83e366bc-c10a-498d-9ff4-3c1527ed37a5", "comment": "Malware payload", "value": "59759c83644d24963b9fb7f920ad33c21c8ff99e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682966148, "uuid": "0faeecde-f12a-4cf9-91a9-52766c2e5ae1", "comment": "Malware payload", "value": "0c8c1880234a5520bdc767356c821d48bf9a0e67aee1c1da54ad2c6f9bce152ff3dee527e3d9fc2ae57dc8e7ba50a8fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966148, "uuid": "d032f896-a5cc-407b-8988-3e5113a6540c", "value": "T1E6C5332645E3D570EE15CFF00E73CC008F2977BB5CA4592EBDAA4A886B7F2550896783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966148, "uuid": "8357bf22-2c5a-48c0-a84c-2b82fb241e60", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966148, "uuid": "2b494561-1390-43dc-bbdc-528a60352bb2", "value": "49152:MDmsCKJVTU0Q2uq7XvoYPe92Iv3ThrmM/jbmlYKpZKXpWytP64AG5cc:MisCws2v/oYgf3t3O4Xp9ZvXcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682966148, "uuid": "a8e26091-3f6b-4f46-bc7d-eb1f173bdc43", "value": 2544422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682966148, "uuid": "a8e178f9-0c0f-4a85-9d70-d290bfb527c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682966148, "uuid": "c4d79f7d-61a0-471b-9980-24fa5ffe07a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9583382c-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1682935908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935908, "uuid": "fc014497-fdde-4c96-b135-4311294b14c6", "comment": "Malware payload (STRRAT)", "value": "037774674bc238d188d0b838bdedeaf1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935908, "uuid": "a6b8c611-a797-4982-9778-b9fa064682f1", "comment": "Malware payload (STRRAT)", "value": "577bd350eedae345bdd3d56abb8c897662a9ccc081fddfeb045e4b2ee2875df2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935908, "uuid": "212e2a5f-f32b-4b45-807d-8dd4ec45147a", "comment": "Malware payload (STRRAT)", "value": "a84ba0a296247c33a8146813394c86c9c24385dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935908, "uuid": "427f041b-738e-4145-b7f5-4672aedc28f1", "comment": "Malware payload (STRRAT)", "value": "7b647698aa26b44853d5a65061a720dad1747e9acf47dcf395ede96760c443f3aca1f6a19746beed7a7f693f872c9f7c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935908, "uuid": "c475af01-8db2-41be-aa19-0b66882b134a", "value": "T16FA48D889F84272F9BB0511004FE6792AB90569C3D34D49FCE6A2B4EFF53698E1325CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935908, "uuid": "d59ccfcb-67f4-4d90-bb77-6ca452d416d2", "value": "6144:MQP0B0b42kI8XCNB5yZdtUTz34rbEOLN7w1ZmaYYP1f9wFJpatIS9ay42LxQtKSw:XcK5OCoZNcT/5apatIxjCOrPmIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935908, "uuid": "cd5ffde6-ffff-417c-8bea-6617d2b3ffa0", "value": 456524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935908, "uuid": "6ed09feb-4641-4c77-8ea2-a17e035728f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935908, "uuid": "aece806b-3532-4d79-8074-aac0a547ff87", "value": "Doc99474866474222WTD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6faa64d-e80c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682937709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937709, "uuid": "6f6a65ec-502a-4049-8f77-be4cc96bc7d1", "comment": "Malware payload (Mirai)", "value": "c31bda26ae4e2dcd4311988ca2a4f14c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937709, "uuid": "c0cddd36-f27b-4bb8-842f-d8c7e027beae", "comment": "Malware payload (Mirai)", "value": "581c00053f9de3dc7a7fb316c5de31a80b298ae403250bcc960b59c9ec7ad2fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937709, "uuid": "65bcb8e3-36d6-4665-ba84-1653fdee3247", "comment": "Malware payload (Mirai)", "value": "901a123ca8086d8cc17a1e50f4e1b8d999a0edbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937709, "uuid": "b58b5be4-0c50-405d-98eb-05ece4e46cd0", "comment": "Malware payload (Mirai)", "value": "04d3a1d8c3c5290ca018531b1e3f06b23ebf4b6c2db39f5fa5c15b69ada782388fa61c11eb53ba95b09ef515b5ff4ea0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937709, "uuid": "391292ea-dd25-4dae-9594-51aea96139fa", "value": "T1E8C2E1B1D10E8DB3FBBAFEF04A81D9E23F86479D1891ECD26055BB25067283D55009F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937709, "uuid": "00473699-45ed-4d9f-899f-f373988a5a1a", "value": "768:z9xqNa7PqLefxslATOTIAA6Q7dHGKKdPBKp0+OweA4uVcqgw09A:iNLaxsl8X6+dDePQwG4u+qgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682937709, "uuid": "7c3c8bf5-8230-4980-9f88-46636c272276", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682937709, "uuid": "a8b0d9c3-7c05-46c6-9aff-0131a0bca226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937709, "uuid": "fe68eb4f-7853-4954-890d-712d8cfbb8c3", "value": "c31bda26ae4e2dcd4311988ca2a4f14c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7c16ee-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899976, "uuid": "70af8c87-4ce4-4931-9538-b778983af771", "comment": "Malware payload (Formbook)", "value": "e1def58ae94bc89d5bcf50dde9d9c79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899976, "uuid": "a8b52501-c230-4839-9efd-f55281d778be", "comment": "Malware payload (Formbook)", "value": "59393e44f0898bff733233dab3423c0a682c583886d87897f3ee184fd0acb3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899976, "uuid": "656d8f77-88e5-4e35-a9fa-7cc6552e5122", "comment": "Malware payload (Formbook)", "value": "5c5a6c28f7778f144078c156bb7139923fc8185e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899976, "uuid": "22e2ce6e-0be3-482b-a0ca-9a84bd7800e9", "comment": "Malware payload (Formbook)", "value": "f5c9e169e2e344654bad4023c4ba54cfafd7c65be18466fabfb232824786ba5532adb1c14b43344a89703f689ed4de34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899976, "uuid": "2cbf4e52-f47a-4251-a34a-965174af934f", "value": "T102A5BC33D59E180EE133BA36A6E5721F5A5DFEE2071FA5D604412B4B5533E80CF88E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899976, "uuid": "3dea2975-0183-45fa-bf5d-efe28c9ca506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899976, "uuid": "056c5baf-c15a-42f8-a72a-8cc8c59e5ead", "value": "12288:rdtprgYPd4ZMr6OyVLTodGrAAeZpREEDOwEjs8H9AdXM6fVWWdzwWDOUdgOxwr:0fwhfMWDOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899976, "uuid": "faa04079-1364-46cf-9e20-5d448afc85ff", "value": 2091008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899976, "uuid": "67be14d5-8b42-410b-ab88-62ae68216de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899976, "uuid": "49f844e3-1dab-4a9e-be5b-73221e074643", "value": "PO84100036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb8a667-e863-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682974956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682974956, "uuid": "36fd8995-f953-4513-8824-bb4a323feaea", "comment": "Malware payload", "value": "0a1b44ca37e95c9375b11bec1452509b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682974956, "uuid": "ec47fb23-eead-4111-8e85-9e073f7bee0a", "comment": "Malware payload", "value": "59d0a86e29a877fe6ab943b03f01a553274e626eb5f2da49605b98aaa23e6ab4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682974956, "uuid": "c7a9bb63-6381-4d40-a4da-40b04872a45b", "comment": "Malware payload", "value": "11f7a6277cbb38a894e75e9b6c24f634f9fcb4f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682974956, "uuid": "c6aa6002-3cf5-40e4-98f1-3e5363563025", "comment": "Malware payload", "value": "82357b3573a5718eae6b1aaea6ccb2482f8f230bc9b735fee8436cdcfe6021bf7a5426e87ad56d89c814264d7aee6b61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682974956, "uuid": "4ee45d8b-ee2e-4e64-ac0d-59781397e3fe", "value": "T11FC53312E7E206F5F9A38FB5CDA6D270C01FF5113E281A651AC94A5ABF335B12D01A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682974956, "uuid": "ba00e296-e6ca-4861-b801-b1807742d9b6", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682974956, "uuid": "770681ab-241c-4dc0-b066-1e7e1f1e6c1a", "value": "49152:cuz79lP+G9onylZ2oujHZ4cDiggzN18fOcaBC9qEdSIAG5c0:cuv9RprlslHa7N18/7qERXc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682974956, "uuid": "446a5a1b-62c3-49d8-908e-86b7844dc221", "value": 2520934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682974956, "uuid": "3727fae1-b6ed-4858-a9d6-bcabcbbc18e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682974956, "uuid": "48732a16-bed7-43f6-a754-6da65458494a", "value": "0a1b44ca37e95c9375b11bec1452509b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2fd123-e819-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682943118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943118, "uuid": "d0244483-1449-4522-a4fb-ba2eab78b012", "comment": "Malware payload (Mirai)", "value": "a40f7d457e155807e6e8ef526a085405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943118, "uuid": "15759421-8b01-4199-9721-48e191452583", "comment": "Malware payload (Mirai)", "value": "5b323f9ff758c2eef56897d51d0b732eb495fb1b6a5b760c5fce3fcdf14af8ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943118, "uuid": "16be94c6-fa11-4442-8082-dddec558eabc", "comment": "Malware payload (Mirai)", "value": "da9294f7d2ca1fb0eba8050b3b3ec4c106053984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943118, "uuid": "82ffcf67-5d21-42bc-a96c-baa6e3073f60", "comment": "Malware payload (Mirai)", "value": "abd4126660ce80da3cd6c4f2034350b6bb61712277489b7374ecb467c4d8e7c6ebe235c63ee3cf176c61431ac4065650", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943118, "uuid": "466295d5-1e26-41e6-bcc0-c20c0fb777fc", "value": "T154C2E1E0B726FD31C4206C3DE53A4D8A3A51067C90FF353664158D399EC2A5B66F48F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943118, "uuid": "28b07a82-86b9-4972-b439-c8a81329e321", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrs9q3UELuk:NKy4qfqoeJdXWg1LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943118, "uuid": "27e88701-350e-41b0-9440-124ed16c4140", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943118, "uuid": "917c2bae-1351-4d43-a58b-e9e658b0113d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943118, "uuid": "99e2a42a-9583-4d61-b44f-ebad257457f4", "value": "a40f7d457e155807e6e8ef526a085405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67c4114-e833-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1682954405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954405, "uuid": "7a2b02ca-3f23-4018-b758-9e123b08aeb6", "comment": "Malware payload (Vidar)", "value": "adc122aeeab23cbc5acbd04f770da00e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954405, "uuid": "b8bde437-87cf-4e00-b499-9ebbbc0a13bc", "comment": "Malware payload (Vidar)", "value": "5b3e2470f8de7440ab314ccf5808706253c07463bdb05f70662af67f1a36263f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954405, "uuid": "d8b995e2-be67-4d51-8857-b93bae4b7dc4", "comment": "Malware payload (Vidar)", "value": "421f4b6aa96c97a6e46b322be232850726b90e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954405, "uuid": "03892074-ad57-448b-b40f-43e72cf03fe0", "comment": "Malware payload (Vidar)", "value": "d76dfa80b2c9336d38248087c419713f1e2e880065eb7ff6938dcdd67b9d1650d8a72f828bb441bb57e995a219010233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954405, "uuid": "a99a5b1f-1db3-4ed3-a261-174a136e6770", "value": "T1752623B312641489D1E8CC3AC53BBED4B1F11BBB4E41E978A6D6B9C520327E2D2179D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954405, "uuid": "4eb65a73-2236-41d9-a3e2-13a95c85e5b0", "value": "ca91f2a8cc23c203b59f83be0b2f7aa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954405, "uuid": "4e479c38-d59a-48e7-8dc7-4af23666a606", "value": "98304:CZZ+YLKd3+a+Ogu+FPQR4J4EHTN7jmXbemSY9jItS:C3+qKd3+abr5+4eJmLepW0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682954405, "uuid": "3a4983d5-60cb-4c4b-939a-45f398e25e08", "value": 4656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682954405, "uuid": "bfeac27d-36c3-400e-b3ca-d1dcce83c451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954405, "uuid": "957dfd08-5ce2-492f-a413-f46e9e9dfaec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5ea3c7-e800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682932623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932623, "uuid": "c3e03f4b-dba4-4e23-8521-96397c53d8f0", "comment": "Malware payload (AgentTesla)", "value": "e61d0882655e1080a96b81b9fca39347", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932623, "uuid": "d95fda67-b42b-4ec2-8f6e-861335e8083b", "comment": "Malware payload (AgentTesla)", "value": "60abd6ba380e92af4fb614434417fb71ea27f5eddde211cd189f8db0aba401e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932623, "uuid": "ffe67098-3653-4094-b8bc-2cd31ce2b02f", "comment": "Malware payload (AgentTesla)", "value": "59d72de7fe52de9d4495ad3d771ee6c854e7d64e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932623, "uuid": "4ed18b34-e366-4ad6-9e30-f5af85049bb3", "comment": "Malware payload (AgentTesla)", "value": "beed9ec0b6dbed99c22e5a6b5d28a2533775ae9c55e6c6a139d14f6ea0a26e8a10cb7d58c5d4bf0ffabde469d33e440d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932623, "uuid": "5a3ddb0d-dbee-4f76-bd80-dfe1e2a68edd", "value": "T12805483C19BE263BC179D7A5CFE0C427B514A8AF3121AD65A8C747A6434AF5235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932623, "uuid": "05e5cd13-b051-4ff6-8b00-26a390613091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932623, "uuid": "69edf4c0-6868-4384-bfef-3586ed920fcf", "value": "12288:wy/9WflU/9I6Fs+391oaNsigP5tbtESErRk0yVvSaCFXtRd7s5jxc9gB:lylUTs+MNigDtESEFoaaCV9QjIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682932623, "uuid": "fa040846-d078-4e49-9cd0-723806352322", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682932623, "uuid": "21f3b788-e4fb-4686-b269-fd8aaf6a6584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932623, "uuid": "f5c97cde-213c-46ac-a8bd-93948d8a5839", "value": "PDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed92ea0-e7dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682917428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917428, "uuid": "7fb407b7-6a6f-4123-bbde-cda0b9d0d6fb", "comment": "Malware payload (AsyncRAT)", "value": "97845eca9567226161ecac97a9cfdd4c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917428, "uuid": "c398c46d-1cc9-4ad1-9cdb-51e5043787e1", "comment": "Malware payload (AsyncRAT)", "value": "60ae5794afacdc55c75268040eedce59d20776dced641d2cba250bd768359d8a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917428, "uuid": "306ead8f-7ade-4fec-85f4-9a2ca39e1911", "comment": "Malware payload (AsyncRAT)", "value": "c5cdb968f6532d56777afec6276073228ba9df4b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917428, "uuid": "66f581ef-158f-4b19-a511-66139daf8d29", "comment": "Malware payload (AsyncRAT)", "value": "c229741e7a8bfa47fdab13fb8fae76d9645eadc19c217adc4db44599dfde44af8fbb179fa15c2d531d69e1a6aa1577c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917428, "uuid": "4c7af0a1-fc74-4896-9f76-6c38c642300e", "value": "T13763F7053BE9911AF3BE8F7469F6628546F9F5AF2912C51D1C8810CE0632B829941FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917428, "uuid": "efc3a096-c741-45c9-8ddf-11bd7c5f618a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917428, "uuid": "c329cb2e-ba83-4ee0-8bb2-7dd5b0cc9986", "value": "1536:J2wukvF1ak9gcKu5UYF8d5cO+vXMbztfuoKMCqorQTGpx:J2dkvF1ak9Ku5UYF2crPMbztfiMCBGqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682917428, "uuid": "8950a677-033f-4ecb-8919-db8bbb5b950c", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682917428, "uuid": "b5bf3b50-23dc-4b41-8e49-bdbae49a80c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917428, "uuid": "598deae7-08f8-428b-95ef-d931ee394d56", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ad3518-e812-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1682940022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940022, "uuid": "71c007b2-f256-4201-b7c0-f70727820f24", "comment": "Malware payload (NanoCore)", "value": "c98de529cef3f418de14bccdff7503f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940022, "uuid": "706a0657-beb5-4671-938c-2c88865758dc", "comment": "Malware payload (NanoCore)", "value": "62ac819f738f75c7840ae6c91a53ecabb0c711b37ed6cf022f9d1a605a523460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940022, "uuid": "a71dfe0a-73ef-44ac-a972-ffee898426ef", "comment": "Malware payload (NanoCore)", "value": "2c298dfa121cf12fa95ea0af2fbb75f74a809f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940022, "uuid": "8a50b74c-61ac-4a7d-8303-55ea6425451e", "comment": "Malware payload (NanoCore)", "value": "dc888e09ece1df018d7551675e57fb5fd0a27f84444a1d4b449c58e11b561234501456445cfa1273428ee9919f10ec6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940022, "uuid": "8caad805-b36d-47f0-9dd3-1002eb66e46a", "value": "T10874221433D5C0BFE8F6CFB01E75152ADCD2A413D8B88E5B8372590A7E12994D71E36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940022, "uuid": "1d968ea6-aeea-458a-98cb-133852c04611", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940022, "uuid": "d07fa560-58c4-4e72-9196-48b987b6b993", "value": "6144:/Ya6jdFlXUcGuS1fgB8XagGObNYmxnHzCs9687k2oYgUhFaHh/yivF91qnM579DK:/YhNUcGuygCa22sqsD6haOTD1xNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682940022, "uuid": "e47c0060-10f3-44e7-beec-9086f3f68043", "value": 344896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682940022, "uuid": "744427e1-e2d7-4307-a37c-b3f3cdf1796b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940022, "uuid": "cbbc979e-e8f2-455e-ad38-da9fa8b58e0d", "value": "Signed Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61fd61f-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682935989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935989, "uuid": "fcc96c33-a24b-474e-bd9e-c524824c08f8", "comment": "Malware payload (RustyStealer)", "value": "34db03585e43135de8d0944cd15781ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935989, "uuid": "1c8b8ee0-dd46-4a40-8f47-4b2e7ad1190a", "comment": "Malware payload (RustyStealer)", "value": "63bc0424f515ed76125bf3f7d77a47a3da77a9a52d7913a273fa0bd8e5189ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935989, "uuid": "930d1d24-3554-4def-83c8-8c86cbded837", "comment": "Malware payload (RustyStealer)", "value": "c5be4d907b3864aa7d05d6c6af751efc65b583fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935989, "uuid": "48e849e2-7741-4bf2-a801-7e91608ad851", "comment": "Malware payload (RustyStealer)", "value": "1d0689606c9b30b6951741c8b38e6b8df4d6030e0a2103873d65ea4c8b8a4a408f942aeacc4780623ee396ccdff89a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935989, "uuid": "ee58f361-40ef-468c-a5c8-3a93561d617c", "value": "T101167C03FA9546EAC06EC274861B5323E772BC4A0724E79B17D45A723F13B605FAD398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935989, "uuid": "4ee94a50-dff6-4d58-a551-61791b538386", "value": "867f8d99a619345d9a11a8961527be79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935989, "uuid": "df152a91-d399-4af5-b48c-a45dea53a660", "value": "49152:X+yKgmnByOdPH9k995XjVX6Jzf1QQ43CAAeKxTkA9T+Gm1hkJtyL0ZVnulDkV50j:uyKLdw91jczN/TkKF7JClTvvXvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935989, "uuid": "7bbccb53-e2fe-4c1d-b852-1cdaedfb496f", "value": 4044288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935989, "uuid": "8b7fbfd5-c8eb-4142-9378-f9606b845fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935989, "uuid": "2d483c8c-0be6-44af-8a81-53fb63325d9e", "value": "Zooty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70a8df1-e7e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682919267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919267, "uuid": "5f90437c-518f-4b36-9d40-232096130869", "comment": "Malware payload (AsyncRAT)", "value": "d5adf9dee7bfe78a92e715fedfc64cb3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919267, "uuid": "ad8c39bb-e4c9-4022-9db9-8bd7e7da9a5d", "comment": "Malware payload (AsyncRAT)", "value": "64349010e1fbfa33f4ea4f3ec59950d2a7b44874488902a78cee4544dfecce33", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919267, "uuid": "0ab2da1d-7ab6-4bd6-8f19-dfa05e007761", "comment": "Malware payload (AsyncRAT)", "value": "3f9be1c256e25efce8b789d7e0bca5e8ba7f0aa0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919267, "uuid": "f939c26f-7cf6-4f17-9234-76792b1917b3", "comment": "Malware payload (AsyncRAT)", "value": "452afeb009dddbb8cc3934f807d6f5606c0b8a79604faddb234b9299f8e6c956e1ce612495241af68af702392f069864", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919267, "uuid": "e2e30c1c-6541-4960-95ec-d654c799fee0", "value": "T19763F9053BE99126F3BE8F7469F622854AF9F4AF2D12D54D1C8810DE0532B829941FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919267, "uuid": "02169aa7-041b-4d52-a3a2-52c296b3e217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919267, "uuid": "b25497bf-5b03-4cbe-9473-7b68652b3273", "value": "1536:M2wukvF1ak9gcKu5UYFLrsxobD/BuGUu2wNLVrQTGtx:M2dkvF1ak9Ku5UYFYobDeu2GLVGmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682919267, "uuid": "9f8c86a5-8a3b-414c-b92f-ca7ec61b43ee", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682919267, "uuid": "d50d2d5f-0bcc-4f48-b0d9-462f478a9984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919267, "uuid": "eb5c91f6-9253-48bb-81cf-3c47808cbd32", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f482e01-e7b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682900088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900088, "uuid": "8b9dd27b-1897-416a-8ec1-4446a34e4df4", "comment": "Malware payload (AgentTesla)", "value": "ffe4153cf76ca6513718c579853d75cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900088, "uuid": "95dca053-1571-434a-94a8-c836fbdf913d", "comment": "Malware payload (AgentTesla)", "value": "666bc585b6341881de4e977a55af6f313ed70ef0af9d9e20729bd776cd1fccc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900088, "uuid": "fa870a3c-804c-4a44-b4dc-c4db94958554", "comment": "Malware payload (AgentTesla)", "value": "24e7aeea24cac1df5fe3f1fb59f03a5b8f894110", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900088, "uuid": "b058bd36-d7c2-41f9-83f9-03b80710f468", "comment": "Malware payload (AgentTesla)", "value": "f97c9217870e37a182f3731b5b71e783039f88e02e860ba99645d7b594a3fa135ec228ded52a6f8260daf4aba4e8dccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900088, "uuid": "c405e37e-7787-465b-b29c-60162bd9ea41", "value": "T12CB4236598332271A2C4DFCE72ED62453CE7CCA42DC9920ADFB72DA41C4F635A16729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900088, "uuid": "0b681aed-6018-4289-8254-0a7bbd08a992", "value": "12288:UuUtPqx79ShyLcqYKF+hPpWvyheNQFgMAUMPN/27awMPw:UEZEhyL17+VpWvEFUl/27abw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682900088, "uuid": "42f844e3-0c99-4353-ace1-854973bf1b9f", "value": 523372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682900088, "uuid": "66e5a977-defb-47a4-8cf7-0930ab461bc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900088, "uuid": "588d2331-998b-4139-8a9e-0cf546ef9bcb", "value": "Payment swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f4c8de-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682935959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935959, "uuid": "a7d27d0f-f5cb-44e7-973f-c8d6090c86ec", "comment": "Malware payload (RustyStealer)", "value": "e1708dc06578eb8f336855014f797d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935959, "uuid": "9b4fc41d-e1aa-4132-8cde-997664b3a781", "comment": "Malware payload (RustyStealer)", "value": "6adf2c15ea165800613668691ba65ba8346a037f70086c444a084937a4d12018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935959, "uuid": "ce671086-c47f-4de2-a90a-df9e20b282f5", "comment": "Malware payload (RustyStealer)", "value": "6eadc7ca5e2f4f56f23b2e17f685b0d264de1686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935959, "uuid": "2d4f2430-4388-4cb2-bb4b-e55e1325112b", "comment": "Malware payload (RustyStealer)", "value": "ee3c96cc36b3ad87e0b022b552160774dd95cd089f370e3cfd70d0240a36b85a176121fbc59fc6863e99493389c6084a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935959, "uuid": "3a253993-07e8-43ff-a3ae-641ce65878f0", "value": "T1F5068C03FA9546EAC06EC275861B5223EB72BC4A0B20F79B57D45A323F13B605F6D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935959, "uuid": "9e12a281-05ec-4154-b9ec-4d4037dd85a6", "value": "0fa6abd5edd1ea3b4502eeb25b682f8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935959, "uuid": "46c86ff9-260c-4674-be50-bf181a7977fa", "value": "49152:kFgkSCJzLkCU31+WVyasP40/8vSkOcF6D/+WZROGh7wGVhUjpCkWf1PsoOKlXzDz:egkxhUryVPiSZAEEYCo/viCXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935959, "uuid": "0c951753-53f7-4a24-b1cb-c6a98dc0b3ec", "value": 3971584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935959, "uuid": "a9e71612-e4bb-431e-afea-c39c22ce9e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935959, "uuid": "c7fb5825-611e-48ae-a050-81b076369029", "value": "YLW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fba1d7-e835-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682955016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955016, "uuid": "532f2acb-47ab-429a-b7e9-d5dd8c972988", "comment": "Malware payload (RedLineStealer)", "value": "c6776d68b63f3c80c8652edd4a1e0a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955016, "uuid": "eebf5f1e-b1af-4d8e-a46d-9d4015ab8177", "comment": "Malware payload (RedLineStealer)", "value": "6df496d409b602598ada5180e46837ad83e0fb7810b718908d6d3e3f29469763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955016, "uuid": "e33e9ca1-6f3e-4cf5-b502-fd03df104ebd", "comment": "Malware payload (RedLineStealer)", "value": "6e3c6d0748a985639c0d04a2d6b24f5cf78aabdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955016, "uuid": "1471ea18-c5b4-44c7-a3a3-2810efe4bc84", "comment": "Malware payload (RedLineStealer)", "value": "6332325d03dd97e567a1d28fcad04e9ce61ff0851db2abde07edcc6124d53c53622f2e95868af6e93d232fa673e13fde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955016, "uuid": "1725c66d-b50e-449d-832f-af067b759458", "value": "T1EF946C1383E13D44EA2A8B729F1FC6EC7A8EF2509E593BB5111A9A5F49B01B3D173710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955016, "uuid": "747eb4c5-7b1a-4442-822e-0d1d177eb27c", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955016, "uuid": "768ebab9-1360-4534-8b66-da9b12a7b2c2", "value": "6144:ETRvvIqvPCgVOvbIZ8RXrriYCfUyGVG3v+:IRvvIqpVOzC89r27UrM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682955016, "uuid": "f5ad0938-f025-45a9-b99c-58819a12b198", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682955016, "uuid": "384f4b52-ce21-4e56-906c-e670d509fbd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955016, "uuid": "84a23ca7-530b-4443-92ad-00494fa9ca54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a3de06-e7de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682917648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917648, "uuid": "1e00154a-427a-4525-8849-3112328548db", "comment": "Malware payload (AsyncRAT)", "value": "ec3fb005182c03e31ad5f652fcaf433a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917648, "uuid": "a6906463-1cb4-4f36-846b-4242383189e7", "comment": "Malware payload (AsyncRAT)", "value": "6e39cc4bf7d911b9b6b47d0ca860df4b405386a8232943cd9e4a7f03d2027c0c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917648, "uuid": "570fa12d-d7b7-47a2-91b7-6a9c06337785", "comment": "Malware payload (AsyncRAT)", "value": "1d1533e4c07dc0f21235e2011f1e99e263aa1114", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917648, "uuid": "e26843aa-6b54-4a24-867b-73957253cb57", "comment": "Malware payload (AsyncRAT)", "value": "ded663b0b2ea35394192079bf1799da53de310f9e1969aec9aac1bd924cc3221d3d9f96748e0c13dcd723337bc84e4d5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917648, "uuid": "a393566d-05ab-4453-a720-a0a3ee5cf782", "value": "T152443165609AC8DEFE5ADB40B1B8FFA161F1B1B355C81A2013786104CFE9F962F8D09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917648, "uuid": "7d5ea751-e401-4018-8a38-4439dabc06a9", "value": "6144:dhMHd8wF9VtLr3EXGpI5cGIE+QI33INenAZYn+FphxVC4werLfEM2QI6ii4jqJrB:0Ht9VtLr3EXGpI5cGIp3INenAZQ+Fphx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682917648, "uuid": "b78947d8-660f-435f-be34-c105d87f22f9", "value": 262679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682917648, "uuid": "cd08d3c7-753f-402c-be88-0e009a2d47e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917648, "uuid": "ff81d97f-4533-4935-a0c2-c608a9615fe0", "value": "t.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349381b4-e85c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682971823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682971823, "uuid": "10cca5ad-0fd5-4c98-a938-cf6e9bc8e80b", "comment": "Malware payload (njrat)", "value": "0b420e1d7d031b6271a0dc1217b4afeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682971823, "uuid": "44672345-8696-4b45-8aaa-81531d43bd93", "comment": "Malware payload (njrat)", "value": "6f5bf43c9a70acb4a89840a43ffd31afe83e249b29cb3b015d754f83933c4c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682971823, "uuid": "7a7dc09f-0466-41c7-84bf-92ff0ac58ca7", "comment": "Malware payload (njrat)", "value": "436a828c99b8164fbbb39af21e71f9b2fa0cc793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682971823, "uuid": "f61333cc-b16a-4a42-898c-bf7f54195e05", "comment": "Malware payload (njrat)", "value": "48b9c79439ba2f7642c52a6c36624cdf01f7dce74b1011a8cef201bfe3cc3bde549fab0a6668e2f6253e95525f985b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682971823, "uuid": "a598ad1f-82b4-480a-9f64-f0733f0f0ae1", "value": "T1B7D22851AA82E721CBEC05F4D8B3771007349A4F5506EBB35CC4A9D9BBA3BF427466C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682971823, "uuid": "67d43384-3aa4-4f5e-b684-67a44eb67768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682971823, "uuid": "58a6780d-f210-4722-ae6d-e96bdea65864", "value": "384:2KD5s6ECOiEQy3kvYYDBsAvyPI2IWjIcIcEAP5fh1UL3R3d4UCbIokrwAsA1u33O:AHhaR3+hsVnwKW9gbPD+nEfeNMTmtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682971823, "uuid": "ba69b76a-2b08-4679-b276-8f8bf451c245", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682971823, "uuid": "c570b4f5-e5a8-4239-81ea-6b170fdb4b59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682971823, "uuid": "bcde7fc0-7309-4f4f-8dc1-b6d6c7119ddc", "value": "0b420e1d7d031b6271a0dc1217b4afeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ff0128-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931875, "uuid": "5221356e-2c12-4088-8bd0-4cda7d91d743", "comment": "Malware payload (Mirai)", "value": "1b6ae35bb944d44a60398e19acf96b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931875, "uuid": "df446b22-d1cd-4e8e-9283-fb00950736bf", "comment": "Malware payload (Mirai)", "value": "71cc4e0efad6f37dc668da2325766e3efc4a80102ea424f3958f8b1357cc264a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931875, "uuid": "eb50cef9-0539-4386-9847-f2c61ccbf95d", "comment": "Malware payload (Mirai)", "value": "2f5b37474f488a7e83e7e4815c23b20b400c8400", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931875, "uuid": "360b0ce6-4e89-4667-80e8-6a480fd82053", "comment": "Malware payload (Mirai)", "value": "79a2acfa8b09fdc1f8776d4859f2f67d96cb50aa3e439077f848a6cf041f042cdc525eac26ce4ec33788a1f34d614af9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931875, "uuid": "7a9958b7-0dd4-4a85-bfed-d5942becd5ff", "value": "T17943F682EC81DA1BD6D41379BAAF61EE3310B3D9E0DE3747DD115B103A8990F0DAB652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931875, "uuid": "3e26150f-47a6-4910-ab48-a6f028b61321", "value": "768:t8MrQ65Srsn8HBWfZm7dvQbGc1Vm4U0m1GgHMBEIeVpl87TU0o1Nv4ewpobO5GI5:F5RZf4BQb9gTwgHUBeVuUp1N/wVl9I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931875, "uuid": "cfedc87a-e0d8-4f89-a5ee-8366a6d0d559", "value": 55236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931875, "uuid": "8778e8be-d5ee-49fd-bf3f-8fb6adb290d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931875, "uuid": "43b4440c-043b-4786-a2de-6c33de3432a9", "value": "1b6ae35bb944d44a60398e19acf96b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea240842-e81a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682943781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943781, "uuid": "85a89dc2-1665-4aae-8efe-f4f2060a7321", "comment": "Malware payload (Mirai)", "value": "37544dd53131d5ebc7143fa14ff3e01e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943781, "uuid": "8a6a4b49-dbdc-4d96-a246-424d7164979e", "comment": "Malware payload (Mirai)", "value": "724357165ae27e8d77ed63537d41fb9c3f654f86179d44dc32c597eb2c51e660", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943781, "uuid": "97cb78b1-d540-4b5b-9f59-86f2c0e9401c", "comment": "Malware payload (Mirai)", "value": "afacc54e9139bad81dee3fe56ef3f33b3e57c245", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943781, "uuid": "059f0b88-5244-41a5-9994-c67d48b5b637", "comment": "Malware payload (Mirai)", "value": "2719435f9ebafc22ea01ccfb8aa2fdb0b46cf615d62862af09b377acb8e54072caefaf0d41952094be7f3147277dc8d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943781, "uuid": "34dd34e8-f03b-4710-af0d-194b495886b8", "value": "T1D6330A8EB8029D3CF91BE6BE54164E0DBA3177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943781, "uuid": "7667a99a-99dd-4d6a-9f0f-fa1b965d28e0", "value": "768:gduPBFnHooqR8qOCKq2cH4Y3e+TK806MMUVjzMfQXOtHud2oGN:r/hqaJM53eqK806MHdMfQXoHuCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943781, "uuid": "06dfd42c-d829-45d1-84a6-e775b7e9b59d", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943781, "uuid": "b2ee8f5d-1d20-4284-820e-4d1f740a4ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943781, "uuid": "c590acd6-0edf-4c57-bdea-39dde1301124", "value": "37544dd53131d5ebc7143fa14ff3e01e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12dfefd-e810-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1682939417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939417, "uuid": "d13a1da7-b417-4bed-8565-1bd73c2cd602", "comment": "Malware payload (NanoCore)", "value": "151b74926b70a010cf15da3cd0dfbb6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939417, "uuid": "92198876-b3d7-4837-8d7e-e86da3865b7b", "comment": "Malware payload (NanoCore)", "value": "74e6fd677b63ce915e7e14b34a3a3f3eaf9dea250c330ccd48cddaa4cdbe4106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939417, "uuid": "45e62096-ee22-420e-9718-cbd371e89fb7", "comment": "Malware payload (NanoCore)", "value": "4665c0fbd00b1c3f6c9a4def1285304351a669ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939417, "uuid": "c228cd6c-2dec-4b6b-8125-15af7184fdbc", "comment": "Malware payload (NanoCore)", "value": "988181f58308dc4265ea4b0112ba7f0d25e7ba4d5599d2faa697b5a0ddf9f4f7bbc77a2cc75b8fbdf69020002c776125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939417, "uuid": "88b22952-fba8-45aa-bf22-a579b64ade82", "value": "T12414CF567BA84A3FE2DE857C601252139779C2E39CC3F3DE18D865B69B263E00A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939417, "uuid": "31bba84f-f7e2-46ab-a0a5-606af5f62abd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939417, "uuid": "0237ef9e-9cd4-4b23-9aab-28a634956420", "value": "6144:yLV6Bta6dtJmakIM5qjaSdHlHMLHLpnN5g:yLV6Btpmkx3FmHLpnN5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682939417, "uuid": "b479d2fb-cf8a-4495-b3b1-cd2944c50816", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682939417, "uuid": "a374af1e-1afe-49c6-acea-7ed0b5bee426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939417, "uuid": "f5db43fe-833f-4dbc-827b-ac973a063f1f", "value": "74E6FD677B63CE915E7E14B34A3A3F3EAF9DEA250C330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345a305f-e826-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682948630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948630, "uuid": "53365e81-24f9-4980-a26f-3a003347bdb7", "comment": "Malware payload (Mirai)", "value": "8834c6964b3c5faa191a1160357d0ffb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948630, "uuid": "9c60d532-da44-4646-9884-e26fe5d3e650", "comment": "Malware payload (Mirai)", "value": "76012ce2fb3d7f01d457dbcb79ef058fdfcd14aa6a4bbfdc6fe4fd65993696fe", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948630, "uuid": "001995e3-5e00-4534-b00a-498ff33d6197", "comment": "Malware payload (Mirai)", "value": "84bd781f329cfb8374294f8f09736ff468724627", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948630, "uuid": "568bfff0-b687-4899-9d71-e790cec72ba6", "comment": "Malware payload (Mirai)", "value": "bc4c9a7aaaf48a425c8568ff73c7d676845bd28ce870680bb0b76e833c3a6cea385c474d4683214eb94cc187b2076ae4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948630, "uuid": "17e5737f-18fc-4db0-8091-0262326621be", "value": "T157F2E09788E7F376F4739372407651E5F896E62285038793544235EEEDEB7880F12A48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948630, "uuid": "92bf512b-311c-4db5-a0a9-f927ebcba1fe", "value": "768:hardGcRVfZVuo3y02Pk6DezV95dn3iPlC8Pr0W4ffhmOXYx0YBr:ExfHuo3y02PHsdyPlCG4WOfYxBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682948630, "uuid": "28e0b7fc-cd3f-4878-a78b-4fe0312f0118", "value": 34372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682948630, "uuid": "2b779603-1b15-4841-8411-1fb28477835c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948630, "uuid": "99395fd9-a317-4a8d-b9af-348296de9e80", "value": "8834c6964b3c5faa191a1160357d0ffb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fa6a29-e831-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682953538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953538, "uuid": "7c43c0cf-749e-4fa0-bac1-4ca7a1d18e0e", "comment": "Malware payload (AgentTesla)", "value": "2463575784d44db969d159daaeab6f57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953538, "uuid": "c79614d4-4e49-4698-b302-3472a5d3d0db", "comment": "Malware payload (AgentTesla)", "value": "767f8a18d7d28b82d76fd39c3ae639d352659110a6bfa1a4b929f136e034ca8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953538, "uuid": "fc18ece5-f607-42b1-aa4a-fcb2074dc8e4", "comment": "Malware payload (AgentTesla)", "value": "7585a951ad6217ef5f0141eb12c61ac6a14134a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953538, "uuid": "ae7dd2ae-f31d-4494-9c58-a9f188b3a878", "comment": "Malware payload (AgentTesla)", "value": "daecf163763265dd0f3100a7e7bf5dd8ac87b0ffa174283914c7f2d3410a9c6b322d6dc090e6fbb194eddd8b9cdf8cb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953538, "uuid": "27ef2312-173d-4e7b-9685-9055f0add363", "value": "T1E405483C19BE263BC179C7A5CFE4C427B154A9AF3121ED65A8D747A6434AE1234C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953538, "uuid": "d84db81e-1d67-4d63-bdd2-c51ecd60b167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953538, "uuid": "f8916880-a62a-4497-a4bc-bb4afd844e95", "value": "12288:tJ/9WflU/9DJto2jXoZoP4HZh0UVDXAvaeB5Lgjho2f4LxuqS:zylU1o2jqnH70UVDXAvak+0Lxuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682953538, "uuid": "449d56ab-1517-4fef-b61a-ad252301c067", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682953538, "uuid": "dfe4363e-654d-4425-9604-9a172fa6701e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953538, "uuid": "a1eb2b3a-6577-48f0-8ced-ee1a0bcf481a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3824d072-e852-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682967534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967534, "uuid": "427b7d51-3267-4df7-a4ef-6a74109bd4e7", "comment": "Malware payload (AgentTesla)", "value": "c3c6e6ad0cb985a5fef887041a2c0a81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967534, "uuid": "f9cc3b89-c3c0-4d63-81c5-50ec65c7a2e3", "comment": "Malware payload (AgentTesla)", "value": "784074560889770845788ca5875ff3660a30fb85d27823c017b209b101be3499", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967534, "uuid": "8123a5a3-e22e-4897-b42a-d872b0c3320d", "comment": "Malware payload (AgentTesla)", "value": "35029746388fa672d76c77583b1a514d7d51e849", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967534, "uuid": "bd3cd9bb-fda0-4df6-a09c-1d742a45f6d1", "comment": "Malware payload (AgentTesla)", "value": "5f1cccd7f98718d92af58fdae31d29b6daab6e678aff6d72aad78c1824d9045bff5abc94e9aad6630f5c11533dadd35f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967534, "uuid": "84198eff-c59b-4251-8b3a-09f0bdf82dcb", "value": "T15AD4CF4251B9DF5AFD3ADBF054A4FF4457F0B5B7A8E0D1202EE614CADAA9F000E4861B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967534, "uuid": "5436209b-8a84-4164-a61f-e0d520af11e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967534, "uuid": "bc682d09-7119-457e-b0ee-43fb91bf9037", "value": "12288:izmA6JWfw5+azHjuwTFqKxxJgdOKH3zBEUhbOMwlpr:YmjJW43budOKaUJZOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682967534, "uuid": "fcbaf764-9de1-4bc2-8b7d-db43b2ccd358", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682967534, "uuid": "cbf0815f-be8f-42e1-b479-fe3f130b6961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967534, "uuid": "6dba14fb-e695-4841-b1cf-bb7cea69820f", "value": "Factura comercial-2023050188.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5615fd-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899791, "uuid": "54e64063-8473-402e-813b-201fd9eedc8c", "comment": "Malware payload (Formbook)", "value": "597df2d801d07c126245e7548fdc2870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899791, "uuid": "b85c05f6-a9fc-47aa-8dd3-62a766e235b3", "comment": "Malware payload (Formbook)", "value": "7a5485f2125069864504a7667e5b12ec25e918195a849768c39148c752b023c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899791, "uuid": "58ea1100-76fe-478a-b6b3-37bd7b24ee08", "comment": "Malware payload (Formbook)", "value": "8b609a81ecf62418236729c140af9af1a5a2f0ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899791, "uuid": "a3c90f65-5b36-418b-a4b3-1cdb7c6ed21e", "comment": "Malware payload (Formbook)", "value": "064f10e072b6ffbba626862b2ad85d1c2ec24ecd85373a86941666b8af6a1c22e3c4ee1f938e55eef2deedf0b58dc1e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899791, "uuid": "9da995f7-5865-49a7-a43e-35647caec7d8", "value": "T126E4BE535065CD1FFE6ADBB0D1B4FF85A6F1F07360D194241BB92189CAA9F022E8C52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899791, "uuid": "afd6dabd-f368-4496-a27a-36a4953644fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899791, "uuid": "99a08bce-dae0-4ff7-82dc-f646144cba53", "value": "12288:C+rFdMaU197wgOQLV99NHP5PLHeI7sZth5TPegQVt:C+fMaChLVH3TV7sZT5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899791, "uuid": "dfd28358-24e8-49ee-b2ca-e4af47fdb0e2", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899791, "uuid": "21c88007-5f37-4b22-94e3-422c4ea97d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899791, "uuid": "d8dfc742-1f26-443d-b8b5-c28000c79c6c", "value": "INS5109M61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869bf50d-e82e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682952204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952204, "uuid": "2ec6b4f3-6dcc-4449-a17e-4a0a288170b4", "comment": "Malware payload (DCRat)", "value": "036fa51df862fe3b8aba2e4af281ed9f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952204, "uuid": "8cda2f74-1649-42de-bfcd-962439576b4c", "comment": "Malware payload (DCRat)", "value": "7ad0927e11735407e2fbcb844fb5aed5ad205db57d9dccfde4a4c975622678e0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952204, "uuid": "e3bf27c4-eaa7-4de8-8903-c22dd0800c5f", "comment": "Malware payload (DCRat)", "value": "00fc0047c51a33e478845086a8c2e6c0af65abea", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952204, "uuid": "10899485-4fcd-4e06-b1b8-4cf1752141f5", "comment": "Malware payload (DCRat)", "value": "117e45353bae0d2540b664a624b8d1774df9f36617b286ae2fb84c755002ec101399e40640847c0c6d0383eb4bb155e7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952204, "uuid": "a4e56df8-64a5-43fe-ba8b-8397fef1b01e", "value": "T1CB063342F5D2C473D1B52A3115D187B9893EBD610BA8A8EB57A40EBE8F313C18371A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952204, "uuid": "dcbdb25b-55be-4e64-ba8c-3490fcf2953c", "value": "a474be77234ae202002ad60047ac23ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952204, "uuid": "4ef169fe-e4c9-49f4-8f0a-6fe36f19a08f", "value": "49152:tjWS5pYUNeHL+Zokgdzl/EGPqTAHytO+c2xvkbhp27GzYaPPO6KASKMeVITO:9WONerOoRdfP2AHx+4gvanxJSKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682952204, "uuid": "6d8de2be-c0b5-46c0-a8ed-b1f24a748c73", "value": 3701760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682952204, "uuid": "af4a3bcc-b29b-4e6e-b202-6da34e128287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952204, "uuid": "2bfc114e-7892-43a6-aeb1-601a4c5e2b22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9546a397-e828-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682949651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949651, "uuid": "95115734-25c5-4b11-b9a6-44820e1b5a6b", "comment": "Malware payload (Formbook)", "value": "a89895046d06502b63725b10647de9d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949651, "uuid": "26577718-74bb-437c-a9af-c44827ae4b0a", "comment": "Malware payload (Formbook)", "value": "7ae7549fcc35a02ed81ab68dbb4997b955edd32cc0207f9e58199200d82e281a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949651, "uuid": "6c310392-5ffc-4015-b836-5413baf60777", "comment": "Malware payload (Formbook)", "value": "827bea9df2ef3d70a6f2d62348096f1ae8f87534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949651, "uuid": "f843277b-30da-4431-b8f7-72c3c1631715", "comment": "Malware payload (Formbook)", "value": "975e415d64bf69984a0552ec6df1eb2664a44c0cd0eb4ed4990d9ea9056d019d29ff5303ded406aca8a029836fc1d5d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949651, "uuid": "a70f4ff3-253a-420b-8e9a-ae3ab3d592cb", "value": "T129D47C3D16BC6737D17AC3B88AD05413B3E0E81BB221ED956CD643A64753A427AD323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949651, "uuid": "5d0eb84b-dc21-4531-868d-1808d14faff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949651, "uuid": "56849ada-c13e-48bc-b1ac-4b115acc0cde", "value": "12288:Fc/FuT/euHB93Z5xeOwIqFPkkfd1R1PsSMWDE:KuLNh1rxiHPLL7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682949651, "uuid": "9ab09491-ba1f-48d4-94e4-a8a8e8feac10", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682949651, "uuid": "dca1dbb0-0a3e-4061-bf21-526f3fabaf45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949651, "uuid": "344cc961-fad2-4b94-9c18-9b8348ce4ae7", "value": "URGENT REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfcdd2a-e819-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682943089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943089, "uuid": "03f60d36-b8f6-4e0d-a58c-9681f52681fc", "comment": "Malware payload (Mirai)", "value": "acc5332931d7f2c87622a28302112304", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943089, "uuid": "55de7e7e-8bcc-4be1-9e00-48092f0af190", "comment": "Malware payload (Mirai)", "value": "7af977b1e04e455d8f44582de3a99436eab0e69e2e6aee43e952f679d1bd7eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943089, "uuid": "a7408ec0-a123-4146-84ef-dc00b1e183f8", "comment": "Malware payload (Mirai)", "value": "2c519e06473c19a2c0b9f50b97b3de7f60ebbc28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943089, "uuid": "5aba5f6c-3a01-499f-9b2b-10bbe9f37fb5", "comment": "Malware payload (Mirai)", "value": "9f18c80c4d11a7ef6ae10821750ecde2d81226bb71490baefe428549bdeca9ca7242d36903bd813c2d2e914ac4f8f153", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943089, "uuid": "74c978e3-facd-4e41-91d2-68daf3a92390", "value": "T1D0A2E025D345BEF4DFAFAD9452C1C3C2B6E946C6278BC8E240EEAF016506042B788C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943089, "uuid": "eb93cebe-a648-43c9-bf88-6040c68a81c3", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5dM4uVcqgw05VxJL:9RxsSVsMD6xiJJE5zRWNM4uVcqgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943089, "uuid": "bd4402dc-5d3c-43d9-8df1-dfe1bdba3753", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943089, "uuid": "52308010-062b-4984-9894-d7be2649bfb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943089, "uuid": "e3d61f2a-7888-40da-bd91-307cc1ec5424", "value": "acc5332931d7f2c87622a28302112304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c937e4c5-e7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682927405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927405, "uuid": "da036e0a-72ed-4491-9dec-f66db344a48a", "comment": "Malware payload (Mirai)", "value": "4f7262cb63c24183c6412c80fad84c78", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927405, "uuid": "557a5b47-2913-47dc-913f-5d012e85be7f", "comment": "Malware payload (Mirai)", "value": "7b3d76dcc6aa14f588549784b67e6b55607bff74ab0945a1b51da3183efea786", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927405, "uuid": "9c6dbffc-1b14-4390-8959-991556b47c41", "comment": "Malware payload (Mirai)", "value": "760457a4313999e85c9e3589e2a7125786779854", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927405, "uuid": "80729ff1-4b06-4271-a7a6-d1eb6add7d86", "comment": "Malware payload (Mirai)", "value": "bf4d8f52bc707781daf3b020cce35dc738f7dbcf55fdbe57b8d5d1ba6e0853633554874237a9faee5af5b97e78c82fa1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927405, "uuid": "8263832a-3e5c-40d7-ab95-9ae0c5748c9c", "value": "T166236DC1A543DDF8EC1105F12173EBB79BBAF03A6029EDD7C799A932D842A01E50329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927405, "uuid": "8ceb7617-7a86-43a5-bc1c-c187abac7044", "value": "768:3W8Vw1BBOGSc2Wlo/bvnhwMMPRwECqZ7nbFGdlYybJmiXO+YkX4aP:3LV0BOGSc2Wlo/bvhwMMPSiZ7ElYuJmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682927405, "uuid": "0acfc337-43f8-4ea0-800d-4cf54e50659a", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682927405, "uuid": "f06fcaac-8197-4fe2-b4c6-92348d19e14b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927405, "uuid": "94c629f3-d271-414b-abf3-4901c020fb7a", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa051b8-e826-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682948863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948863, "uuid": "b0020765-38cb-45aa-8dfb-da8e9ab67a79", "comment": "Malware payload (AgentTesla)", "value": "71c8f4b6fe02eae1ae062af24d751674", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948863, "uuid": "609517c0-bdbd-4a27-87d8-1204f66dfa23", "comment": "Malware payload (AgentTesla)", "value": "7b4164cc352f02f53d9f49d8a5d6df6221b85c5412fcb133462c5d779730dc64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948863, "uuid": "5db14e6a-3c67-4706-8829-58020d54ec34", "comment": "Malware payload (AgentTesla)", "value": "f442aa3847109e33868e671d833314693f4202c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682948863, "uuid": "e4b5c564-8460-49be-b5df-a981aa136ad6", "comment": "Malware payload (AgentTesla)", "value": "bfaac30adf9457ae6a9baf742f4640eb7ef6db0088c30f8578e2ad05ba246fda9b59b9065f7c1bef9188d1f6261f7900", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948863, "uuid": "dd5b4bc8-38b6-4f5b-a439-c8f6a53a3cbb", "value": "T19BC4CE2770BCC4F6F89E3CF14A194B616AB5AE920179E203D25FBED5E973123D10A2D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948863, "uuid": "d83ebb68-4912-428d-9cf6-90252b1e4cb5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948863, "uuid": "93accb48-3ac2-4eef-8922-7722a8697998", "value": "12288:8YZ9daFLvg+AHMX89IX1p7X4Z36IeMLEJOXWV:8YZ9daFLvBAH7qX1FIZ3Leo6OM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682948863, "uuid": "b4306e47-d8ea-4253-85dd-d5ef481954ba", "value": 580190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682948863, "uuid": "716bfac8-1d62-434a-8539-3b53bbb580db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682948863, "uuid": "98d696a4-454c-4509-bcd1-f813a003d90f", "value": "RFQ#010523-EQUIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5426950-e7f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682928767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928767, "uuid": "6c8575c6-1ba8-4ad1-846e-050c8ea16ebf", "comment": "Malware payload (Mirai)", "value": "d2233f67e909d0172417e65ac81432b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928767, "uuid": "6222774c-419c-4e52-ad79-952da43545ab", "comment": "Malware payload (Mirai)", "value": "7bc7890a8cc5a3fb23f2f24e6681d1ac4533b5ae27fb916968cc1f1d19fb4c3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928767, "uuid": "38600678-8847-4946-af77-72530d3ff716", "comment": "Malware payload (Mirai)", "value": "eb086e82c842e8b99dc0a42d044c0a32d58715ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928767, "uuid": "3ad44721-5651-46c1-a1c4-56c69e52c0c7", "comment": "Malware payload (Mirai)", "value": "1532c00e7f317dd593ea8f0dd4fdc79cc02b20d35973d4389b5c2c4886020799c940f1d14e03175d2e61bab7def31185", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928767, "uuid": "7063fce2-da8d-4b3b-add8-4583b3be5b80", "value": "T1E9232B42722C0A47D1A65EB0393F0BE093BFE99124F4F6886A5F9B468535F371186F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928767, "uuid": "2ff73a56-31d1-4d1a-80ab-a273ee9c7e0e", "value": "768:m0tc4n8iAxt1V+B1cNsG/Res7bfGMmD253nhhVLoxhoXRheH:BvAxt1V+BaaQWu1i+XTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928767, "uuid": "6894bb4f-8525-456e-a9cb-d8875211a03d", "value": 47644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928767, "uuid": "b045bcf0-25fa-48bc-a1bf-c0813886994b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928767, "uuid": "9d3b9653-a2a7-4cf0-a2ba-50cbd69b00c3", "value": "d2233f67e909d0172417e65ac81432b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d2958a-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682899405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899405, "uuid": "0ce890a9-5619-44c8-aac7-7cacb4fde5c7", "comment": "Malware payload (SnakeKeylogger)", "value": "4db60d02e5986e60e5fcfa257535d332", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899405, "uuid": "255a7df7-5f63-430f-94ed-c97c61122703", "comment": "Malware payload (SnakeKeylogger)", "value": "7c63d1f27fb38be310bac3daf0c2ba03f70d4c60dd51e42f0e6172161a37d3fa", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899405, "uuid": "10a0a055-8a88-4346-85be-3d18c3e8037e", "comment": "Malware payload (SnakeKeylogger)", "value": "9e5e127bc0462e38875d321c60c9b56ae3136ca6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899405, "uuid": "b5710247-2848-4eda-a6ab-f4a1974521d0", "comment": "Malware payload (SnakeKeylogger)", "value": "0a2810b82f30551903e43bb6b3a2e1d9243239d54817061ffa7a1fcf6b2a43618d10adaee8e87977f1c8e87f3b3dd6ae", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899405, "uuid": "057e9919-eef9-414e-a417-39c24156d894", "value": "T1556533D314882BFC4781DE300F35AD4742153987C99EEA47268E1D6BB9FC63A5602AFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899405, "uuid": "c5cf5cf8-c874-4903-8203-b619f74bb93a", "value": "24576:vcL7lx/bdv0nICztepwbn5Sr04NZl9xHWK6z1e/8Erl0FDH+TwZqqhVWI8:EL7l/i46b14NZlN64Hm1eTwZnzWI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899405, "uuid": "167d3896-8b34-4a14-82fa-17d36a624a22", "value": 1512483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899405, "uuid": "25ac2c3a-7b64-407e-a29d-f3f0cfeeb211", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899405, "uuid": "673ad741-a241-4238-ba0a-37fef098a8d1", "value": "28042023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfa91da-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682936001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936001, "uuid": "dcca0c09-d858-44d5-9c0d-21696cff63b8", "comment": "Malware payload (RustyStealer)", "value": "83f3a86879eb7bbaca8b2ec9556452de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936001, "uuid": "a3da4482-20af-4e04-b40d-0466c1dcc2a7", "comment": "Malware payload (RustyStealer)", "value": "7cabb568cba602df4c51bcc522d3f3f199f2e7bec2c56a8585c5f1816a0eafb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936001, "uuid": "90861a90-e3e6-40cf-a397-6d7401b3e9b3", "comment": "Malware payload (RustyStealer)", "value": "230fa30edbb0dc758051f5fa32f5689a9cce8c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936001, "uuid": "81c9f0d9-ba6e-4c92-a227-c2a9a786fad1", "comment": "Malware payload (RustyStealer)", "value": "d990298bd3d5187aed2856a1cb74fd646f37ca2c8665df96791f09c83a04805abcf7cc52e1c905d283a4070ff601220a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936001, "uuid": "782fa0f8-c8f6-4ac3-86d1-13cc837190e0", "value": "T1BE167C03FA9546EAC06EC274861B9323E772BC4A0724E79B17D45A723F13B605FAD358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936001, "uuid": "70e04be0-aebe-446b-a9ca-d5efe1b2225d", "value": "867f8d99a619345d9a11a8961527be79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936001, "uuid": "118cf4aa-33cd-48ab-b7c5-d94d2acec755", "value": "49152:iuyKIfYxgidPyQjdN54jRXZJzavF3v3yPYWTmxhj+Gm1hkJtyL0ZVnulDkV50vIi:NyKldvN2jHa8mxRF7JClTgi2v4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682936001, "uuid": "257927f3-f592-40e3-b1f2-c26c55ba428e", "value": 4044288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682936001, "uuid": "b81495cc-5568-455a-aae8-6d88701329b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936001, "uuid": "eecc53a1-0880-4e9a-82f1-066b2adf25b9", "value": "lxx2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e590f83-e7b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682900248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900248, "uuid": "55c90858-fc30-4971-b63e-900123e562f8", "comment": "Malware payload (AgentTesla)", "value": "9726970a51f78a656c3b3969f1aa100d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900248, "uuid": "4e9d27dc-5ef2-4d85-bfa5-07fe385e3442", "comment": "Malware payload (AgentTesla)", "value": "7cbc579277017a2bea83c04dc9e930a4162c56b92c22b399cf6add405b09bc37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900248, "uuid": "95050b51-3422-476c-9546-6edc4b3a24dc", "comment": "Malware payload (AgentTesla)", "value": "984ade8f927bd5b7f26bcc4ad31edeeeba0e079b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900248, "uuid": "98836f23-ced4-44a2-b944-3dc942b9481e", "comment": "Malware payload (AgentTesla)", "value": "5e24da1fe2c273e762f4c4351a28ae7acc69e0162de37d806e83c7f4ea8516cbc9f2bc21b1e810e6bfd73c87f845f381", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900248, "uuid": "7a066aeb-496f-467c-b339-712640786af1", "value": "T1F6B423C315341F7E6A22B496E8E55C1E031B6F8F5C012D77F0BA172BE645D8CACB5292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900248, "uuid": "993d9a07-67c3-4950-bf52-2681e859138f", "value": "12288:8csIDQL4TbjkMorUTRVXQfxYxyaY6v5hBDuBHdAH2VmfGsz:+9sjBore/KxYxyp6rBDuJmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682900248, "uuid": "b017cb93-4130-46b0-83d2-28ec7dbcb3f1", "value": 522828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682900248, "uuid": "3d31a32d-b976-47f9-8ee2-0d9d46a74115", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900248, "uuid": "f567dade-bc8b-4d07-b0c1-41d0a8809370", "value": "820471922.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63ff1b0-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899429, "uuid": "d9927651-30ee-4553-a6c7-5bb5a93f748d", "comment": "Malware payload (AgentTesla)", "value": "0aa3494a91a29d89ffefb192147a6553", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899429, "uuid": "9d6a6a01-1b64-44ee-b13b-3c12e0266c53", "comment": "Malware payload (AgentTesla)", "value": "7e17d20032413cfa6dc32271e7a386b32a4cc79744171f9f2d9b895444c5e110", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899429, "uuid": "fb515176-6129-4190-b1a4-c7975a7fe367", "comment": "Malware payload (AgentTesla)", "value": "6a02a1983823cf22aabe793c8da1188523e6bab9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899429, "uuid": "58b071f3-ba65-40c4-a6d0-1244d2821266", "comment": "Malware payload (AgentTesla)", "value": "b8b186a072f5cf60d9a093b9fccb09823ec3896d4cfeac9cc2a9b41fc9cf0d0b9073ddbf3ff872f4d95dc30e8fb7e042", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899429, "uuid": "9512468e-df35-4420-a338-d80d84054c35", "value": "T1B8E4BE535069CD1FFE2ADBB091B4FF55A6F1F07324D194242BB921C9CAA9F021E8C52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899429, "uuid": "907b2177-7133-49aa-838b-aacc5cfe29b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899429, "uuid": "f4271c6f-0c78-460a-a1a0-92409c3b4656", "value": "12288:QXRsxaT2HkTFWkV6Ye3BgAYoBD+tDzregQVt9:QBN286YQBLYoBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899429, "uuid": "9e0d4cf5-bade-471a-b6ae-9c514f647061", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899429, "uuid": "032ed52a-443e-4121-bcbf-1bb424458d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899429, "uuid": "21240a53-7d6f-4b63-9130-af0298d65d9a", "value": "RFQ1123031240058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c2d465-e845-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1682961953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961953, "uuid": "89cd401a-be1a-485e-aec4-25ba0ecce828", "comment": "Malware payload (TeamBot)", "value": "4eceae8ae4132c8606c3da47e6cacf3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961953, "uuid": "0c200418-c190-4018-9909-99db472c1bb6", "comment": "Malware payload (TeamBot)", "value": "7f5027cce0e8aa45f9a86b13328ce878fd640137449638ea0bc28be155e311ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961953, "uuid": "88484765-16e5-4787-9b71-34c9cb8d145f", "comment": "Malware payload (TeamBot)", "value": "c0d593a92bf12202983acceede2f4f29d13be0a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961953, "uuid": "6d2944af-930f-482b-aafc-80c9228886ed", "comment": "Malware payload (TeamBot)", "value": "5319e2509e6dbc3595d6919d3d963fb662f0dc9ad606d792959f061d675d494f1316d146739f49cf4ad3a019f36747a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961953, "uuid": "79764baa-2df0-4d04-b03d-64c31a9635e7", "value": "T11564F80382E13C44EA2B8B72CF2FC6EC7A9DF2509E497779511A9A1F49B15B3D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961953, "uuid": "2e83e568-fef5-4c8e-a5ae-2788d98924bf", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961953, "uuid": "255d7f2f-ff23-422f-bcd1-c16c0dc4b104", "value": "3072:1uo8KAHOOUWJnovWjP8mhYYTfwZj0pmQSeB7Uk8cyK5zlDTVMHhd+OH:0o8KAHqWJ7zDGj0pmQRJUXolVMHv+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682961953, "uuid": "380c7cff-09ce-4e12-b7de-9d35a32ed708", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682961953, "uuid": "53d05f8b-24ab-48d3-89a0-0ef4ef40b4e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961953, "uuid": "cd7a6e99-6f40-4a7e-9ae4-40d14170d343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34057fb2-e86f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682979983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979983, "uuid": "c6706683-b724-46bf-a03d-ce557cc45788", "comment": "Malware payload", "value": "9ad8ca502e5a46298c039b49fbf8ef3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979983, "uuid": "66544eb4-0fc9-4173-934e-01b4026614fd", "comment": "Malware payload", "value": "819c80050c2c41c85c28f745b153bef2ebe52a8c468182f5e3fe44a816fca109", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979983, "uuid": "5071b908-91d6-403e-bae4-ca821721d7b8", "comment": "Malware payload", "value": "b7fae5713de3e6dcaf994914665d378d0f164287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979983, "uuid": "09e8034c-ef71-42b2-ba57-c959eb4e04b7", "comment": "Malware payload", "value": "59bc496643fd1a731ccdf50b66175f820144ac2484ebe0498430b96ac313dba34ab7e3e3e261274e53840c10ac46725c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979983, "uuid": "e542445c-1daa-4ed5-87ff-957d87bb4087", "value": "T1D6C53332FBE8A931D0E0DBF4CC87D94505B6BE6700F4450A76AD096BBFE6741B9A4342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979983, "uuid": "edfe7843-51f2-4ba6-9705-5c010641864b", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979983, "uuid": "e8a7d4ee-25c5-413d-931f-5fbd9cfd68e0", "value": "49152:cgUoRqp4i1yOrPsSAkTT5oEJ728YEnm0sae79XkAG5cJ:cgUWilr0TkTT5/yE/ve7SXcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682979983, "uuid": "d4901487-cd8d-4dba-a210-44114aa1589d", "value": 2565501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682979983, "uuid": "c14fd055-5942-49ff-ab4a-25a329ce3e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979983, "uuid": "c33d8858-7677-483a-9edc-e86f4a63ecca", "value": "9ad8ca502e5a46298c039b49fbf8ef3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476e96ad-e820-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682946085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946085, "uuid": "9dac6b0f-40e0-4612-95b3-aba9f0fe83cd", "comment": "Malware payload (AgentTesla)", "value": "6a2dec98d4672a3d9275ce2deb4ec1a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946085, "uuid": "56823479-3b14-4897-9313-50935488f2c7", "comment": "Malware payload (AgentTesla)", "value": "81cd7d55388e715517b4f91ad4185a3ed27514cac314680eeb34cae3b839581b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946085, "uuid": "b9a69d66-2ae4-4d87-940e-123f0e1acb1f", "comment": "Malware payload (AgentTesla)", "value": "68bd51fb9786ebf8dcd5f2b6a7f2723b0eb4a6ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946085, "uuid": "bef53fee-45ca-4f56-bc0a-4c85ce3a4182", "comment": "Malware payload (AgentTesla)", "value": "ad15dbc067acd0d41228f8864a7bcff56dc44a06a48115537d80a7b1c236b811fa1c7a38e1f46d42a51ae59df6310649", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946085, "uuid": "e213f13c-9482-4804-b23b-9c28714c2662", "value": "T1A005E67C2578E9AFC57AC5618AD4CC67F320916B3306CAE6AC9303584709B52B9C71BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946085, "uuid": "1af18420-acd4-4aba-b1ee-b02a86975c3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946085, "uuid": "a372a9e3-5c90-4e70-9e68-8b76ebebf51a", "value": "12288:el0DNHisyBMophe06Sfkm5BoZx1X0Hfy3xAiGgTBSbE9PusQvT4IJ0X4e:eiDzyBdW0bPoZDXuf+xAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682946085, "uuid": "a8cf0040-55ed-410e-9f7d-cefa2ae6f22f", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682946085, "uuid": "2b09dfa4-292f-46e4-81ec-47f93593bff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946085, "uuid": "1b5e6983-f388-48ca-b36c-b36f620fc208", "value": "0410YT796705-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c847490b-e818-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682942865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682942865, "uuid": "68bf357a-713f-4be5-82be-fc97539ea0d9", "comment": "Malware payload (AgentTesla)", "value": "1a3d798ce06a089dba40b588974df40e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682942865, "uuid": "b8c7a1a6-1f52-40f0-906c-26699140d39c", "comment": "Malware payload (AgentTesla)", "value": "83fd553a717918ae581282bf4e8f07a77f178a16cbec587a622a6058d353ddf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682942865, "uuid": "8eed85dc-f7c3-4f54-9ebc-4de9b7ff09f6", "comment": "Malware payload (AgentTesla)", "value": "6dd91998a987787a6b32b6c4078f4862d6b2c16f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682942865, "uuid": "93566e3d-022d-40cb-a772-394cd669d7f8", "comment": "Malware payload (AgentTesla)", "value": "524503e512484c4c11bfb1b065e14726efc750c818543beb143acd846292c7ee1d7fb32bbccdd29c7b1b516638b6212b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682942865, "uuid": "a827cafb-6bd2-4168-91e4-6cb09296a560", "value": "T1F6E4053C19BDE23B91B8C6A58FE18427F340D4AB3115AEE6ACD747958316E1235C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682942865, "uuid": "9c904b91-bd76-495d-a34d-90caf9eb8095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682942865, "uuid": "f0f5148b-d189-49e8-877c-97703dabc8ca", "value": "12288:zSVx0D3tiG+YM8rJ4AY+ywuvDw1kaQTxuYIdTpIlRPV:zFDd4v8F4SywuvLa+uY6TpUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682942865, "uuid": "5b6893c3-c0d8-417d-9f0f-8088c27994af", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682942865, "uuid": "2c93aa8d-edbe-4ed4-88bd-00d261110e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682942865, "uuid": "f11ccb7c-b65c-46fe-a8eb-4690393eba97", "value": "payment swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f79a84b-e854-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682968540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968540, "uuid": "a2331a7b-8770-4a69-93ce-0f2044dc6bad", "comment": "Malware payload", "value": "5a683b4fd996afadd0b70327aa95a24a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968540, "uuid": "bfb80d4f-9f6d-4392-a7e6-4a3f752a4185", "comment": "Malware payload", "value": "85153474fd273c6139c54fa214d3a1bec3866b80559447b4c28a578daa637d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968540, "uuid": "9d3b3386-df1f-4084-9911-22ffcd47aa6c", "comment": "Malware payload", "value": "157972d7b8e5c5b859d289a12a721caeee626266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968540, "uuid": "c7bcb772-ed7b-4250-b799-4c77ad0905d6", "comment": "Malware payload", "value": "99eeb178edf4f3802f303b60ac868e48b6cc9f50dd8bab63ba8299540052267cee0cdc690875dc3cdca4937c93b6613d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968540, "uuid": "5c13dc9e-7ea1-42dd-a269-ce966a81c49f", "value": "T179752387E2C88672CCB513B048F997A31E3BBDB26F3983D70797965A18746C19C31792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968540, "uuid": "eef5fdce-b00e-43ae-a1f8-febaff1ce647", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968540, "uuid": "808d5ccb-103f-4f4e-8b15-9e659b347858", "value": "49152:Elv/DVXz38ekIGl1GqoIAH7wqfvD3+DyMhi8GACsuoETnD:cnxj3KIq1WH7nfb3+DHhbGfdoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682968540, "uuid": "2be7532c-a9ea-4011-b1f0-97f61cb514a4", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682968540, "uuid": "a798e310-28e9-40a0-9872-e87fb56da8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968540, "uuid": "9e8c2ce0-1a69-44d4-ad25-d3c6e3062637", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc2e72e-e853-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682967916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967916, "uuid": "8587708e-2a9c-4050-9796-8433c53feb1b", "comment": "Malware