{ "Event": { "published": true, "date": "2024-04-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-02", "timestamp": 1712102581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f8b632aa-1a92-40a0-a51d-982b967e4f9b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf50cad2-f0f0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712062755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062755, "uuid": "f3febb9b-9860-46fc-89f0-f7525e72381d", "comment": "Malware payload (AgentTesla)", "value": "efebcaf71c8f17989636db5620e70149", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062755, "uuid": "f5ed1837-f535-4967-a525-cf10662576e0", "comment": "Malware payload (AgentTesla)", "value": "004dc4a6d738c14412221dd8c2fdac631f4585e155cf030dd3cc814362f937bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062755, "uuid": "1e6b16ef-db2f-43ea-be34-9434de8bbc34", "comment": "Malware payload (AgentTesla)", "value": "381e5d15e8ba39467aa87e95ccea1ce158552f7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062755, "uuid": "1d3e6416-4f8d-4000-998e-6f7d61f9c9ba", "comment": "Malware payload (AgentTesla)", "value": "7a61ebf0fe0897b30144bb30b0728707323f7435a8429b04ad64f0ab8d07c22c71fd0fec1fcad7a4ffba61df2746d0bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062755, "uuid": "a3f95ec5-d656-46c4-9572-a2ed6666018b", "value": "T167340F037E48EB15E5A97D3782EF6D2413B2B0C70633D60B6F49AFA528512825C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062755, "uuid": "d07e055a-427f-4672-a24d-6154e703c399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062755, "uuid": "6f2ea42f-669a-49ec-ba31-4469f9cded64", "value": "3072:Usv0V4eemme5w/PQloqJ03U6uKlqu6H1/wt5gsFziK:UsvLeemme5sPQloqJ6Ruwq7VohF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712062755, "uuid": "28974b8f-ff0e-4034-ad1e-ac2d2a31ed17", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712062755, "uuid": "c8b3e76b-f515-4665-9b34-de2f7d165266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062755, "uuid": "9043331b-3b61-43f8-b676-e1b722de9578", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ca9797-f0ed-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712061370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061370, "uuid": "567c4eb1-af13-4f53-8540-e1d6e82a779a", "comment": "Malware payload (Mirai)", "value": "d24ed1c4d6a8aa7ddf731068b68b34ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061370, "uuid": "9be06ae0-3e21-42b1-853b-ca4d37764b18", "comment": "Malware payload (Mirai)", "value": "0063dd2d542a8776c875c2e286f36457e73666ea9e2581ca1e93facb6d444242", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061370, "uuid": "cb0cd246-9145-472d-b1f7-616fa8cac1bd", "comment": "Malware payload (Mirai)", "value": "2eb9ae1ac2048b9d52b57bdf2059546da8a1adc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061370, "uuid": "b5d9b3ff-bcf2-40ef-b5a5-dba7dd92bcbc", "comment": "Malware payload (Mirai)", "value": "e9b92716b77e99afc264837241e60941c041b0478f7669b4df9cee5a34f9a5ac10b516d622300b328460022d4d3498a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061370, "uuid": "9cb9d0db-435f-4431-9fb3-dc29cf234540", "value": "T18E042A46FA404B13C0D627B9FADF42453323AB9497EB73069528ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061370, "uuid": "d2e3d1da-7f70-4c15-8faa-8f6e4be455ed", "value": "3072:ftjUwBbBLHcBCkAabwdyqkkELH/6EBpau/1Jso0M/Rsx1:ljtBLHElAabwdybkQ1B4u/jx0M/RsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712061370, "uuid": "b1da404e-1b40-45fb-8fa8-a38115958d82", "value": 179821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712061370, "uuid": "fbd9befb-8572-4ab9-9dad-2e5d6c509711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061370, "uuid": "2f2c6f7d-12dc-4b74-9046-e3f3113415dd", "value": "d24ed1c4d6a8aa7ddf731068b68b34ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf1551b-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712064172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064172, "uuid": "9282dbbe-fd1d-4c33-815f-0dd1ce8d200c", "comment": "Malware payload (RiseProStealer)", "value": "bf0137e15637ddd2eefc0922092ba059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064172, "uuid": "48b6fd62-b1dc-4bea-9ea6-5198a4a43720", "comment": "Malware payload (RiseProStealer)", "value": "007b625dbf26d9e0c83eabe4a77317bf7aacb1aebd26799b494308ef28a6fab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064172, "uuid": "260ef939-aeda-4522-bfc5-28f4c57ddb0a", "comment": "Malware payload (RiseProStealer)", "value": "e267abe1428aa6906e7f78dd4e2ba27ba2c5094d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064172, "uuid": "00d159f7-3dc0-45ea-91e9-972c7eb9a7dc", "comment": "Malware payload (RiseProStealer)", "value": "d42837ec28064d6e1333f8ec6280035b2f8705b55c5725f0c3bdfa79a22f46cdd234f07ae17e25825f9b7d00e0045c86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064172, "uuid": "3f7a4868-6210-4288-a40c-7392814f42bf", "value": "T1905623DFE648A659F43C007DAA93AF7CB1F577A2B0864D29A44158C089B33907CF3AD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064172, "uuid": "a1edb94b-95ee-49e3-8199-a0ffcf549784", "value": "781c86f538798e5b8b2b3427fdfc978e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064172, "uuid": "43f2a47e-9fe3-4df0-9231-034c8586fddf", "value": "98304:uCVtrrNZ4y9SB4gfnpAC5H0U7tsM6EVXw5pllaswAH2KsMzhqY1V3yHQWRueMI6D:uctrBqyQBFfpN5H0QJVAPlNwAfTzhqcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064172, "uuid": "a0145e64-7cf3-4b7b-8097-f15704e91eb0", "value": 6211872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064172, "uuid": "6261e069-4178-4317-928d-cfc9510b6cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064172, "uuid": "8763cba1-67ff-49a5-be5d-83d53ac1cac0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b55b885-f149-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712100813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100813, "uuid": "5ac12825-fd29-4906-bbc2-eb82c2e0645c", "comment": "Malware payload (CoinMiner)", "value": "c74b09048451ab0d821dabdfce289d2b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100813, "uuid": "f5018e06-e433-4f86-a181-ac7a3bb55c04", "comment": "Malware payload (CoinMiner)", "value": "00b7e5b7d85431b60afa8d886c6df155e2a2d341319f4912a61d495e729048d5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100813, "uuid": "49d63aeb-c868-481d-b72c-9415d628f6a3", "comment": "Malware payload (CoinMiner)", "value": "70200cd8a0838940239cea5cb7f284143d1b374f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100813, "uuid": "d830884b-5186-4f4a-8411-58b69e8388b1", "comment": "Malware payload (CoinMiner)", "value": "f6ea1df86f6b9e3a1709733e83b0d4e65c7cc55cae67fe856df1b43fb693075165d59964c100f52309b74da4e7af405b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100813, "uuid": "00f3fc67-39eb-46b5-b758-d4a17dd499fc", "value": "T19B07332B6FFA651CCC5B52791DB8A47CAA611D233E4F74EA0624C434CB3A58833C75B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100813, "uuid": "8437fce3-c287-4e1c-bee3-ab6828337534", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100813, "uuid": "baf8a786-8be6-46c3-988f-d5ac8ac896d7", "value": "393216:t1Ge6D+penpUI6UaIAwy85LM0j+CL9ynDgTz4KlJ4FZUNu:iem+p0pUI/Aw95Y0aw9ynDYyFZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712100813, "uuid": "d58e96c2-c3fc-4b47-b0a5-46c0718c9e49", "value": 18450944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712100813, "uuid": "99bd50c5-03d9-42e1-a2b7-92e3d3389914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100813, "uuid": "05d64a06-b405-46b8-beb9-54a5904e8f59", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.25256.942.20710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101cc93b-f111-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712076608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076608, "uuid": "52f8138f-58b9-4269-ad58-0a8cfa3f1602", "comment": "Malware payload (RemcosRAT)", "value": "6ebc87bf4c5649898af41a29d7da96ed", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076608, "uuid": "cb0669ec-3e61-4c93-9486-4094a7c41bf7", "comment": "Malware payload (RemcosRAT)", "value": "01fa80e47a8c9e3c9fac7b033656d345e87cefcb16eed7560caff7891d1a881f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076608, "uuid": "5f17c01b-4d87-40c1-92e1-44d4c5779104", "comment": "Malware payload (RemcosRAT)", "value": "95f3be2a78da078bfa31c24297d4f574f7c91cbe", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076608, "uuid": "e4455f19-75b5-485b-86ec-be9db4d1d766", "comment": "Malware payload (RemcosRAT)", "value": "8ee8af94f1f838b88a195a986801f01e6cccc9c8ab7a76433de850370ccca6c0c4b94bf7de18dbbf46142cc76d1415eb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076608, "uuid": "905bce67-6973-476c-8a76-c2126e164fb3", "value": "T119F1AE2BD64B1C97CDF7977C71D4205310453790A2FD0AFA3216763AAAE786068C8AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076608, "uuid": "a43f6116-dff3-4e72-91dd-dc0df4dbe700", "value": "192:cL20rrtvaEE8HbAP8gxuvP8sNSX7/K4pG9d3rYQvq:020rAEJ7e8qYUr/I3s4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712076608, "uuid": "eec63bac-7a04-43f6-bd20-a643c5e40c64", "value": 7571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712076608, "uuid": "7381505b-96d1-4b71-bf00-943480569872", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076608, "uuid": "6a6d3a52-bb90-4cef-a23d-23cd688b1446", "value": "awb_shipping_documents_bl_02_04_2024_0000000000.