payload", "value": "735d6c6e3f43cfe90883c024837d29cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967916, "uuid": "62a89cc9-34a2-43af-900f-402953dddc79", "comment": "Malware payload", "value": "8768799a86c3e47a671dba04e15435fe7efb348e1af83b17cde14a6743b9d749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967916, "uuid": "c6a2bdf7-8262-4db5-bb75-a382b0332fd4", "comment": "Malware payload", "value": "34acb37373592660c1f5fb4301e366a0d741c65e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967916, "uuid": "c8b1b499-8149-4f90-9181-dd39b7744cc2", "comment": "Malware payload", "value": "a6acab0c686256cc7a41d31f63c481f21ef8f56c5a00814b511829d481f5d0666516e3257a75826e82eb0963d0c68425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967916, "uuid": "d874319f-10ed-4bde-8d32-b61c21c9576f", "value": "T11685C60B3F254966EC1A19FAB0E727344B60DE829B29D24732C637D943FEDC3A84D159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967916, "uuid": "c0716096-6507-4d9a-92ce-cd945c14dd0e", "value": "49152:r9eNtiWdjtVZ43lS5bT0sGlShKpK1XqVU1:z14SU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682967916, "uuid": "b48605be-c4b2-465d-8909-d5b8c5fa7f34", "value": 1784056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682967916, "uuid": "9100bc07-d487-418f-919e-80c09f31abd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967916, "uuid": "6d91fcd6-c0fe-4ae1-a09a-92befc22dc25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a895d6f1-e802-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682933363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682933363, "uuid": "39ed8882-dd4a-4be8-9d43-7b195bfed743", "comment": "Malware payload (Formbook)", "value": "d19b3dfeb914806a27b9e13433948228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682933363, "uuid": "c60b233a-184c-43ca-8c83-aa70d22928ec", "comment": "Malware payload (Formbook)", "value": "895f56ac536039f2b575b9013cd2d756d48f2fd6ecab01689f33b1d18598452d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682933363, "uuid": "8ded60fa-1cf9-422c-8a86-448eddee73ec", "comment": "Malware payload (Formbook)", "value": "b474a937081fe94306d1606422b5daae098438e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682933363, "uuid": "1cbcfea3-78e0-4cd0-8785-46649ffdf900", "comment": "Malware payload (Formbook)", "value": "5a34867ebac1ab637b5ab3774d6ad99a3ce575aca364d765343ad2c0006218220f58cad9be2813546c4ac98f1857dd82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682933363, "uuid": "67636639-ac05-4ed3-985f-188c49259a14", "value": "T1F2F4AE3D167C6737D17AC3758AD08413B3E0E85BB221EDA96CD613E60753A427AD322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682933363, "uuid": "fc2a2251-4a87-4303-92c6-15b98094402d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682933363, "uuid": "be03d648-3e40-4a5c-b25a-2d75f849d97c", "value": "12288:BN2vFuMR4QsUVKHO2LbReKF581y15/LqtdWU2SYclv2DOqR3UwYhY4I8:fSuzeOnBP581OjoYOPsSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682933363, "uuid": "70591d2d-ae72-442d-8aed-b708ce7aa469", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682933363, "uuid": "c1f00a55-3097-4720-af28-c68946e7696a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682933363, "uuid": "b2a9d218-269c-41b3-93e3-ea4a3113f074", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0426f51d-e7f8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682928792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928792, "uuid": "8d770955-f4a3-4192-b171-24d4afe6c42f", "comment": "Malware payload (Mirai)", "value": "6f863259451d7d318354760f18c5d96f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928792, "uuid": "fb175f75-17b5-4d43-9c0f-8a5897e4974b", "comment": "Malware payload (Mirai)", "value": "8dc2c189d271a83a0564f744cb08ae842a5408c6715b5f82e3dbd58e66da2ccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928792, "uuid": "be91a4ca-9661-40d7-9d6f-9b6841ae92c4", "comment": "Malware payload (Mirai)", "value": "ed7af77fdd7ee224669223a8e52124f1f77c67b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928792, "uuid": "c0c31a26-cc55-43cf-9919-a2182756e3dc", "comment": "Malware payload (Mirai)", "value": "aa0a3cf21f37d1ac083e9fe6a0f96cda2af757e8ae32395772076cf1b6e64e3325994d3832d4435573d8a45dce9d8ace", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928792, "uuid": "6bfdf814-f1b1-47df-9423-360850060bbb", "value": "T1DC236DC1A543DDF8DC1105F12173EBB79BBAF07A6029EDD7C799A932D841A01E50329E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928792, "uuid": "03685624-a491-413f-9c0b-6fb49469fb0d", "value": "768:3W8Vw1BBOGSc2Wlo/bvnhwMMPRwEL5vZKnbDcdlYybJmiXO+YkX4aP:3LV0BOGSc2Wlo/bvhwMMPSivZKIlYuJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928792, "uuid": "5b7ddf36-2887-4b86-9a4b-21690f691036", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928792, "uuid": "760ef770-669b-4577-8e86-f785919d1aef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928792, "uuid": "54901d3c-40cd-41fd-8c01-006fa82c8360", "value": "6f863259451d7d318354760f18c5d96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c56473e-e814-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1682940939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940939, "uuid": "dfd62d94-86ac-4470-8c6f-a681c2bee7a5", "comment": "Malware payload (Tofsee)", "value": "9f95df4831aaa8dc6bd0cd4584f59e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940939, "uuid": "b86a074c-c5f3-41a9-a36a-a9298ae0d05a", "comment": "Malware payload (Tofsee)", "value": "8e7b46b880092192df1a09ea0fd5878b17d1ba9ae89c5de6d61d74d1dd3e35f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940939, "uuid": "67ef920f-0768-4ff2-a931-eefe965152a2", "comment": "Malware payload (Tofsee)", "value": "14db8de87695de3074043932e8479e18ac2dd5d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682940939, "uuid": "68b0d33c-7477-40f9-b12b-23785018ee79", "comment": "Malware payload (Tofsee)", "value": "0d94f83b07606d69979e76b65e48ac3791a734cd6d3f174d9547dc004f8a2c2424e3ff3ddb9c988bd62a116ad08800c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940939, "uuid": "e673c485-22e0-439c-b9ee-c24a266bef93", "value": "T112747B3262D0A871E5275B718E1EC6F47A6EF4604F556BEF27994A3F0A701E1C2B231C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940939, "uuid": "c3f815e1-c1ee-4cec-adcf-aee57045c4e9", "value": "e690d90f10792337897b6f984bebcd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940939, "uuid": "f31296ce-96af-4c49-9e0f-3fef975aa914", "value": "6144:r/eUB2wMyGWA1qom6IvMlU9kaXOOEbLQHl2QSzVhn25Y:r/hBVPGWA106bha+OKsRSL6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682940939, "uuid": "f8dd4f8d-eee9-4925-9adb-5d48ac0860da", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682940939, "uuid": "a53dca6e-92c5-410e-bf9a-a59f6c3b5573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682940939, "uuid": "87e29fd7-5e12-4b4f-8330-6d1d30707093", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537037c4-e823-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682947393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947393, "uuid": "6f73bd99-f42c-4edb-ba4a-a3e8b5ecafab", "comment": "Malware payload (AgentTesla)", "value": "f948d2a0310e530ae1db8e0ae15dc31c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947393, "uuid": "afdbbf8c-1506-4e12-93bc-d3492a009349", "comment": "Malware payload (AgentTesla)", "value": "8fe7d0ef2d9aa32d76480ed8cedd24a3d4186343d8cf99f76d2977978db05608", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947393, "uuid": "52444ee5-872a-487f-8209-e16b8062daae", "comment": "Malware payload (AgentTesla)", "value": "297458453bb83080cb583420730161cc28bb34b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682947393, "uuid": "42f40c92-3fab-464d-adec-d6e36aa1d10d", "comment": "Malware payload (AgentTesla)", "value": "b9877b309b18d84107941ab82d9b36d5d658b4e365c77523e11bca371ed0625473af94ba27f6e36e23ade2fc9eb9b924", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947393, "uuid": "6332aa5c-7c57-4b31-bfb9-f350cb12805f", "value": "T1F9E48D3915B86727D17AD37996E09813B3E0A45FB211EE987CC603EA0746E8176D323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947393, "uuid": "f7e30629-d995-4b58-83bc-30821d0e3746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947393, "uuid": "a8b43859-f58b-4278-a49e-98325f937263", "value": "12288:ML1gs4+NlVlcOi/3FlxkHptmqbwaFudLgZXUvv34k1+5ARRkp:c3lVlch/HxkHpMkidLQXUvv3J1cCRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682947393, "uuid": "27504ab6-6276-4ed7-8792-00b552543b03", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682947393, "uuid": "b9b7ace0-2e90-45e6-a777-797821ee1ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682947393, "uuid": "8aab3581-5dd0-4b65-a3d1-9b29cf0569f5", "value": "50931426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9bf5d5-e7e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682919309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919309, "uuid": "9e51461d-12a6-4696-b8ac-ef935ceb739d", "comment": "Malware payload (Amadey)", "value": "c23d62c9166ae248fe9fe078328182f9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919309, "uuid": "ce119a80-6825-4705-a388-add1be02281d", "comment": "Malware payload (Amadey)", "value": "90fd1a34bfc130e0d23555bf7f57a4e7d1cd49ae035b29c02aa76eef28b07a9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919309, "uuid": "578cc70c-1751-4ab0-a84a-5284f72eec94", "comment": "Malware payload (Amadey)", "value": "ce684054121205b1cd7befc016644680fd5b29d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919309, "uuid": "3f07f444-30b2-4561-927f-126348ed27de", "comment": "Malware payload (Amadey)", "value": "f782a0bc7bf980fb23f17672d9a5151158abaa0def2a7731d5997a994c97c547f936803ec35c9fbefa5bac5afd581e9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919309, "uuid": "775ea259-b210-4566-8475-5e444eac77d5", "value": "T19E3419217D12C031C96061B729B9BFF2C59DA8259BB049DB7B800F77DA112E67A31E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919309, "uuid": "804ee98a-eeb0-4be2-98f3-a7945383bebf", "value": "5a0c3aefe02225d25079e18b4cd48911", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919309, "uuid": "e77a6601-44a9-4f96-9c7a-d2ea52748f81", "value": "6144:qZOKsgHE8srZb6sbJ42UqQqcuFCXogRNEFWa0:RpBJuqsuFCXogRNI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682919309, "uuid": "01912bc0-1360-4ea7-b3b4-48e23d170947", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682919309, "uuid": "d46547b9-8676-4021-bc87-8374a6664369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919309, "uuid": "c208ae37-4673-48b3-8d23-ca10dbab4b36", "value": "c23d62c9166ae248fe9fe078328182f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f0bf47-e7fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682929946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929946, "uuid": "868e452a-559e-4029-bb22-2d8f5c8e876b", "comment": "Malware payload (RustyStealer)", "value": "27cb88ac0a72387e85de13cb144d1737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929946, "uuid": "7fb2404b-16a3-4315-98f9-c9e6a0ffbd1e", "comment": "Malware payload (RustyStealer)", "value": "9446190081232d7d7de3ad599a3376b301e8167abca3935a6ac645cb44ab4a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929946, "uuid": "8209a7b7-0d61-468e-9c83-0e553f384981", "comment": "Malware payload (RustyStealer)", "value": "70c8808e26e791f28b9c4a702ba00d7c7b2ec1bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929946, "uuid": "e5417b2f-5415-4659-a7b1-c727bb4e7428", "comment": "Malware payload (RustyStealer)", "value": "e92b33bfd8d23e85aae9f77e4580f497b38a96ae9a0efd17698a3a8330541c730a66e9f38da70733b223668c31d1b408", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929946, "uuid": "e7abae58-fcc3-492d-bf5c-37fbdca8ba74", "value": "T15E645A12FB4664F9C85BC474C642466676727CCA0B31BAEF1AD462383E76BF06F39244", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929946, "uuid": "4c5a0e45-6567-4dc6-bf83-a6482ab21ddc", "value": "7cd0bbb42d4b316f99f5cabd76b4bcaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929946, "uuid": "f4384ab3-aa5b-4b25-aa31-8d5b0dfeeef0", "value": "3072:HBbwPB644jZVjwMVuG74CHy/8c77uv6tvkNN0P3oh06QM8aTVcZjaKW:HBbwp64+jtVuG7Hy/7uv6tvNPH6QSxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682929946, "uuid": "bf8859dc-ebed-443e-a162-22b538e27e3c", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682929946, "uuid": "beeb50ee-1d5d-46c9-b2fa-38dd5631ff13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929946, "uuid": "30902eeb-fa69-4740-bf64-4d5538910bed", "value": "elevator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d671d0-e830-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682952892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952892, "uuid": "c20143a0-2b15-4b33-810c-8d728ab08af9", "comment": "Malware payload (RedLineStealer)", "value": "4ea65ebe7f90958e67bbaa64855e815c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952892, "uuid": "67807c90-1c91-4097-9287-7e7556be8928", "comment": "Malware payload (RedLineStealer)", "value": "978f74d89137491600075b28ea9fdbd45c5ee4f34a1caaf95f6ca937419c382d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952892, "uuid": "6e27ec69-2a0f-4ed1-a357-9fe168ef0139", "comment": "Malware payload (RedLineStealer)", "value": "3c74c0e43a188769d4f99e2736102bce58544493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952892, "uuid": "c4d2ed3e-48d9-477f-bf7d-2786472d439e", "comment": "Malware payload (RedLineStealer)", "value": "b599d854e6f34c4a877b5b13721a4077988a4722cce8694c540e70a872d674944cc9c0f46f8562beae39e47c5602e426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952892, "uuid": "05f404a5-1b8b-4929-8f30-b9284fd22ebf", "value": "T1CB944B0393E13D44EA294B729F2FD6E87A8EF2509F4937B5115A9A1F49B01B3E273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952892, "uuid": "13af8c05-5c1f-4643-b165-b17268b7f116", "value": "8e752cbc2a7c73137ae3765e2dd6f418", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952892, "uuid": "d3f53932-6498-4a84-83a2-ccb0306fa074", "value": "6144:yYqwXu4rwhg4x7u69Yd4BnuaLso2atftUvcXW7b/H+:+wXuQqg4x19Yd48aLYatfycXay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682952892, "uuid": "c2de40c0-56af-403f-b350-88551b55133f", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682952892, "uuid": "ddbb490f-d266-41ac-b360-41eb72ed1117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952892, "uuid": "8271f022-8eae-4c4d-824e-72488445b655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf01a82e-e80c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682937722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937722, "uuid": "b94dc20e-be05-4037-9d5d-b23b5805a7a4", "comment": "Malware payload (Mirai)", "value": "a2b5994c39e8c52bed1bbd32045ebda0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937722, "uuid": "5af79a19-6f59-49d8-90d0-c60fc1fee614", "comment": "Malware payload (Mirai)", "value": "97b8031e7f1f656113e3f3808afdac2e7d9b7703330b20bfc62ca2e12862264c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937722, "uuid": "1423458e-29af-4fc9-9d9b-9613f9fd9129", "comment": "Malware payload (Mirai)", "value": "c5416e2dfded96d65a400f69a58377a57bc8f9b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937722, "uuid": "80917ad5-ebfb-43e6-9050-77d69a3d97f6", "comment": "Malware payload (Mirai)", "value": "b9a1fd9b4abb362ce051e7d43b0f803a2ef9413622fe78118cc3ed8ec7022882bf8fa48a89a63988ee908cfcf65fc086", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937722, "uuid": "e813b01c-90bb-4765-9d10-c0f69371d9bd", "value": "T11EF2D06328598D61CFF0317AD6E062017FA85A7CC16974B256A16F18BBCFD8F64A018B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937722, "uuid": "c03d8b40-f617-47a0-8f6b-774d71d1b2c4", "value": "768:Cb+GsIbn0XpiTAPB4bT9bOs26GIa+UqaX+TCx9q3UELQi:Cb+GsLidbT4s26dVUqaC7Lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682937722, "uuid": "52a9badf-20f1-4085-8fc4-367ee154afde", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682937722, "uuid": "43e1d3fc-bb09-4972-9ae0-11ad4c9b2559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937722, "uuid": "3e2b11f7-6edd-4410-bf7d-31c9f1bf69ff", "value": "a2b5994c39e8c52bed1bbd32045ebda0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "196ea73d-e807-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682935270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935270, "uuid": "e21b924c-551f-471c-a26c-743fd9fd1f6f", "comment": "Malware payload (SnakeKeylogger)", "value": "d340b255ab3e052b5bcb910f0c79d886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935270, "uuid": "de13627f-2522-4463-b256-b34c231cb46e", "comment": "Malware payload (SnakeKeylogger)", "value": "97b9854240d147393cc47a0a37bbca4bfaad2233f87d45da15784b9750321039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935270, "uuid": "d8eabbc3-a943-4c7f-9918-25397af3e9d3", "comment": "Malware payload (SnakeKeylogger)", "value": "82a1a897e0fe989342fcfdf9e90a7661ff5a0915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935270, "uuid": "0fb0bc8f-20b6-40cf-9f53-d9b35eefaa2e", "comment": "Malware payload (SnakeKeylogger)", "value": "9212f09e64108a46d2340f17cfd0f9d1f559bacc59524ffcddff96179a9eb8f427e171668c8293d6cc8357543eeed1f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935270, "uuid": "e92b0165-1671-4eb6-9922-757fcbe8d682", "value": "T1BED4F53C49BDE23B91B8D6A58FE5842BF340E46B3115AEE6ACD747518316E1234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935270, "uuid": "c671ee87-3f6b-47fa-83ae-3a1d8758a9f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935270, "uuid": "a6c1a19d-e8bf-4a88-8e32-746ea38d667e", "value": "12288:LqkulLxfRiiXpfJzjKqiL1LvhGdUGe/b7H7n0CI6z:LJuldwiZBHXe/b7j0C1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935270, "uuid": "dc746871-b080-4f26-aa12-6a9f42711bfe", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935270, "uuid": "a62bf713-4b67-478d-8f17-6350fc6fa0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935270, "uuid": "d2868548-367e-45ae-a77d-6c7432208ec2", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a54b4c1-e853-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682968048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968048, "uuid": "85369430-4054-449b-a9f0-c2177fd9365d", "comment": "Malware payload", "value": "2ba2e73f96d59d7dbe7d6406c86f0962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968048, "uuid": "ab59cb0f-3c37-4b04-ac86-af7588032941", "comment": "Malware payload", "value": "99e5deb6e2e5af9bc44cc14c4f6954fe8d235b705ed9efca27834b709601bfcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968048, "uuid": "9ff6a13b-a3b9-49f0-8d8d-ef2e127878ae", "comment": "Malware payload", "value": "649bddbfbe192a61e397b4bf671cd59505882595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968048, "uuid": "7463e138-5401-457c-b686-a9cd36130ab7", "comment": "Malware payload", "value": "720515076d30b41ffebdde9adb9f1094fdb97dc48797ead0ccf1f824e1d9ae7830c8a853730eb1ede819859586d0bdd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968048, "uuid": "fe8ac1da-c5b8-4cfb-98c6-26480c727561", "value": "T19214D0123B54C5A3DD5E0630693B8EA71AF67C291AB0451B37EDFE3F96B3252490E309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968048, "uuid": "48713e46-c56b-4ebc-a37f-dcd7a8556a2f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968048, "uuid": "b0b95590-933e-4ef8-a812-8c3a807a6cf3", "value": "3072:91NjcVVnLpPu4z4UvthII83E0PDiH3E1poWCSYN8Cqi5u7tYPjb:PNeZLz4UHCr+koQCputAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682968048, "uuid": "0b5ac0f1-6667-4ec5-ab85-95aaee56e018", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682968048, "uuid": "709b5509-ee33-4b22-89a8-29cc8f560375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968048, "uuid": "554c4669-1b81-472a-bfd9-e82bc4142dcc", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a43aba4-e844-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1682961632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961632, "uuid": "a70f8085-7edd-4dce-b86d-be9eb00aaa5f", "comment": "Malware payload (Amadey)", "value": "3765e5a027328866312a6f27f6d02875", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961632, "uuid": "2e3c3997-935b-496c-a49c-ed441c7cb388", "comment": "Malware payload (Amadey)", "value": "9a23b608d40c2409be16f02653f782b9bce18fc6e204efea3072c3bd60915715", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961632, "uuid": "00ee455d-17e0-4e58-8f39-4b66219e1d8c", "comment": "Malware payload (Amadey)", "value": "88a999cfb8317430a887fc87ee4e243218583a30", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961632, "uuid": "5cc0bcc5-4101-4039-afb1-b5075bc50dbe", "comment": "Malware payload (Amadey)", "value": "2408a90c21b9c53650caf2831b3bd6d0b0258938cf7c955dcb0d46f06986f6e5dc27c5d6b96778e77e4b18a6ef77f9f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961632, "uuid": "8f029b07-cca7-4b47-a3e9-0c1826f81b65", "value": "T16C75231A98D14266D9BA4BB059FE17B70F3AFC61F66842EB3384518D9C313E59830737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961632, "uuid": "370c70fd-e76b-4ba3-b1d8-7ce4de0c1ebb", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961632, "uuid": "7a573a7e-6107-4d84-8a20-25b0dc94d4ae", "value": "24576:eyBiX7WB+CjluuY6ckhEUHvEqCyzTGeACrbjUJMb9wPpyJm46fo3qLvZ:tBiXSBkuZl9cqC8TGPCrXUJOSM+/Lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682961632, "uuid": "62a07af1-fdb2-4602-a73b-7f7591d6d200", "value": 1583616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682961632, "uuid": "6096611c-7ea5-4ff3-8488-761b2fa3c600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961632, "uuid": "a0e1e197-24f3-4bd5-aad0-9495fe9d0f8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c5b12a-e81c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682944310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944310, "uuid": "2bbde8e1-d1d8-48dd-9857-4dec4bd9f5ed", "comment": "Malware payload (AgentTesla)", "value": "c77154b7b463d59152d2ed3c8dd92ef5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944310, "uuid": "bce191b3-0066-448b-b151-9ca7e2c1c35e", "comment": "Malware payload (AgentTesla)", "value": "9c4bed3e367c58faa476e1f02c6f3270daba50527eee5a20d4f25a4610cd56e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944310, "uuid": "3fd69618-07ee-40b1-a504-ad64b0d66b5a", "comment": "Malware payload (AgentTesla)", "value": "2a856b03e0e67084c48a95e2d97a1b4bd27698ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944310, "uuid": "c5a4f2f7-95e3-4683-a10e-1c38bc2b7da0", "comment": "Malware payload (AgentTesla)", "value": "2ca31b75b6ebac323375021af0d7b62160147af9944555c8ff52ce9f65c813cbb568d699e97827188070bddded1947f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682944310, "uuid": "1473ab6d-e1a2-4cb1-a536-f40a7f39a957", "value": "T1E9C1E854E3EC4737DBB64B39A833B7504378F742EA93CFAD6888410F9E167944A21B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682944310, "uuid": "28cc6f16-0850-4961-82ff-ef7c4b2bf5e1", "value": "96:aAlyWIK4Sfxi04wgazMEiwr0a9OXOhdtbzNt:adKP4FwMEocOXON9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682944310, "uuid": "50030880-6f50-44c9-a0e1-85ad648eb2bf", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682944310, "uuid": "b1d6b699-a447-426d-a80f-f93fc8d4b66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682944310, "uuid": "a7f2e85a-8c96-474a-a2a0-b42193fc0e9d", "value": "doc_ORDER ##567687.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb22b8e-e816-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682941804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "a819d095-6345-49df-a957-c0fa9087980f", "comment": "Malware payload (Mirai)", "value": "b4431e6f613276927197ad11f19d057a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "a771fef6-984b-4217-a425-12e8dedef739", "comment": "Malware payload (Mirai)", "value": "9c60c5537651b08560ae5c742e69f4c8460c9741ccef5862a98befcffd68cec4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "a9436f1c-58af-4154-89cb-baa019e2bf34", "comment": "Malware payload (Mirai)", "value": "77d15358656f27bb5d721e30142f11b8b083124c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "9241794d-b313-4450-9cac-39f920995ff3", "comment": "Malware payload (Mirai)", "value": "18b90c96374da028ee0360e254e7973a24b2e4cb73f8a9dcd539e4fe6042d0b842a5111ff4286b8226a8ee76122a17ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941804, "uuid": "520c539b-8c04-479b-ae3e-07babd5d9dcb", "value": "T101B2C0CD61943084CA8D7C7C578D4A674F6CA1C0BAEEDB29E354CD9873BEA4B3859078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941804, "uuid": "38d407e0-1104-496e-9f62-a3d1a4bcacba", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpUZqEWvM:/QlS07FUXqIYSXQKqusqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941804, "uuid": "f8fc728d-1eb1-45de-a3ea-754dfebf0278", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941804, "uuid": "64cc1fee-875a-45e4-8689-28a17c083e7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941804, "uuid": "e5e3b0a8-8ec9-413f-ab5d-1b36dda8fd43", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5ba2c9-e7c6-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682907497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682907497, "uuid": "eac1562e-76a3-4d34-a563-36f5a8c0a968", "comment": "Malware payload", "value": "baeb098b27562e9cfaf19c349ff65084", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682907497, "uuid": "37ff97f7-5870-4cb8-925a-f60829708f93", "comment": "Malware payload", "value": "9d8b5e70442a337f546e149aa4393ec8f561daa323fb17c3b9c3faa8071a6639", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682907497, "uuid": "1abcd750-4634-4a23-ad7c-dc393c191aa2", "comment": "Malware payload", "value": "431d41226f863fa3b3e02a18af52ea6cb1826d82", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682907497, "uuid": "70260050-93b0-4411-a65f-40f4dd004558", "comment": "Malware payload", "value": "46d5367e0401579a239f83855ea8b0a1140a7aff28b5efa105a75a9748c4f77ba51f9af8f35997a9b50c84fe306b8a78", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682907497, "uuid": "fa152e05-8dbb-47f8-a1b0-b54dcb9aea04", "value": "T16D2733931C0AACDEC0326475493F2349A935CE2E3EA236621458DF77C6F3565CAD9EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682907497, "uuid": "40a57397-c4d6-4b66-8d1f-0b7861b27361", "value": "393216:ZqRsJA35z7A79L+UA/1mbgafiubcPZTbZT9i/zVN2I+TX/tgKpPbNiRSKcstJM:ZqKJA35z7c5+9mbBffchTTi/zVN2Ikvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682907497, "uuid": "b27c0af6-35d9-44a9-8b1d-a1ae42a8120c", "value": 21502757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682907497, "uuid": "901108e4-7b4d-49d6-abc9-0aec64edafa2", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682907497, "uuid": "1089628f-a9dc-41f6-a229-3783149e7047", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4489ab2-e853-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682968199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968199, "uuid": "8ecf0863-b0b9-4137-8b42-7eaf524b32b9", "comment": "Malware payload", "value": "f778a9b4ae7faba9c4a991864f7d51c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968199, "uuid": "d27080cd-938d-457e-813c-c6d6b9a82431", "comment": "Malware payload", "value": "9e741bbca30380dd6f62954ca9e1c9d2a6270e00c92ce11ff18956dfe0ff2f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968199, "uuid": "80aeecdd-b9c9-4cc6-b10e-c7e213297b58", "comment": "Malware payload", "value": "1e3261f314e84702006add2d0ba641a3f8c50578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968199, "uuid": "8fbbc60c-d0d6-4090-a695-d93ab934485e", "comment": "Malware payload", "value": "796fae0315a87f855ef2e57ff9f58eaffd74f21442f2fbf87ab7edb4a3b08ca018121eeb5b608253cd4eda028ed87e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968199, "uuid": "e6f3d6db-753d-47f2-b8bc-b9ad6b766642", "value": "T1D6F24B8173D00594F29BDA78C5A7E23989E1710DF7ACEADF5712E0641FF1AA0793B860", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968199, "uuid": "06ee2506-fb5d-4b17-a3fb-0fc4ed2d6f67", "value": "b79c11cdf3e82702b3d0b272d133abea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968199, "uuid": "4c6f3ba4-dc42-4cb1-972e-2e34e0d444c2", "value": "768:gcamYcyoggt9drmVTuU4bGxlZ+0noKl9tqrG+05bHfyW6eCmKrvTsma762SuzGGV:g6BbRjrMw/QxWik5fOtOW0L0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682968199, "uuid": "086a4f57-4e52-4c74-beeb-bf021d49f7bb", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682968199, "uuid": "d4d00cbf-dd0a-4978-9b34-e75a9b3e665c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968199, "uuid": "004f7a0b-ab56-44d8-bf87-b4ad02d33c5b", "value": "9e741bbca30380dd6f62954ca9e1c9d2a6270e00c92ce11ff18956dfe0ff2f20.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d4eff1-e822-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682946919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946919, "uuid": "f35a5865-1a64-486d-84dc-bd3ef9a2cd10", "comment": "Malware payload (RedLineStealer)", "value": "c726a4eba148b17c9ccf3692fbc90701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946919, "uuid": "2bf815cd-dc94-4eda-8425-adaf51a79df8", "comment": "Malware payload (RedLineStealer)", "value": "9eb758edc7a192e4a4fcfe1eac1799c1e64408cc57809628f2ae8c2114ff8eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946919, "uuid": "8fa29515-5e3c-4f0f-91ee-30f8a3e5ede7", "comment": "Malware payload (RedLineStealer)", "value": "52d203ff30f7a23fdc4cb45caa2efa40324a43d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946919, "uuid": "ae108d76-9072-4516-8c4d-2e8318acf906", "comment": "Malware payload (RedLineStealer)", "value": "7f2b04fa00a790cd6da177a0319e895c6260538edb1274a9a1db595d97f4e04716ee706b0952b7da39e1a69dd92232dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946919, "uuid": "52a6c4fa-83a8-48f8-a5f3-5dcd0c7f26e3", "value": "T14F854A47BC9160B6C4AAD2328A665251BB30BC980F3563DB3B50B3BC2F727E45E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946919, "uuid": "62367ba8-91b5-4717-a574-8e839cb6fcc7", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946919, "uuid": "b8a8fc5f-ee1a-49a6-977e-c496061da11a", "value": "49152:rbwfYXOdg8BnGyKkv6dfaAHYgDJY2Zuqz1:rs7sf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682946919, "uuid": "58d4c515-1123-4684-95f1-731b3b165c61", "value": 1790976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682946919, "uuid": "c4878533-9a70-492a-b332-6ea80edb3777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946919, "uuid": "c9d45e76-1b8c-4fad-92fb-9d14e6c4b2ca", "value": "c726a4eba148b17c9ccf3692fbc90701.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6242c8db-e7f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682926802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926802, "uuid": "5fa47dd5-d1f0-4a05-a7bb-8415621dc8aa", "comment": "Malware payload (AgentTesla)", "value": "8d203384466b73545f2599b2c49c33f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926802, "uuid": "e36d120c-1d46-47ed-8f9a-658b16a01ef0", "comment": "Malware payload (AgentTesla)", "value": "9f1ebfe84d852a7415907215361a166ce38c8805dfec213ca225f52894e91430", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926802, "uuid": "e37e7ddc-1ed1-45f0-b535-c3631f7a4b30", "comment": "Malware payload (AgentTesla)", "value": "cebbdc36369d06f970c28c30371e0d615dedf10e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926802, "uuid": "0a485220-9cf5-49dc-924b-df2aefe21e05", "comment": "Malware payload (AgentTesla)", "value": "e4d3c3c09a895a3d195b6614aa42e9b712245760a29acdb5d9e3450dbe3d76c90bb2f575035a2c001786e9a4e1400ba3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926802, "uuid": "9a4b7668-f3e2-4557-9b12-a6ae23866a7a", "value": "T1BB5423727644C07B31A50F529DFA0594CADA790DA6CBB0315700F6EB8CB878AF3911AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926802, "uuid": "8b56c885-7c66-470a-bb05-2300abc53714", "value": "6144:L6Add10WSzXAT4tapS/388LY9t8/NayTD6Ewf1FrrQ84:mAdT0ZbTawv8V9y/VOFrrQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682926802, "uuid": "cf4de10b-1110-42f3-abf3-bb230c5e1dcc", "value": 278810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682926802, "uuid": "27d237c5-7d20-4c21-9445-f9db43270c58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926802, "uuid": "6b1e531f-5bec-4684-8abc-bb7012f321ab", "value": "New Quote_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f73098-e809-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682936503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936503, "uuid": "afcb1a1c-824d-4794-886e-44af02e4bf0c", "comment": "Malware payload (AgentTesla)", "value": "93fb23e72b3bfb1b5b384d32133b5000", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936503, "uuid": "141abf01-6d26-4b3a-96e2-093a935ecc74", "comment": "Malware payload (AgentTesla)", "value": "a0959f72e13211452dc49f9359f43d5b7df3a98fb24f0fbaf0ec2c29d85bb1ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936503, "uuid": "29c32b57-2557-42a6-99bc-d1eade62ea2a", "comment": "Malware payload (AgentTesla)", "value": "0bc84a35e687c7dc3785e00d5da808c0f57eed40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682936503, "uuid": "aa4e7cff-bb49-4277-abdb-53ff569e0335", "comment": "Malware payload (AgentTesla)", "value": "ffd6e61b9fb33a669fb92076fa882519ae1eb4310f1510c6023c4afcfe6b40744cb730e7c49af860ec85b6a679871a07", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936503, "uuid": "3e409b7a-5b9e-4b1c-b4e3-338923d82fd9", "value": "T1FBE320D2B5045994EC663A7244379D740163AEEDA8B4E70D60ABBF237FF32831427987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936503, "uuid": "090df834-8ba6-4fda-9a63-af3687bb85a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936503, "uuid": "7076ef56-923c-4623-ae4f-8a3e3dc8d979", "value": "1536:UiClYy1sRWQm41YjJKqdMYIYG9g5mYz6MGnxCikFy5e2Dos2TGSW7zwV2111a:UiCJ1id+MYIYG9L/xkMLUs2XWXwVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682936503, "uuid": "e4db303d-1a24-4a1c-95fe-d313d2cacb5d", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682936503, "uuid": "209f94fc-b7c5-44c9-8d4d-1f022659229d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682936503, "uuid": "19e08500-b971-49e8-b262-784cdf82bf46", "value": "Request for Quotation 016pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e185f85-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899281, "uuid": "4eef9720-5fde-47ec-9eb4-ab837d5835a1", "comment": "Malware payload (Formbook)", "value": "97ab2171b12f2e2b41f65c02f23da953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899281, "uuid": "72e837a1-344c-4551-a6e8-9a21254912bd", "comment": "Malware payload (Formbook)", "value": "a25247a44c6daf029eae02060c11c9a946d0648f2eedc1a6348822c7c6590af3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899281, "uuid": "7e2877cf-c8ac-4680-9e6b-fa05ed2909c6", "comment": "Malware payload (Formbook)", "value": "5f8c09681c05ef89b17737eebe9452e522848428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899281, "uuid": "11088f25-9255-435c-a6f8-8d20da3b772f", "comment": "Malware payload (Formbook)", "value": "1db24a35f916f57717e88c42167bf36722c3455cb9201d5f1e7698812e8d390d7c0d159b62986261efe528ebfc1f085b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899281, "uuid": "7db681f1-5c3d-4306-9956-17152d15ba6d", "value": "T19DD48E3D29BA5627C0B6C3798BD49823F1509D6B3011EEA694D733B60713B9739C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899281, "uuid": "15a6c081-5f5f-4a52-9123-76b4f0393780", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899281, "uuid": "f7bde49a-689f-42eb-958b-1fa17d139cda", "value": "12288:UjLj//DKqnAoX8EIrdQE0b/QFoOKIrpYZIrDb0kt7OSbSU/:UPb/5n78rWzQSyCSrDb0kt7Hbf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899281, "uuid": "eb06ca09-f28b-4977-a8aa-425b478f2cf3", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899281, "uuid": "15721163-7a7e-4d26-baed-9bebef801de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899281, "uuid": "232d96f0-55e8-43b7-b4fc-1fa0cea03df0", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4224bca7-e852-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682967551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967551, "uuid": "3ab1f6bb-4f94-44fb-a93b-45b3b91a3dfa", "comment": "Malware payload (AgentTesla)", "value": "bb4eac10bd885d26d6cdbe6d0660ba7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967551, "uuid": "953e6796-9066-47a5-a45f-1dd1ed0f9ae4", "comment": "Malware payload (AgentTesla)", "value": "a32c204008b19238bf121a713fc57e95eab775cc388f5466e35c0f024750e777", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967551, "uuid": "08785277-1726-4e2f-a9d7-ac70c0f1e136", "comment": "Malware payload (AgentTesla)", "value": "59121e22508485c493d12f8a233df27b7e7ad2bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967551, "uuid": "d3d63dcf-6734-4f7d-b342-2a630ec688cd", "comment": "Malware payload (AgentTesla)", "value": "cb6612d9c9a8368ec25db490dbb9f54b54dd765f01d3c530a883bcd359098106c8f786ff65e98bcd64aebc6dc2280a39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967551, "uuid": "7d816260-9e69-4047-a1ac-34aa3d8d3b88", "value": "T14345F963F599CCC8B2D175639B9FF178B7F7A2E4802C5DA964DCC62A36C848C86012D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967551, "uuid": "1581ed05-5dfa-4410-b7e7-292ed1d9b410", "value": "768:II7XTXBje9YWXA0rsntuTKDsonyd2B2ovOm4LOw7A7PTMYTR:fJj9GPeDsFd2AoR4LFuTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682967551, "uuid": "80b59cdb-76de-4419-ae4a-6186ed47f604", "value": 1238648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682967551, "uuid": "f010f596-89ed-4734-a456-5759d76d7847", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967551, "uuid": "8166c960-d735-46bc-a439-7394594b9ca7", "value": "takenoted.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe28f3e-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682900002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900002, "uuid": "cdbbe920-5aa8-4845-ac8a-e116addb1da5", "comment": "Malware payload (Loki)", "value": "fac4995df3560bf80d569f433ed66f3d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900002, "uuid": "7fdd1b93-8f27-4f80-93fe-d6b4f217d39c", "comment": "Malware payload (Loki)", "value": "a39d14a98f0818eff83c9a3302c3fe028d377c4f2323276b272803869bd4599d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900002, "uuid": "d5cba5c2-535b-4ef7-a2bb-e1e23ab11a8d", "comment": "Malware payload (Loki)", "value": "95b8acee0a4b613acfb9dbc689d316470fb357d5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900002, "uuid": "886464af-c58e-479c-a30f-7fc714a1dae3", "comment": "Malware payload (Loki)", "value": "79bfc05dab7669e560d9d5ae6fdaf16f30c06a225a8bab2fb7b023c216af2fe524d1e41bc01522c9550954f927545655", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900002, "uuid": "aa7c58cf-7b77-49e9-a6eb-70dcf6a25aca", "value": "T1BDA42381E34A187E61C161289FA713DE2AF9E0F8B5D615B53D3568326C16C38A3D0FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900002, "uuid": "7c122c42-e44e-42fa-9bbc-71bbff34595a", "value": "12288:ILn9zdKoXCOxPqJO1Hrw1O6SgJL4ZQSeXl4Dw:IL9xKO9QOr6Se4Z/e14Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682900002, "uuid": "e1b1729d-a2f7-4d5d-bd88-c3595c700680", "value": 464681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682900002, "uuid": "71f819ac-9981-4d35-96ee-3c2460f304f0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900002, "uuid": "4088c732-fab1-40fc-9bf6-110fbba0c59f", "value": "FedEx Receipt_AWB#53053232046343.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a73ba5-e865-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682975856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682975856, "uuid": "076ec6fc-e946-406e-8694-d3c1306f5c35", "comment": "Malware payload", "value": "1320d5301598051ba9ce00b02c9ef76d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682975856, "uuid": "7414f185-297b-4b4d-a953-36db6dd5f82b", "comment": "Malware payload", "value": "a4573549be3d9b3c8fd6695047f42211804cfac1e42dc4b23ab486fcaca3f6c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682975856, "uuid": "1362feab-a7e1-45b1-8012-12688d231b98", "comment": "Malware payload", "value": "6c61e5752bf60e76bb175e827378be3fb5432adf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682975856, "uuid": "cd1f75c6-c88c-4a8f-bfe0-130c29745515", "comment": "Malware payload", "value": "ef716e89fca504c65be106f16d968b17dfbe736d5a3a561cbaf7556020d2554c4e8e5ab359b97d2c043ee1ffaf0b61b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682975856, "uuid": "2766a368-8009-4d36-b5d5-aa24757fb131", "value": "T1E243191073C74751C499147184E34A3103F2BB9BA2B7D76D3ACA638A4FA33FA9D89B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682975856, "uuid": "ff0d33f3-baf3-4110-9c38-a0ad288713b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682975856, "uuid": "3e2987d0-6ff0-4a78-b81c-1e06a8a5aa89", "value": "768:IQhQ2fgsrYid16QXWlIK365bEmN+a29ms4HD2Gztyjr:Iubyid16QXWljCbNIa2IXtyjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682975856, "uuid": "18f7728b-6e15-4d1f-87fe-8d14c803e4eb", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682975856, "uuid": "cd127492-4c0b-4783-83c8-d4d6a315253d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682975856, "uuid": "f792d42b-98f8-4afb-be81-64c3c28d6a0d", "value": "OPTIMUM INSURANCE MAY PO567887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ce43b9-e838-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1682956526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956526, "uuid": "8a6265b1-442b-4680-9f04-7f2bc448dd23", "comment": "Malware payload (DCRat)", "value": "4954febecf4857edb5d8ad0ee44cb189", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956526, "uuid": "3162ba1c-f0ce-48f9-8446-60c0ccf7b91e", "comment": "Malware payload (DCRat)", "value": "a59f8c90ff305ee554649893f9150ab96679e2ddde6924be41419f2f0511ac0b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956526, "uuid": "cea5f773-b078-44d4-81ca-0b84e498c850", "comment": "Malware payload (DCRat)", "value": "7c6d48a184d916f37477dc2ebe078e764604e792", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956526, "uuid": "4df8ade1-4378-44f7-9340-d6cab0d4c76f", "comment": "Malware payload (DCRat)", "value": "3d8c7ce852634e4dccb890e9f949ec358794781f020898f4a39a45b6fecf4c357c1ac01a56e456396ac20432c1bc3ab2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956526, "uuid": "8efe9a04-f16c-4806-ad35-b49616af0a0d", "value": "T184556B017E04CB12F0091633C2EF494887B4A9516AE6E72B7DBA337D65123A73D0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956526, "uuid": "1e18dda1-ebab-4217-a47a-e6ca9cf2523c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956526, "uuid": "d55fae36-3231-49a6-b1b8-cd1d6f137b0f", "value": "24576:zQZ1A+ppaNb0XOQlpReoyHxqtIvbKIpEQTdSt0Zp+EYp:zUA2tRUo6KuEqSKZoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682956526, "uuid": "7da8a2fa-5158-4857-bd95-25fde0b0ff25", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682956526, "uuid": "3c4d725c-0223-4732-b8fe-08096e35dcf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956526, "uuid": "97e3f3b2-f1c5-423a-8a41-511f424a9527", "value": "4954febecf4857edb5d8ad0ee44cb189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35acbe3d-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682935747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935747, "uuid": "5435e885-f292-4697-a1ef-c5f6e5119469", "comment": "Malware payload (AgentTesla)", "value": "f7b9f945082c80ee10c3e95082e96597", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935747, "uuid": "21047a2d-18e4-4105-b264-203a5da64a27", "comment": "Malware payload (AgentTesla)", "value": "a7bd440cebd598d5baf8741864d87849def7fdd5bd97f35d4b4d5c558a3376c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935747, "uuid": "81c472b8-49bd-4d81-aaff-f8a1bc5c1cc2", "comment": "Malware payload (AgentTesla)", "value": "525345fe3e65448519a2ad83bae1ffaccedec1cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935747, "uuid": "e34f48a9-bdf1-4165-8f3c-f9eb91cff520", "comment": "Malware payload (AgentTesla)", "value": "51b94e114699511a2a11dd9653631184d72d34cea6f1aba70d00ec6a54db8508ebc36422e5fdcc2252f38881222d9776", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935747, "uuid": "8b5fb0d3-eb82-49d6-a486-07fa49a90a41", "value": "T1E005D67C2578E9AFC17AC5A18AD4CC67F320906B33168AE66C9303594709B53B9C71BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935747, "uuid": "2d4891e6-8eab-4a93-be4f-9888af31a4c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935747, "uuid": "d7ad0fa4-6dce-454e-ae62-378901cc425d", "value": "12288:hvnKSemDPgiQ1vluo946+d4zOpN84W7A2dgiqrjoX2S7cBisgt3uvCAryDmFTDLk:hvnKOjgiQ1J46+d4S/8nkuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935747, "uuid": "9fec0f86-5f82-4c30-bc44-4a48697d4036", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935747, "uuid": "c13c4e2b-9e73-4b29-bc8c-0846ff3f6044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935747, "uuid": "8ce338c8-e48e-4f96-af45-e2274138cbb5", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5b7069-e836-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682955515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955515, "uuid": "f4989a0d-46b1-4532-9862-10fd6796c0bd", "comment": "Malware payload (AgentTesla)", "value": "ba30b4e7b1823d3bbbfa2cdef17cd243", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955515, "uuid": "256b96ce-541a-407a-8ed9-080bc6f53d27", "comment": "Malware payload (AgentTesla)", "value": "aa3e87c3886fe443df71b65dc484b40811a253f1ac642a70c59653912a8a467f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955515, "uuid": "839068b0-b7a2-4c73-b9e1-47833b6b57af", "comment": "Malware payload (AgentTesla)", "value": "f0549d5acf472d5f37c918120983a6a48ac9e589", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955515, "uuid": "86ba6172-0a33-498a-aa3b-ceda3e5ec951", "comment": "Malware payload (AgentTesla)", "value": "53b98043ccc9fa2380215b8d4b67818d32f8540b3d11e11de5a76f57bb9b981489648e9781d7fbe603144af17d2438f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955515, "uuid": "a9342aa8-620d-456a-b2e0-f0ae2a9c3a5d", "value": "T17BE4DF176458C98AFD1DCB35C464FBF062B8BCB3E4E594232B763C85F9FAB41190825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955515, "uuid": "c24d4325-00ee-45c9-92c5-96c1b1547a3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955515, "uuid": "ab0b7edc-eee6-436b-bcd8-129a00fbe8f2", "value": "12288:l0dTnj8vdP5ArlczwGdkpuTHB2h6Y+It/MZlXiZY:ODj8/Ec82b2MY+W/MrSZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682955515, "uuid": "9f8b7d2c-7f3a-476d-9ccd-16d2786d5161", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682955515, "uuid": "aaf9e7b0-2ebc-4b05-afcc-c2031f483ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955515, "uuid": "98b8f091-d175-43a7-a120-3a63a306c2e7", "value": "Avaliablity Accounts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3930dec6-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931888, "uuid": "e29ce490-15fc-4566-90f1-fd3c9b466f4f", "comment": "Malware payload (Mirai)", "value": "ef160508ff9bf5a3095d49312c01ae28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931888, "uuid": "2e15a8c3-db2b-47a0-936c-47605aa919b4", "comment": "Malware payload (Mirai)", "value": "ab665ef91bf5cf34b739ed93b98aeb608b5bf2753a65b3628b964cb678e5e405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931888, "uuid": "4f796632-869b-4d9c-a8e7-2e91bddd5979", "comment": "Malware payload (Mirai)", "value": "a11f3c8307921095fe35dbe5941d753f46466388", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931888, "uuid": "1cd0d536-10a5-4a1c-b74c-d19e05f79a56", "comment": "Malware payload (Mirai)", "value": "59f03fb8a0d3825cf7c00419118a2d9e00afbb82c8d48e589877975cf891112a4a0b1a7896b7b7caf141b0497900fa1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931888, "uuid": "57f42ae9-67a8-46e9-9c8d-3a4396a7b378", "value": "T10C438D3BC4AC6DA4C55881B4AA288EF00B93F504A6A67FB587868D244047FFCF5077F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931888, "uuid": "6940b8e5-8224-41f8-86da-0b6a664e7411", "value": "768:I7/bBvb3aMFSaSRSueVSTp2DLdH/FCXFgQCDoLCcZ3CXx79n:I7/VvTaySaSvhKMfLz3CXtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931888, "uuid": "9e3932eb-cb6a-481d-906a-b6fe5e2272f6", "value": 56208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931888, "uuid": "8f25fb46-8af3-4f07-8144-63c95bc87e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931888, "uuid": "65194641-94fe-4ee7-bfd1-6925655705c1", "value": "ef160508ff9bf5a3095d49312c01ae28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a3558e-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899354, "uuid": "1d5f1266-d37c-415c-a0e7-657bb7b68c87", "comment": "Malware payload (AgentTesla)", "value": "6b32d401f9ce817a1f4ba9a1a5b3686c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899354, "uuid": "3f6d9668-fa65-4e3d-96ba-d8d78c4e35ec", "comment": "Malware payload (AgentTesla)", "value": "acc56d676d67ab62bebb9226f1689228a8c9bbd1a5855f6ce8dbdf8088c61ac3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899354, "uuid": "40e55a00-6131-44ff-aeb0-2829e8fbc063", "comment": "Malware payload (AgentTesla)", "value": "29ad34cd49277b83d22333eb625b0ea69cd342d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899354, "uuid": "859483e7-8202-46a1-8afb-fa3905545852", "comment": "Malware payload (AgentTesla)", "value": "c280c571bd530bcb001bdd5a3c60763c6ad8d3f96b7d5fa93fec6af906352b454a3cff6ac08a3249525dc0aeeef8f801", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899354, "uuid": "1ca8c35e-e648-4471-9856-8e07755ab856", "value": "T111F4AD569014C84FFE56DB70C1B9FFA4A6F0FD73A4D5102223B93989DAB9F021E4D268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899354, "uuid": "f45f7e0c-66cc-4b02-ab7c-19e44d3f09ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899354, "uuid": "9af9fb6d-3484-41b1-a9f1-fa248b2768fc", "value": "12288:xOX9xnueUElNzvxsXxs2egQVtALF1Kp09rxEQ4llF9yU4tibHDASg77pypQeQU7:W93UElnshsipMp0UllFAUaibHS77ReZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899354, "uuid": "5b7d089f-0446-4ce9-932c-a2da7a7feaf9", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899354, "uuid": "95e91f9a-2968-4f03-9909-d2a682c11ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899354, "uuid": "276faaea-7329-49ed-b8e8-3823478a5716", "value": "INQUIRY LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d78dfa8-e7de-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682917695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917695, "uuid": "e02940b3-66d0-492f-a4bc-ae6d16c1d521", "comment": "Malware payload (AsyncRAT)", "value": "915c194ce83fa5e97aea45f447bc753e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917695, "uuid": "a8fe4cee-bf14-4148-b7f1-ff1dcf21ae34", "comment": "Malware payload (AsyncRAT)", "value": "acd3fc66fd0197318253d2d5f4cb724b6cb54963f554b60839d03a252f560901", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917695, "uuid": "19871c3b-7cd7-4111-a88f-ea5c2a6c91a7", "comment": "Malware payload (AsyncRAT)", "value": "6b99f0058ff24475149d79fc271ca3561269be76", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917695, "uuid": "4aab9988-1758-47c7-9b82-443a1cc12ab3", "comment": "Malware payload (AsyncRAT)", "value": "3e49dd56fdc3f520e8d7ef5e3fb32cd9809867744bca1e1e7f19646a9377e8c650634854fd3d22f9bdc066f995ef9225", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917695, "uuid": "ecd46c3d-03c3-4e5b-9dcd-10c2cf4a4023", "value": "T1D46308053BE9802AF3BE8F7469F6258446F9F5AF2D02D55E1CC810CA0532BC29951BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917695, "uuid": "25b7c54a-6506-4b6b-800d-8b8aa69d582d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917695, "uuid": "3d9ba48c-6ca9-4223-9bf6-22feab0b8bc3", "value": "1536:J2wukvF1ak9gcKu5UYFX1UMxvUb0JUM0I1g/ln6PrQTGpx:J2dkvF1ak9Ku5UYFFRMb0l0ILGqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682917695, "uuid": "6dec5322-2e33-4c60-b4f3-ae06201227e4", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682917695, "uuid": "360797bb-664e-4172-84c5-ffed46f9dc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917695, "uuid": "398ac25e-ad63-44f7-a07f-e902cf23d69a", "value": "stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e0d4cf-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682935937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935937, "uuid": "d83fe1a4-4c2e-4248-8e2f-2ab622a5dd0f", "comment": "Malware payload (CoinMiner)", "value": "5f2f1ae240812065799e8c05d3a01aa7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935937, "uuid": "24f91e54-93ab-42da-a2d6-ce111c47949f", "comment": "Malware payload (CoinMiner)", "value": "adad69d9a6bf24c7739cc25cf4def1b96d05accc349ed86e9200d404c039ad03", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935937, "uuid": "821c8536-826b-4a03-850a-563040326a8a", "comment": "Malware payload (CoinMiner)", "value": "e14d1c6a64f27267c688b695da84b7a9527a3d13", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935937, "uuid": "0c5b08bf-a0fd-4916-9272-8199b2c81502", "comment": "Malware payload (CoinMiner)", "value": "b33005a6118224581346d78af4c9c885d164241402704fa634871e7c9dbf4613bea485ebe50d91d60199a1fc276d7b0f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935937, "uuid": "867b852b-666c-43c9-962a-11fbe4914868", "value": "T1A556E05698C4C7FED288C734C4B46AA933A3BC5B1629C6FF23A7D4150A0BD9BDCC5984", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935937, "uuid": "ada88e2c-8854-482d-8876-26ac51d82306", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935937, "uuid": "5ca4deff-3edd-4652-82b2-42162e6cc339", "value": "98304:nFgc9lwquOMw7CRBgZXLzpYyAVIAPs0yFPJ+m0gfEOIdVZZMxy9/qbnbWYwhgI2Z:n2O6qLMwQKZXLzcqAPs08PJ+m0kEOIzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935937, "uuid": "58f1e257-19a7-471c-9fc6-5b007263abf0", "value": 6046008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935937, "uuid": "eac1fba9-cb41-4796-82fc-bc467fa50b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935937, "uuid": "49e636fe-efa4-4d12-aa35-8e35f50419f1", "value": "DEVMI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497b3ebc-e852-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682967563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967563, "uuid": "b3dfb1c3-e737-498e-8883-4e586d3c6860", "comment": "Malware payload", "value": "c399617a690eca6284911685bc11e55f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967563, "uuid": "21eaab57-c1e0-4bb7-8976-f83a352e7683", "comment": "Malware payload", "value": "adbadc76b37cb0785f07144b8908b277154acbc1a8ce57106db05876a0be53fc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967563, "uuid": "74c34b7b-63d9-4357-9827-94d5608dc1ef", "comment": "Malware payload", "value": "02a13a4cbcf042163d049770c383f298c3ceed10", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967563, "uuid": "559dbe6c-409a-4e5f-9bca-4290be895040", "comment": "Malware payload", "value": "a2cdcd8f53c8b1082525e2bc895153278b8aaa7b2de5d6e391b73b6eec4fcdf4cc411326b1271072f5a7ef6c80b9ba78", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967563, "uuid": "db4a9479-f199-4446-9f1c-9579b90098ce", "value": "T15F713A3A56188DFBDB6794F7C80E3C2D0919F16969DF0D951625FEB11A03230653AC8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967563, "uuid": "8a4cf024-f089-49e5-bccd-234a6baa8278", "value": "48:257WSx1ibHbr9djWmUoV57D8OySUGRstUdEcqpByF0b2LHCBK/DVqGG2fMq2uPXA:eyPHbfWmUob6bPBK/YPYMWPXnQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682967563, "uuid": "f0f4cc7d-bb17-4a0f-b230-cf8a08cd17fd", "value": 3476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682967563, "uuid": "4f9e3f6b-0a64-4863-be51-4aa323eec16e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967563, "uuid": "84110f5f-4010-496c-a6e4-aad203a54f0d", "value": "Purchase Order_PO230501.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24be362d-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931853, "uuid": "e6e3d6d9-3ef8-4688-a1ba-8afe33b6d6f3", "comment": "Malware payload (Mirai)", "value": "1c75340d980ca6b74de4325c248e7d87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931853, "uuid": "dc2f5580-771c-4c9e-9bea-f6bf4ebcdbd8", "comment": "Malware payload (Mirai)", "value": "aee1d4aeb4c4e429f8c301aea8e2310e12ae4bac46d89dafc36e64562cd96a78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931853, "uuid": "fa92d757-60c2-4d02-b4b5-32f0071ea669", "comment": "Malware payload (Mirai)", "value": "ae065aca90df24e6a96c4738b871a614f3614bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931853, "uuid": "97c0b1b7-8aca-46ae-9ad9-9b7bf53aafba", "comment": "Malware payload (Mirai)", "value": "fb6c42840e4e18766244785571d25de1f406846a72876b36027eb7a50f876f789636e8706ac63eeb47b5c89122c159a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931853, "uuid": "bfcaec4f-1537-4b25-aadc-97abe1710aaf", "value": "T1248360197FE11EB3EC6FDC374AE92B4521CD651620987B79BD30D818B24A61F19E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931853, "uuid": "7790200a-39c7-4475-8ce2-5c9e90113b0e", "value": "1536:VwjrooP6LS1c/s9knwv413k5azHnZWyFpp:WjrooPyS1cmAHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931853, "uuid": "79adafa9-c821-4c75-92e8-0d9d706687ef", "value": 88140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931853, "uuid": "8ba99d4a-8a12-471e-b564-3b56cf7d1416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931853, "uuid": "2d06647f-1d81-48ae-b233-4d6927e6661b", "value": "1c75340d980ca6b74de4325c248e7d87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3337bebc-e7b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682900095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900095, "uuid": "a964c5f9-24e5-45a9-a058-d7e0e7913d37", "comment": "Malware payload (AgentTesla)", "value": "45000d93b838bbac4cb303f730d4515e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900095, "uuid": "a93004da-a24e-4058-82b9-b3518e75631f", "comment": "Malware payload (AgentTesla)", "value": "b043051326f23517f62d8574da891fbf25b9fc7d940537d3203e3366010e986e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900095, "uuid": "fbd98034-9926-4fc5-8736-926d9c07c5ad", "comment": "Malware payload (AgentTesla)", "value": "bc8ed8ba21e80e08ebe7a4ac37322c43f6453e38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900095, "uuid": "a63da894-03fb-4c59-b434-7a6ee7eb414e", "comment": "Malware payload (AgentTesla)", "value": "54dfb8c592e451a964efd7e7c2622fb2491ca5a38843408068ab32663b57071f039440dfc139ba914097e2a24d9acdd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900095, "uuid": "5b902ec4-874b-46ea-803c-d614deb5fc2e", "value": "T1C8E4163C09BDE23B91B8D6A58FD5842BF750D4AB3115AEE6ACD347918316E1234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900095, "uuid": "cc75a3a6-6043-48b5-9f91-2700f0f17e6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900095, "uuid": "8072cec2-065b-4cff-ae5a-09439706b151", "value": "12288:vtPYxqFHSPRVccIm8FKZPB2vyteJIFgM+8hG64DzUhP:6YFy5Vc5vK9B2v2FVachP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682900095, "uuid": "8c0ce91b-daf2-460a-98c4-263cb5d840dc", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682900095, "uuid": "9a0aa05f-e3e5-4b39-b5f8-90d402942d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900095, "uuid": "7aa4847b-1063-4071-b562-b5d8e7549cf9", "value": "Payment swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7020bd-e831-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1682953422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953422, "uuid": "7ace1d6d-c0cd-4aa6-9ec4-837ac5e7165d", "comment": "Malware payload (PrivateLoader)", "value": "38f000bacf037f9489db983e5e409da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953422, "uuid": "f489c4cf-a275-4b95-a49a-4f6dc0cda7f8", "comment": "Malware payload (PrivateLoader)", "value": "b0b206e8239e1e93f5c3cbedb8a25b585d5f7d148524fbdbbfc8085cc26f1ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953422, "uuid": "8d2176d5-e023-4772-ae8e-52c1b5683a7a", "comment": "Malware payload (PrivateLoader)", "value": "8e5a3ba637324e9d06f4545c7b9e6ada234759e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682953422, "uuid": "d6aa100f-2311-45a7-903e-3e32ae5b5a05", "comment": "Malware payload (PrivateLoader)", "value": "ea3575efe6e400e09977533deed79bb1bbec9cf5a079ef763d3994aa5e3611746ba3f21536f1c00d7fa202a2a2497536", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953422, "uuid": "5c239d9c-3dfe-407e-b6db-644796aa5227", "value": "T1E66623732254C089D8C59931C12BFEF176B11E7DCB43687BB49ABEC53632399A606E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953422, "uuid": "c7e27807-c59e-43b1-acc7-b19fd3890e36", "value": "e02b276fa1385eca0c7dc7a4b0d621ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953422, "uuid": "6c751ab1-3371-4e34-a6e8-14f3ba0bebaa", "value": "98304:deWcgHovCxfu+Na01KteIB2oiAdG0HewKwwg/0ohxYm9DoSCVLtisg8hj:Mtvg11eV2m/HeGwg89mJoBisvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682953422, "uuid": "239990bd-7f94-4219-a86e-e87bfcd2bb1b", "value": 6806728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682953422, "uuid": "1100b45a-6a08-4501-ac7a-8c9a41dfa0e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682953422, "uuid": "87fcb7a6-0556-4e3d-a1e4-8370657d9fb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db9d183-e7c0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682904810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682904810, "uuid": "a884ad01-eb3d-4b3d-b569-70af066e97e6", "comment": "Malware payload (Formbook)", "value": "8349b02688c937b2a1cb11991a3008d4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682904810, "uuid": "a22311ca-12cb-41e0-9feb-ce6a95acb223", "comment": "Malware payload (Formbook)", "value": "b0cbdd9ef3246790f12a5ce550779510f40c6a1f77a13f9f6c6ad654b5b1a2aa", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682904810, "uuid": "e4c28d1f-cd25-4858-a4e9-1eeb97b49661", "comment": "Malware payload (Formbook)", "value": "80b0d06979e96d7298584ee5a91f2974aa6c004a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682904810, "uuid": "a32e0337-5de8-4c01-bd78-c57dfd5d7d20", "comment": "Malware payload (Formbook)", "value": "dd5899b071df87032ce135b3e6a989e1d206541ca21ee9fdc4bc63c9eceee3d21d572a07c378c8f9e009f4c91ec8ba61", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682904810, "uuid": "00f99b44-2e10-424e-bf08-e498310bfec0", "value": "T1D5A42341CB921E14BB67835F88AC25509B4A25F62EFEE410B8F12EBDE4D025FB53467C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682904810, "uuid": "56a5ae5c-a35a-43fa-ac9c-0d6f2e25dfa9", "value": "12288:o9M++jDChcviiNQCYCg65rKXxFIfWysRQZY1oYYUCL5:o9VyCiDYc5rKXDkoR3eECL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682904810, "uuid": "a2ffaba6-98c5-4387-94e5-cc6bf4ccc6b8", "value": 472784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682904810, "uuid": "0753b837-76e4-42fa-89f2-8d183562566e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682904810, "uuid": "4522748f-faa9-42ae-8d1e-209351623466", "value": "scan copy-001.rar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf86e406-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899901, "uuid": "01be0b71-eea7-42cf-b8de-2a8acdf721e3", "comment": "Malware payload (AgentTesla)", "value": "69a239c6a104496c0ce672393f064929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899901, "uuid": "e49eacd9-1857-43cc-a761-99bae35dfd6a", "comment": "Malware payload (AgentTesla)", "value": "b37a81f6f7d740289169911e85526837ccf784fb6e86ebbc0ebb29cf50c6735b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899901, "uuid": "2911d407-3dab-4e60-b84a-a03e25c5fd9e", "comment": "Malware payload (AgentTesla)", "value": "f0c42f557e0481869f40305653adf49ed9c13d55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899901, "uuid": "ee835a72-ff4f-4e4c-869e-d13967794c80", "comment": "Malware payload (AgentTesla)", "value": "32c36781345d04ee49a6bf9c45d2847b381e9c4b1a9d0b3a4985925d2579107c5e8948f7022476acf71ff3266e7d1ac0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899901, "uuid": "2180d03d-1c53-48ba-9ee4-9386294d95c5", "value": "T19553F76963C88A27CBFD76B3E561C0190775C913D4A2E3B728C866F64C83B03A9751E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899901, "uuid": "d911ea61-1a4a-4e50-ba80-938a44227a44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899901, "uuid": "8eee74c5-f5ee-45d4-a7c5-f69db65cd763", "value": "768:yuus/h2FWhTsfsgPmAr+souOPShXkTXsylvTow0jnRjyMa3a9+FH7ISTkxsfTW:9Hp9gn6sBOqhX8s2UwAZyMaKYbVTvfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899901, "uuid": "92a2c799-5930-4667-a809-bfb1224334ee", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899901, "uuid": "413483e7-dbd2-4b9b-bd49-8f52ec724320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899901, "uuid": "a59ed6b5-9938-4c65-a85a-f4f95977d333", "value": "ORDINE No. 40076_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600b81b5-e876-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1682983063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682983063, "uuid": "8e77b804-8ffa-4fa0-b481-2f4d1bcdaca6", "comment": "Malware payload (ModiLoader)", "value": "938aa66b7eb10c7386cbc12ebe24d5a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682983063, "uuid": "201a3b01-468c-4041-a7c7-fb473115906c", "comment": "Malware payload (ModiLoader)", "value": "b553d17383669425973b2dbd042ebe90a6afc4822aeb3ceb2684667a3ed4d36d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682983063, "uuid": "10278ae2-8bcf-49c7-a89c-8394aad89951", "comment": "Malware payload (ModiLoader)", "value": "693b13a3fcf5b88494fe88f994f5b3ba0dfcf490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682983063, "uuid": "73662ed5-80cf-40f8-aab5-3931a8bdfb3a", "comment": "Malware payload (ModiLoader)", "value": "75de7750efe746345fa61aaf4fbd3303ded507fd70c2a37186e6934a12c887deb265810f7f9866d2f3d2367b7d2fa410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682983063, "uuid": "02106582-58c2-4cf2-a227-13e661910919", "value": "T117F49E12A7B08977E0171AB44C17DB9C4CD57D203935BC4BBBE47D8CCFB66826A1A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682983063, "uuid": "12683a10-8263-4162-8049-4514dc00583b", "value": "3315fbaa0073c4f3592d7e54ba056c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682983063, "uuid": "d223ed53-f3e4-4a94-9d2b-b28a2bc25068", "value": "12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNghnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeW+zhxN2rn4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682983063, "uuid": "55e3d71e-64b8-4df6-bd51-3a22d27f6394", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682983063, "uuid": "b0d7c091-b6e1-427a-856e-b297d1102e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682983063, "uuid": "255e9d7d-8304-4122-b30a-c76c4012501b", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bb0d90-e7f2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682926537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926537, "uuid": "c227efe0-eeed-4c66-860a-2dddb187c67a", "comment": "Malware payload (Formbook)", "value": "c147589a83ecf67417e361f208cf646f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926537, "uuid": "4d9c1f14-3a38-41d4-973a-bb4b8d008c0a", "comment": "Malware payload (Formbook)", "value": "b600964a8820087cca83e668feeb9096d3aa9e2dbfdaf8a6546d8ec57d52b876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926537, "uuid": "7ee1d443-f0ee-43c2-bbad-0f518b171cb0", "comment": "Malware payload (Formbook)", "value": "7522a92fa7f1fe63d86b99381ef9a6675254561c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926537, "uuid": "f57dff39-aee5-4ffb-a367-5fe08b616e82", "comment": "Malware payload (Formbook)", "value": "3fcc4d88fbc4e38573bada38a13acc72575de7db9a58a790a243a484f2d8e14cdd0d825d7a0380b08464cc9529a9cf9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926537, "uuid": "c2b35160-5a14-4086-98a7-d299cda7e5ab", "value": "T198F49E3D16BC5733E17AC3B88AD45413B3E0A85BB221ED956CD603E60753E467AD322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926537, "uuid": "42c7e006-6fd6-411f-9498-d7e0700b352e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926537, "uuid": "a2e7cc98-ce01-4077-bae0-a21ac3a00f78", "value": "12288:sH8FuFkhpo5DNnFGBQ/Vtx8Y84+4Ojvrsn0b0o:3uFkhpIBE018xppjuU0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682926537, "uuid": "92e93a0b-bbf3-4e71-9a8e-d348412ae5a9", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682926537, "uuid": "a5f723b6-b9ba-4660-b98d-de38409e91a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926537, "uuid": "6e1939db-264b-48eb-a2e1-d7ea4eab115e", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38153969-e7f6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682928020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928020, "uuid": "e13b4243-4b57-405f-86de-d6ffaee15c86", "comment": "Malware payload (njrat)", "value": "aa46b20356246717850549a1b8f78ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928020, "uuid": "e5b93589-1dda-47d2-a345-1dec5eff2c52", "comment": "Malware payload (njrat)", "value": "b602851ad45443d82624f78bc0de708158b1f991603c362356d1cd9e19b1055e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928020, "uuid": "54c8c16f-0fa5-436e-a717-abae03152b82", "comment": "Malware payload (njrat)", "value": "900c40fe64933e22681d7df1e5ab76de2b02df27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928020, "uuid": "69a88cee-2bc7-4f04-820b-6ccdfa377800", "comment": "Malware payload (njrat)", "value": "6ef30feccbd6469a9c9af1eba18142dbcb20dc343b151dbcf636e0e7a6b2f7c604cb8697719ff7270e4428c1f41f929c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928020, "uuid": "9b299b64-a0c3-449f-b1d1-b5dd0bcfd815", "value": "T14693D78D37E15065E2FE4AF3A871B2404F7AF0471743934D49E2A9B61A33AD84F44DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928020, "uuid": "2d5b8fcd-5573-4331-950f-840a081d6283", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928020, "uuid": "15003332-f3e2-4f64-a777-20e8241ac904", "value": "1536:4Ox9FlyhgoFeHZN587mIhfkOmVR1Fp/v:Tx9FieHZN5NY3mVRV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928020, "uuid": "50bee896-637b-4b3d-be2e-6d785ab45cc3", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928020, "uuid": "2692383f-e82c-4b51-bc72-b29e2939ee2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928020, "uuid": "ff75004b-f437-4565-94e2-75264c815e6e", "value": "aa46b20356246717850549a1b8f78ec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67db668a-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1682935831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935831, "uuid": "abd26862-e8cb-45a5-95b0-da531043758f", "comment": "Malware