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b161c8f-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039045, "uuid": "65359be9-8ec5-47f4-9616-aaaa1b54f668", "comment": "Malware payload (Mirai)", "value": "69e2bb469cf1324ab464c91a1b67e812", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039045, "uuid": "dd7009d9-acb4-44ed-bf90-6defc9eefee4", "comment": "Malware payload (Mirai)", "value": "0291a68e335410407a61c62e8c4b89a0ac9f4e21e61c1a1e9a2fcc5b1492d148", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039045, "uuid": "8aafa8bb-54e2-4aab-904e-f521be56e43b", "comment": "Malware payload (Mirai)", "value": "40bfd622422d8369640bfe7d8fbc9f21f3de82dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039045, "uuid": "8e4816ef-b455-4af6-9fe9-01331daa2ac9", "comment": "Malware payload (Mirai)", "value": "25ae2523644c9e30906ba25a33b5658bafc2a824ac46a53c4320ed785697afe085159643d77f56fe924e01e69ac67ebe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039045, "uuid": "541351a4-2a4d-49b4-985b-507573ea0f61", "value": "T172F2D0602832D192CE36AE2DEC6090D06DBE47F5F55A113172E893FE69D650395FE087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039045, "uuid": "d2894de1-4bb6-43f0-9d4f-db3d794848af", "value": "768:NYVgAxkU1RHz5payiI6N5MznmDu52cZd32IPSo9q3UELCQ:NYyAxdRH9AyiI6NrK52eF2IPELn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039045, "uuid": "f761185c-26e5-4aeb-a392-e68aabdf00b9", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039045, "uuid": "4d3abeaf-c121-41f1-8ce1-fc9c81a540e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039045, "uuid": "b89c8a40-983e-40c5-9b8d-53bb78e8be7f", "value": "69e2bb469cf1324ab464c91a1b67e812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1b2594-f0db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712053514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053514, "uuid": "d6775a15-76d1-43e1-a795-0bbb3d118365", "comment": "Malware payload", "value": "1ed5d5028436816818d9777b79aff986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053514, "uuid": "167455a2-f43d-4661-8bf3-608a7e0ae8f0", "comment": "Malware payload", "value": "0291e9b42f30b92e8d0cdbc170004f87c2a8e8a867ec0aed1d726e846bcd7a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053514, "uuid": "165d8677-7950-448c-8160-9edd77013d6c", "comment": "Malware payload", "value": "471347193af7b7beda7756642ba997fe3bd84f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053514, "uuid": "6d72f535-c4ef-47f5-9f0f-237da6bab336", "comment": "Malware payload", "value": "ba88994f80663115b83c1c089943195832c6f7b77d40fe537186cfad0038f3eec8906eff2b744ee62b2fb892670481af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053514, "uuid": "b7e251dc-717a-4e42-b98a-1e5c3fac50db", "value": "T12F056B12B3C7C1B2EFA226F2D67453361939BD39173C89CB7390382EE9A06C16A75355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053514, "uuid": "27fc0e30-db54-4c1a-b60a-3b78874c0708", "value": "c6226f6a092dcec547d41454113dfb56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053514, "uuid": "4c7f642c-acd4-4adf-96c8-f1bf0b0f6fb9", "value": "12288:7qP4k+DXsg/vauGrCakHcMHuUhWkYRmw0RFbriNCG6i9i:7E4k+DXHsrChHcMHXhWORFba6i9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712053514, "uuid": "459b1024-585f-4fdb-a5ef-09ed5bb3f4d1", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712053514, "uuid": "c3fff5f6-2b21-473c-adfd-012fb823d762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053514, "uuid": "8fab0a2b-a598-4d65-adcc-1da3889abac3", "value": "SecuriteInfo.com.W32.PossibleThreat.4387.11770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348a25d6-f0e4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712057341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057341, "uuid": "287da88f-4266-4241-83e6-5e83978a8c71", "comment": "Malware payload (AgentTesla)", "value": "275f6af98196aa194cbfb4cadbe5a016", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057341, "uuid": "ef5db0f9-ee6b-481b-ba8a-81bd433d2e18", "comment": "Malware payload (AgentTesla)", "value": "032990d23d29d1aa03f97b3f2f91811de49c4c7363f9c89b6113166c8db19810", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057341, "uuid": "cbe48fa8-1be9-44fa-8a91-e51a0d16dd1e", "comment": "Malware payload (AgentTesla)", "value": "77f951ed5a3338091911871737d58cc0af560892", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057341, "uuid": "40d841bc-be12-42c3-8ac0-93f7db170968", "comment": "Malware payload (AgentTesla)", "value": "88cb5b93bc3dd1ede9359efb1f26212566face3674c7ca78841fd4e580543830caeda2fd5fc1bc1806c686e00afd8645", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057341, "uuid": "d811abd4-3e0f-459b-9e7a-d8cf6717c78c", "value": "T108D422847200DB42E16D6BFAE85866F4033A5D22F811D6573DC23EEB76337A58941BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057341, "uuid": "7d853ce3-8bc9-47e9-b89e-597575e1223f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057341, "uuid": "ea8960c0-e014-4175-9c4b-a253ebd418ef", "value": "12288:/Zc5pdlDVTui9T2t16KC0KARlTWAYVbMKK97Mdc3LhJv22ZQrt:/8pPDVTui9Y18A04+cbhJv2zrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057341, "uuid": "023d8031-dbca-4239-89d9-da19c8e25b58", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057341, "uuid": "1d64b0ca-98e7-410c-ac9a-f797c7d0983a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057341, "uuid": "78db77cd-de43-4495-ad2a-ec9670e5ded9", "value": "payment copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba81d09-f0fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712066856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066856, "uuid": "34b22506-085d-4014-82ed-63e3a0d7485d", "comment": "Malware payload (Gafgyt)", "value": "5441577a546a4ab2ae6ffd79ec3bd659", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066856, "uuid": "24a53abe-14a8-4fba-9f2f-81acdae0a99b", "comment": "Malware payload (Gafgyt)", "value": "053d0f530242cc21f19c727f8b7b76396948576a9a7c68b69f930bbd76b19954", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066856, "uuid": "f5ee4499-480a-4129-87fb-231fd8afa8c8", "comment": "Malware payload (Gafgyt)", "value": "18c89babc31f7cd007c37a935d81793333bc2640", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066856, "uuid": "99a94b4e-3e08-48de-b71d-76509a48ba08", "comment": "Malware payload (Gafgyt)", "value": "1bb5914d2c5e14a8abcf61d3c5b1b2566b2cbeeef76b11995a6183bed76a1a4cdaa0310a59fd4b1304af162f472796da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066856, "uuid": "5b30e85d-b8a2-42af-8e45-e629a116c7dd", "value": "T1E1B32A44F841872BC3D327BBE78E479D3B36569457D733116A38BEB42BC1B982E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066856, "uuid": "c2171866-03eb-4184-8ce0-64cbde9f0402", "value": "3072:XYTlJvrj76epWE+yEHjsVxmbZrSdKjitXSrk:0vrj7CE+XHArmbZrSdKjitXSrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712066856, "uuid": "7692990e-c794-4df0-beee-b557d517b560", "value": 110336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712066856, "uuid": "910f48a4-36ee-436d-b822-5094d953aec6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066856, "uuid": "d9810e0a-44df-4d63-a6fe-d76bdffe2fa4", "value": "5441577a546a4ab2ae6ffd79ec3bd659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9789af2d-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064380, "uuid": "fc339879-8fbd-44c8-94ea-9e85e43a63fa", "comment": "Malware payload (AgentTesla)", "value": "254423f1e144c8e51104d4ee36e560f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064380, "uuid": "3cd5fd1e-5e1b-463e-96c4-ca44564d9949", "comment": "Malware payload (AgentTesla)", "value": "09052597c3b34634069bb69c4f758ad02108a2fe03a668646521eb295d593964", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064380, "uuid": "cf47ffa6-e565-4240-8f3b-e16357821679", "comment": "Malware payload (AgentTesla)", "value": "2e01accb2e18bc2e10a221170f1374c9c1e9aa8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064380, "uuid": "b6750c37-88c6-4ee8-b671-ad2b81ec158d", "comment": "Malware payload (AgentTesla)", "value": "5e77c74fa4f254dcb0f230bc65ef8a32229ce5a2e6506d03ca67dcebb0ade1635d8adc426a30bbe8a65c9ae37284417c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064380, "uuid": "74a47860-5f38-43b0-90f5-ffe85fb87531", "value": "T131724C8B77430B55DE331F954D4E098A85F40D63D53208E4BB69A3CD49139E9F33668E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064380, "uuid": "21ec31ab-b572-41b9-aeeb-aa5cbcc3cec1", "value": "384:dG9swEKlBI5lQGDvAXukxzqHzjGiAU/fqg:dhwEgBlGDPkxzqnZfqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064380, "uuid": "84a02e1a-e81f-4fee-906d-a7d624392da2", "value": 16833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064380, "uuid": "5d522f6a-4f09-4923-ab0a-ed83071aa293", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064380, "uuid": "10c37763-c99b-411a-93d3-e6231214d7c5", "value": "agamogenetic.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf17b70-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712038646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038646, "uuid": "cd90db37-86e7-4e2f-8b8a-a15bf5792227", "comment": "Malware payload (AgentTesla)", "value": "78a834187a127899e0c8441bb27b0b5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038646, "uuid": "d47bf354-1317-472f-92b0-09636ca7c175", "comment": "Malware payload (AgentTesla)", "value": "0a12220f93b07073f12bdff473b96cfb8a24c10b3c0debd536397e0ba6465bcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038646, "uuid": "0c69f51f-9743-4d08-bf92-972c8d764971", "comment": "Malware payload (AgentTesla)", "value": "4a2b5c84468bef44a253f616b87b4e05229a0285", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038646, "uuid": "07283c4d-e4ca-4479-b3e6-83d9c3832108", "comment": "Malware payload (AgentTesla)", "value": "f360b1dfcd7ae3ea7354c478ea380cf1be019b503729a027e657672c3020f85e4973ed1d1c4c8fc0901f6d720d6b94c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038646, "uuid": "e8250690-aacb-4149-bd80-1d4fb5689c21", "value": "T142D4238DAA1F3954DF7AE5037D32B2E3D11D0D037A8B17106F5CE0BBA50AA558602B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038646, "uuid": "f1fc392c-b439-411f-a2f5-20fb7e2913ef", "value": "12288:ge0d9MFVykSZvYf1p/uLvws9P2V1VPDtk4EQFfVP3Rx2K+STM1nDsM4puj:g9da+7v41iNwVPDtlfVPj2Fvn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038646, "uuid": "0aaef7d9-2a1a-4ceb-a92f-46f1f7209e68", "value": 648229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038646, "uuid": "cde28ea4-9bfa-4f82-80bf-7b8b4081a875", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038646, "uuid": "7dff3d91-6065-4e09-b227-c9b7383bc25e", "value": "FEB-MAR SOA 2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5559c74c-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039358, "uuid": "aa46e29c-09e1-4684-8104-4dc052dfda09", "comment": "Malware payload (Mirai)", "value": "3eb504136e9ef996b0b2a6f323a9c48e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039358, "uuid": "f356a419-71fe-4ea0-bb16-cae7b5aa0f0f", "comment": "Malware payload (Mirai)", "value": "0a98090f3d39359074b4c9f1daa1f9791d2503ebf8a372fe72020b440b880bd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039358, "uuid": "322d87f8-b988-4a66-bfd8-6e99ab63857d", "comment": "Malware payload (Mirai)", "value": "4ff114a9580bd1797f0408e6cca4da910e414f8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039358, "uuid": "a997a81f-7709-421b-9a25-7e0e13067ccd", "comment": "Malware payload (Mirai)", "value": "dc0fd3eb49e960c919c674a26b926a2d38e33d67c10492682f9efe2cf9821dd8f8036bba7caafd8645c1973ca3508643", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039358, "uuid": "13871954-1e31-4252-a854-de2b99c74de5", "value": "T1DC331884BDD19A17CAD40777FA0E42CD33266388E2DE3213DE216F65378A92F0E6B151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039358, "uuid": "084a45fc-4a8f-4b32-9a41-823906c8d61d", "value": "768:v+06wC6msroIilOgORV1Gv1xG03vpx3jTDbxDRozClHn+uE9TpsCSC7RbYm6hn:7roIiUgqkTDfpZjTD7pzEgCSgGmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039358, "uuid": "e3deecce-540c-443c-b826-f59fa633f02b", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039358, "uuid": "4c4a4b76-5089-455c-872c-ed96c93db9c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039358, "uuid": "ab499684-00e0-44da-9671-377413ebaea4", "value": "3eb504136e9ef996b0b2a6f323a9c48e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec509fc-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064472, "uuid": "1558cb9e-e6df-40e3-a506-537d6c2cf48c", "comment": "Malware payload (AgentTesla)", "value": "d3a4bf7f848c61a68bc114896965a78a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064472, "uuid": "da538904-604a-4505-87ce-a64c7c940296", "comment": "Malware payload (AgentTesla)", "value": "0aa9b9c9f830e9b956d83430879b8dfb026627478530909112f4c014d63a113b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064472, "uuid": "cb56ae76-6c3b-4b8a-a498-29b0945bbaca", "comment": "Malware payload (AgentTesla)", "value": "b83a713c9a1093f3ec16700d44a2b754c13455c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064472, "uuid": "ad8e2e62-95fa-4f8a-88c6-49407fff299b", "comment": "Malware payload (AgentTesla)", "value": "a926037227a22f9fdb5ff3f5193968dbb69f06ae054ec4e3766c40d5e7c45eba2f53af5c64a5d60ebec7f9b5c90cc723", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064472, "uuid": "6b2955b2-4903-4ba5-aa89-993cd6b0bc93", "value": "T1ABE42369BB38B607DCBB48F1A1F06815ABF479572D91C1C99C8035CF42D5F88AA43D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064472, "uuid": "4354b491-7748-46b6-ba8f-98695a4bfc51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064472, "uuid": "c3190d88-ce38-4383-99e0-62d77351134c", "value": "12288:G33bBqeH3YNE0qRg/YKedOTM1uj+n0w7XNrYJSY1DxyKx3FVfXGsePzaCkR:m3MeoNz/VeX1ewBIS4tyKlFRWsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064472, "uuid": "968902a5-d1a4-4a2d-93c8-31c5cc315190", "value": 683528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064472, "uuid": "c7273540-cf2c-4c84-8d21-49c599a1dc28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064472, "uuid": "583234dc-2053-4487-aaca-44e07e693bf6", "value": "DHL Tracking 01.04.2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d04d8e-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038983, "uuid": "979e935d-baed-4cae-bf25-8c35b6fca7f3", "comment": "Malware payload (Gafgyt)", "value": "734606255f28f29c00a6c92aa9bcc7a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038983, "uuid": "2ac9a949-fa84-4f87-9ea0-aeb8dc081fb5", "comment": "Malware payload (Gafgyt)", "value": "0adb45109522e78dd54adaf11e85b1a1ce41a6872a60c35760166b916cb717a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038983, "uuid": "e363db9a-c422-4319-8652-018fb3310c54", "comment": "Malware payload (Gafgyt)", "value": "81402d44cef8666c098fe309a54bd2b26684e0a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038983, "uuid": "df3c15cd-982c-4c17-998a-653f1d3107f9", "comment": "Malware payload (Gafgyt)", "value": "daa6a4f1aa5a26cd185b2501879b510eedfbbc1539dd3a9ac8fc3b7c58f7c699922ec4906db0390c129517c27d9947e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038983, "uuid": "faa6ed24-281f-43ba-9667-68ae15a09730", "value": "T1C3D30A77B61C0793C4C706F11D6B3BF28F68A2F312E761C5661ADA908B739B61412F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038983, "uuid": "93d60f86-c49c-4372-960e-bfd66c7e69bc", "value": "3072:eVrQyEDCvqBvpnTy3S5hgrJ3JCI0Dmzj0qDJAGyoze:eVrQyEOvqbnT8S5hg6I0Dmzj0qDJAGyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038983, "uuid": "c94214d4-1b8e-4ea2-b8da-87c2d236aa47", "value": 141485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038983, "uuid": "5fe33d6b-e4aa-4273-96e6-fa41cfd55f9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038983, "uuid": "50dfae22-6808-45c0-aca8-b1d37ff8bb6f", "value": "734606255f28f29c00a6c92aa9bcc7a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e846ac49-f0c5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712044329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044329, "uuid": "23cb2518-5c21-410c-b17a-730d512e2ea8", "comment": "Malware