payload (RustyStealer)", "value": "66ebb16d0a73a1ebe1daf07779147d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935831, "uuid": "0eede1ba-702e-42d1-a327-8f9be84586d3", "comment": "Malware payload (RustyStealer)", "value": "b730fa8b5829701fe6c828ced7b79d3c882ef872b77d94d37ba511d0a3ae6a8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935831, "uuid": "a7bc0d3c-ffd4-4b91-a95b-809c82e5b9af", "comment": "Malware payload (RustyStealer)", "value": "63873b6c38c16f5de55081161994f2518b5ed77f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935831, "uuid": "50b89f62-09ed-47fb-9b7d-697996dbad68", "comment": "Malware payload (RustyStealer)", "value": "302cd5014ffc503ff7ee4d9a8715665c571d1e38d4aefed33f6e510930f6e95214661095944703c451959e7e4d3ddff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935831, "uuid": "2a71949d-1c4f-4efd-82e6-e265cde3eb69", "value": "T1A8168C03FA9546EAC06EC27486175223E772BC490B21F79B17D45A723F23B606FAD358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935831, "uuid": "1b042c81-db9e-4aaf-aa53-521166e4fdf9", "value": "b0f138b3518b7d35d190f478825445ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935831, "uuid": "4dba4e66-7980-49b9-84ee-85812b00f33f", "value": "49152:63U+I/TdjRg3RikxsOj4A58ZuBBAcfnEQdjxpUFbMXu/2FTSpQNq9f3llnAcw97u:B/Dg3MkEQdjUBYC7DAZBIBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935831, "uuid": "3915f439-8066-45b4-be72-0979ba95d28d", "value": 4061184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935831, "uuid": "b1230097-c654-4b5d-9462-61a1e5cfc774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935831, "uuid": "bf918c9f-ee0d-4893-a123-b6c832793cf3", "value": "Yellow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9341d6b4-e810-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1682939340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939340, "uuid": "5690cdbf-8623-429d-a9d3-408da129fe33", "comment": "Malware payload (DarkCloud)", "value": "b1ac20a35e6a0546c932b3b83fe56853", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939340, "uuid": "b035fecb-49dd-406d-8de6-14dcf74bdfcc", "comment": "Malware payload (DarkCloud)", "value": "b79720c1133b12a4ed824d20602fb14b0b736a1c0e60fe23c1b96d57ee031ba0", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939340, "uuid": "187c2d9b-a4ff-40dd-a0b5-c0625f603d4e", "comment": "Malware payload (DarkCloud)", "value": "4d04231811647ff1f5300e9c99882dc7084f5b13", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682939340, "uuid": "29fe2f53-7f07-4a66-8b63-b9145c507fae", "comment": "Malware payload (DarkCloud)", "value": "b0998cdac6b94bf2e9105e37de4f6922fe6bef9c8158c3f8d36e8e71e25d3714883f7c9fbca6f4e8d03c8a711c199760", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939340, "uuid": "f30dae58-822f-4fd1-8ad6-d99a16c3c610", "value": "T11075BD3C49BCE23B91B8D6A58FE5842BF750D0AB3115AEE5ACD347658356E0234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939340, "uuid": "03e0d19d-52c6-4e87-ba0e-d3b2c03f13b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939340, "uuid": "9187a492-ec49-48d7-9c5f-9360da0a6530", "value": "24576:5XPUk+sHjI1AccWZV/7Ytz9WjFQPB/+V7yj3k/UjAM6AhYcbZNEH5mS:FPUk+knkYtzwFYBGV7D/nM68lbZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682939340, "uuid": "93945dcc-023b-42c1-81b2-02527f34ef57", "value": 1550848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682939340, "uuid": "242e96d9-3ab6-4d35-bde7-57438bceabc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682939340, "uuid": "10bba4d6-7a9a-47a7-add6-090547bf2663", "value": "Request for quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8deaaa7f-e805-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682934607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934607, "uuid": "1dc09291-4aef-4b06-a4f6-fbba2f7a32b2", "comment": "Malware payload (Mirai)", "value": "b1a27390687110fd54d0ab444b40e088", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934607, "uuid": "1359285c-85e0-4172-9b2c-a4310b09da3e", "comment": "Malware payload (Mirai)", "value": "b7c457cc440a749f1440550b911f77e76d36face97b38c60f94095fec5d57fc9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934607, "uuid": "ce16f13f-697c-40cf-9b2d-9a53995ed3e8", "comment": "Malware payload (Mirai)", "value": "f38f68fed5c6a3d67ce7bf922d260eff8ff10ada", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682934607, "uuid": "9bfcb6c3-88fb-489b-8399-0b2bbad03410", "comment": "Malware payload (Mirai)", "value": "a13aebf327012e5f6437a00d25a68a40aeba57de0819d9205f10c1d3c9df7af5c79702c4cab68e5a8f89416341ec8ecd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934607, "uuid": "0d596d83-5dc3-4506-ae4d-aee3af91bb15", "value": "T160D2E054A3E1D8B0DFB4473EFE3D8142221703BBE4E8F5AB16948A49B28D606E335385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934607, "uuid": "65b08ade-6e99-4778-9773-48180c757879", "value": "768:lFoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZcs3Uozp:lF2+IoXVeNIlzpzAzzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682934607, "uuid": "ded4eaac-1852-4695-b095-de52011ddad1", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682934607, "uuid": "c337076d-298c-492f-b7ab-31ed71e23b42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682934607, "uuid": "83f2b46f-34d4-41cc-9ca4-211fd96e4423", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ac7430-e83f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1682959549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682959549, "uuid": "741bce6d-c18e-46ca-bc6d-3343ebc7f220", "comment": "Malware payload (DarkCloud)", "value": "25fd5bffe980f3b72d65e21d15a86053", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682959549, "uuid": "033ebf03-cdd0-47c0-bd82-508f4b9f184f", "comment": "Malware payload (DarkCloud)", "value": "b8a62f112c6160c5830015208c34e95772aa2f2620dd27166033b57d130e89da", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682959549, "uuid": "15211e3b-7028-496a-8601-72675a6339c6", "comment": "Malware payload (DarkCloud)", "value": "2333114042ebe36adda1af09927783c0aea37d69", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682959549, "uuid": "f30f3099-ffba-4d2f-8843-3abd8c4b5d7c", "comment": "Malware payload (DarkCloud)", "value": "5b886bf92e101c60c1d018f29123e25d1efb701f9c234615212d12c545cb839bfb68e74d6aa222296942360847ac0bce", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682959549, "uuid": "23867711-0473-4a8a-8ea2-410d2362670b", "value": "T127256A3C19BDE23B91B8D6A5CFE5842BF310A4AB3115AEE5ACD743558316E0235C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682959549, "uuid": "1226753c-7d82-4470-8b74-f50f36d3cdc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682959549, "uuid": "bde034fd-b50d-4d16-927d-57d35475510b", "value": "24576:mmuKSNK6uN3I7n19slVx61e0JRo4objEOHLnv+1x:mmuRwH2OY1AXnXzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682959549, "uuid": "a1ac0245-0ea4-4c70-ba37-01f53bdc2076", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682959549, "uuid": "077843b4-af6d-4fa1-bd4e-2ed7d70c2ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682959549, "uuid": "ac34f817-d312-4624-92cb-4f346dd8bb73", "value": "Inquiry Listing_27042033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb1270c-e816-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682941804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "cf98c6c8-4bda-44a4-bb1b-ddc56b61f19a", "comment": "Malware payload (Mirai)", "value": "eaf74a5c6e9fe44feef9dec729cb05dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "44d01fcc-76a6-443a-9faf-1ca2df195556", "comment": "Malware payload (Mirai)", "value": "b8af262c902218e0f77af583a1d51f9952e4b417059bc51f7484fc8db7499232", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "dc686f62-69c5-4bed-85a2-78efab6e4d91", "comment": "Malware payload (Mirai)", "value": "9bc01050f219098adc2f355213c20a5c428ad995", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941804, "uuid": "a2e3a4ff-95ab-4ac4-a4ee-a1488295f957", "comment": "Malware payload (Mirai)", "value": "6d4a5f843357d036f5c09e4935baccc2f969029b102a3c140fde967992611836a42e87ad44e29a4a065c937f8a5ece88", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941804, "uuid": "d4e33d81-e3af-4754-805f-ba5e7387bbff", "value": "T104A2E114BF28828BC832293555E9E6E61297FC61F2EDCD492940C16FF5633AA6434F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941804, "uuid": "e111aff4-b5f0-4dde-91d7-4d5022a34467", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTg:x98o08kxofBE+ZkXaEbp2F2TWul0c5Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941804, "uuid": "3b24c551-0b4e-4f67-aab0-8e85ef84a583", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941804, "uuid": "b3ec4e1f-ea50-4b88-80d6-23ef7f06ae9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941804, "uuid": "b8782b3c-fef3-4528-b3d1-3abae5d04ca4", "value": "boatnet.x86-20230501-1150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89643dfb-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972824, "uuid": "632bdc78-a445-422b-847f-856221acf1b7", "comment": "Malware payload", "value": "f4a54b13328b3387693e29e654641d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972824, "uuid": "d2d6ff6c-15e8-46b9-93d6-89ba6c61527f", "comment": "Malware payload", "value": "b96189db3968989aae45bb80b7c61d699e055b15b7aac1729f58b1fb99ea604d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972824, "uuid": "b45e485c-f4a0-4364-bf59-e6d16dbd4c5b", "comment": "Malware payload", "value": "a01613292a72c4771294f65cece209f57cded420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972824, "uuid": "434543d0-570d-47d0-a148-d8207ae1f78d", "comment": "Malware payload", "value": "a9b4a6ee6e29e2341bd3fd63632e82885393834630cfbb35cc8d70664d3b66f584180570dd7c9aec4ade4850bf5c34cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972824, "uuid": "6f84a563-b0c9-48e8-9556-87d5fdd68ef4", "value": "T18AD49D76F642C03AF5E211F166BE1B666C399D25030264D3B6C11EDA4BB11F17E3E22B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972824, "uuid": "359d7658-fa8c-4a0b-bf9b-4ed6bea7f840", "value": "3f5d6869cec42a1938794bbff17a146b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972824, "uuid": "8123c69a-52cf-4ca5-9e2a-8f0fa4b1bec0", "value": "12288:QD96xkLPUsVEl1QjQWUkMu5jBBI/EkPct09hq1c1+B4V4mzvsPcdw6NdN:u624vQEhkl5A/EgcqeadV4mzvsGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972824, "uuid": "fe6a6333-ee99-40c1-be51-9c7d419ad39e", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972824, "uuid": "61b6e0ca-c6f2-4820-bb08-465224824016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972824, "uuid": "f9dd771b-c874-4a84-8312-e7cd5489bd4f", "value": "SecuriteInfo.com.Trojan.Win32.RatKeylogger.UV.MTB.28825.17288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c34232-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682972823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972823, "uuid": "ba284cb0-99f7-46ec-8b3f-d298d73960d6", "comment": "Malware payload (Formbook)", "value": "612934573cfd4614369ec85a23dcc0ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972823, "uuid": "21c1a6f4-e35d-49f3-8be9-c82c61259603", "comment": "Malware payload (Formbook)", "value": "b9efa23dabf1bdff085a3340fd11bbe78199678ca649fc8aabafd2fd27ed0dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972823, "uuid": "91fe6164-b842-4476-8193-29acf01740b5", "comment": "Malware payload (Formbook)", "value": "7c3e9484f66496b1e67bfdb38e20064dcd0f1791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972823, "uuid": "2cc106c0-2f52-4e59-8856-eef1a54e6ba5", "comment": "Malware payload (Formbook)", "value": "343076af79dcaceab5f01b19f84c75cc79836136a8fa9a8ec45316a6881d9dc80524d57661598db2535bdfa8a1e8ab00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972823, "uuid": "499bd9ef-7e1f-433d-b28e-4edf1ffb2024", "value": "T1CF6294C37CD5F3A2E3C1857009368AA2617B7EE4D81956137A97BAFEDE341932E116C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972823, "uuid": "fa67dc9d-ee15-4337-b756-ae96c7c770e8", "value": "96573fde7435607c68ec504aa2204433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972823, "uuid": "44857436-333f-4388-b2d8-36172124d516", "value": "192:XSrOtYAG31HSt9F7BWALVtZJFKIS/Oc17Y/H0JH08lYH0yH08lg0GH08l:XSGYAG9St37T/ZTS/V17Y/CvYNvqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972823, "uuid": "e9a90a84-d290-4b65-b9d2-aa393b934348", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972823, "uuid": "8dcae50c-3eb1-4601-8097-4067fe516377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972823, "uuid": "87ebb9b2-86e1-4f4d-889b-511ac3bb8657", "value": "SecuriteInfo.com.Variant.Razy.921254.19666.846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842ffead-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972816, "uuid": "67ccf7aa-96e5-4b15-86ea-190dedd06b58", "comment": "Malware payload", "value": "d4534ef21b2f4b8ec360905c0ce2614f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972816, "uuid": "c51875b7-7ef1-4b82-9944-7ebea38a1091", "comment": "Malware payload", "value": "b9ff2b1a0f93eae86c8323cd59bdad6b4e94c1bc4a4289632a084a98bc55e2a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972816, "uuid": "f89fcbc7-fdb2-4c01-8dd7-48a4249fe8b0", "comment": "Malware payload", "value": "811786051909c1268e8acade9146e6f199ba2211", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972816, "uuid": "fc7bbc26-a24a-482d-af8b-5a3dfadb4099", "comment": "Malware payload", "value": "d9df92bbab6cd778e0c65f2cb83e465edef24bc55887356caf188eac736a398ab6841f823e0fd5fc6f9a813bbe7c3a04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972816, "uuid": "28a51668-7233-43c5-8c83-8d20557f15f9", "value": "T10BF418957A82D927D070293148D6DAF06AB2FD405EA386C335CF375D3F322C45F266AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972816, "uuid": "a2d30dad-1bcd-4b4f-958b-4b96ee0d39fc", "value": "63bc622ddbb364868c646ebb5f982ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972816, "uuid": "db183389-cd84-45d3-b5e6-848dd340517e", "value": "3072:r7KeDoesgOZqPHYD6SvxHBobVBAK9c1TOtXPmbJOpYxKJ6uLD7E8ZubYLhxv44Cw:roe2qP4uS5HBobVWK4T/uGMxaED6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972816, "uuid": "ea138922-e451-40e5-8c7b-ba472824e35a", "value": 764596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972816, "uuid": "7b585c61-a0ce-4ed6-9df2-7ef7a12bbd12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972816, "uuid": "8d01a45c-2940-4b4c-8047-62bdb4e983f9", "value": "SecuriteInfo.com.Trojan.Win32.Hider.26435.18457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf98f03-e834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682954765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954765, "uuid": "d1756ea8-f99f-4750-b412-be580ab4f693", "comment": "Malware payload (AgentTesla)", "value": "c2cf8ccbdd1f0d0cc7cdfb012f9d5350", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954765, "uuid": "d795bf99-7c34-40a7-82c3-c1aba59af994", "comment": "Malware payload (AgentTesla)", "value": "ba852b38002916eb89dd9ada1f1ff78c308b433732b1600813789f5707ab6d62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954765, "uuid": "ab5d5136-73bf-4340-bb98-1cc47df5a9b2", "comment": "Malware payload (AgentTesla)", "value": "4c809d856e11a4f8031477ac1b9dd8e57f52e094", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954765, "uuid": "bbe3d88b-6bcc-4d20-8c3e-6db3118e4a30", "comment": "Malware payload (AgentTesla)", "value": "3ca01fd0fc0baef74ea0cfbc450c356c4006a6b284f0562c976384504e56d69f351c7b89b5f8d4ec55a1334beffba0e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954765, "uuid": "95cb8a25-7d5a-43aa-8cb5-8ee347cfa3ea", "value": "T125E4DF176059CD8AF92D9B34C468FBF461B8BCB3E4E5912727763C84FDB6B010A4825E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954765, "uuid": "e8b82f72-ba38-41f8-89dc-5f16eda9b3b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954765, "uuid": "eac14fda-da42-432c-ac0d-636073e2403c", "value": "12288:zRdGyj8a4lPquPXKNuNRdJlpax76wpBY0eMYrWEVA/IBiOtn+NooEQ:PRj8a4RlPXnRdkZvpBNeMBEVIMvnta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682954765, "uuid": "1af403f9-8414-410f-a6c7-bf65a3204bf1", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682954765, "uuid": "1fc77b4d-f958-495d-9f5b-17e671d0b835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954765, "uuid": "087cd432-f7dc-4b28-a1a7-742e7112013f", "value": "20SMX0701006N20SMX0701007N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67244668-e7fc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1682930676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682930676, "uuid": "31ec02df-2551-4193-a946-8ad92d2696b4", "comment": "Malware payload (BluStealer)", "value": "39810b7912907fc879004874df0e9e9e", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682930676, "uuid": "a3adeef7-7cb1-4583-900e-bc22f758a1cd", "comment": "Malware payload (BluStealer)", "value": "bc61c93084dbe9aebf93114d082667bd696610a81e8fb4bda751204f86d3ea61", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682930676, "uuid": "adf9d40d-3402-4b3b-a0b6-0a15bad82bb4", "comment": "Malware payload (BluStealer)", "value": "f2e51d5e9f644058a8ff4d64458e2914ddf2a364", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682930676, "uuid": "de8a20c1-6a70-4c36-a921-74ed463c2e6d", "comment": "Malware payload (BluStealer)", "value": "5c4d65c98ad665c2fd4b858a6039d7063c814f6eaa14ad140906b697b0b13eb86b63b9df1d8db247f7c4ed0b76ca4e08", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682930676, "uuid": "81e06232-0391-4e33-a39f-69dfea296fdb", "value": "T1D165BD3C19BDE23B91B9C6A5CFD5842BF74094AF3115AEE6ACD243618316E1235C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682930676, "uuid": "6c740852-f203-4864-a11f-debff8fb298d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682930676, "uuid": "b04ee256-a3c1-4fd4-af12-506836348aa5", "value": "24576:molqfbt8n/WmtqmZfq/ppZge1+qWMZukXfRtgyCrWw:sxgWm8m+Zj+qbZuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682930676, "uuid": "364d4c74-5827-4785-a3cb-e5c2d3557751", "value": 1533952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682930676, "uuid": "e9040f8c-3955-458c-b676-472a69113cc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682930676, "uuid": "97254eda-8ce4-4138-b205-f80dd43ff215", "value": "Quote 1345 rev.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bbd73b-e81b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1682944035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944035, "uuid": "e5963d65-80d7-4632-9f7a-76f70caa90a2", "comment": "Malware payload (GurcuStealer)", "value": "3121ecc67e64fdf65b2b3c9f5966ed11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944035, "uuid": "2ad0490b-0a8f-4db8-9f50-c8b8b9ccc582", "comment": "Malware payload (GurcuStealer)", "value": "bc7536cb39c4dc0ef7522b46efbc97b87edd958248267932c46cdda2d571a72b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944035, "uuid": "ba03d60c-f37e-4e29-b655-1876e09757cb", "comment": "Malware payload (GurcuStealer)", "value": "e02765d98dbd9e1a2d3106c5cfc849f91dae49f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682944035, "uuid": "4913c051-fc0d-4231-960e-85de5869ad81", "comment": "Malware payload (GurcuStealer)", "value": "ac4f6cf7b54adde3dc7ab013a57cc35a6eaf3ad72e0d5b553d67c8641d6c547e05a385ad01c177af3a912569f3ce20cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682944035, "uuid": "b1dbda69-19ef-4d6c-9515-f6524a82cd33", "value": "T15574750CBB45EDD4EA2E55FAA975EB004335E3534200A6175FF9A8960B726C14E0BCEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682944035, "uuid": "fcb65b7c-609d-44c9-aea9-502ceeb43bee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682944035, "uuid": "55f738a5-949b-409f-a679-f580496e637f", "value": "3072:w2drpq3JiL1FBpMVOvnz5R6ipM5XnjBZhHmStRlxFVNt+hcC5fjmP0pzYAzpceSI:wdKGCDRUFv2O16o809bAFz2c0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682944035, "uuid": "d614c433-0401-4cb3-b6b2-3e6798f90a11", "value": 361984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682944035, "uuid": "94aa56c3-65ac-4886-9f15-5def6d8fac41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682944035, "uuid": "6af7b0f3-4626-4a63-86e5-c9a874d2787e", "value": "SecuriteInfo.com.Trojan.Mardom.ON.24.25444.6656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a982aa-e816-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682941807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "8bd0fcce-e283-4870-903c-93cb96ff9aa6", "comment": "Malware payload (Mirai)", "value": "abdeec26b01239c7bb3063f73c5148b0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "0ec1514b-7ef9-4ba2-b89d-763fd94b0d5e", "comment": "Malware payload (Mirai)", "value": "bcee9cd67b4900c416203b08a039106aeeecf58019d448854e1b9a3f34e16c4d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "7db835b1-e75b-4520-a530-89b214e362ff", "comment": "Malware payload (Mirai)", "value": "55d9b502a1f09054bd7b3008d0daa9f8af43fd07", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "b424c397-14cb-48da-8aca-7eb843938429", "comment": "Malware payload (Mirai)", "value": "4980156d85db2873d1bfaa4a1a9dbc393524b58a9224d3ab3578d4d1ee97d1dd1054a0a064e6cbd5ded57d47864f09d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941807, "uuid": "2470e119-0cb6-4b1a-b94f-8ef0c6d80a77", "value": "T1A282C03051AB79E5CBF14431EAAECEC657560BF8D0FC36E227586F78894650611F82CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941807, "uuid": "cd509ad3-95a0-4ce3-936c-37f13085e2d4", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaKhymdGUop5h5lp:6GV0P6+kom0tVAoNvm+to1Ks3Uoznlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941807, "uuid": "a794fcd3-7612-4482-b9f2-491bd0b94aed", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941807, "uuid": "4fe07593-4283-4b96-8492-6f3c4203ee0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941807, "uuid": "c75e8356-81ef-4de1-8019-389eba8a572f", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5309fcb-e838-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682956604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956604, "uuid": "d5baaf1f-336a-418b-9adf-a761692ddca4", "comment": "Malware payload (RedLineStealer)", "value": "0f96997986c7ee9aa2e965c1ca75a871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956604, "uuid": "be8603e5-862e-4911-8140-326f66e97990", "comment": "Malware payload (RedLineStealer)", "value": "bda5af69cfcd0c1f273601b3c8588035891d6f6834ee6e8a64983f6b751be82f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956604, "uuid": "9098fbda-cd6b-4946-a6c7-85da64b436fa", "comment": "Malware payload (RedLineStealer)", "value": "1e3d2dabf79a0f53005917722eae21a5d5b012e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956604, "uuid": "c2c5d52e-6432-4730-9a72-a16b0a7149d8", "comment": "Malware payload (RedLineStealer)", "value": "2dc6c585d26d79731b37844508efb946b1190774b202c41899b47fe594f1b0b3f5d91ed0cde2b322ea285bf19d7f1703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956604, "uuid": "146265c9-6c75-426f-8847-31b0dc471100", "value": "T110945C4382E17C44EA2A8B72DF1FC6EC7A8DF2509E493779121ADA1F49B11B2D273711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956604, "uuid": "2c637efd-c16b-4983-b4b1-1d549c46e4fc", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956604, "uuid": "021d28d7-77b3-4cfe-97b2-388525eeb21f", "value": "6144:egijwdjQWdiZYzpQUXOWLy539f20iXLYL8S8630I1Fd9kXvjtF/wYp5v+:LijwdjXdDn7yZ9fO7G9jfMZFLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682956604, "uuid": "825788b1-3ed0-4dc7-a1fb-db4c72fa3da0", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682956604, "uuid": "21c2749c-9255-4870-b5e9-f4cff1b66148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956604, "uuid": "855bff39-b0cb-46a0-ab68-f2cfb9caa352", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5204719d-e7dd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682917326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917326, "uuid": "8cb03778-51d9-4853-a628-7635112ec615", "comment": "Malware payload (AsyncRAT)", "value": "2e5964cc837e99181da8fbb1a72459f4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917326, "uuid": "c9742fe6-067e-4120-89aa-b338bcaff0d1", "comment": "Malware payload (AsyncRAT)", "value": "bf2d33230f6da074a70938e96042a56f340d26b34511ddd254e10a0293f746b6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917326, "uuid": "7c7f35be-6efb-4518-8141-13046618214f", "comment": "Malware payload (AsyncRAT)", "value": "554eccb95fd042e7b59ae59009e66c02d40bc606", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682917326, "uuid": "13abb0a5-5d0b-4a9e-bd4d-7ffb5ba5b5b3", "comment": "Malware payload (AsyncRAT)", "value": "c26470e6bb4e4e028080260d2263288fbab6557638acb731f9b6c2460f703992515f9d31c0bb6729f07671e3e610b4ba", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917326, "uuid": "4208895d-9ce7-4831-bea2-63e709bc7617", "value": "T1D0349DBC64A785D4F54F988035FCBFA5017237E39ACD0E641328A6448BE9EE92F4458F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917326, "uuid": "a3086cbe-b643-46fe-be9b-be0d6a74acfd", "value": "1536:eeMD10HxuHY05UIy4rpmLoKZqcxU7SHzqQHw7rRim3ve0pAGFBQDVWQIypscdLNk:1k0t0iInKWQIyj37vB1rsz131513ApG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682917326, "uuid": "dc4e073d-98db-4b3b-811f-05c166a122d4", "value": 231940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682917326, "uuid": "ff708322-9961-4bbc-958e-384d1000ac9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682917326, "uuid": "7e9d7883-6858-4c53-9067-8e6a184d4ff0", "value": "t.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b6f328-e816-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682941807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "640356c7-b928-4e40-a5ed-907abe667456", "comment": "Malware payload (Mirai)", "value": "9ad54e66b0afb22c1538d2c185ec72a7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "3d544dff-3079-498a-b59d-b7199f33d497", "comment": "Malware payload (Mirai)", "value": "bf9a7624cb34550069ca99550b5a9529cb2d5bc743c1d562536d3ef7fb804c4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "287ec470-1b98-4f82-bebe-18072dad2bf7", "comment": "Malware payload (Mirai)", "value": "dff22bc00fb5e0478545a7fd2fb6d422a37743c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941807, "uuid": "a809ce0f-f6ae-4718-8204-7febb507b337", "comment": "Malware payload (Mirai)", "value": "43b88431f36d6d4cfed4ec9134cc7db42f9a3a545c9ebfae263a95ff746d829612b0f816c4fda0cf5bde9e753d660ac0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941807, "uuid": "7ad14613-4206-45b3-b619-b5abf8a9d004", "value": "T1DAA2D11572A32D66F3ED1C3DC96E8357F9A71BFC90F6327669401620C94D20A2E3CA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941807, "uuid": "8245d03a-060d-4e80-b555-06d59a410941", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjj8p+hymdGUop5hG:UvQn4j+ZO5fKAlx/vs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941807, "uuid": "0241c31d-1547-4aee-81cb-0f5fe0993f46", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941807, "uuid": "025d262e-f3de-4ff3-bf78-092d1b73406d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941807, "uuid": "1311bb49-cd8b-494a-b8d1-9bcdf898daa6", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1304d3d1-e800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682932253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932253, "uuid": "6029faa5-c220-4f72-9acc-f7203e328d1c", "comment": "Malware payload (Mirai)", "value": "4c9ad37267e6d60bfe5ac5737949d89f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932253, "uuid": "5ba7939d-bbdd-4174-b839-301198b4b696", "comment": "Malware payload (Mirai)", "value": "bfa766585f80c38eb93e488a337f456ea275e61e18ea18483cf48f279cf7cae1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932253, "uuid": "d393f826-59e0-4524-b82e-8a4e050c59cb", "comment": "Malware payload (Mirai)", "value": "e4c59e08c1c0c9e9fc2c9f3a4709dda79bbdfe46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932253, "uuid": "6de18aae-dafa-4562-9011-11876395504a", "comment": "Malware payload (Mirai)", "value": "22bb47ff5444009947f5a0ad035020988450815a4d21d7e569eb33aef13980ca7860a80e9b7c9f5d4f8a25dbf6f97f05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932253, "uuid": "edc7660f-26d1-42e1-8037-efb6bdecdca3", "value": "T18473F946BC818D11C5C91379BA2E21CE33136369F2DEB223DE116F247BC692B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932253, "uuid": "a90646b2-f080-46d9-9e9b-0c1a70812240", "value": "1536:3NnlGf4rpkSi8me+/on6ICZuwqsSdOzXImiU+9Nm/uJ:TGCWSizD/on6I+p+9Nm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682932253, "uuid": "e1664019-e75e-4629-966d-423e5fab19ca", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682932253, "uuid": "d935cb41-2167-4438-9fa6-37b2667ec365", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932253, "uuid": "f2e0a569-7236-4fb9-91e1-4763a048219b", "value": "4c9ad37267e6d60bfe5ac5737949d89f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ac389b-e7f3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682926808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926808, "uuid": "55643b93-1be7-47e2-8b62-ed3761c67e4e", "comment": "Malware payload (AgentTesla)", "value": "c26b6b7eadc851a6e1dfc8a0351e9e45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926808, "uuid": "99a3dfd4-b01c-41bc-81db-94eac8e37b4f", "comment": "Malware payload (AgentTesla)", "value": "c06c0309db9e858944bf7ab5b07ffade02b158f768897036793bb8188180fd8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926808, "uuid": "d5d45348-3ee5-4d6a-ae34-ea5dcbbba443", "comment": "Malware payload (AgentTesla)", "value": "c678b4cf5533122f3d0d37af6d822380f74f26ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682926808, "uuid": "9a4a9091-5b91-42e5-910e-ecda476db18e", "comment": "Malware payload (AgentTesla)", "value": "3dcaec6e82f2447bdf10da1ccf758856adf91965d74f1ce64d639512b35d3be940eb8b85ceb04bc8fdd33b5f275846aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926808, "uuid": "87cd3a9c-8948-4f84-8305-bb1ea0ecbcd1", "value": "T12254122532A0C0BBF5B20F724DB64621AEFAAA0911D6B2271300B7AD7D77342E75D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926808, "uuid": "36a49991-1383-42ad-b9a7-8bfec1fcc286", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926808, "uuid": "b4b8702e-fefa-49b3-b09f-7b5511dac53e", "value": "6144:/Ya6+/NB10W0zXAT4tapS/3G8LU9B8/NaCTR6Ewf1FurQ8K:/Yg/V0BbTawvG79m/XMFurQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682926808, "uuid": "8640673c-07cb-4756-a563-9dcd9a9a2c83", "value": 292849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682926808, "uuid": "81632481-912b-4d9c-9b3f-75e3a3d15abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682926808, "uuid": "64816e55-4b54-40ea-8948-16532d5bc930", "value": "New Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7b58be-e86d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1682979327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979327, "uuid": "b2816bdf-0346-4146-a01f-0949a9b7a2db", "comment": "Malware payload (Pony)", "value": "87f72b058699f794f09a7e71e16065b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979327, "uuid": "bf23803c-7959-4f6f-bf05-599e19d7b3f3", "comment": "Malware payload (Pony)", "value": "c139fc652368b4e5279dc109033b92344ac651798ca22d409bc289c4f42f43b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979327, "uuid": "bfec2b95-4bfb-4bd1-a40e-4a6195b7b614", "comment": "Malware payload (Pony)", "value": "dd942522978158fcb56377495c6fa80a382f69b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979327, "uuid": "c4837ab3-c409-47c6-a1d9-55a714c3b2ce", "comment": "Malware payload (Pony)", "value": "df3fcf32710e02cd48f2006d3532aa481bf914e04ad88fc85fea514e62338d1339e52abed768319000fd0dc586b7843f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979327, "uuid": "b0fbc452-01bf-405c-afce-bad25f44976f", "value": "T17CD4AE62F2E14833D16B2A7A7C1F5774593AFE102D285A822BF8DC0C9F3968135752E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979327, "uuid": "6cb6e1e8-17a3-4164-ba6f-4e0acd8aea7e", "value": "0ab74006f7d763a33b44aa5007f2f0f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979327, "uuid": "b8480fb0-ea5b-4e8f-870c-9de8ce374fc5", "value": "12288:TGGKDh606HnH0lX3xSQ6iGBwm4aCIO6U8NWgzVdMB:a7DV6AoQJMmr6+wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682979327, "uuid": "51641819-507b-4eaa-959e-c22d78617e83", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682979327, "uuid": "92c05db6-e693-42dc-94b8-45d6dcaa91c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979327, "uuid": "381331b7-7fb1-43c0-a787-2f781e3aed62", "value": "C139FC652368B4E5279DC109033B92344AC651798CA22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dd420d-e7e0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1682918709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682918709, "uuid": "2b91d02c-ceb3-4af4-9cc5-9def5d3eab8c", "comment": "Malware payload (njrat)", "value": "c124518b57caad61673cbe251784c24b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682918709, "uuid": "edf67d41-95e4-4362-80d9-a8e27b6ab035", "comment": "Malware payload (njrat)", "value": "c21b4e49208eab14b010c842a62f98ef7f93dada64ec94414c02d62b73289ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682918709, "uuid": "7effc6e1-5660-45bf-9d76-27e8c5c412ee", "comment": "Malware payload (njrat)", "value": "f2dc60e70afaadf6818f19e7b6e95484997e66d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682918709, "uuid": "44c91789-e72e-449a-8e82-5f5ed08063c2", "comment": "Malware payload (njrat)", "value": "6a4e3edcc10cbfde1facd196455ed9d957bf1fde201e512d159b488d778d955dbbef8e5ab4ee85010f769209793502bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682918709, "uuid": "bd37037c-9956-4255-8af6-757a5f9eeae3", "value": "T18D64729D726072DFC857D476DEA82CA8FA6074BB531B4203A02715EDEA4D897DF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682918709, "uuid": "76c26c77-f328-4326-ba21-192cdea76c65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682918709, "uuid": "bd091fa0-3035-4b24-8ef3-57e9da2a0ed2", "value": "6144:IAOnGnqVi+vRveNcfznYWWHjJcsVYk4s/Oo17VXXiaVd6OB78rAlEjBZhso4yWoX:wBvmcbYWWHSGOo3XXiaVdvGrAlEjBZha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682918709, "uuid": "038426ed-f154-4b8b-9e33-356bea027f89", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682918709, "uuid": "b4d8a949-deac-47ad-8966-c04deed20edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682918709, "uuid": "b1bce503-de2a-4b8d-a302-9e0863fc03e8", "value": "c124518b57caad61673cbe251784c24b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5f7ebb-e832-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682954089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954089, "uuid": "89784fee-d66c-4ea7-98a6-78d76aa050c2", "comment": "Malware payload (RedLineStealer)", "value": "064d62de37c1daca638a4926c8e0b8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954089, "uuid": "3809b1c7-3eab-4d75-bd41-9c42a3171851", "comment": "Malware payload (RedLineStealer)", "value": "c3ae28893182c56f2dd617710bf2c240088c45a3edb529784e7c499e61397e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954089, "uuid": "f50ecd6b-558f-490f-9fa1-b08087b06099", "comment": "Malware payload (RedLineStealer)", "value": "478fc10f7cf03bc90d06061a277afa18f4053f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954089, "uuid": "3101abe0-305d-4007-9cc9-085ed8f6bdf2", "comment": "Malware payload (RedLineStealer)", "value": "9fcd908f84d82c48d00ad0c8fa3cf76bb6f87bdebca4f6d474937e587b19089654a61455feccd07457083c467dea0910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954089, "uuid": "c95a77bb-895f-4bd7-82a3-6b89e22ae3c5", "value": "T13975235666C8C132C5B103F64CF947C306753DBA5F79C35B26A99AFF28B128864307AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954089, "uuid": "87b66003-b9db-4880-8fdd-6a45376dfde8", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954089, "uuid": "344fd7f9-5492-4044-a4d8-a6434dbebff0", "value": "49152:iXZhE3RXytuq+zQ0d4aoQQ8YNszP/JjWM7wdT:pRXys3zQ0dJoQQ8YyD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682954089, "uuid": "c5a76797-a53d-424a-aabe-3da14cbe4e91", "value": 1586176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682954089, "uuid": "b6fdc779-074e-4017-93c0-1151aab92463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954089, "uuid": "f974c49d-f1e5-4159-bb16-207789f1152b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2533278-e843-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1682961323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961323, "uuid": "d46c6e04-65ad-4099-b8fd-3e9e13e55e29", "comment": "Malware payload (Fabookie)", "value": "8e49c8a9fea42c8ec0315041c173401c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961323, "uuid": "9e0dc2f8-44b1-47c9-81a3-0cf7d5fdb561", "comment": "Malware payload (Fabookie)", "value": "c3e4b936392928fd4e1190f3ce396efd4495f1132f8aad00aab1d2dceed6bda6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961323, "uuid": "a5b42ca3-b249-4dd9-aaa8-59ba14dbd9fe", "comment": "Malware payload (Fabookie)", "value": "172b13dfad0dc188d49b922532b6473abedd3255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961323, "uuid": "3063c9fc-9241-4076-a601-69250dae682b", "comment": "Malware payload (Fabookie)", "value": "37d655bad58e6c0b8717e211baff8b9f27c7cbc4f272dad94bbd8fe21aa3589ee5a16d0518ab2948224717a1470a2f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961323, "uuid": "d3093576-461e-414c-9b99-fdb5371daeb1", "value": "T12CA45C16B7A841F5D177D13889928616FBB2B4478B24C7CF12A8D36D3F236E14E3AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961323, "uuid": "403df95c-e6d6-483d-b801-991271c1adfc", "value": "606a690081d1bdedf2f5dc3cb5f1d4a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961323, "uuid": "0533d916-ce02-4b30-8b6d-bfc6ee41a18e", "value": "12288:ZjaaF2sTh5S3B8ZlNnYKF/DCeT2T8fltAPCH:oaF2eh5S3B8LNnhZT2T8flOPCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682961323, "uuid": "073662a9-3be5-470e-a710-7378146658d5", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682961323, "uuid": "61aaacc7-4e36-4e3a-b3c7-47e4051b1e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961323, "uuid": "b8d85655-fd78-44a4-b93a-0cc00391781b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd90f467-e835-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682955329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955329, "uuid": "ac827d7f-0c2a-49ef-9cd7-5ff4d0a91855", "comment": "Malware payload (RedLineStealer)", "value": "13465c45ab58a81669d0b55b40d8cc6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955329, "uuid": "a1e47344-c538-4d4c-a7f4-0b71529de2e0", "comment": "Malware payload (RedLineStealer)", "value": "c47da482e6a196c4c325379e9f8fa61764cbb401815391d4a5efc47411d044de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955329, "uuid": "49ebec00-5289-4e82-8ec5-3c99242b0f46", "comment": "Malware payload (RedLineStealer)", "value": "b124e944e6c7d8905f1d0d0ed4ada9da9c9920df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955329, "uuid": "44fda34b-b543-499a-b326-85afca144403", "comment": "Malware payload (RedLineStealer)", "value": "e90402351c2278d3f9cba0880a53e043984b8faf686348a340018a3213369583d8e9671888f4f7b46d12c46a1d74912b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955329, "uuid": "79ed7677-7210-4563-a0dd-fdbca83da97f", "value": "T16895490870E08037D53275F38AF99574AFE9B411CB1325DFD7D4463A8B21ED2AA3227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955329, "uuid": "3b365a15-1011-4147-a189-893c80e03144", "value": "31379d8e4079161615a0383612464e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955329, "uuid": "36196d0d-0c1c-468d-bea8-ae551bda667a", "value": "6144:RIiVa7ZcTBCF8+g5XV3T8OxMqWeAOonboFtu67A4fVdyoP:OiE7ZcNCq+zo6nCtuqA42m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682955329, "uuid": "daddbe10-ce35-47eb-9a03-1537233bc0a2", "value": 1940992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682955329, "uuid": "1c40e6dc-439b-444b-956e-2cdf544353ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955329, "uuid": "4fc3d34e-fc80-42ed-aa4a-5c0f3fff4fd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccb850c-e821-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682946604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946604, "uuid": "90b2c8e9-64cc-4cdf-af8e-9cca76393ad9", "comment": "Malware payload", "value": "556265984de1a8686c3ebf4663349a62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946604, "uuid": "f7911ad0-301b-458b-8bca-f50b626949ed", "comment": "Malware payload", "value": "c4ec756efbf98351e1ac8c4bbf5e7880b0a724a7216639e16b1f3abfbfb89540", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946604, "uuid": "fca7e6df-e738-41cc-91d8-a5f41d48764e", "comment": "Malware payload", "value": "8154d51216d8d4ce478e08264e494e36e2f75c64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946604, "uuid": "1db76294-5384-4c09-bf5e-8d620f7f3b8f", "comment": "Malware payload", "value": "07f077215c7e67a364ca4013822a16bf478da40432a3c940d2936197902a9d6cd245ad9ba78f19066e2b849f0cfca53b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946604, "uuid": "aab6a54d-f4de-4d50-a58d-f5666b56dfb8", "value": "T168527547BBD29D3BC4D4933419E7816435F3DCB0AB62B337294851B61F8278C1E2E68A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946604, "uuid": "cd2acf78-e186-497a-9b19-3ae6ef6c8c74", "value": "96:GmTRsvi1jGE5Fi8f+1KvsqSS/yv/F/RjRlITfCnHJrSY5fPPVopx5w87AMRKysEy:GmfFW1KEqDudZj3XSBkFyJW5ZxPSi5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682946604, "uuid": "621e4d73-735e-4b45-9a31-53a59d12897e", "value": 14032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682946604, "uuid": "b891724e-8261-48fa-a808-45349b5fc497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946604, "uuid": "3f91f6ba-a830-4849-bd8b-fc5c0e769c33", "value": "u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc6ad5e-e82a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682950421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950421, "uuid": "4e019f48-6c0e-44b3-a0be-fa4a7df39935", "comment": "Malware payload (AgentTesla)", "value": "013fdf649b8459b5dc4bb4459ead94ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950421, "uuid": "2b78f45b-ef8c-4bbc-bab2-532375e49fa2", "comment": "Malware payload (AgentTesla)", "value": "c7b10eabd7c4fac8ded3b53b68cf55963ae6c9e4e91587039466c06f64d9541c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950421, "uuid": "b5403f48-f17e-4381-b3cf-dc4afb2fad16", "comment": "Malware payload (AgentTesla)", "value": "f4a0ad2343ce165b7c3ab6ffdc662a3fac3f884d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682950421, "uuid": "7c77ab74-ae1a-4447-ac2e-40335b57a692", "comment": "Malware payload (AgentTesla)", "value": "5dcba790b484bc7c53ae5cef7749f5770c7d9ebf1a4973f560a8bcb0be6ebab79510e5b14e82e8636fd60bfc6089eb19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682950421, "uuid": "3ceede92-cbb9-4fe2-8300-1c65f0bd4d7d", "value": "T10AC43A023AA88996FAB54BBE9C9180411F7D7D16DC64CBAF70E773CD0273382694791B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682950421, "uuid": "af7310c4-2e07-402c-b1b5-f86829452e92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682950421, "uuid": "9c215825-e0a6-4325-a875-06fffe260a0e", "value": "6144:EPl9NAMRMi8EvYq83vrUkXGbJWTVh23SjcDIWBy:Et7pKitYq8frUkKJWJh2gky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682950421, "uuid": "db8718ab-cd28-4474-af2d-6999f8e51323", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682950421, "uuid": "a97e2633-ba42-4a46-8334-607211b42b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682950421, "uuid": "27e76475-f071-46e2-9716-1d87a06d43a8", "value": "NEW ORDER No. 250-270423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882b9242-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972822, "uuid": "b2e09296-06f3-4856-ab46-b95a29b514fc", "comment": "Malware payload", "value": "87e13b97781f3e22371b127d34d865da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972822, "uuid": "640ab1a1-7fbf-42a7-8ffa-74bbf01b02a8", "comment": "Malware payload", "value": "c8250a9f89d5819d4755b2cee8098ac6e6c5f6a56aaafa3be0dc40ab38444efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972822, "uuid": "557da608-d903-46e8-8552-33857b3b31d8", "comment": "Malware payload", "value": "d75d7880bf609887af7e732e433010054d545c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972822, "uuid": "3ad0f9b8-6c6e-4657-8867-f3185edec736", "comment": "Malware payload", "value": "93f6a5075057c930189a08efb3309f2e6a9da926e2d6001b9f64da7da6f3177b194c30d55e51569cafb044be8bbf56e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972822, "uuid": "fa18fd43-0917-48c6-922b-da73271db3e5", "value": "T1B21633E4C35EC11ACDB094F5CDAB120D32528E1E5AC1FB9AD293317BE637925ADC30A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972822, "uuid": "f21900e8-c362-4a68-81ee-957b9585c895", "value": "f8e929ef2ae3e430ffc5d8d946a65dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972822, "uuid": "c3ea31d0-efea-455e-9f0e-7f383a0cf81f", "value": "98304:AVquhY7QzpVJwFlApwMak3wto9bL6PQYkmSFF1M:AVqVIB4lOXn3wtYEvSF/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972822, "uuid": "904b8410-9a63-4f9c-a3a9-f6a426e056cd", "value": 4059136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972822, "uuid": "dded9fce-2f7a-47bb-907a-e1aa59e10166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972822, "uuid": "5927d1a8-2fbd-4c86-bf15-0cd511acebe2", "value": "SecuriteInfo.com.Packer.Enigma.1.30820.4255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86c78d8-e82e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1682952261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952261, "uuid": "f57bbaf2-38b6-48d3-8993-b48e9b3bc7ca", "comment": "Malware payload (CoinMiner)", "value": "6ccc154c5fcb2f7637a5a0edf8d5f9b7", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952261, "uuid": "e6646be7-05ca-49bb-8663-b261fb5c220c", "comment": "Malware payload (CoinMiner)", "value": "c8e81c4d181e65bcf28ab26d67b9afcd85ba74fb0dbae302ad4c0d3acdd7b0c8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952261, "uuid": "50113c77-03a1-45a8-949a-11bd843d53a0", "comment": "Malware payload (CoinMiner)", "value": "3664933d1221397c3b578cc75dbf9c1c5dc04bc6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952261, "uuid": "d2a4b5cf-2a88-42f9-9ed7-b628cdde9d96", "comment": "Malware payload (CoinMiner)", "value": "c3efeb2cfc8b402639c2352cc6b7dac15a802448be2f6eb67a286cd73bbdf2da99540cf8f821eb158d59ecce961deeb6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952261, "uuid": "937bc2d2-461f-4be5-9c18-bd0a0cd60003", "value": "T1DF86C0E3FB802456C036637BCCF2ACEEE76660A6CF5AB54351C8527A9913A403D5D34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952261, "uuid": "02f5a2e2-2077-406f-a393-24c9a9ab7ed3", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952261, "uuid": "99f7a570-413d-4a5f-bffb-fbbf246cf008", "value": "98304:Fecv/Ig6bD9R/ShoIrlJ3/0t0clWAUoomKRdplfcilDssOdoSNFJFdFBQ9GkPX:FecnQD3/ShT0vMBjHpREBFV2GkPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682952261, "uuid": "faea6707-fe3b-44c8-8344-0fb553150665", "value": 8565944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682952261, "uuid": "9e752ff9-0ffe-42aa-9c37-b6367b494f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952261, "uuid": "17ddb2d6-c567-4990-a595-329afb7346ff", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4260cf-e7f0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682925581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682925581, "uuid": "1f782e9e-e855-4018-ada6-0a37c060d5f1", "comment": "Malware payload (AgentTesla)", "value": "2a445c368e9bda81aea6705d3e013a83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682925581, "uuid": "b10acb87-496c-427d-9c4f-66a79fae7398", "comment": "Malware payload (AgentTesla)", "value": "ca5fb8c65adb08fa65191c8c9fd1884cbb730afcff6c9231684bdf6b3a1b6fdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682925581, "uuid": "3c87b890-0391-4bc0-be86-6b6fdd7898c8", "comment": "Malware payload (AgentTesla)", "value": "532685443c2bea0957cb94b9f05f94690504122a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682925581, "uuid": "3938b441-edbb-4739-8bdb-95ceb2fd5660", "comment": "Malware payload (AgentTesla)", "value": "6d5cd138ed7798e8728e157de73fa8769e47274efe13c8fea31a21e0b27307740aa8fff833635dfabb0c51e33406e372", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682925581, "uuid": "6527dd86-c759-4d9d-98a0-348148ba2a2b", "value": "T1C5D49D63F139CADFED7137A5C159E795BE60D016E090F0A07E0A24C8DAA57E21F8C17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682925581, "uuid": "03a860c1-5be3-40b1-87cd-57c57df796d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682925581, "uuid": "734f6bc2-0977-4771-9806-54ae7a5c6a7e", "value": "12288:nhaK7z3PMw/RZyZgklXrZHEApslEKpxrxW0EulnR7ILy0:zn3PMwDyZdVEApwHrrxWuR7ILD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682925581, "uuid": "f6753c01-a307-4a78-bc37-0ea2ad42da8e", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682925581, "uuid": "2ba21bdb-57c0-4e91-ae4a-41f3f3a5d446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682925581, "uuid": "4d44c842-cfe0-4da0-88d1-a1c4e5048296", "value": "Purchase and Sales Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1cedbc-e7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682927406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927406, "uuid": "8c46b4fa-e152-40b6-8a36-bbeae6fa9646", "comment": "Malware payload (Mirai)", "value": "7196c7d8233255a56875a6181b4aa336", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927406, "uuid": "a48b6200-8130-4e10-beb1-da11addbd0cf", "comment": "Malware payload (Mirai)", "value": "ca6582ecc1947451052669f71f84b01d8db9b49a650cc137a629384db01cc535", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927406, "uuid": "b17cf811-38b1-473c-9d32-2345a0c16a86", "comment": "Malware payload (Mirai)", "value": "cb0074a6d031772c2e8d5b9578ad0340b0739b7a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927406, "uuid": "1abc09e3-3460-40d5-bd42-3709455bedc4", "comment": "Malware payload (Mirai)", "value": "728186326b5dca2aff41ce9d63ea691a3ac5fe0a58a36ac6d0c5d7a54f65406cfe0f4447a1e80dd19d6355b38b9cd743", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927406, "uuid": "108f03a4-b74d-4389-901d-ea1d4d555888", "value": "T178C33B46EA818E03C4D61776BAAF42493323E754E3DB730699186FB43F86B5E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927406, "uuid": "bb5f986c-b7ca-455b-87c0-cb8b3c870b4f", "value": "3072:Fv4D3QbzSuNWh0DkJd9OL/k9n+2jvM/9mTg0OApJO/:14D3QbznrDkJd9k/8+2TM/9UO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682927406, "uuid": "7a6f56da-1238-4311-b4e0-ffef9f5a2d46", "value": 121958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682927406, "uuid": "4732e58f-e629-4f74-a6b2-0ca976358f50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927406, "uuid": "f1bd4d6a-b83c-48bb-8530-c31ea7ce4160", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af70883-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931864, "uuid": "983a4ec1-0fde-4a07-8d5a-1c569e042a96", "comment": "Malware payload (Mirai)", "value": "714efdaa4344057d01a37f3b1381b76c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931864, "uuid": "27021d5d-b3f8-4209-a5a7-2d328242120c", "comment": "Malware payload (Mirai)", "value": "cc54b068fc5170221c328ce79a87c6ae156d78616e4d29c9c51324382ddf1e9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931864, "uuid": "2a511d0b-2451-4287-bd71-c9edbe36e945", "comment": "Malware payload (Mirai)", "value": "fd21d5a1fbce1fd57b3259be9cfc53f659b86e14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931864, "uuid": "14c2e5b7-63df-4ec6-bca1-5a8bf458e86c", "comment": "Malware payload (Mirai)", "value": "24d905f1b6c421024ff48cd0fec5893bc94a974d9cf037b91f6c05bb44cfec264f9483f9d21898352ba95a954f1e82a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931864, "uuid": "262572f0-ba01-4919-bf23-44fba76fb7a2", "value": "T1D0434A0137584E07C1665AF8293F27E4C3FEEE9024F8F6845A0F961A8635E37149AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931864, "uuid": "b9d9f125-604a-4edc-b825-0888203c645c", "value": "768:vrbqajhCJ9xtROUWcnDrjRdqRaMV8+o1R4EWiUuScp9/+wbGJDmHLGRACC+FP6Ss:Kc2WzO71cuSczirWCC0uzMe9XwlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931864, "uuid": "9b891a5a-f4ba-40b2-94e9-6205dc7047b0", "value": 60144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931864, "uuid": "ce0a44b4-ccd3-4590-8ced-d2844e8851fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931864, "uuid": "1f4bf985-4a66-4bb8-822f-a4a02c3c5553", "value": "714efdaa4344057d01a37f3b1381b76c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a5c17e-e844-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682961512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961512, "uuid": "ddc51249-8eb5-4aed-9d03-ba25eb73ccf0", "comment": "Malware payload (Formbook)", "value": "214781137223b5113aa03b3298eae10d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961512, "uuid": "7fbbfc47-a179-4d31-bd01-97fb32e7cb02", "comment": "Malware payload (Formbook)", "value": "cc6eac2e2359b08c5e5c37cafac26d252ca8f22992168fbf5c70a5471ed86ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961512, "uuid": "d857f801-79dd-4362-9293-79535077ec02", "comment": "Malware payload (Formbook)", "value": "73bcfd3de51dee1a603936b6fd2038ad382b6f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961512, "uuid": "8cc42461-2d3b-4898-8304-872302817775", "comment": "Malware payload (Formbook)", "value": "a98339a6562870add9d0e42c52d5d26ac94bff3589ca5a3f7e74688fe32db36447c7aeb899011c8ca7659f6cd5f37e6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961512, "uuid": "7534aa53-b28c-4b62-bf88-dc5a027b6904", "value": "T12CE4D00122B5CF2AF97ACBF40464FB4427F5B03B54D5D1281EF6A0CAD9B6F050E64A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961512, "uuid": "432917e7-3cdb-42e1-a540-9fb6e253a7e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961512, "uuid": "b5a4ddc6-ce97-4778-9b7e-6101a92c3eb7", "value": "12288:KuW2iNvcEgZnjHIBIcdakkTyIW8/jsLedh8NbhrGHL1GzFw:pW1tCZnjo9dGTyT8/ALaKNFrKL0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682961512, "uuid": "509b86e3-62ea-46ba-b01d-86087806cf27", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682961512, "uuid": "e1a00420-ed4f-4f83-9b9a-26d79f288598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961512, "uuid": "433d44f8-259c-472d-8e09-efcd41328db5", "value": "DOS31092ES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae8f30d-e7f4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682927408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927408, "uuid": "68c5ba84-afce-4b6c-872e-a44e863e1456", "comment": "Malware payload (Mirai)", "value": "0043f937ffa690e60f55c310243ac410", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927408, "uuid": "a281d6a1-1d32-43bd-a2a4-2b59836f1388", "comment": "Malware payload (Mirai)", "value": "cd47773c43d6f13c62286b201b69b9531d93145e706c72e8525b071f80a486da", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927408, "uuid": "75a21a49-f450-45a3-ab7e-6859a22414f3", "comment": "Malware payload (Mirai)", "value": "62b92c43bc927dbd8db5d258354bac873c09ddb4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682927408, "uuid": "3c2d8a40-5291-4fd0-a876-f58220d8fc8a", "comment": "Malware payload (Mirai)", "value": "85bf871472c6cfbb9f6cd6524cd1a83f74c9d5a3d7eaf0f1bc36be08f57647006d7f9ed4a0a10abe23da7a474a2c55d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927408, "uuid": "5e9a4d3e-a0dd-40e9-a18d-8e2703e562d3", "value": "T194332A51BC919A12C5D4637BFA6E41CD332623A8D1DF33079D262F513BCA82F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927408, "uuid": "b068851d-1eef-4d8a-95b2-84e7d1e76bbf", "value": "768:omso9sEallYUxBTcJ3qbxJ3USFlvG4UbPUWTSh05anSRZvYPvT/hcB3D8nRRePNj:2ooCUxdr04UdaqZIvT5r5xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682927408, "uuid": "28dd9a77-c024-421f-a550-698255c7be61", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682927408, "uuid": "908d4886-1880-4531-8c1c-aaaff20768b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682927408, "uuid": "95461d7f-66c5-4748-bc03-ced5dbae95f9", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a7fbe0-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972820, "uuid": "5b21c07a-9888-4ec5-aeb5-0723767456f3", "comment": "Malware payload", "value": "7aab27c0745c1f5071d169836eee5bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972820, "uuid": "c1c86ac0-ff22-4363-ac15-2832a9534db9", "comment": "Malware payload", "value": "cdfd8ce750d32400ad7f551f137810dc36e4e44e9fa479f5256abb49bf926e88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972820, "uuid": "31aa8815-ae5d-42ce-a94b-70ab2e8b10d3", "comment": "Malware payload", "value": "cef36ab926c62a2af8d6e23279e00f54e8272d7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972820, "uuid": "0190bd5a-7a51-471b-9bc9-31ac30bb4f39", "comment": "Malware payload", "value": "12766d96ca7aa95bb48ec4abfbfa5ad7f9ea1e546ca7fb1214f2719d58fe560da41e602a40389514dba69f485dfbd158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972820, "uuid": "2711b23e-fca2-4e90-88ba-9ee0a6babedf", "value": "T102833813BB4AC3B3E41153B16838A31B563BF8B00BA563E3B7D55FAE9DA51C14E32506", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972820, "uuid": "c91000ee-33d8-449f-8323-b9b7af9ac366", "value": "1f6665585b7724a1874d04781016d9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972820, "uuid": "17fe780d-cb30-40e0-b259-9cfac337f8b7", "value": "1536:VHSUaLF+o/xTPX3Nj63zXDjtCByXQToslDCuojtz80eDOqXO2HiH5M:VytMoJTPX3NjGjVGyg0q+um58UqXO2CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972820, "uuid": "056b0419-4faf-4353-aaf3-55139ebb34e4", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972820, "uuid": "cee54eb4-2e4c-4e8a-8410-30ab4f3e34e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972820, "uuid": "d4750f8b-bfe5-4ba0-a23a-eabdcb48f670", "value": "SecuriteInfo.com.Trojan.Win32.RatKeylogger.UV.MTB.31736.3673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6345de-e82e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682952344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952344, "uuid": "9dfaf7c7-c98b-4230-b7ce-85c67b2548c3", "comment": "Malware payload", "value": "7515fbc014040dee7d54da46931ea1ed", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952344, "uuid": "02c6a942-e61b-4a1e-b56e-09b75a0ad21f", "comment": "Malware payload", "value": "ce1286b0ac0c7cfa5bb44446430af0ade159cd35bdf255b4ce0521c513fe9466", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952344, "uuid": "815690ba-0684-46bd-b56a-22d381696422", "comment": "Malware payload", "value": "baef412f57d12cc28f1e693ee87d70cccd2a31ca", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952344, "uuid": "a8fab81e-f1e0-41cc-9dc3-5f4aff615660", "comment": "Malware payload", "value": "ba2efe8ac917f5dd04ee36e21c983fa6fa5c4a805aa949008f32ecae179b2cc59ca07675870845129b17d3261d580855", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952344, "uuid": "090c0ed9-31a8-479b-b967-331be840e2b5", "value": "T1DD23FA1FA381133D76260024254F7AD1E3B464B86BA5D778A05DC22833D2DB9DEFA5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952344, "uuid": "21660b65-8649-4ac8-9921-f906d288b759", "value": "768:4vjJCjIw/3jQ/2SltF1P8PsAZuCDK+4oS1VzRfMfaLSh5Q7xI4:4vjJCjIO3WP8EAZvDd4oSnlF0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682952344, "uuid": "b16bea84-0011-43ae-98cf-b4a8a8c809bd", "value": 46627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682952344, "uuid": "cb3f8789-c1d8-41bd-848f-ac48d1deb19f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952344, "uuid": "64ff8752-4da7-45a5-b9ee-6664c23ce805", "value": "ProjectFunding_C258_Apr28.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06d9a17-e848-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682963414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963414, "uuid": "b49e9fef-f831-4220-83a2-305026a11338", "comment": "Malware payload (AveMariaRAT)", "value": "f40ac1614e7f871e320e77eaf9a7f229", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963414, "uuid": "53688d20-d01c-4093-804e-2ef8772fadfa", "comment": "Malware payload (AveMariaRAT)", "value": "ce411fa4af687b15beb90211d18afb4e5ec2842fde8cae87d72bc7def65ef6ef", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963414, "uuid": "a9b91fc0-b187-49a5-a3e6-dbe1938bceab", "comment": "Malware payload (AveMariaRAT)", "value": "d354cf45deb897f9d96d51b8649a704012923e2c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682963414, "uuid": "e48401db-a8a3-446c-87aa-5fce7603ed7e", "comment": "Malware payload (AveMariaRAT)", "value": "8d7c6bb3a06d1c08ac04beae5c31b649d0824e26d152bd4691369104359a7fb002f80ad5d74a54d8f2cd375844e1033b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682963414, "uuid": "2be0a1cc-aee8-43c0-9c08-2103c35141f7", "value": "T119F4AE81D0ADFEC6F8358BF054B5FA4022B5FC7B64E5C8215EA170C499B5B033A6AD1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682963414, "uuid": "f3b6f61b-bfb3-443f-935f-d39dd6e75943", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682963414, "uuid": "9a3717bc-6ba3-441d-8b19-f9215ab1f58e", "value": "12288:TzmUi6Pt/g4Q6lqtRKHFsVU4Azk1tBfhxHaSQGRNvTykLcPES:fmUiuU6lqtRKHmBAzahJvLJT1cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682963414, "uuid": "2eee3f9a-dd3a-40d3-9eab-61d097689e48", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682963414, "uuid": "f23ca8e6-449b-4614-8e34-3527e302056f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682963414, "uuid": "36a53576-fa1d-4326-b1d1-1365fa1a1cd8", "value": "rfq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e95d90-e86f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682979929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979929, "uuid": "1dd1485b-fe00-42e0-913f-f1d92379a76a", "comment": "Malware payload", "value": "7338bbaa657ea27aaa910356fb982bdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979929, "uuid": "d1e14958-22d0-495a-ae87-9a63f99d9cd4", "comment": "Malware payload", "value": "cebbe2f5899d768d85f2546625a503ce5aa659c9fe0a0d051df9310a383e1902", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979929, "uuid": "d282e15a-6309-4bb9-a203-d851ea46ac39", "comment": "Malware payload", "value": "8f786b29896f2d30af4f9aaa85d94cbcbffc13f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682979929, "uuid": "97647d5d-cb8c-450c-9f8e-d404e05026e0", "comment": "Malware payload", "value": "0f15437f6dc8c9531cac6c9371066d1d4f026307476d7c07fddb0453da44aa35e6ca38275bc8e949e024da91009bfc39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979929, "uuid": "1f3168fa-1dbd-4d24-a518-807a829c4282", "value": "T1667523AC74B6B94AF1D4437BC7853CF6DB2CA540DB9D3D9B8E204056BD8310E4F6A862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979929, "uuid": "b0d83457-f59a-4c02-bbcb-88f79749da9d", "value": "6144:VdtJWsUAJojNYw3RYJbRo528d59i5MEbBcKhgQ:ftJjmYwEbRCziTVOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682979929, "uuid": "0485e86b-8555-40ee-a62f-720c21a09ce6", "value": 1568743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682979929, "uuid": "d25aea70-fb9f-43bb-9d09-851c6fa22433", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682979929, "uuid": "c02eef8c-140e-4d74-983f-823e85d7aa0b", "value": "ioc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60fcc76-e7e6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1682921413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682921413, "uuid": "4dc032f9-b8e4-4615-9cc8-c4d5e7cf6e01", "comment": "Malware payload (AZORult)", "value": "37b10d88c783c48c404dd39365c47540", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682921413, "uuid": "2e66db84-393a-4825-9bb8-d5ea3f25da84", "comment": "Malware payload (AZORult)", "value": "cf6a0127f90f8d0155b5b822830bbe5f0b1966e74f805b4c1814af34df750748", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682921413, "uuid": "bf43c6ea-6636-41d6-8730-3672d032439d", "comment": "Malware payload (AZORult)", "value": "6af237c77fe5e9f3f48ab1c4432a0aef0d046c65", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682921413, "uuid": "15ec6118-4942-4194-897d-2e66c2e0e679", "comment": "Malware payload (AZORult)", "value": "28fac3affbc4b333fec9f66e80a399a9c24ab1c9adcc167b38a1fe576ca2faad2350ce99d99f766f568ea6c40b845b33", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682921413, "uuid": "1c17a8ec-272a-4368-a501-bf4cad819ae1", "value": "T163D4CF162029CD8AFD1D8B34C474FBF462B9BDB3E4D59123277A7D49F9BAB010D0825A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682921413, "uuid": "1f7ab58b-8f70-415f-acbc-694b390f577f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682921413, "uuid": "06360bac-a837-4be3-9abc-41d9fe5e38f9", "value": "12288:h3dpNj8zd+7fDYtzKuCns60yj2+GOkdLpLgqPinVqbOk:Xjj8zd6oh4GzPin8b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682921413, "uuid": "a0040f9a-d67f-4ad9-b359-b65e34c51fd4", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682921413, "uuid": "0ec92792-e11d-45f1-8396-494620895335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682921413, "uuid": "9fab1798-6736-4525-8162-367296ed08f3", "value": "RFQ-MRF343951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0131577d-e7ef-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682924922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924922, "uuid": "bb3ac16c-3d23-4d89-83fa-26d2ea714125", "comment": "Malware payload (AgentTesla)", "value": "6b2dd72f6f26aa827a68f887b421fb64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924922, "uuid": "77ef5b14-1c0c-4924-b0fd-ac22fd0d5c3d", "comment": "Malware payload (AgentTesla)", "value": "d03aff28646cc98031c9cfc6369fb665cdbe4d8bb89e9d9c8df545848a74aeab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924922, "uuid": "bff15de5-d3ba-42d5-b498-672110d3bb43", "comment": "Malware payload (AgentTesla)", "value": "6420f5c9563bfb4c8f230feb5dd44a23290a0d05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682924922, "uuid": "98cdf0c1-9a1d-486a-b80b-6e8ad3c5f5db", "comment": "Malware payload (AgentTesla)", "value": "7dea52f91212333508b1fb9bd0fdb7047ad2e96cd89a5452dad72d350bf4ddf983b978092e61fd5323088589597c8d04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924922, "uuid": "b5da313f-aa97-4218-8542-cb12feea7759", "value": "T1C1451957B2A9CCE5F2E27A87A74FF23537F79AE4402C2D5564DD8626B2C840C48853E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924922, "uuid": "cb040738-ab87-4976-bd43-8d29272b8686", "value": "768:yYb3TXRT+t4W3gEbMXtuzaTMYHSNmhm4/O2ILuArgbfTMNMQ:x5TtG/OTM1NmQ4RILlDMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682924922, "uuid": "5a39d0c1-1444-42e9-b26b-329434e474d1", "value": 1238318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682924922, "uuid": "418264ec-b3ac-431c-86ae-09a5c7c0cfa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682924922, "uuid": "814a6ff4-0f32-4e30-aea2-5e34c66a79e1", "value": "INVOICE TX 3931 2023 LO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098931cd-e843-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682961013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961013, "uuid": "784a0d8a-0e53-43c9-845c-1237617d3140", "comment": "Malware payload", "value": "c0eed8d7cff4a9b56b014b87ef779937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961013, "uuid": "3f737daa-74ca-42fa-8c06-359199647306", "comment": "Malware payload", "value": "d2046e7907d430c57564fd882814a9786efe8b6fba8d5c0b5090068c3b66c7ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961013, "uuid": "c6f0b934-2c5b-4c37-8e5b-d04b5f11b467", "comment": "Malware payload", "value": "3e3e2c02bedaa92bac010de4e0358e01d6a38438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961013, "uuid": "398d2f02-cd3a-45b4-be38-0cb959fbde12", "comment": "Malware payload", "value": "5681eaee66ab57d3c9a35f0770ed38b571810a52fbb97678802c14c59fafb20cde57ab4207524437589316f563504775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961013, "uuid": "f604ee5e-b292-4084-a804-a7dde616b630", "value": "T1FF36233323561285D8DDCD3D8A3BBD9532F2533E8A41AC78A6EB79C638575F0E212943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961013, "uuid": "e438e76a-3fe1-43b7-97d4-6e86f80683d1", "value": "f02e2ed6dd0446a675987edb746d2999", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961013, "uuid": "0754a4c6-084f-4bf9-96a1-ca501f02b858", "value": "98304:kUpUQp1iu+I3+gu/aUCl2zjii+CDOpzRVddpyeQENSsLJdNlJPBl/U:Zguh3XKe+iiCVtR5NS0jL/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682961013, "uuid": "5d24f95d-d0b4-4ad0-a351-19b614531609", "value": 5191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682961013, "uuid": "f7c9e552-50ea-4298-be5a-cad1ed429945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961013, "uuid": "d1248bb7-5eda-4ed0-8d76-3d3fc6d08b23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34165c2-e819-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682943340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943340, "uuid": "f82200fb-70b2-4f62-98eb-fe116788670b", "comment": "Malware payload (AveMariaRAT)", "value": "245b1ca964c539e7abb589e21f72f38d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943340, "uuid": "c045aede-e1b7-4d63-906c-0da4232684a9", "comment": "Malware payload (AveMariaRAT)", "value": "d3f147a1471b7e1096f2f02fdd50380c9de21540d103420839384c9351655fc6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943340, "uuid": "c2262764-7cd6-45d0-bae3-4c1cba5e548f", "comment": "Malware payload (AveMariaRAT)", "value": "d258bacb58c7150f7c4d611a2754985ea94adfc6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682943340, "uuid": "d4069a0f-a658-45de-9b23-a597096fbf5d", "comment": "Malware payload (AveMariaRAT)", "value": "ba3e0dba2b59efa7b7e2e31772674b38baae472da406be37c368e50296401fc07b49a9b6183d847182300feff3d6c9bf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943340, "uuid": "27d29b23-546d-4916-a5c1-e5e2265d92e1", "value": "T107735C6137874601C95F957081E7812407F2B7CBD6B3C28E3684A39A4F537A28EDBB9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943340, "uuid": "93332265-6476-4a83-ba0b-69172f8ad8e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943340, "uuid": "9ebff552-1936-4e0a-a2e3-9b3b635671ca", "value": "1536:sP7zu7BtvwAUEdAz4J9Z9PWKdOhI6dyjry7TPxdF8o75F943hh:sD2vwAUPM9vPNOhFdyvyfxvXX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682943340, "uuid": "8cacd84b-732e-4a5c-8101-7247030e92c6", "value": 75336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682943340, "uuid": "c42e23f1-ef74-4e8b-bbce-97a151742ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682943340, "uuid": "2e113a8e-a6bf-43cb-8471-0b72328b9e49", "value": "P.O.