payload", "value": "fefea0783a568ade16261f3f140568b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044329, "uuid": "414ae96c-6489-4af0-ad39-84f4fda188db", "comment": "Malware payload", "value": "0b4224501a1e8dedac0f05c43fc67ae2fee1c08e358331844f5177ec9f978309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044329, "uuid": "f43ad883-d9c7-49a5-a3b5-f4058e174a05", "comment": "Malware payload", "value": "a5e0cb479748bd631e2802b73c4188b36e2c7402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044329, "uuid": "401f5f0b-699b-4ec5-a4f4-7f761a5600fc", "comment": "Malware payload", "value": "5e92ae4d7763c68f8339f5b0d493e69f4dd74f599f4fe06b32234ccc52afa3662f0d57c27361debce065291e36be70d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044329, "uuid": "296eb58a-ba6a-4628-9732-a70df3e27e0b", "value": "T101B7E74B3C419394D4BE0A3548F2966B7F713C8A0F2413CB2915FA893F7A7E485B97A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044329, "uuid": "7633d857-f5c2-4817-8ec9-d3c632553bec", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044329, "uuid": "ece54795-7863-4762-98e0-b8325c712fc1", "value": "393216:OFArsCO57teKlrNNPC2NjZns8+20864z17:AAQCO57UKlS2rs8+20h8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712044329, "uuid": "1c298f6c-a92d-44e4-98a6-aa8eba935a77", "value": 51174088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712044329, "uuid": "44db83e4-acc6-4620-a18d-928e625ab2fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044329, "uuid": "260a00f6-dfb4-451c-9df8-258c30706ec3", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f7d5b7-f0fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712066840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066840, "uuid": "b273d36b-30f7-45b6-9e8f-e76e24f8ccaa", "comment": "Malware payload (Gafgyt)", "value": "3fdc540dd494821410455f1bee9ca2c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066840, "uuid": "efc7a553-58b7-40af-acc8-aa6d4d2aa136", "comment": "Malware payload (Gafgyt)", "value": "0b5a65576a638a8878d5dd9259ac30584285064b48aa65f5f9d2e3658a789010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066840, "uuid": "8f714e9d-c838-4a4f-8424-6a28d89bda27", "comment": "Malware payload (Gafgyt)", "value": "15538bc534cc4a9602db8fce21637d6451327bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066840, "uuid": "8e76c8d0-c95c-475a-b467-83fd7a4bae4e", "comment": "Malware payload (Gafgyt)", "value": "72a5eb5804a70ed457fd4bf81914a88aa412c1cf867800b79eaadc01ab952b52fe1afc39b92eb9fe5c67ef804bd05151", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066840, "uuid": "927c49ca-e802-4216-a506-291494d14bb5", "value": "T11BA33A17B71C0B93C59B59F12CFB3BF18B69B9A012A36185611EEFC40372EB12521FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066840, "uuid": "e620b3b6-0976-4c68-9c49-0509f2181fd9", "value": "1536:SRUEun4qu7NXshESrULQcFRGRvtWt32qelEmZpVLoPs+Tf28k:SRvACSEevcFR+QE5lEmZpVLoPbTf28k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712066840, "uuid": "ffe635c4-4469-443f-b10e-af262e4b42c3", "value": 97982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712066840, "uuid": "d00d65bc-9746-47f1-b7e0-6dd16238f78a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066840, "uuid": "9acf88a0-0e3e-4837-bb9d-a1b027b671ed", "value": "3fdc540dd494821410455f1bee9ca2c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fa5e7f-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712064343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064343, "uuid": "e1a82710-8530-4b7a-84a0-4a4de556d059", "comment": "Malware payload", "value": "067967c130bd95c21effc2e850fab085", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064343, "uuid": "34234339-2624-4043-bc94-a9016359e757", "comment": "Malware payload", "value": "0c58c400878e58a4758e8d3d1736928e5c73d8151da95d8ea1e353118c4e4211", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064343, "uuid": "4fe1544a-db46-4b76-b44e-e5c4cd7f3bad", "comment": "Malware payload", "value": "aa5b2888c2d4cc22c17c1f5fa14d082e15c32508", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064343, "uuid": "e4762bb1-cf8f-43d4-8f4a-7db3384c5b29", "comment": "Malware payload", "value": "30991cb12832f2131a54cc79f44f05eb427c1bc29553761065e78e962c7307edc547b1050c8b09d9a7463dc3da02ec32", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064343, "uuid": "330db0d8-a847-4778-9072-d39668afaa88", "value": "T188513685FF0FBE218EA6B325001E9959AF48D7168992581A3DCE8C4FCB12658B4E5DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064343, "uuid": "01482de1-39f9-42be-aa1a-c02256fccc98", "value": "48:Vqh80ZvwGX4QarjZIh5A3B4duMzCCn2MQc:siqvwHtsRuMzCyQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064343, "uuid": "713b981c-d68e-4efb-963c-c694021fd1e6", "value": 2666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064343, "uuid": "2da6931d-a015-4d71-b1ad-b0736475f688", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064343, "uuid": "698948fe-e349-40eb-a456-dee520bb0ae8", "value": "peticao_inicial.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec9f558-f0fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712066834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066834, "uuid": "71947ead-5670-4d1b-ba33-a686112ed93c", "comment": "Malware payload (Gafgyt)", "value": "d7497d89fe0f5eb13976ad927062b337", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066834, "uuid": "5c12e657-79b8-4521-828d-7ad0e13b51cc", "comment": "Malware payload (Gafgyt)", "value": "0ca62d10756cf924403ad940777ae8582d450002d7c10d1687cc158b736d76ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066834, "uuid": "26f22560-4f7c-4009-9270-27102c839567", "comment": "Malware payload (Gafgyt)", "value": "935950cd86f88cbcbc1c814f74c42f9e27f526fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066834, "uuid": "12aec8dd-876e-410f-bdae-bfa73d69d325", "comment": "Malware payload (Gafgyt)", "value": "d6f7b040f3ea751b15b5f82092960c5eb7d09a9a853d109a99bac4a7b5a62a7a1dc777e8eb438531bf2abb7085bbe84d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066834, "uuid": "8eb752dd-d270-4690-b708-9d50463f422d", "value": "T1F0831A45F643C6F3C8830BB5029B9A6A0931F9BA1E2B9F4AF36C3CB4AB124C57115F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066834, "uuid": "6887f862-52b8-4474-ada9-307c109fda0e", "value": "1536:SppgTcvoo3CQWRaTMPIl6/HRb8opNqlf8vomLHUVr4wsgDfB26:PTcwoYk4PIlAHOINqDmzUVr4wZDfB26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712066834, "uuid": "c2b7826f-5811-41f2-ad0b-8c499b2e04fd", "value": 85870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712066834, "uuid": "c2a6dc1d-2998-4ca8-b533-21c0b538c20a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066834, "uuid": "3b6a583b-103c-488c-bd6a-89f362901c61", "value": "d7497d89fe0f5eb13976ad927062b337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebe0095-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064526, "uuid": "01012580-cf23-4802-a333-ba6aec3d2da9", "comment": "Malware payload (AgentTesla)", "value": "acce1b8742211d00d45038fc1e3dc48f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064526, "uuid": "0c35bd26-65d2-453c-86eb-7d9c65fbed7b", "comment": "Malware payload (AgentTesla)", "value": "0d12d9fa2b9bb08bcc2da19f2d8cdbe704ff948b40e85a2d2f7e1ef75886a9c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064526, "uuid": "f556132b-d9ab-42fc-a909-55d5017bd56c", "comment": "Malware payload (AgentTesla)", "value": "b211cd4fc271cc12949e3bc1bdcf32741302df23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064526, "uuid": "053a04c4-5d19-4504-acec-698cf1ddc957", "comment": "Malware payload (AgentTesla)", "value": "f7ba96793fe59e69b666db84b39029e090fd7b808241d1e4757ae4fe62f7906e99b80d646103210f49cf7ca9c2837e00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064526, "uuid": "8d55dd0f-42e3-453f-b8f1-8fb7d6973632", "value": "T12BE412A01328C342D7859FB5D48AC0F1A33ABD03D871C6AF78C53DAFBAB6751495069B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064526, "uuid": "d34a619c-548b-4bff-991a-afe83e616817", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064526, "uuid": "1ae049e3-e533-4e1e-819e-2127bc797e38", "value": "12288:bZcUvsn1yCv0WV6p66i7wnpI9jhBwiSHVwusjjswosZMMtYwR1LSNkR:bMP0WEw7wnpI93vYwuosUZMMqTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064526, "uuid": "1e2d8570-3a7f-4c90-b035-0b8e45042ffd", "value": 658952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064526, "uuid": "d383c7e4-d7ed-41e4-bb78-34e99bda65b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064526, "uuid": "099105ba-b404-4a3d-b4a7-7e70f8430e38", "value": "FedEx Express_AWB102235516763.PDF.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbedcdf2-f10b-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712074346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074346, "uuid": "ad0e0841-79fa-44e0-bf79-d05f9ca492f0", "comment": "Malware payload (RiseProStealer)", "value": "2dc9ceba069ad4540a8a5bd03b4b4f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074346, "uuid": "4b3d4a83-d727-4737-b59c-c416076b0863", "comment": "Malware payload (RiseProStealer)", "value": "0d5dfa5333b6138322fb6cc306002fa5cc36db62576867856866bbd98031c43d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074346, "uuid": "7b6c7e00-6c89-408a-a635-d973ac37a9c6", "comment": "Malware payload (RiseProStealer)", "value": "f19105cea05c67d8220dc6a4413db5059db5b1c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074346, "uuid": "c7775671-aa92-4d7b-8748-c467c8dc2f61", "comment": "Malware payload (RiseProStealer)", "value": "d8985a32303a3aa5c347b640417e6a9c4c288f4f9462b907cc98b6265a753ed4048a97d4a7379f4c085e630419f1988d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712074346, "uuid": "1f656287-dd3f-4842-b9d8-de80f0fc60c6", "value": "T1185633CFF6886909F87C507DEC47A63DF2A2BBDA6942492E35444EC15CB32D4287BE11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712074346, "uuid": "08ebf27f-0ad7-4388-9faf-2922e9aca5d3", "value": "4c8cb173aa80ccd2b7b9e8523b514fbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712074346, "uuid": "225ba01b-f4ba-45d4-aa42-e41073dffc99", "value": "98304:pvzTUXYDZ6ZSyVsysRfmWXsEJxf6OaRB9Yep8ZqTxM8qlnkaTelzKRhFgZJxAMGI:SX0yVhsRtZnF2OdqVMhkWuzKjOZJ5AlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712074346, "uuid": "e400f2a1-8351-474e-9180-86e7fcb87c10", "value": 6203168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712074346, "uuid": "ae17536a-a4f3-4622-9012-3915e0d24e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712074346, "uuid": "bd8a1ad6-5823-4d3a-b5b5-30ed63037c53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4132be-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067209, "uuid": "bf3a62f6-56a4-4c9b-b702-5a48688cdfee", "comment": "Malware payload (Mirai)", "value": "7fbbdc8e413911bcc534321c57fcc2dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067209, "uuid": "442f3c53-3501-480d-8888-ceb28c18be2d", "comment": "Malware payload (Mirai)", "value": "0e3b931fb413040e171bffe224c7fdb98996874d4febee1d6f31f2004e8edcf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067209, "uuid": "4e57efb4-16ff-45f6-93d3-fcc7c706c39b", "comment": "Malware payload (Mirai)", "value": "4c4049705573b699a80a1be04fb28c33b7e48dbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067209, "uuid": "d79b5107-1239-4e74-96c4-3336606ffe9f", "comment": "Malware payload (Mirai)", "value": "70d957b91b69b83b7c294ac715415b4514726a8391c5161ae09735e092e11894b5f5cbe93ab34a0e2dbd903a8dc52d43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067209, "uuid": "0a178482-602c-4c3e-be88-0f80363d7126", "value": "T1BA243B46AA408F13C4D72BB9FB8F425633239B54D7E763069528AFB43F8779A4F22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067209, "uuid": "fc844211-0b2c-451b-9762-44907d9f124e", "value": "6144:DlGwZjTSB0wagCh6d/ZpD4BFw6MDhpCM/RS7uO+KP:rQB0wa1h6d/ZqfN6pL/CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067209, "uuid": "8ba7fea6-1e0d-4be4-81ed-6135cb308b13", "value": 216461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067209, "uuid": "f5203e50-462e-42c2-b9bc-3d5f775ae968", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067209, "uuid": "e7113968-2a38-4bac-9a51-0afeed30119e", "value": "7fbbdc8e413911bcc534321c57fcc2dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fa5de3-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712046575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046575, "uuid": "dec6384f-e743-41c2-be76-ccb968f89d36", "comment": "Malware payload (Mirai)", "value": "99a46f6aa8e048bac37d99d35f6f7cc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046575, "uuid": "c8db80f9-f99e-46c8-9efa-b00c4ee331ba", "comment": "Malware payload (Mirai)", "value": "0ec1515076398f82fac7e135e3c85dd3a2a25f4454214b4feff1b9975adc2a60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046575, "uuid": "46533f2a-11a8-46f2-8739-9898afd5b647", "comment": "Malware payload (Mirai)", "value": "50ae0aa8cf5412e394948b8b48e5125544b0e4c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046575, "uuid": "6c0cab60-0221-4f9c-94e3-f2df6aa846d3", "comment": "Malware payload (Mirai)", "value": "c40377ec4cad4c22e904cdeb2a4e536c79756ad586efd55f0814c8d2673a3057062a410d195cca48345e2a1d7353c819", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046575, "uuid": "6b2036fd-2887-482e-9626-35e995096ed4", "value": "T13843022F47F781FDC86A3833412661CC8B913285138F473A48E7D96EACAD8DD59179E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046575, "uuid": "5073241a-d4cd-4616-ac49-7d036119b270", "value": "1536:wYFbeoupDAS62CbpMvsIIrcEF1VSVfwkGGmaL:7p4RkpNoVxBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046575, "uuid": "ae24d397-ba3c-49f4-8772-ad592f33a76a", "value": 60352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046575, "uuid": "a1abdffd-46f9-4e30-baa7-61918a45963a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046575, "uuid": "24efb474-17c3-4f0b-b9d1-00939f8a287c", "value": "SecuriteInfo.com.ELF.Mirai-CBI.24800.19819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed1ce46-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1712046568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046568, "uuid": "959e236f-899f-4ecd-aa5e-12bee5aa7b5a", "comment": "Malware payload (Glupteba)", "value": "6eea590486106b050b8c02aa38055cbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046568, "uuid": "a271655b-ba3d-4e61-8fe4-1378b4223659", "comment": "Malware payload (Glupteba)", "value": "0ec9dbde5d3aa5b362ca3f4932b391a8355af8c53706eb22ef8490ec03c0e2af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046568, "uuid": "5b3de731-057b-4ce1-92e8-a9f61758b1d9", "comment": "Malware payload (Glupteba)", "value": "0f93bf560ab716990a5105f5303808bd1257a777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046568, "uuid": "c38f4f75-f714-47ee-87ac-b55e0fb39cf2", "comment": "Malware payload (Glupteba)", "value": "a5b1a03b696dbc8a3dd723a3dd9307d55930cd23ecb8eaa3a0e39c68474df7dc9c5bc78235ddbfe7244e851ce6fd0426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046568, "uuid": "b58fd679-f186-4692-86ca-530549ed0c61", "value": "T1F81633227421D052E17C1A34CA6CCD99F47DB9238662D5BF3B48278EED74AC45E1CBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046568, "uuid": "55e6e52e-e7bc-4827-ac58-d6ac648aca46", "value": "37e790ea5156f496ba5ef90577d31fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046568, "uuid": "cf669b1f-9a24-4849-9768-5aeae0fd9484", "value": "49152:E6ZBZz1QHZg0vg9DXgMzKz8P2GZVpv2kRlJaRCrA/17YDARPziiW/w0YaUHaz6rb:EKZO5gTDXggnP2GXpuK0RYgByH6Z93aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046568, "uuid": "8725c328-f028-4e09-b95e-e88c45245b5e", "value": 4303752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046568, "uuid": "fcff7fea-61a7-4d2e-9d72-73bdbd29446c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046568, "uuid": "bded73cf-9e31-4a8c-a42f-fd22c2bd397e", "value": "SecuriteInfo.com.Win32.MalwareX-gen.16451.28543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cdb850-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712067225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067225, "uuid": "3822fb38-b282-4005-9e0b-14b6b935feb2", "comment": "Malware payload (Gafgyt)", "value": "28de33f3b036dc628612c11cf4c8a080", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067225, "uuid": "c5543325-f115-41f2-96be-7ced61e34b0b", "comment": "Malware payload (Gafgyt)", "value": "0fa517469b80788a5d9d1e3c38e21b2fe5cdc3d3eb5073bf1932d93ffea86371", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067225, "uuid": "b14acad8-9add-433e-bc91-6b626d2c5ccb", "comment": "Malware payload (Gafgyt)", "value": "7cbc723179d166b033dab9fcaa5be61e6f0fc0d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067225, "uuid": "b99c1b08-e08c-4e35-b749-8e09c3b8f42f", "comment": "Malware payload (Gafgyt)", "value": "b0720d0ae3b1e573adece6d90f42f00e758cde4745fa7f0fe3d1ebb65d4f61d5a4593c4de15fddab836824aab97e09e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067225, "uuid": "54e321c0-aeaf-4c7b-a0a7-288506ba60c4", "value": "T18DD3833E7E22AFBEE669823107F75F70879521D237A19382E26CD6181E7128D1C4FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067225, "uuid": "53509f40-c9d8-4330-83e2-ff9fd0b2f0b0", "value": "1536:qOyl+GxoTGPh+PrI52rK8Lq3qLqdqkC2rK82qmq+A1R2euZNRJnbYUmTEOFmUDfL:2ruA0A1RCnJnbYUmTEOFmUD2sLWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067225, "uuid": "3e3d617e-c43d-432e-a9e7-2462b2047896", "value": 131233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067225, "uuid": "91ec2738-c9a6-40e2-a79b-2fa064900859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067225, "uuid": "afd7730a-dde5-497a-a928-618443048795", "value": "28de33f3b036dc628612c11cf4c8a080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10def8da-f0e5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712057711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057711, "uuid": "a8514acf-574b-4d20-898e-a102ba2b9ecc", "comment": "Malware payload", "value": "a691b17dd88865dc8ac4ca24cf1d5782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057711, "uuid": "5563096c-edc4-4d99-be09-88fa837cc359", "comment": "Malware payload", "value": "1091c487e68278f32c72990570afb8d1732dfb915842934d0083c6e70da6db37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057711, "uuid": "99c1e677-2d2e-48ae-9ada-183974fa7b80", "comment": "Malware payload", "value": "40085cd9b7b5e33bd270eb8de04140dbd1bd700e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057711, "uuid": "fdef01cf-a26d-4fbd-a701-42359c478cad", "comment": "Malware payload", "value": "e10e48f0cb82464ccd1d59ebe59add42fac995da73c2c5fefe27b7bb6286c42e80b5757ebc1d98b903cf78b12716b112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057711, "uuid": "d41f96bf-1af5-45b2-98ed-54c3690bde36", "value": "T160A423C90A90B9D1E8DE0C329534F8E5A5AD3B07DEF43160CE69EEE80571AC61D47F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057711, "uuid": "3c0ccd5e-3409-4830-9905-7650d9f21267", "value": "6859c1fbd5011b39e2b3c5ccd6eda491", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057711, "uuid": "3a6db977-8002-4b0a-8133-01888f23ce28", "value": "12288:3SD6FucTVp0vxMPpmVD3A8dZxT5g6fvK8vh:m6us0vxeUQ8dZt5gcvK8vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057711, "uuid": "7e12d1aa-2d6d-4242-989f-87eed6f8f7e8", "value": 463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057711, "uuid": "45960569-3188-490f-89aa-a7ef9a7a0885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057711, "uuid": "8479bc9b-7db5-4404-aff2-2f104e873bc4", "value": "TPThumbPlayer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aeca2cd-f0eb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712060466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060466, "uuid": "fcbb7b74-895c-4eae-9b50-1ab910d874d9", "comment": "Malware payload (Mirai)", "value": "b090d71c44a816f72b9403a964869ea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060466, "uuid": "6f8fd6be-f4c1-453b-ad88-0b4f66cf61e6", "comment": "Malware payload (Mirai)", "value": "10cfd14a97a283471669f4c85be720a23c5b51c9bdf7658c3033d06305059072", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060466, "uuid": "542d7a16-ecb3-4b4d-b92a-d1c00dc50549", "comment": "Malware payload (Mirai)", "value": "85a3692950a51a808f57b44170aaf06d83697692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060466, "uuid": "b50a530f-6b56-4f19-b3e8-620805ec5c46", "comment": "Malware payload (Mirai)", "value": "ee6a8c88fe29f9cb5666d66b8334e74a36cf364682be05ad434e36ebc75ecb65b2b00a365acf281aa5fac4e3bd23b6a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060466, "uuid": "c63e72e4-eafd-4852-8b2b-ac27e81727c0", "value": "T1FCD32A06B30C0A47D2632EF43A3F67D093EF9AC121E4F640356FAA899172E365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060466, "uuid": "b88d14a6-63b7-433f-8349-4e51e38bb1f6", "value": "1536:a0nwryWvmn/qZIRHSL98z+xpnvTnNoMfBIdegp7PMXgvAtId0DD2h/qvc8kpd/z8:BWvmXHe8z+x57nBKeglPMVtQpdbuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712060466, "uuid": "1e36ace4-8cd2-4bd1-9eb0-72e5a8b9ed65", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712060466, "uuid": "9ca291a4-17b6-4c43-a382-54df893c0eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060466, "uuid": "8ad5f735-5554-4d8e-b20c-97b6f98ddca2", "value": "bot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a240de9-f0db-11ee-a120-42010a9c002e", "comment": "Malware payload (ConnectWise)", "timestamp": 1712053512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053512, "uuid": "9bf2e8ae-4b50-4121-8844-e0ff4d0b3ed7", "comment": "Malware payload (ConnectWise)", "value": "012f7cdb8804eb7a23fa57ddbf954862", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053512, "uuid": "617d1fb9-8fb8-4b5c-84ed-3d52a9b82c2a", "comment": "Malware payload (ConnectWise)", "value": "11195d57abd9dc0ce6d69cf039a71d0a7a7872e581d12fad7f5edcf00343cb2e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053512, "uuid": "f5c9d150-e03c-4faa-887d-df8d0912a0ba", "comment": "Malware payload (ConnectWise)", "value": "17ee0ee99dfad6c19e418cd5338b85e411cbd43e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712053512, "uuid": "2c2d6311-9b78-48e4-bd24-affa44aee152", "comment": "Malware payload (ConnectWise)", "value": "c78aeda11ab62f7788f7c6b8f94f073dffcb289642cbd75c31fd5fa350e34f6f8915a500e9f51bcc5efe29866b470e36", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053512, "uuid": "6c348eab-7d23-4909-ac2f-be7e14747cc8", "value": "T1ADC46C223378CB7BC5AF473CB0E1186557F1E802A985D3AE6A90B8D91E973C14D453E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053512, "uuid": "c0c9ca97-507b-4c89-ba81-d2a812566427", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053512, "uuid": "922eb7d8-5772-4a64-819f-1c737b096f9f", "value": "12288:Ipu96mzdjnwbrYQySjbs03fG+Yg2PQG7M:npjpSjqb7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712053512, "uuid": "4cb6b3a6-ad3e-45d9-8960-1d0dbe882cd3", "value": 587040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712053512, "uuid": "3fc40dbf-5705-461b-96b3-713409641076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712053512, "uuid": "f91b3584-53e2-4959-842e-76eb3a75d572", "value": "SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.MSIL.ConnectScreen.gen.20205.9746", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3a360a-f0be-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041064, "uuid": "607835b1-3105-4a02-b793-f3c5fd0d11b0", "comment": "Malware payload (AgentTesla)", "value": "be219670ce836f4a0eddfa86885df4e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041064, "uuid": "ead6b128-86a2-458d-8c36-0ebd49111012", "comment": "Malware payload (AgentTesla)", "value": "113179c64692a1db2bb8124a9d360111b7084061ad6d7b43c888814c8ee04e94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041064, "uuid": "35704a5a-8b37-4622-83a4-541fc43122c1", "comment": "Malware payload (AgentTesla)", "value": "5a78d0441bfe13b0d99f4e5e68ae2bdef6c9a22f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041064, "uuid": "f3a450c9-fdb4-4e07-a296-811019296ef1", "comment": "Malware payload (AgentTesla)", "value": "8a006e2dd9f71dbbb5fa7bd08487ed5fcdf1eb10ba7aca9f574f9034eed69ffab20aed5c8f2e23cf6251c8712107880b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041064, "uuid": "6017186e-42ae-4e1e-8e0d-760a7348b614", "value": "T14DD423E37C571FF64A597E6E1E3C332EBA9EDCA9AE9106570701620ECAF31011851736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041064, "uuid": "69e9f64a-2112-4126-aebe-d41137efda60", "value": "12288:qgeiMTUvGLWstY7GiPgSuFShCHzIr1MFutvfCHLMFMFfFlG7vJ/vAB:qgevAvGRHinuFqCHzIr26Hte9m7vpAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041064, "uuid": "f5ecc68f-a6ed-478d-b5d1-0c7a4e927a51", "value": 654209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041064, "uuid": "6a2d1cb9-7ced-44cf-ae1b-54626ee4ec76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041064, "uuid": "3bec4d9d-8239-4dd4-9093-61facb03e3c4", "value": "RIVISED INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8adacbd-f0be-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712041350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041350, "uuid": "063d60af-415c-4046-8ae9-70d194ece9b7", "comment": "Malware payload (Formbook)", "value": "0b90be647821fb3812e6c340c6587fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041350, "uuid": "2e5acb19-20ad-4fb1-add2-9b2a914c0fcf", "comment": "Malware payload (Formbook)", "value": "12c7ec6f047ebf12cb9f142bb71fb0de5a61de79286776440b5814c94d93e2e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041350, "uuid": "289d7c2d-66e6-47d5-9ef2-5e6fe5890ed3", "comment": "Malware payload (Formbook)", "value": "04ee5bf64f4fd6a512828a818c110697d19f18ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041350, "uuid": "aa1d802e-4cdc-4117-92ee-12eb59392f1e", "comment": "Malware payload (Formbook)", "value": "85cd11d0d2c2a7a4d971f9b77d9a848f05777540fab2c356711515e007fc9e0831b73ce581e5cb7070dc851d03775253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041350, "uuid": "9c744a81-d23e-48db-b89c-b136e86f51c4", "value": "T178D4224633B8692BDC7E88F3A169BA274FB0A6263D55E6CC4CC220CE4DC6FC01795817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041350, "uuid": "30f67750-24f6-408e-99e0-8cc0f3dbe773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041350, "uuid": "e4f0c950-47e0-46da-8c85-f4529c8a311f", "value": "12288:233bFUoSfRmhTIJgWGdm6HrC/QpCiriaEHCnLEovkR:23pqf8TIJge6HrCy6hHCLEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041350, "uuid": "5c41e590-03c4-46b1-b7df-5446b1c06906", "value": 624648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041350, "uuid": "6a1421cf-8a59-4f8e-bbe1-dad6a127e8bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041350, "uuid": "f1b1c347-66c0-4f7d-b26f-442daae92ba3", "value": "bnY2j1hTDlb4vxF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427c68cf-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067243, "uuid": "5fbeac78-ab4b-4cf1-b6c9-f5de35232dd1", "comment": "Malware payload (Mirai)", "value": "fa5cd909e8db0a964c27b8bc1971ced5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067243, "uuid": "aaf3af91-d33f-4cf2-9012-962ffaa3c3ea", "comment": "Malware payload (Mirai)", "value": "13aa0376a46026845987d8083eee4290ed0329ff2e9fca68c41badfc0db9cf73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067243, "uuid": "ff0d8be1-23b9-4c77-b5f9-65e58773194a", "comment": "Malware payload (Mirai)", "value": "89fc80412a32a3db829bd5de118b5044558d780a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067243, "uuid": "84eeafa1-5bf6-40af-af49-6398ae0cd0e2", "comment": "Malware payload (Mirai)", "value": "617d549c45d3cfc47419ae882a5f3cf2479108c326c4efce4625ae14526a51d0d78b9edc1b8cbaa6158c646cbc28fe0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067243, "uuid": "b623b2c4-345d-454d-8495-63bb333f8d8e", "value": "T1A7635CC9D183E8F6E81611706076EB3FADB2E0BA1129DA87C77CD171FC86641A117ACD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067243, "uuid": "e2983e34-00b0-44c6-bb53-667dbf27171b", "value": "1536:gappboyw5WCqcjCQ8nihWBOReRUchiGpTnN0pNUugIkxpesrsuB5n:gappEyqWC9ai4BO0+chiGpTN0LsI+enW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067243, "uuid": "5f4dfbb6-9615-401e-9236-dcd67747cc62", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067243, "uuid": "3b75d481-500b-4c18-a023-1a79b912bbd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067243, "uuid": "b586455f-5384-464e-90f1-99660cadac98", "value": "fa5cd909e8db0a964c27b8bc1971ced5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81df3fa-f0f5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064891, "uuid": "74f6fa58-3e4d-4a13-9309-b73335290c30", "comment": "Malware payload (AgentTesla)", "value": "a2dc2f05e00406b46156d003b438f6eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064891, "uuid": "e76c491d-2d84-4453-b125-1b7f132c1a29", "comment": "Malware payload (AgentTesla)", "value": "1408213c15754a0bb54ea752fbd95cd21ced805e8398548fc400526058d6606b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064891, "uuid": "f799a19a-f468-48dd-a9f5-7bfdb72b8ae5", "comment": "Malware payload (AgentTesla)", "value": "19ba6a08076c6ff6736994c25ff8aff97e1107e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064891, "uuid": "3b36d6b4-f44e-473f-afc5-e6820cd304df", "comment": "Malware payload (AgentTesla)", "value": "e3dac7e2d01e13cc0287d598d9398647680495782b2ec51dc1a0ed0c69b875aaa28b8af4fa69c5f663870e927db2354a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064891, "uuid": "dbd0f5f0-a123-45b9-bbec-a7594eb6163f", "value": "T1CAE4221477741627EC7A90F66CB0351A13F269062ED0D3C9BC8A34CF76E5F89A28895F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064891, "uuid": "bfbb487c-b70c-42c4-bdaa-a6c87a47e6e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064891, "uuid": "3cecd42a-6bd1-4f05-b7d9-8c285d5a7c1a", "value": "12288:/33b9bSmFGsICshc7oQ8nOLnFzCFPdoZkDOK0QqwuJGTK0Ao:P3l7IncoQmenkFPq+O9QqwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064891, "uuid": "50e4dbdd-4df2-4139-8643-965090b876d0", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064891, "uuid": "77d00b65-64cc-42dc-aec4-f382f92fc1d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064891, "uuid": "6b3785c3-96f9-4048-bf4a-4e27e5097c30", "value": "Aykuttekin YEN\u0130 S\u0130PAR\u0130\u015e 0191621#01042024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbd9609-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064551, "uuid": "33fd6345-d7f3-47b8-aefc-d2b910639980", "comment": "Malware payload (AgentTesla)", "value": "128772878ab0018eb3cb68168202da5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064551, "uuid": "cec818bd-de93-4299-aebb-e0ce302f7aea", "comment": "Malware payload (AgentTesla)", "value": "144aedb5d8473f0ffba16e084e3aed8fe50ea464d9647f24d9ff162a239f38b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064551, "uuid": "aff3ff0a-cf04-4b45-9715-4a23fc7dae91", "comment": "Malware payload (AgentTesla)", "value": "c0869abb85a93dae4ca5d3cd74f8509ac32ec49d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064551, "uuid": "e9a16fc2-3b3a-469b-aa76-7e755ff2a4a1", "comment": "Malware payload (AgentTesla)", "value": "59b01c3f22bab8b9a0234b8315abe4c59fe3bff1615e637028b0a5814b6ac2a65c59b8ffd0eacf4608429eef27630f7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064551, "uuid": "c170c17b-2564-471f-8c14-94de7123d0ff", "value": "T183563B30D390A5E5D1A7C031C9DA4FF4A5E2753B81365E0F1984DC1A2DFAE609FAD2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064551, "uuid": "628b06e3-8c57-4c1d-93f0-4b8281be3e44", "value": "e7b1f94260f7161363d71fe0112b86ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064551, "uuid": "15a2551d-cd84-4683-8199-78fba30641f7", "value": "49152:XOtTwbWWXM6iBvszLLA2M0TNyc87XEQPfg7wL0IOhUuofE1BebczOBFgbb8Civse:8mD/sGJcdm81pwGKRdpoSKgtTThO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064551, "uuid": "fddeb995-b9dc-4b94-b645-f263e5482b35", "value": 6462082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064551, "uuid": "d5b0bb3c-dd49-46b4-9ff4-ba789aeb84ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064551, "uuid": "fe4da1fa-eb2a-4bd3-a85f-7b7a8d6e8eb0", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30508158-f0c5-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712044020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044020, "uuid": "1cb9c114-d89c-4a37-96a7-c3a4bc94c6ed", "comment": "Malware payload (RemcosRAT)", "value": "0f9c0e378126ff2574bf3915ddd07014", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044020, "uuid": "f82a3288-57d2-4ec4-8eec-6db1b3742265", "comment": "Malware payload (RemcosRAT)", "value": "145f990406000a1e944fef609e608edd4f6a347d4038e880599bcc1fb6c709b7", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044020, "uuid": "f9473d5e-e2be-4b19-8714-c5a0d06b6ffb", "comment": "Malware payload (RemcosRAT)", "value": "29164c7b01fb5b05e1edda76c5dd400a94433272", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044020, "uuid": "a19f7f04-a8fa-4440-85f5-596c4df8f024", "comment": "Malware payload (RemcosRAT)", "value": "4ba53f63f3cda69bde9098fea1ceb80d89041dbdba16f908e0aa38de979ce19947d729169cbab96a9f5cf4da00f92a02", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044020, "uuid": "6c6e268d-a507-442a-8ff3-fe1cce003025", "value": "T127153345180D2BD768B07A780B5978BD29B17AED15C8B1807B65E8256FFC3C8B1D08F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044020, "uuid": "18245e30-e26e-4aeb-963e-a8137cb4c4a9", "value": "24576:IIp/sdA8JNZbSitOf5hte/dT9Ob2PBN3fLAU+hrObAQyXfrw:7pCA8SitOxreOELb+hSAfrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712044020, "uuid": "38430da7-9880-46c7-86e4-ef3b19144c8a", "value": 942581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712044020, "uuid": "9f3033e1-7bf2-407e-a46d-31ff1aedd1da", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044020, "uuid": "3a8cc63a-c2ae-4b34-9c25-4a02aaba3e11", "value": "Quotation.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa1795e-f0ff-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712069118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069118, "uuid": "51192653-a71c-4eae-b9c4-97f7f8ec00da", "comment": "Malware payload (njrat)", "value": "6abaab6c3d6b1446b67325bcd14d11d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069118, "uuid": "7fc82efd-17ad-48dc-b273-aa56b9c5fb46", "comment": "Malware payload (njrat)", "value": "14e564b871915d4d37cf992c664252ddd390e954ba9ccf0629aa497184df5d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069118, "uuid": "e5e22585-89f7-48d7-83af-7213e1efe651", "comment": "Malware payload (njrat)", "value": "052a7939b40f1862527529ba3b5f2ac4a6bea466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069118, "uuid": "f23bfd58-a66d-44d9-81b2-031b4965b547", "comment": "Malware payload (njrat)", "value": "5b693686519f5b8dd83bd4ef685a75ee01d4305a118f24b9513fc9c83730d5b2d5bb6c05c5b27da36126fa2001f07b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069118, "uuid": "c954c5d0-5e1b-482e-a811-27dd043747da", "value": "T1BD032A4D7FE18168D5FD057B06B2D41207BAE04B6E23DD1E8EE564AA37636C08B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069118, "uuid": "04c2dbfa-a789-4c24-94db-282f9a245964", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069118, "uuid": "d225e061-0985-4751-a1ae-a1bce5e77e24", "value": "384:xE2KMizdVjnBhFbJ8ycPN/fnGwacpirAF+rMRTyN/0L+EcoinblneHQM3epzXzND:u2gVlLJfcPN/elcIrM+rMRa8Nu1nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712069118, "uuid": "e7a92bf9-ee59-484d-8def-8e62ea198880", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712069118, "uuid": "2aebe008-ef27-495e-bd30-da67b03dd7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069118, "uuid": "ed81370c-8e6e-43b6-8626-a4a803f484be", "value": "6abaab6c3d6b1446b67325bcd14d11d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd215b1-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039375, "uuid": "4e03ec0d-9f84-42eb-98db-1cbdaf1c9020", "comment": "Malware payload (Gafgyt)", "value": "eb29845c5b37100c3ab5e4e503ea5e82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039375, "uuid": "edef4b0c-3b79-48cd-9b63-4cc98ce7e5c8", "comment": "Malware payload (Gafgyt)", "value": "159c47b679b7c7f0887ecf4fd48e046700f1d5c30d985a5249e2299c0e626cd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039375, "uuid": "d23ea100-cd6a-4f33-996f-39eb990b2394", "comment": "Malware payload (Gafgyt)", "value": "cc310694aceb8d08919b878efbd72eb46868d155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039375, "uuid": "e0ef426d-a24c-4f05-b7e0-c0f91069b65d", "comment": "Malware payload (Gafgyt)", "value": "bda1a6f9f6e7076bef696ced0651f9013c87a4aab3ee01600befade2b21ae392f03c43db67e55fb1f2029fec29b952e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039375, "uuid": "ad0d32e7-cc9a-41b8-9ee5-a947487a515b", "value": "T16FC319F9E30BC6F3C40316F2125BEAA70D21B1B7166AA985E7282D70EF734C62555F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039375, "uuid": "fdd3311c-7b15-4b75-a8a2-2593fce48e83", "value": "3072:TWpbc37+Qp2nrkGJc/85hJY7rpmJC0OzQaGyPZk:T9Lyc/85hJkmJC0OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039375, "uuid": "fd563434-78db-4b2b-9d7a-3dfd83e89266", "value": 127460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039375, "uuid": "8842511c-0c20-4449-9f1f-4721338e4d7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039375, "uuid": "75155ac9-67af-42b5-8c06-b604fd798350", "value": "eb29845c5b37100c3ab5e4e503ea5e82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d3a4c8-f0c9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712045855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045855, "uuid": "3d06c64c-848d-4766-9c68-924de86fb7f5", "comment": "Malware payload", "value": "d5198ca444863a3138d9f63165cbc8e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045855, "uuid": "4a2dac14-d460-4c74-b8ae-45a0b9f270e4", "comment": "Malware payload", "value": "1865817302b3d3eee0fa870c1291e4cc170f2df5a361fe2475f2faaa9eb551fe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045855, "uuid": "e3dcf4eb-8e27-486c-8c6b-34ad14cf9c98", "comment": "Malware payload", "value": "b6088e1c294cee0df05dcb30ab5c53b6760ad71a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045855, "uuid": "0a67008d-8ba0-42ce-a54a-b3f67db43576", "comment": "Malware payload", "value": "27e91830282cd4a173e22e09bea5c362493fe4608b19986c56a7e4eb2fe006b6cca5c5b75c41ec229f931bc256e270b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045855, "uuid": "b20d08bd-d5ee-407e-b049-77fd000fcb00", "value": "T1BC57334629CFC0F8DAC52D64871F76DF03B356B68D844928A6C03DCBE961F7360699B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045855, "uuid": "d7a4de7f-c692-4135-ba27-1f9a84eb4a17", "value": "4b9e76b096e66961c3b83d8639b9cc95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045855, "uuid": "d63f7a2c-f4d9-4002-b061-41c90c2501fa", "value": "393216:sQvBBJg9lDG2ox82l0A8Fuq7qBhYO5KNzUK+DL52AuzVr:sQvB09tG2oeej8ceqBG51+X5TuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712045855, "uuid": "5e5e2455-57f7-4324-b9ef-549a7ef100c6", "value": 27323904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712045855, "uuid": "51c649ab-97c1-4430-886b-0052d770fc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045855, "uuid": "3f985801-a9ba-4f51-bb90-675cd8b350de", "value": "RAM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a6b4aa-f12a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712087589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087589, "uuid": "ff47bbfb-4c1b-4a69-a894-ca0c50d0c762", "comment": "Malware payload", "value": "f65caf108ee51de0471dc6b7d915f8c3", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087589, "uuid": "dc40d84b-7756-4818-98e9-7e49a10a947b", "comment": "Malware payload", "value": "1aeea9f11766b43172a31323560f1198647e219aaa8ba332aabc8e27c59fa07b", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087589, "uuid": "b4861a0e-95b8-4f60-9dbb-56dbb91125ba", "comment": "Malware payload", "value": "e7336957f513ae9d5747b80a8fdd58ce4704f79d", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087589, "uuid": "5847330b-a327-45b0-afaf-be01ddfd7129", "comment": "Malware payload", "value": "d9760ffc74f5cab359c37955dc3f188170c2cde5e601b872769f80696bbf2e3f647be462548ec0d1b9dc7f07cfbb0fa2", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087589, "uuid": "321719ff-2b03-4418-b31d-8eecfa03d231", "value": "T1F037B20DAEF71091A923317C8FAF640AB6748017190ADD143D8DA3945FA953867FEFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087589, "uuid": "0412d15d-979c-4c0d-83fe-2225fb37b4ed", "value": "49152:L7V7zjCxbzqHlp4LhyN0kfhDzGZzjYzYsmCD+8z2V35kr/9SbGqmr3quVIKwglcY:b333333D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712087589, "uuid": "03fbdb57-01d5-42c9-93e5-8ea7d1426261", "value": 23605960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712087589, "uuid": "af2482f3-bb66-4135-9d8d-1cdddd36e389", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087589, "uuid": "33106cd9-1e98-4970-b08f-40fd23ca0bff", "value": "co-trustee delegation agreement 66445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f44f366-f115-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712078566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078566, "uuid": "46df2515-a021-4e1d-98fc-d2286b036458", "comment": "Malware payload", "value": "6fff48b0487aaff9d4a7e9032f1a9aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LeprechaunHvnc", "colour": "#471618", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078566, "uuid": "a4120098-cde4-40e7-a1a7-b059a8e14c55", "comment": "Malware payload", "value": "1d0753beaabc660960bb5297f43eae38128647c2a23b02b2550646d58aff8797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LeprechaunHvnc", "colour": "#471618", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078566, "uuid": "1a407ea7-fa1e-4fa0-b518-c06ab707a951", "comment": "Malware payload", "value": "c4