#20(Ageless 15)for C-Max Canada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1a439f-e800-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1682932486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932486, "uuid": "8aab7a48-f2fe-4da6-8533-878803b1fc45", "comment": "Malware payload (QuasarRAT)", "value": "ec4951e9f2b1945815954fec161cf57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932486, "uuid": "4e892bc6-b173-4cd0-99dc-2257c5bdf68f", "comment": "Malware payload (QuasarRAT)", "value": "d969fc2e15743d6d44f477907368f2ebc96cefba20a232861fc7337bfa938d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932486, "uuid": "ad577361-cb12-4b7d-91aa-cdc25121b0c9", "comment": "Malware payload (QuasarRAT)", "value": "8e9e6857a0251a89b9c43b650344fb4f1648fa76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682932486, "uuid": "c20d0287-346c-4a58-9cf5-6221f14baca0", "comment": "Malware payload (QuasarRAT)", "value": "a408c95e4387dabe33d3e54af9fe598cf4b4e29cc5e120b7dce4ef04a3f38c81ad593c8782c8767e4e7203f08eee9c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932486, "uuid": "21ef361f-03bb-4521-bc2a-62d8c2312aec", "value": "T10DD56B1477F84E2BE16EE272D6B0501297F0F81AF3A3DB5B2491A6791C53B404E817BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932486, "uuid": "ab0acc78-aae4-47ee-90a8-fc9e07a09388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932486, "uuid": "9fb49a5b-46d7-447a-ace5-f898c301fbf9", "value": "49152:y/Cbs48/vm/XpRDVHFZuAzG5LfvUza32ehyfT36:y/Ob8/vm/XnDVHbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682932486, "uuid": "a0ffa63f-6d59-43ec-b5c1-5a8632ecc753", "value": 2899968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682932486, "uuid": "95c58186-63e4-4b5f-95b2-866943deedb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682932486, "uuid": "c60dc8f0-93ed-4739-809e-1d456f23339a", "value": "wf_4780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435e4c07-e829-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1682949943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949943, "uuid": "d8c415fb-0f02-4bab-8a63-52a0939d4af3", "comment": "Malware payload (BluStealer)", "value": "e90e41677f6030ffc3eac62929ced1d9", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949943, "uuid": "b24e3e3f-122a-4bdc-9b31-a547b43dc7d1", "comment": "Malware payload (BluStealer)", "value": "dafbb2a0e6111947e20d5916eae5c2a56937dec2c6c4e1843ce29ceefd22f205", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949943, "uuid": "8661bb42-cad6-46a8-b0be-545ac17d686f", "comment": "Malware payload (BluStealer)", "value": "edb0a2acdec33328a864ac178bfb0b42a2e0d444", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949943, "uuid": "3495de6a-0990-49c9-b14a-f047cc6fc6e7", "comment": "Malware payload (BluStealer)", "value": "c174d54d730cb60be1907be81fd1ebbfaeedd077e098d27634a46b3dea20ab4d4791ba12b1c7e74f3a7ec558595c7387", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949943, "uuid": "1b86166f-4182-4799-90c4-0f807db0e811", "value": "T190759D7C2578E96FC16AC5628AD4CC67F320916B3306CAE6AC9303594709B53B9C71BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949943, "uuid": "8fdd8868-4b03-4e2a-bbb4-4699d65d53d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949943, "uuid": "596021bd-bed4-44e3-baf2-45775f7ac0da", "value": "24576:KRKQxWUF61/J27K4mgZB67gTsD6RROjiDefziWX2GDjGBXtnZYx:K4QcUFO34mg367gTOwMMohjw9Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682949943, "uuid": "d62aa87e-60a3-45ab-abab-ac868b0426fa", "value": 1682432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682949943, "uuid": "7deadcb3-edd5-4d22-ba38-2242a91c0381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949943, "uuid": "03c74d92-da14-4519-b090-d4855761f6f8", "value": "Quote 1345 rev.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32879a52-e827-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682949056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949056, "uuid": "287dccc8-e510-468b-ae9b-1100c6eb7081", "comment": "Malware payload (AgentTesla)", "value": "53dbe9cfe79080637302bb098827ca31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949056, "uuid": "df6c6256-d998-4b75-b6b8-bc137c97a199", "comment": "Malware payload (AgentTesla)", "value": "dd344c32dd59a635e9ebfec3a33f2242178c82498769b995d7fb1c47a34882c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949056, "uuid": "a919d803-3c33-4d07-9384-61038dde52cb", "comment": "Malware payload (AgentTesla)", "value": "8d07e7a67afa17b3e4288c74921c724e5af6f3ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682949056, "uuid": "3547c406-ba19-4b9a-b043-d328b6734dff", "comment": "Malware payload (AgentTesla)", "value": "cecd53950f9b70d2e17494a413aec123ffe9b51eb54c50addb60bea435f17a18fa4231d17bb51139c7d2d1df41e671f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949056, "uuid": "0f2b6ca0-6163-4737-9826-850d77aedd3b", "value": "T124E4D0162019C98AFD1DCB34C474FBF466B5BDF3E4D491232B763C89F8BAB42190925A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949056, "uuid": "24bee49d-0de3-4bb2-96fb-34383e62841c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949056, "uuid": "98e7d279-9951-4b42-b565-435df2edb3f9", "value": "12288:AwZdXrj8HvgDKjFvWqGpj9rTwLDLT2zmYHpkXVygD7+btTDb1V1:r77j8Hv7ch9JnzmOpk5qlP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682949056, "uuid": "c6918f58-75e3-4d13-bde2-e62c0595c456", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682949056, "uuid": "e84e0f19-1817-48de-b1bb-f901fd8c4c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682949056, "uuid": "b45024ec-739b-4a7b-be6c-58d58c293dbc", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2c01ed-e846-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682962576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962576, "uuid": "9be67773-9ae2-47df-98fa-3e283ace9eeb", "comment": "Malware payload", "value": "c47f32f68a1ca3309768b48ec98cd752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962576, "uuid": "bae2b46b-9baa-4f54-96d1-85dc8c6519ca", "comment": "Malware payload", "value": "de3f27526eca92d8bab305d2942fbaf89d96b5fda6467dbf931b373868215b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962576, "uuid": "669f2382-2258-4164-b5bd-4995a0878cf7", "comment": "Malware payload", "value": "ab24f2d6a2cacd0b807b2a174e4c43e8d629b32e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962576, "uuid": "df986f49-c109-4527-b374-99da9794e812", "comment": "Malware payload", "value": "94b8e704235c308d90a37cbd012fe160a6b00afc54fdc6f40ba06d577e4ed602fa24eea2c291d80086d810b667462bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962576, "uuid": "a237e5d0-f172-4520-9800-006231737337", "value": "T19664F80382E13D54EA2A4B729F1FE6EC7A8DF2509F493779125A9A1F49B01B3D273710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962576, "uuid": "4a5c7218-f17f-4fe8-8f55-cd2c6fd9f5c1", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962576, "uuid": "5bd780ea-9e12-42bc-a5c7-46a8ade2e68a", "value": "3072:Muy7xHO5Ur+3sfGjmvp8hPdJidlfZl8ebAGMR5zODTKchd+OH:xy7xHvrmsejm6d2NZlDAGMHOKcv+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682962576, "uuid": "8055f30e-1379-408a-b45e-0b1eaba9684e", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682962576, "uuid": "3515526c-901e-4d88-a495-ea17f80bffa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962576, "uuid": "7b88237d-a87f-4997-a670-8edc2ecf4061", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9103d0b-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899433, "uuid": "f2e458b7-d4f5-4fe9-8dca-347ea847a512", "comment": "Malware payload (AgentTesla)", "value": "e3e7c03f9df09ff3ddc942592f419c2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899433, "uuid": "39faf1ba-1773-42ae-9178-061c0c9490fd", "comment": "Malware payload (AgentTesla)", "value": "e0974635f59997b5e616630b075c0441f539115f06a3bf00d6fff1d4c3ad052c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899433, "uuid": "66ef4c8c-613c-4842-94d8-b8e9bb35b23f", "comment": "Malware payload (AgentTesla)", "value": "763a5da664a7244f1843f98b2f726b0ca269aaff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899433, "uuid": "03fcacd8-0c2b-414c-a207-bdb70bb1d7b7", "comment": "Malware payload (AgentTesla)", "value": "bd42ad4ce69e58057451ad249f4002412c1f7640231eef9c1f981d39773a6f7686e0554fbe3e72d4f39c259ebb5890c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899433, "uuid": "7949d2e6-466d-421d-9801-9248811ca215", "value": "T123C4230BFE0D1B9E7F5494CB5F2B99415F6A20B0E33BAC160668D0BF828397C5129B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899433, "uuid": "3e3bffc5-3b95-4387-ace6-c81f27458302", "value": "12288:Ulw57sqL82+ra2pPo5RnG6fo5oxDYt9UZz1:b82+u2poLnz3xJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899433, "uuid": "9196e2e8-8b33-42ac-bd3b-a1ab8abeb8d9", "value": 553014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899433, "uuid": "fbb3a6e5-3778-4390-b5cd-01fc9f28c232", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899433, "uuid": "767e65a6-8877-40bb-831e-899b5a50ed8e", "value": "RFQ1123031240058.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccf1033-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899359, "uuid": "fe2f7e5b-e021-44da-8ae5-97e925a9bc17", "comment": "Malware payload (AgentTesla)", "value": "bbcb1e8bf512dbee9b0f8e74bcfb0071", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899359, "uuid": "7b756baf-87d6-4727-b84b-6b94ff134504", "comment": "Malware payload (AgentTesla)", "value": "e0c1bbc57223b39ffc2e9041b0f6b28f49ca1d0cb3ba9e3fde0baf9d1ae63492", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899359, "uuid": "60fd63eb-c7f4-46d1-9b3d-6581fe97f667", "comment": "Malware payload (AgentTesla)", "value": "f259aa9df83bd13c27ea6f9613ba7124dcaad5bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899359, "uuid": "c6714a03-5ff1-42a5-a6ab-eb0826f161e7", "comment": "Malware payload (AgentTesla)", "value": "6ae325af943ab5c588810096e158a090057295125bee312bccc3eccb2d81370fbe83b127a2b342b1f0016ae226b07bd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899359, "uuid": "dee8518d-9b9b-4dae-9c89-001d07781a4c", "value": "T1D9D42358580BBFC418C1909065E93D59E726D4BFCF56B2E24ADC8A83184BACF79277E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899359, "uuid": "adc6ef65-f102-4f15-90a7-607b7f7102f1", "value": "12288:ULeiraZjLzPKp2PCIvt2U41g3HzAKgD7uicV8V1MwBiNLhyKvZlz:vieZjPCpGTvt2UYg3HiD7/116LMKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899359, "uuid": "212c2118-809c-4336-a215-b37e01abe271", "value": 597377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899359, "uuid": "7010136c-a4c8-4ef4-a2e3-00cbeaec6f19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899359, "uuid": "b1060d5b-b4f3-42de-950a-4e2755a4f7d0", "value": "INQUIRY LIST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86b6eee-e821-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682946784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946784, "uuid": "9d420dee-b02e-4102-9a43-16764a076442", "comment": "Malware payload", "value": "78dd374adf183a61cabb893e42bad376", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946784, "uuid": "49f78344-9e53-4b4d-bddf-9ffeee639e58", "comment": "Malware payload", "value": "e197964f69329b2caf6098d89c2a858097dd43e60520bfdb303d6edab99e3da9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946784, "uuid": "cd3b5832-3868-4292-9750-bddc2539998a", "comment": "Malware payload", "value": "f2d9566407179e765238dc776e8cedd62f80649f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682946784, "uuid": "3f9c172f-3eea-441a-9725-412196a593eb", "comment": "Malware payload", "value": "c44aea6f42f677d0b2ae1c79a52ab338ae4beefaf995ff73a1c20bbfc56bdb92f7644a5af28312a976c2dcc2aad606cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946784, "uuid": "fd897eb0-d806-4a25-b8c0-180190881f94", "value": "T1FF41CDB27E1C6DB2281A022E2B15446973FB7617062ADE29F01FC5F9179EECD705D314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946784, "uuid": "471d01fc-d23f-4827-be18-a7bd730ba976", "value": "48:wytDi+oh+N68KsaMjNXEW1aWWevDyImV0tAacjzW5F4k:J2cN68CMjNXJakWhV0tkGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682946784, "uuid": "405adc1b-0358-4eee-90a1-7c895fae5113", "value": 2160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682946784, "uuid": "8dc2887d-4340-4d68-ab75-5c8daf6b2c1f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682946784, "uuid": "8cc46018-265a-42ea-be0c-2d043df47855", "value": "salut", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd332a45-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899467, "uuid": "8a95db51-f074-497b-9462-6cf201d3eebe", "comment": "Malware payload (Formbook)", "value": "7ce44891311265e472bf0242b58de825", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899467, "uuid": "4a9010d7-2a6f-4f58-8abf-d71caf36e10a", "comment": "Malware payload (Formbook)", "value": "e1dab40b0f439378b5785e970fb2e3b02fccf98015408ee934eb3fbf2f021892", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899467, "uuid": "0e284b41-bff6-4466-a2ee-bdadf73e1a32", "comment": "Malware payload (Formbook)", "value": "c82bfde33dc2e50af1bebea2289969b49b77a7d6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899467, "uuid": "93982093-3874-48b1-9570-b51249e75195", "comment": "Malware payload (Formbook)", "value": "3d0e429a163449b515b452ba1b968fadb385655accbd40582b536d778eb9e8066e4f3a4bb443c6f6e2ba66c5c8c36d75", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899467, "uuid": "ed26ee8f-4e11-4f72-9357-f2e44e0a3c0a", "value": "T1ADA4233AEF199E35A643E1B5EF5F535E490E11FD3C888E26ED2BA88145D8DC01434AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899467, "uuid": "ab7e64ad-ee81-4850-8d7d-e7f9d8053123", "value": "6144:5i6m5AW9nQWsYT312N/ltdmeey9YjPU+CraidGlFkgLrjZLWhzQEdVRyfgE1GuJs:A6mqpdYT312T+o9EnCuFkgLr4JJeISzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899467, "uuid": "963a7e2d-811b-4cff-b8a2-7b91764660a2", "value": 472474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899467, "uuid": "0d834711-50e9-4cda-b1a6-04e3e96cfe4e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899467, "uuid": "15938f63-9ab9-4bdc-82ee-91a1a6581e4b", "value": "scan copy-001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edbfdc1-e7e1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1682919173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919173, "uuid": "8567b2f8-cb6a-43af-90b3-5901fb54b870", "comment": "Malware payload (AsyncRAT)", "value": "fb299e0e8ae35692f1541b2912812184", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919173, "uuid": "b3330691-2cef-46d5-be45-48ca40d32f89", "comment": "Malware payload (AsyncRAT)", "value": "e2e4ce0315ef9f241c5d3ab09ccc9de3f8bd71f5388d8a4dd7fadd0a1110f266", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919173, "uuid": "5ff03e6d-2fb5-4239-9662-8195c8b72ca4", "comment": "Malware payload (AsyncRAT)", "value": "4ef1f2589e960b9645a8010920da2b1caacdd350", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682919173, "uuid": "44fb80d9-8684-45fc-adcc-4d019be01b87", "comment": "Malware payload (AsyncRAT)", "value": "b8721a7e646ce672d8eef713a393308824b31f90534971b1b8dad795dcc3dfd41f1f4d9734e19bf5a375f5b1d7d8b759", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919173, "uuid": "fc6924fd-8cac-4754-a630-596921da921e", "value": "T18834AEBCA4E785D4F54F988035FCBFA1017237E39AC90E64132966448BE9EE92F4458F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919173, "uuid": "feb898bf-2bad-41c0-9271-d5c3a6c5c361", "value": "1536:FeMD10HxuHY05UIy4rpmLoKZqcxU7SHzqQHw7rRim3ve0pAGFBQDVWQIypsc8bIX:gk0t0iInKWQIyjdZaRMXYxr315+3ApA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682919173, "uuid": "b6935435-c730-4a3d-999d-5239cfe17373", "value": 231996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682919173, "uuid": "3c2947b4-33ec-4be7-b31a-4527129a1800", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682919173, "uuid": "356d17e4-0b30-4170-80db-991c81aa8760", "value": "B.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5c75bc-e853-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682968164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968164, "uuid": "17895ca3-538f-4066-acef-29cf4877993a", "comment": "Malware payload", "value": "7510e251a9c982ab9b3ae391097d25cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968164, "uuid": "91e23aae-7fd3-4a38-a801-13e223511966", "comment": "Malware payload", "value": "e34d39424a53ba039a4feef2290dbfd28c1535d2df962f4591f827d79319ceec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968164, "uuid": "4aa54998-03d5-43e4-9fed-4810a592869e", "comment": "Malware payload", "value": "e7b6a9ac4b20f3597e525b6b759655ac87b4cb41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968164, "uuid": "1024c9fb-8f8c-4ed6-a167-80df69ac2c6f", "comment": "Malware payload", "value": "0eedd5771ed9856bbcaa23a3caee0dadf65b65c14fe511d0381d1756d4aed318914367e138793c85a7fd354931ae7579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968164, "uuid": "7be6923c-7284-42c4-baf1-60195df88ada", "value": "T13C652342BFFC4572D9B6173049F606830F327CF15B24E7AB22889E960C726D476357AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968164, "uuid": "bbaa15fe-55f3-4b37-980b-04cbd356b4b9", "value": "1efe015ade03f54dd6d9b2ccea28b970", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968164, "uuid": "ce4581b7-b102-4db8-9258-eb80010249a2", "value": "24576:qypDN6buZ1K4JnDBll1k8tIIejkUbPxAhGnLCOXaCvT9VZjVAIAy:xpDN6bYnndj1XtreoK540GOXaCRVRVAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682968164, "uuid": "8c331759-28f9-44b5-a22d-0ac4ee81f439", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682968164, "uuid": "602380e2-bf2f-489c-a0ab-b03148572b7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968164, "uuid": "161dac53-8780-41cc-93d7-7e3291f641ef", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a053378-e85e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682972825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972825, "uuid": "cc4df337-a61a-44f3-99ab-4929a475b1a4", "comment": "Malware payload", "value": "8bbf32a8697e7aebf53cfd02c852ee55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972825, "uuid": "eb72a208-22ab-4481-9ca4-c36f2718ab4d", "comment": "Malware payload", "value": "e35c24d485c43aad17d42ded594fc1d54d7a5058fea2ab3cd481e927bbfcc58f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972825, "uuid": "2d472b2c-b382-4bfa-9e38-d5fca15459ca", "comment": "Malware payload", "value": "763768045d13a5531506613593a122c32e0b0914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682972825, "uuid": "b8d787bc-8b47-4431-8fe9-ad3b05367e93", "comment": "Malware payload", "value": "1096c5ed1672906231c577975816b778d32440778c87750f42f5f0c0849040251db4d42cf80e19eb5f1e7c24116f562c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972825, "uuid": "ce372535-f152-416d-a750-3bdca6e3b7e6", "value": "T18F930913B75A82B1E05163B178B89B1B927BFD600B24A3D3F2D45F5E1DE12E25C3216A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972825, "uuid": "f4a47629-fab2-4c4c-bfe9-c72136df7966", "value": "f8d8884bda097a71d4c3d3bbb282f2ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972825, "uuid": "143a7d60-5900-4e7f-a37f-604740ecdd99", "value": "1536:tXXi8t7Kbj/lLXlomTblaE/cD+/0u2Aq+OYpyc4:tC8t8BpokxUD+X2Aq+OY0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682972825, "uuid": "2e0222ba-81ec-4fa4-9920-93ed6a797fd6", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682972825, "uuid": "703066e4-bebe-46a0-ad31-60f12a69b449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682972825, "uuid": "1b27b3a5-91b9-42fa-832f-e90bb1975203", "value": "SecuriteInfo.com.Trojan.Siggen19.37494.10486.18295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84853c2e-e836-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1682955636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955636, "uuid": "557c0fdf-81cb-4bf3-9e9f-233fe32b9237", "comment": "Malware payload (Tofsee)", "value": "531df55984e2b66ad9f0dbd639de601e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955636, "uuid": "34bfdc12-ecb1-44f6-a3cb-8c55e25969d2", "comment": "Malware payload (Tofsee)", "value": "e3ffa663eeaa0eeda2b5cb06d094cb847f6520df57385c5d7fe5e49d01c99c8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955636, "uuid": "36ac9bd0-a37f-4d5a-bca1-cefa40b1c8c7", "comment": "Malware payload (Tofsee)", "value": "dc9d0df60d45c19e668e99a39946d1d39a5d9a09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682955636, "uuid": "f995f014-3540-4328-903c-88853032dda7", "comment": "Malware payload (Tofsee)", "value": "464c8ee78f4c9ef8182e499dd38f562903772d3f2db7196d842d898436083fa667e486d2f7238dc76657b6ccb37343d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955636, "uuid": "874dbdea-62bc-433a-9fbe-e756a974dab5", "value": "T17364F82382E13D44E92A4B729F1FD6EC7A8EF2509F493779221A9E1F49B0177D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955636, "uuid": "c3330653-41e5-41be-b357-53ee9f06ab77", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955636, "uuid": "9656f200-5979-4883-9c78-711fb5d08aea", "value": "3072:MuFL7HO/Wc2L/rIUpqfM/FqdAt/XOM5TJDTnmhd+:xFL7HQ2LrI7fg2AtXJnmv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682955636, "uuid": "fc2f610d-8ada-4443-8606-58e858c1493e", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682955636, "uuid": "e8733fc6-13d0-44b5-a9b8-a06a234c53f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682955636, "uuid": "98bb62df-d41a-4184-b418-927960c0e2c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126a4bf2-e82e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682952009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952009, "uuid": "638d3c7c-c664-473c-9e2d-94eec256cae0", "comment": "Malware payload (SnakeKeylogger)", "value": "cf2cc7de7ba72dda126ef4b4c23f4a17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952009, "uuid": "2d7bd6cc-0b1c-44d8-84a0-90408400b34f", "comment": "Malware payload (SnakeKeylogger)", "value": "e5576bd4af80125cef4bbaf71b357486fde975fce56ff17c782644933d542828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952009, "uuid": "e1bf9342-3068-40d3-9803-a4e8769fbd36", "comment": "Malware payload (SnakeKeylogger)", "value": "91eb4410dc1d491ca24ade6e823327b01bf3d4d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682952009, "uuid": "2b349d00-b290-4b1d-92cd-8983da599f59", "comment": "Malware payload (SnakeKeylogger)", "value": "bc216dca71cb0b9bb434f9d57cd7d127e41b14da544cf3dade82fc74076c81ae356cf1c0aa8e004bc19164d3fa9f8833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952009, "uuid": "e3db7b32-f22a-4bf3-abf2-1d72d3a69248", "value": "T1F015177865BD162BC479D3F18FD5D423B2A0986F7021EE2968C367E64362B1224C772F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952009, "uuid": "dc32452e-b781-4112-a535-c643dbc15ab2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952009, "uuid": "f761e912-3fc3-44e2-b0a6-42ad7442fe75", "value": "6144:lsVpZCRorNdxRdMhnRnK0kkMM00nDvkGRvsQNeaJgqYklScMIMqsgq/lwpU3Y9cI:u7KdKrWDv9NobqY6Kl29nIBEAw155", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682952009, "uuid": "67d39616-47ac-4c63-ae55-713fc15a53da", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682952009, "uuid": "edf80c0f-c470-4a66-a128-2b63877f9ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682952009, "uuid": "e3f7c9f8-d185-458f-9367-e67a916713a9", "value": "Invoice No 2023-27-04 037 for prepayment of 100 MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7056a1af-e839-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Expiro)", "timestamp": 1682956891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956891, "uuid": "920238cc-6e66-4d5c-8c45-c98137036093", "comment": "Malware payload (Expiro)", "value": "c6b2e5855e812f01c47f3f3275269d40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956891, "uuid": "8bbc07a3-b3cc-4e02-b247-894020700634", "comment": "Malware payload (Expiro)", "value": "e69807c8d0056d2e128bf54e1412bea2abd2c89a4f28f8c4562e9fa0eb79c544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956891, "uuid": "0c34c588-f321-402d-afe6-2770356524d4", "comment": "Malware payload (Expiro)", "value": "19ca75ef1a3967c45065eb42d9eb4583692608b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682956891, "uuid": "04cd46a9-16f7-4f04-9fa5-4dc2d3ccba30", "comment": "Malware payload (Expiro)", "value": "016feea96e7fd126320fdd4d0d3ccbf96587f4851295a03cc71037996f05b2f49b9db05055605afb91abfa757f78a1bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956891, "uuid": "00a45bcd-a53d-4364-964b-9f025e695d16", "value": "T1407512071069C89AFC2D8738D064FFF466A5BCB3E8D5A52327797D4AFEB5B41090824E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956891, "uuid": "8e601ff6-3597-427d-bea1-cc090798d4dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956891, "uuid": "3b5cad4d-7d47-4214-bc9a-d91c3f85b6ee", "value": "24576:iTj8+Woo8grjY06vnHWk+1S2H/7/J++wLr8PJxgi/N6Vh9YLuolkkLe0XdoNQ+TS:iPp38Gn2kWS2HjsBLwxgYNfnLNNoqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682956891, "uuid": "f5368504-e951-468e-88d9-aba53582dfd7", "value": 1558016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682956891, "uuid": "2d97e8d8-fecc-43e9-9676-d02e431913a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682956891, "uuid": "e1e3622f-8404-4f98-8a4f-6ab13b629e0f", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef486f6-e851-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682967143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967143, "uuid": "e8525bd9-522b-4798-9edf-c6d7b1f36fb5", "comment": "Malware payload", "value": "6bb9d6378e45dffd78ec2894eb078f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967143, "uuid": "7df7c16a-99d2-4a86-b336-68459f8282d1", "comment": "Malware payload", "value": "e6ead3fe15a035a7dcc6a9f3c5d5399f021baf92002f6bf2361455961c4e5cfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967143, "uuid": "f6872744-3250-43e5-9be2-9a1559647728", "comment": "Malware payload", "value": "cc6f373d15eb252bec5377c618df1215f3d69bcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682967143, "uuid": "2e77a5c5-b8f6-424d-9f5c-241cbddd161c", "comment": "Malware payload", "value": "9651e9dbef4e69e53556e1e38d365a7c732fba064b9d8e1e863c818fbc031bde11c758271457596de8850ef3e94c5aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967143, "uuid": "7c5bc5f5-fe0c-4586-aa52-01c7ced66b13", "value": "T10E946C1393E13C44EA294B779F1FC6EC7A9EF2509E4A7779211A9E1F09B01B2D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967143, "uuid": "16db3bf9-3a52-45e6-a161-e34ffdbf876d", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967143, "uuid": "fbc3e615-95ad-48c9-85f6-0d96775fd3c5", "value": "6144:M5favQdtIF0KFp5iCQRYoTrtXGDCYSTtIb6vsGcOqYMmoG7j7hMNv+S:qfavQv4jp5idYSdGD/S5EZGiCb7jlHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682967143, "uuid": "be7410aa-995d-4556-bb25-24cc2148d35b", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682967143, "uuid": "f7703ec6-80c7-49ee-aed3-adcfe1f59bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682967143, "uuid": "622586fc-2e18-42ec-b35d-492e68db4f72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2729d5f-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899932, "uuid": "7401e7a3-53bb-4f8a-9bb4-4b45079e3cbe", "comment": "Malware payload (AgentTesla)", "value": "16e4efed3b0acae6d41ac2dc468fa120", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899932, "uuid": "f31a74d9-fdf6-4228-a282-8ad244fe2e5b", "comment": "Malware payload (AgentTesla)", "value": "e756df77e86e02e94de56aa2afc47e715d1c11d891c96fab09adddbb91c18d42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899932, "uuid": "f2d7a6b3-7c18-42d6-86f4-3e1c8f1f0681", "comment": "Malware payload (AgentTesla)", "value": "ceedf69c8eebd51c8f099fc14e94fecc068290ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899932, "uuid": "5ddd0908-3839-4f4a-97f5-c3bad9d127ea", "comment": "Malware payload (AgentTesla)", "value": "4215896f6b82147b7ca7729a45aaa0928cda8858a79f87bc4c92fe655a27040a5dd25812ca7d7fd38c582ef7b62ba962", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899932, "uuid": "0abda179-fa62-4b70-b32a-3794ec5f1764", "value": "T1C9E4153C19BE223BC179CBB58FE58527F01899AF3121AD75A4D78766470AE5234C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899932, "uuid": "ffa01270-c0c5-4cd5-9c7c-e93b0609bc99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899932, "uuid": "266e8041-9e9d-487c-b41f-eb6e3f4ea9d0", "value": "12288:e90iC2D6uDs+KDFm++ahPDPhPKOBCWAo37vW1Jrsem:eGiCUD4x+UDg0u1Jrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899932, "uuid": "9e3cf80b-5f20-4ce6-90bd-2117cfbcf0d5", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899932, "uuid": "ba577ef2-ad5c-40da-988c-6e3ed6f59e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899932, "uuid": "10a28e45-39b4-41eb-82e4-57519144dfb1", "value": "offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc210b1-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682899928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899928, "uuid": "b85c9faf-708a-4d6c-b905-5c517fd530de", "comment": "Malware payload (AgentTesla)", "value": "21fc1bcc9e3d1d79eee4225dde11aba2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899928, "uuid": "c0a047fc-7aef-4b3e-9eaf-82caee0dda19", "comment": "Malware payload (AgentTesla)", "value": "e7c6f81722bae92c26fabb376d47921bc60869ae7fd4d7ff43b2344a57b84061", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899928, "uuid": "1e7c19dd-c7bd-4520-a538-483defdd8bec", "comment": "Malware payload (AgentTesla)", "value": "684a810c2c8330a28d99354ec94624bbc08f1150", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899928, "uuid": "3cf19fba-0aa3-4b70-9573-88e01fab812f", "comment": "Malware payload (AgentTesla)", "value": "6a4afc40bb280bc0e5328f2eb83c37c99fdd31629ab07e71be303fa097a85759f23bc340a446c9a40c6db28d503f8aa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899928, "uuid": "df717e5d-62bd-46d7-92f6-0397e2a56496", "value": "T1EAB423B28B0417A9CF5583D1EE3BF4AD39C1C8263E027E9FA111B6D72B693893D42513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899928, "uuid": "784cd9a3-e853-43a2-9b43-bf4669f7c773", "value": "12288:nHtiialTANUx9+I2g3EwSCu+ZBzH1TDOYV0POH:nAiNEx9Du+ZBzH1+Y62H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899928, "uuid": "647014fc-5681-4389-9f63-a0ca960b2b63", "value": 524136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899928, "uuid": "d2828965-9c2e-46aa-8339-f8afa47cde77", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899928, "uuid": "e16238c2-af7a-4cce-ada8-b74e926b515d", "value": "offer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1715ade-e83d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682958799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958799, "uuid": "831c7b96-1daa-41de-885f-e0ef2d5140fb", "comment": "Malware payload (AgentTesla)", "value": "ab69d6548ccd94133e98d0969a8e50af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958799, "uuid": "fa9b6807-bf1c-479f-88c4-bf91bdf130e5", "comment": "Malware payload (AgentTesla)", "value": "e8494ad45492e71aa36941a772d0697db87bda82a91f16e69916ad9a4642042d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958799, "uuid": "14fdccdf-94b8-4a6d-9fdf-f673c4026d46", "comment": "Malware payload (AgentTesla)", "value": "2136d572b134905efd820fef2512c7da501072f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958799, "uuid": "8c0b27ac-4fdc-4c36-8466-64b127fa6b37", "comment": "Malware payload (AgentTesla)", "value": "b7c2dffc1d93c613f106b46077e8b96b0436adf9af07940e3fae190aa7a601d2b585f9d1bbfe0f212b8c85a28633009c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958799, "uuid": "c13b6cff-cc8e-414c-bf87-d02a6575825a", "value": "T10F15CF63F165CADFEE713B64C14DE7567E60D452E050F0A07E0A24C8DAA97E21F8C27A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958799, "uuid": "951705e6-98af-4686-a902-10e5ecf6b437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958799, "uuid": "e795fe0f-3728-4416-9e7e-e1dc76108111", "value": "24576:lqm7Kb/PVgWahxsKM5C1oKua6oJXs27t3xQ22:lqoKb/9gT2KYkJTXs27Bxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682958799, "uuid": "eb8e61ed-4b2b-4939-bad8-ff4fc223a3ed", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682958799, "uuid": "228a9470-bd08-4952-a76e-a2e2f557c9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958799, "uuid": "d9731ea4-ba99-4b88-8584-d4921549038f", "value": "RFQ-30042023-COLOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f98868b-e833-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682954286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954286, "uuid": "d65bc050-a35b-4108-a2fa-57471189d024", "comment": "Malware payload (Formbook)", "value": "d24b6d72e85c9b51bd5b39b9fe6d1ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954286, "uuid": "9ba5e3ad-886f-4615-89b2-f9bfe76ce8a4", "comment": "Malware payload (Formbook)", "value": "e9ac57e43f65115bb0e5780178dae36d3a625cf21a21d6b9272d7a067c9c52a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954286, "uuid": "5b858321-326a-41f2-a5b5-5e0f831525fb", "comment": "Malware payload (Formbook)", "value": "b2c1c8c1988924942a231cf30dfc5222b031090e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954286, "uuid": "f6e2572f-6a7a-4715-a620-84d73cd1f7c6", "comment": "Malware payload (Formbook)", "value": "6b22a7173b68f4f12b95c567b04bf8fccd7bce5976344c6a1021f96b1e002053834f793fa23cdc1ad9aa6b50738212f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954286, "uuid": "aaed9d83-feca-42a9-93bb-121041d204c7", "value": "T151F46C382E7A5623E9B5CF3587CD4133B2A79C177011FD86E9E213A106827C769D326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954286, "uuid": "ea7021b9-89b1-4d99-a6c4-4bdc53faf637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954286, "uuid": "8eba11c3-a4ab-44c5-b4f1-2dc6b802c014", "value": "12288:iQu6zWFuIRiPLFuJVygB1VrQ6GSItioHVnwlb1:iSIuIwZwAgrVr6NHFwlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682954286, "uuid": "6b9a75a1-3d3f-47a1-a446-28dd80ef08a9", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682954286, "uuid": "2f0e8c75-27c3-4faa-9910-08142dd9da9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954286, "uuid": "8d505a75-ad70-44e5-8a9a-884e598656ef", "value": "comutation order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30de4d1-e7ea-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682923046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923046, "uuid": "e0ed79e3-eb37-49f1-9345-760848ee2f96", "comment": "Malware payload (AgentTesla)", "value": "f5677beb75959076b5b7f4ecc9e7e785", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923046, "uuid": "dd16676d-b9fd-40d0-8b25-ec5ac8c7e07c", "comment": "Malware payload (AgentTesla)", "value": "ea986562523471cc591f2ff6a1594649f25d3fd2680333e7b7f7858fb7179b57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923046, "uuid": "6ad4a9f5-4ccb-4896-9a2d-5ab4e0c50626", "comment": "Malware payload (AgentTesla)", "value": "82061b100278819837cc34898a68704243f4acb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682923046, "uuid": "a5d72580-5076-4a42-9bb8-24d046223b59", "comment": "Malware payload (AgentTesla)", "value": "477fbcf53263313146cfab64cf9406eb2fd8cdd6b016e08bd66b73707f3fbfa0f3501c2b83688384be62d1bdb21a431c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923046, "uuid": "e6ebc8bc-a430-47ff-9414-bd6e54ae6274", "value": "T101B423352849352A7DEE299E3F7382C4608E3AF46AB5C2A41A7480570FB9FD07D95C61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923046, "uuid": "d0c207f7-040b-4207-b7df-48501e7e8861", "value": "12288:pb1Mfgye07QkTZZp/PC0R/7CJ3ZwP7fd3xTOD2slaBd+Y:VnyemNlR/7CJItx8rg3+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682923046, "uuid": "93130c53-cc4b-4531-804a-16fe924e6e70", "value": 519436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682923046, "uuid": "a179e93d-6f10-412c-b8da-77a2184326b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682923046, "uuid": "7a8727c0-59dc-40c8-9732-37d26f39d01e", "value": "SHIPPING DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efebf08c-e845-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1682962259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962259, "uuid": "583469ee-34d8-4b33-863a-d6999bda15f5", "comment": "Malware payload (RedLineStealer)", "value": "bbe08193d9415b65edea54b16ac83763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962259, "uuid": "21fd87ff-5011-4cc5-8230-9ed85dbd6f9e", "comment": "Malware payload (RedLineStealer)", "value": "ead2e799f976faa91942ed907d0033d969149196a8a52386677d6b9670151f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962259, "uuid": "abe57637-847f-488d-9f48-29a46287e6ae", "comment": "Malware payload (RedLineStealer)", "value": "1d11105124050dabf7645bbdf745f52e4bc501b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962259, "uuid": "170289c2-2bae-4e19-be3e-049c45cc291a", "comment": "Malware payload (RedLineStealer)", "value": "cbc32c0eaa8c7e7966fcf2124a923f8c2068af5494f0cf93880f41382e50a08eeb8dfa2c351837f00d7e219022b9c369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962259, "uuid": "3110d0d8-b0c6-4faf-8dab-aba0377cec4c", "value": "T1E6945C0382E13D44EAA94B729F1FC6FC7A8EF2509E493B79125B9A5F49B0173D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962259, "uuid": "3dbb4c62-1f04-4a88-b79d-acc418c2098e", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962259, "uuid": "eff69dd3-4a6e-4dcf-9ad0-acaa9630887b", "value": "6144:9QaSvlVZ9tNYrEQGSxoRv/TWUSLjKeTNvsNvHLe7/oxENnAlv+y:KaSvl39tmWeoRv/TNVeexSmunA8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682962259, "uuid": "341c048e-5c67-40bd-a098-e3215b2b97f3", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682962259, "uuid": "90a13ab3-c32e-4e02-a109-d3fc0dd2e0e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962259, "uuid": "6e398d84-3656-4437-b678-75a2db3c2d17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a8173a-e816-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682941805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "b9beb637-15c7-438d-af38-83cde922f3f3", "comment": "Malware payload (Mirai)", "value": "670e074cb679fb1e597d1899ed452bf6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "900aa2dd-c5b6-4139-8e74-b3488295fb2c", "comment": "Malware payload (Mirai)", "value": "ef6d5693b7fe6549fdfaf2e4dd4b29668ffad69cb7cb6e195521bfb48d6deb9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "9e2491a1-51e0-4a58-8c4f-c59b3a3a506f", "comment": "Malware payload (Mirai)", "value": "70aabf5ddacd2c0d140caf0fb11126d47d6c1f08", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941805, "uuid": "8046bfb0-9677-4faa-8c38-146b57190d80", "comment": "Malware payload (Mirai)", "value": "320d752539d8168851ff55f859b273ee6816b4484ea04c3dfa6b99c80538efa6bf12226ba929b6086e7adad5a981139a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941805, "uuid": "b4b99bbd-7b11-4450-8a03-c64d29306b83", "value": "T14FB2D03C1B111E68DE1AC1BE839D0B503CB81F259142AD9B6206FDD7AF568747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941805, "uuid": "9da08b7b-e7aa-401b-9919-09d0b85c286f", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiOmdtJgGlzDpH7uNj1JA4P:YeD8ZSWvZHZbs1row697qohQvg9OitJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941805, "uuid": "dff3e10b-2608-4d2e-b6a8-5e2fcdad99c0", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941805, "uuid": "80359480-adbc-4599-968b-b12d4ee9d498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941805, "uuid": "7ac59bc6-9b57-4233-a70c-d197def49d48", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7bf0ac-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931813, "uuid": "a23a5843-ff30-438b-80d9-5370a90f093d", "comment": "Malware payload (Mirai)", "value": "d1beb070363a36c50e73dff2aa10e184", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931813, "uuid": "cbcb8ca6-dbf2-41bf-abc2-ee2db57a3661", "comment": "Malware payload (Mirai)", "value": "f1974dec8c83c8134e843c614170af4b2c2f58bb17c13098a2fa201df254634d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931813, "uuid": "cd84e20b-e796-4ea2-a772-aab6402116ac", "comment": "Malware payload (Mirai)", "value": "acc5116bee129e9203e88747eaace545bf22c644", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931813, "uuid": "83759ae3-f1c9-4bd4-82a0-3119e3083e05", "comment": "Malware payload (Mirai)", "value": "da8980b55509c3dec1876c176fc864407becfbc912bccf3955e5b0f4768fbfce5cf216a119d91dde3d18b26d8c8293a2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931813, "uuid": "086f6028-cede-460f-a877-8dffac300669", "value": "T13F533A07BD4489EDC149D138477BB63AC52631BD123CB2DB6BE4FE275C46EB11A2C889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931813, "uuid": "c905ffde-0537-4aeb-b698-ed599706352e", "value": "1536:ESEKY4Jzjw+Qld5UIqZEZtY+fq+jdHxp5Re0Hcl2L:m+s+Qj5UIqZEZtjfqSRp5Rexl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931813, "uuid": "26dd49ea-905f-43b6-a24a-96fb00862c3a", "value": 62304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931813, "uuid": "01260640-aea2-45c0-9d40-07abcc5a7d1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931813, "uuid": "183425f0-04a4-4473-a306-28483e1d339d", "value": "d1beb070363a36c50e73dff2aa10e184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a975d7-e83c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1682958324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958324, "uuid": "2ca16275-2b33-4133-a881-0a4a856a1b06", "comment": "Malware payload (Loki)", "value": "0bf55bf44d608512998e8c23252981ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958324, "uuid": "5c33fb36-e65b-467c-8cbb-782f320f29c1", "comment": "Malware payload (Loki)", "value": "f44c5fb71ef93673693994a3831a687175a0f6b232d0811631df162f70043133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958324, "uuid": "de447ad4-4e6c-4b51-a15e-abab8fc6bc89", "comment": "Malware payload (Loki)", "value": "e59a5c077916c1e8b12f93368689e03aa70f11c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682958324, "uuid": "e985b5c0-8187-4da9-9707-06cb09f1fc14", "comment": "Malware payload (Loki)", "value": "2cb3a8808120eaf62ddc0662a47687c8cc7802cc79a83d135f007d1e61f26905616e630c81e62c9c6d1d61fed6e93c1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958324, "uuid": "56d71dc8-9faf-4140-9b54-738f302d820a", "value": "T17CA32942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958324, "uuid": "ef5ca952-201e-4fef-87c7-0f80d05dfb10", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958324, "uuid": "1f69692e-9283-4a22-988b-22b04df5f2d4", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqsIzmd:nSHIG6mQwGmfOQd8YhY0/EBUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682958324, "uuid": "5c11e476-115b-4d2b-a675-5a4f9eb751b2", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682958324, "uuid": "3ca19c91-9a43-4d53-98f3-f6ac6d00ebee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682958324, "uuid": "61ed8d6a-bea5-41e7-aad9-d5d81fab678b", "value": "0bf55bf44d608512998e8c23252981ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad81b09-e7b5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1682900054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900054, "uuid": "cb676f64-ab8d-4e44-b1d9-79317541786c", "comment": "Malware payload (SnakeKeylogger)", "value": "5dd477a6d176d37b52fa1cf46a23101f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900054, "uuid": "e487d313-1093-4d94-93fd-899f7a5f20a7", "comment": "Malware payload (SnakeKeylogger)", "value": "f5493bafc1c13d08a80e4119bb3f938c67bfa002ac2b4339c6cf17315a3d96e6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900054, "uuid": "2af2d1fc-31fc-404c-af66-53198f8bf2ba", "comment": "Malware payload (SnakeKeylogger)", "value": "744db965bf7783bf1551d4cabdbf0c12a1bb31aa", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682900054, "uuid": "c07cbab2-8331-45f7-bf72-3ffb2b4d91dd", "comment": "Malware payload (SnakeKeylogger)", "value": "3975b9035fefdb8f8d96a30c6d20a51b3c8170d2e6c2e4dc88cd8d83420fe57f3400207a39f13d0d76c47037abd16291", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900054, "uuid": "007b9b3d-397f-4ad9-879d-866ea935a76a", "value": "T1786533EED42C71972D249D99D0D81A9321B3685A4FC04B43A62EDE834AB72F93FC547C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900054, "uuid": "312df911-5acc-4eca-94e2-c884e2b8f181", "value": "24576:lcL7lx/bdvF3e9RHXdS0Ka7wtl3pUrCn/DQwg7LnZiQ3o1eq4kcdxBcAi+Jno+tS:+L7l/Re9FdS0r8tLYCncwg/ZH3o1idHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682900054, "uuid": "49bb376b-4957-4271-8cf1-afc6fe1d6822", "value": 1510852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682900054, "uuid": "0abb50d3-0521-4cee-b10a-260197f96aa5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682900054, "uuid": "d570d4f0-e47a-4e7d-9034-b541d695ee52", "value": "\u2116444539.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db89f0d7-e80c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682937743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937743, "uuid": "a242fe29-1fa7-4ca5-996f-738b3105437f", "comment": "Malware payload (Mirai)", "value": "dba73bd62a52cd462634db133f93bf70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937743, "uuid": "435b6281-8719-4aaf-b7fd-0a8fb9aafc45", "comment": "Malware payload (Mirai)", "value": "f60b6ea5ff60bee9971366a7bfa4c6d062499a68fb3d5dc8b80e82084754b9db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937743, "uuid": "a55fce74-51a2-4e6e-9303-05d120a21c33", "comment": "Malware payload (Mirai)", "value": "643bd61c885dd51c2e73f81e930addda05d4332d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682937743, "uuid": "830c90d9-dcbd-4cc7-a888-a004b2e4ac69", "comment": "Malware payload (Mirai)", "value": "9bb181524a00d997be5ad6b209ab9385dfcdd8da4687b2d0658da2d73b9f5ab8a93d96b296484c3f3f140ab9c019df40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937743, "uuid": "21cec572-ec97-410b-8651-243f7c11fd3f", "value": "T1C4539DA5C4B8BD99CF69927CB61488389723900564A33DFAE742C796D00BEECF14D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937743, "uuid": "d6a4c501-813a-48c1-9c13-6bde60422888", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC1x2:BjiBGhGp+XZxtf+d21UYjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682937743, "uuid": "adbfba8d-9821-4e94-9497-5187c69e190d", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682937743, "uuid": "067897c7-2e09-4a4a-b3ab-3f1eef73c4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682937743, "uuid": "6916e11d-015a-457a-a219-40c6982d131d", "value": "dba73bd62a52cd462634db133f93bf70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4091fc-e808-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682935946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935946, "uuid": "0e772078-560e-4d7f-8d95-044871eaa75e", "comment": "Malware payload", "value": "17d1a593f7481f4a8cf29fb322d6f472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935946, "uuid": "baa02e56-beae-44a5-a900-48ca95a02ce1", "comment": "Malware payload", "value": "f837127a9ca8fb7baed06ec5a6408484cb129e4e33fa4dc6321097240924078c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935946, "uuid": "81b101c0-d7e4-48b3-aa86-d62cdfce3bee", "comment": "Malware payload", "value": "a24d8e44650268f53ca57451fe564c92c0f2af35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682935946, "uuid": "a688a734-a846-4f73-97d3-8096c1d079c7", "comment": "Malware payload", "value": "a48ae5fecde4b88efebcd2efd5680aafb7fe2c93ba0a55a698a36c5b54d2d1e8462ede6a1311aeab636edd6f52081260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935946, "uuid": "ea4cc15c-0b7f-4791-b111-3e39b179c6fc", "value": "T16B937E1B7B1901E8E06BC1BCC5565989E3B1792A0B218BCF07A1271A5FB76E41D3F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935946, "uuid": "2d193ffb-1b7e-4c0a-89fb-694ae31b6763", "value": "73ccd2c38b5b17199727b5460e62bff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935946, "uuid": "9f2aa0e8-42a7-4169-b4e1-f289733310b5", "value": "1536:n6Gn6mt5kcc0qtJHRBK3xLuzsClqzjf2wr14pUK3HErFr:n6G6S5kc4pXsCEqwhEUKUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682935946, "uuid": "e90358ce-c681-4caa-9567-329c770cda23", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682935946, "uuid": "def3aa24-b820-46ca-81bb-6012d99aa551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682935946, "uuid": "de0410f3-4d99-4c63-a8b8-ae8ad7887ee7", "value": "CL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acb4136-e7b3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899248, "uuid": "532d24f5-2fa8-4b19-9b60-a6c88bed60b4", "comment": "Malware payload (Formbook)", "value": "55ce2f9966cbe4f997c6a09dd4727fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899248, "uuid": "94b12a5a-4107-4886-b4b4-a237bf3cb04e", "comment": "Malware payload (Formbook)", "value": "f874095f50064aa4f4405f045c8ca3640812609167138cd7137816cb8f774994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899248, "uuid": "fc11d34f-7b2d-4dd1-80ca-1b9072d3ca6b", "comment": "Malware payload (Formbook)", "value": "0d936045cbd1abf3ef03a06d2bb399dd987db78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899248, "uuid": "7ad24cac-a230-4eb9-b674-2a8841ae92c0", "comment": "Malware payload (Formbook)", "value": "782a0c6ff000a09c2595380a0b8e70d7f3ea13ceb36f420dfab8e42bd73900706c78857a8f6f0e142a1fb32a43a90e25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899248, "uuid": "6f7d5792-a074-45e1-9950-335b856fbad6", "value": "T1EFD48C3D19BD5637C17AC3B98BE49823F1509C6F7121EEA968C333A64753A4275C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899248, "uuid": "d55ed195-4806-490f-a8dd-c4c65ff4889a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899248, "uuid": "f681448d-ab94-4d78-8d6e-ecde89ec689c", "value": "12288:8R6RreKqnAo2tPiGUgG2rKhecEtz7fjHqLlNhHqVnM:5rqnuCeP7zqD5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899248, "uuid": "28ab4eea-e54c-47ec-8825-745d0465b435", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899248, "uuid": "1c92a8b7-6715-4212-a92f-43e884204ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899248, "uuid": "1fc15fb3-bca1-4543-aee1-d014c2b58269", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ec1ef7-e815-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682941254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941254, "uuid": "8b3a820b-78f2-46d4-905f-5795e7ea70e5", "comment": "Malware payload", "value": "2124d0fcdd4f99d4cafec7f9b430c444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941254, "uuid": "d0e24f86-0326-41d1-b8c2-278ceaacf706", "comment": "Malware payload", "value": "f8b9790f285aeba13331b39b7428227257ca622b0838e154788ddf4de66facf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941254, "uuid": "9d411ab0-27e0-486e-875f-ff4514cca96a", "comment": "Malware payload", "value": "11172fcea79651d62be51ef99575103d68df6abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941254, "uuid": "618f7b37-406e-4fb8-a4cf-e09b53488682", "comment": "Malware payload", "value": "9ba5d72a6c3beeb44467aa0f0bb7737808749f952f946ed71365870049a634097dcdb663916f74d9747ebb29bb49d2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941254, "uuid": "a0d595d8-ba38-4814-9cbf-2540811f6111", "value": "T10F234B067AF1C431E4A3037019B897614FBFBD629B74859B3B8C065EAEB13D05A2D397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941254, "uuid": "1682b19c-c445-4624-9e9e-f90ab7404752", "value": "6d021e52eeb61a6487fb6416f613348d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941254, "uuid": "ecb3860a-862b-4a1e-b9f3-c33c1b7a43a7", "value": "768:/tHml5Cm3HGjcJp9TLcj6bYgbEaNK9W4nNxxmVs/s:/tW5CaPRTLcD1+y/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941254, "uuid": "a13ae40a-c508-47e5-84a8-c5c4aea30441", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941254, "uuid": "bf86b7f6-dd5f-4e70-9572-c13c572d827d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941254, "uuid": "d538012c-655e-4a8e-b81f-933467d154a0", "value": "SecuriteInfo.com.Win32.AdwareX-gen.12524.28552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1149e6-e7ff-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682931844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931844, "uuid": "7848c93e-650e-4955-9dc6-b8ddf5f149ca", "comment": "Malware payload (Mirai)", "value": "269754c6fcc276781604b476cf5875c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931844, "uuid": "81a749e4-de4b-4063-bb9a-65f467d189b0", "comment": "Malware payload (Mirai)", "value": "f8c9d1ede931d0f5fb1e677bb8c6fb920f74d75c1794853247d03d1fb4cbd216", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931844, "uuid": "f3cefb3a-2a16-43d3-8adc-597650fdfa19", "comment": "Malware payload (Mirai)", "value": "b227da2bb20de806fd7819c64c5ce4dee455b22e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682931844, "uuid": "5d2b99b2-c924-40ac-9668-91aa717c6e76", "comment": "Malware payload (Mirai)", "value": "55649810ea3f099c36e140984d270c982bf032c267e1085103a85eac1bdfe23c92b856b951ca709bdb05aa44df7607aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931844, "uuid": "c557654d-e0de-45a7-817a-5c88fd0ce212", "value": "T1D3530985F88B81FACA4B4D3051B7F23FCB31E97981B0976DDF49AF35DA279019212189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931844, "uuid": "59bad361-e9b4-4de9-86e3-b0c0ced1ee6f", "value": "1536:T562r5PIV8g4IVSFRhkiyzxyKu9a9YDlhW7EvOuY:tvFzgLVSFDk5zx5Il0wvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682931844, "uuid": "d40c1d66-fc24-4c7c-8911-23072c0bf138", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682931844, "uuid": "694e4141-680b-494b-bd56-4ef678a31d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682931844, "uuid": "08497889-2968-45aa-bcc8-b72a33213e0f", "value": "269754c6fcc276781604b476cf5875c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b79615-e854-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1682968438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968438, "uuid": "e8c4fa09-6726-4762-a5ed-0b271561ed58", "comment": "Malware payload", "value": "c1e85ebd6ead5cb9462f68e9ce5a7fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968438, "uuid": "eebfc8ad-e637-4cf9-b706-4a725c11fded", "comment": "Malware payload", "value": "fc4651c998c4e2c7c6098b028f3fbe74644a35a08aa47f5ae324f494720e422c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968438, "uuid": "38b9d81e-3766-4f97-990c-784cb99e0fd4", "comment": "Malware payload", "value": "780d30c420d31352126e6b542e5d9efa82ce75be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682968438, "uuid": "d10f7be1-6a4e-4fc9-b4fb-16bac3578e0f", "comment": "Malware payload", "value": "b28f2f98c33ead281fc25d206aef8f5205f5d6ff56317dcac9a0af294f5e90779ac75a9bef41b609007eaba71014e822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968438, "uuid": "62bc0736-5e01-44fc-b99d-a2695d3fd1a1", "value": "T1E9945B5382E13D40EA2A8F729F1FC7EC7A8DF2509E4937B5121E9A1F49B41B2D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968438, "uuid": "5293667f-287e-4513-8399-f24dd2e14346", "value": "203b54dd7cb5052a152152d37aa392da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968438, "uuid": "d65b8681-84ee-48e7-a159-42bf83bec419", "value": "6144:aAPJlFPf28DyiyIsEIVqXJxk2nZdribwTpuhS2U42v+S:TPJlRDyiyI6Vq5K2nZdripIF+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682968438, "uuid": "d78cedd3-6c70-44bd-96c1-f5d437a179f9", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682968438, "uuid": "0455b440-c865-4d30-ab95-b9989fdfd753", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682968438, "uuid": "247b7c87-aeb3-4433-bb56-fd72f4d76e06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d985688-e7fa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Renamer)", "timestamp": 1682929855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929855, "uuid": "703ad5e1-9b5f-48f4-a5bb-2b16be25a2c8", "comment": "Malware payload (Renamer)", "value": "9113f123c4354e9b920c200b6ee07265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929855, "uuid": "1e9a16b2-e724-4846-99ea-892b57b79099", "comment": "Malware payload (Renamer)", "value": "fd2e99f2af157341dfeab0284d36838750845d15231227d556404e41f1cbccc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929855, "uuid": "9a9eb764-2730-4e52-bf18-0be4e5ac560d", "comment": "Malware payload (Renamer)", "value": "8205b5361cf4908f6fea7d3209f9d9b953d5a0cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682929855, "uuid": "7790ce33-bbc3-43b3-8e0d-29cd8afcf213", "comment": "Malware payload (Renamer)", "value": "51313ccadee001674fef21d2922392aaf3ec4339915e37a89990ad6e2ee1b4c0d0fe6293f97cb05fe831d346e7f291b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929855, "uuid": "cbbdb0af-b5f3-4fc8-bab0-fe99339e7943", "value": "T1DA75010BDDEB1167FC552B71D02649B310FBF9F60E464722F6E1E60D2A30FA165384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929855, "uuid": "d493491a-a9a8-47f3-a970-bcc34055a89c", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929855, "uuid": "b64d0419-3f2e-4180-9123-573c46ebc5dd", "value": "24576:lcCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQIA:WCpn8t74iA3qb6W8cU4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682929855, "uuid": "205607b1-98f6-4748-8f87-c758d75e73fd", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682929855, "uuid": "a57f5c08-3889-4d18-9687-cca0d20e7ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682929855, "uuid": "755ea80e-248c-45d0-a060-616f86818c11", "value": "New Order PO#5509126990,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce5c7ce-e834-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1682954711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954711, "uuid": "f836a765-ee3a-48fa-ba62-64505dfd037d", "comment": "Malware payload (TeamBot)", "value": "dd51000228ae5517c9ffe803f297a886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954711, "uuid": "eb58fcb7-aac6-4fb0-b3c5-392e1804b8e0", "comment": "Malware payload (TeamBot)", "value": "fda58ff7e7889c557c06b4a2cace1f675cf3f1a067fba37678fcf7066f467031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954711, "uuid": "d36d3c1a-c918-446d-ac02-425719687ea5", "comment": "Malware payload (TeamBot)", "value": "a199f303f0b7cc164a64a8ef4261d4166596e2c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682954711, "uuid": "0e1cc0f3-75b7-496b-8dc6-93710f7aae70", "comment": "Malware payload (TeamBot)", "value": "55fc163ec10790d3d99d6c0d81cbad82ed705ec5cdd2260778b4151eda5933e8ff33e0eecf24d5ee2055c15af0610cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954711, "uuid": "a1914912-f527-452a-adaf-4b783df0e319", "value": "T18C64094383E13C44EA2A4B729F2FC6EC3A8DF2509E493779521A9A1F49B01B7D173725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954711, "uuid": "00db1fa4-b025-4437-88d3-28b63b3adcfb", "value": "8e752cbc2a7c73137ae3765e2dd6f418", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954711, "uuid": "e429a674-c210-40c6-a7e5-1c3c873407cc", "value": "3072:MWEEaWnscap/u7mBJ+EKrW32F6WpVs1nSkb+m5bEDTsNhV+:ZEEXnsJPJjK22EWpVsbbfEsNH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682954711, "uuid": "95633fee-8468-4090-870f-9a2057681736", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682954711, "uuid": "a37aa064-5b3a-4c83-938b-981175cb328b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682954711, "uuid": "78105eb0-f253-46cc-87b4-7308dd8f34a3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc99b412-e7f7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1682928779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928779, "uuid": "cf936c7d-ce35-4ae3-a08f-2ebe22edf356", "comment": "Malware payload (Mirai)", "value": "473c79a9f0bbd1ce9c3e098b6f1dc8be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928779, "uuid": "41d4c371-a229-4249-bacc-855e726462df", "comment": "Malware payload (Mirai)", "value": "fdacf2f5901a2d1383b6609e34d6418e2fc318ff9e48b001f7d5abd804dc4f5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928779, "uuid": "8c1b4bcb-7b09-46d0-b4a6-5164b6a20061", "comment": "Malware payload (Mirai)", "value": "df57566bb1ca8accaa61be150911aa415ba6e428", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682928779, "uuid": "8b341aab-f121-49cb-9fd1-8172675f9e8b", "comment": "Malware payload (Mirai)", "value": "d6e9651bb6e9ffa8dc19c74800e800c5c176e602b6c8364a66df942c5316a39449373990bc6652b2c11cd4902e87b143", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928779, "uuid": "9a8e759c-0d5a-47d7-bb9a-4f538f181e7c", "value": "T1FB3319DAB401AD3CF84FEBBE9016490AF6212750509327276777FDD36C322A49E26D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928779, "uuid": "969c222e-b476-4784-8e08-d382d6ed6b0b", "value": "768:mIeh5iNsouV+//cHOiGiKhKUwT5u1We7TpwELJTuKiSFu8X8:lw5i+oD//cvGiNTT41pJwELJJiSs8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682928779, "uuid": "cf6f010f-c9ed-47e8-9581-89e3f3e528a4", "value": 50268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682928779, "uuid": "3b9e1e68-8e49-4129-a2bd-915ca6b5b628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682928779, "uuid": "465352b6-500c-417f-88d9-7848d0858400", "value": "473c79a9f0bbd1ce9c3e098b6f1dc8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c11534-e7e4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1682920520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920520, "uuid": "d1f9a698-3b24-4ea0-8565-5a8e6b4524d5", "comment": "Malware payload (AveMariaRAT)", "value": "307653d2f148e098fcc9b3f9ae18ff25", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920520, "uuid": "59082e1c-380c-4e64-8de9-8deae90ca277", "comment": "Malware payload (AveMariaRAT)", "value": "fdafe32c0a60e82305426118d16b5181852cb37f95b9bc1a15f1797357f7548b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920520, "uuid": "7717943b-5a62-4a77-9459-46eac6c59931", "comment": "Malware payload (AveMariaRAT)", "value": "8cf6aef79565e0c1f36386de3ad2f1e20f6d7441", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682920520, "uuid": "81120ffd-bcdc-4331-aa59-d87157f555fc", "comment": "Malware payload (AveMariaRAT)", "value": "6fb594ff9d7df862780ca0cb7cef78eba0a0bb2ef92a89e68fb0811924581b405bfd14b71e376c839ed090776b6b5bb0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920520, "uuid": "14b88652-a824-4b17-a532-bb9ca11c004e", "value": "T1CDF49FA2F12DFECBDD313BB0D1B9A7453921D827E051B4603A053088DA757D33EA996B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920520, "uuid": "be19efed-8e53-452b-a3b9-7afbff25f71f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920520, "uuid": "2cafdc23-78f3-4f89-870a-5e12def72ac4", "value": "12288:MPap0CJgDBkrMsCr3DS/16zsIYPYhJfjeLcPES:ACJgDBkrMsCr3u/16zLYwzfjacP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682920520, "uuid": "a80623c3-fb62-499b-bcf6-b0174df3595a", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682920520, "uuid": "d89bee9f-dda6-4c4b-9825-ef1ed931c6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682920520, "uuid": "01599dca-e01e-450d-bf32-d732de344be6", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5019c26d-e847-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682962850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962850, "uuid": "b82011d8-9703-4a0b-b6fe-ea8791cf7311", "comment": "Malware payload (AgentTesla)", "value": "0947b656672a35b8d84c18e09f86c641", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962850, "uuid": "b0c80b45-08fb-45b1-b395-68d9ec3f2539", "comment": "Malware payload (AgentTesla)", "value": "fe30de8c39a135c0bda337c2624c20db55670737fffd79cb09145b42401782cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962850, "uuid": "d9555187-fa6a-4d56-a52d-401ad97f8b0a", "comment": "Malware payload (AgentTesla)", "value": "e5b51375aa21205b6efc6635cef88a4bfea8f220", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682962850, "uuid": "5424fdcc-be9b-40b2-a48e-4c154ab9d172", "comment": "Malware payload (AgentTesla)", "value": "8c3b347dd676f51e4fcca67a2fae5800be629cc5d83933621008c27bc94aaffbc479ac47610614b97ddcf220b1328fc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962850, "uuid": "7620d844-59da-4d30-99df-82e4b0abc3bd", "value": "T19AD4CE5291A9CF5AFD3ADBF054A4FF4057F0B5B3A4E1D1201EE624DACAA5F010E4CA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962850, "uuid": "8df943b2-7410-433f-b0f9-46b4fadec454", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962850, "uuid": "7e0a1dec-bee9-4f71-beb2-4f977a3300b2", "value": "12288:2zmt6s47yMm4d/KDjXO0NZkJ69+yxIOvVKXGjzRGqfApiLIQUH:cmtb/GiDje0Ns4aO9KAzRGMyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682962850, "uuid": "be9a68dd-3693-4602-8512-9fe5ffc975d4", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682962850, "uuid": "8aa66bb9-9e11-48af-bd78-845694d903f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682962850, "uuid": "11d3557d-b1fb-4c50-ba57-ae1530a2e5da", "value": "QUOTE #82079416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7a2c93-e7b4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1682899787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899787, "uuid": "1b6db617-e8de-4f07-9ca9-40db5326c67a", "comment": "Malware payload (Formbook)", "value": "461279da696f48e7fe906abcaf73fc30", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899787, "uuid": "bf114e95-8b05-4425-8186-acaa5fe95a2d", "comment": "Malware payload (Formbook)", "value": "ff782098b544168676c4e92e14562b6d65883e385a38c0be4d607f31b56f6a1b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899787, "uuid": "2e027f02-993a-4905-b549-213cf502ca35", "comment": "Malware payload (Formbook)", "value": "4bda4732b9d214e27fd3a57e053cb7067fc70c74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682899787, "uuid": "a4e613ed-8f74-4adc-974f-ce6420aa3fbc", "comment": "Malware payload (Formbook)", "value": "f3d3d69e8d4a15f31cc02e44fafe5048e122727a8ce0b488bb728ddfd521f8798fb7975566a1b5fdedf2cf6c83f6423c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899787, "uuid": "044ba504-0409-4282-be58-9b58bb62413c", "value": "T1A045AD535065CD1FFE6ADBB091B4FF85A6F1F07360D194242BBD2189CBA9F021E8C52A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899787, "uuid": "5e52e4d7-dd0c-4331-83f5-ec96ebd889b6", "value": "12288:3+rFdMaU197wgOQLV99NHP5PLHeI7sZth5TPegQVt:3+fMaChLVH3TV7sZT5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682899787, "uuid": "6dc55c09-5cbf-4c16-95a8-29a8e4c83851", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682899787, "uuid": "e5e3faae-3a24-4df6-b9fc-70791885af92", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682899787, "uuid": "ba7750f3-d9c9-4935-8cac-7cf7be01d990", "value": "INS5109M61.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b51b49d-e843-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1682961016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961016, "uuid": "cdf1018f-f4b9-4ab2-80b1-4aa3cc41429b", "comment": "Malware payload (AgentTesla)", "value": "e350ce92b15aea42139122bfde6d452d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961016, "uuid": "8fc5d085-2713-4b49-b05d-78b3235276b7", "comment": "Malware payload (AgentTesla)", "value": "ffb0ebae3ebc0890f24afbb831e437491ab12f3d75bfdadcb81a0308dd3f5bc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961016, "uuid": "8f69f888-1ce1-4bdc-8cad-18e2c22b6811", "comment": "Malware payload (AgentTesla)", "value": "2c00602e1ea4c263b86443d8a0e77afd34d50821", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682961016, "uuid": "73d1b814-bdcb-442d-a9c0-8f3704701700", "comment": "Malware payload (AgentTesla)", "value": "a60c6417fed8dc2880728559972fb3e1053c4c1962b9e538acc6513b3e34e435c07c48e9262f547a755d6bb54d42c8a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961016, "uuid": "31158d3c-1f3f-4238-a7ea-0c62b25f29e8", "value": "T1CE44D05FB7AB5F51C6149671C0E7441803B1E3C272B3D64B784963AA0E037EADE49BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961016, "uuid": "84f68cb6-41de-44ee-85c4-7363824d3860", "value": "6144:hF8sIcKIRkQCFRhNaN3lPmsaayWOhRWHUW+ZNgdbnn4:b8MkPnKlPemOiUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682961016, "uuid": "1e959772-ae70-4f03-b0df-ea5833bcd744", "value": 270920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682961016, "uuid": "056c9acd-9590-412f-bfcc-4ff59e734208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682961016, "uuid": "9f2e2da8-6e1e-461d-a855-d2379a589ad1", "value": "20231824409_202304026_16542336_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d77dcde-e815-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1682941397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941397, "uuid": "9acd684a-b3f9-4c7a-b2f7-d93708450a8f", "comment": "Malware payload (DarkCloud)", "value": "2e46739e331f44b2a09ccad0817b6ad9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941397, "uuid": "e69fc645-8f0a-4d2e-b54a-e03d77047140", "comment": "Malware payload (DarkCloud)", "value": "ffb19cac93e35be747f5418116248e185687596877812115588cd59763d1ed15", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941397, "uuid": "a5340fac-8e15-4749-90e7-37e82f81ba12", "comment": "Malware payload (DarkCloud)", "value": "c9df1742a1a755c6e96e1b17b2ba488c8ad25574", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1682941397, "uuid": "0ca7d77a-2e2c-4f32-ac5f-6431a3ef3ff2", "comment": "Malware payload (DarkCloud)", "value": "b694f1a9ffbb8e763a333fa51496829ee1ea9ffca0d76ff8a708bf860336356b6eaed9efb139a7d10b7e6eaae30f5ece", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941397, "uuid": "0c91c31d-987f-4686-a3ca-7e08365dc542", "value": "T1BC357A3D1ABD263BC079C7A68FE4C427B454A8AF3161ED25A8D757A60346F1235C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941397, "uuid": "f88c1bbb-f7a4-45a3-8bbe-39be73a63119", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941397, "uuid": "47a58827-eb4f-4306-96ea-a1ba15b9dd19", "value": "24576:cylUD2PhxgZnoK7k4JRP8+xlp0hv/OeD+Ow:cy+6PbwounP8+xC/OeD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1682941397, "uuid": "d51686ac-30f7-404a-8f63-12dc224a41e0", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1682941397, "uuid": "fe3b034c-7f45-4bf3-b330-519f617e4125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1682941397, "uuid": "46a7849c-9d51-49b5-b833-c014f772052d", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }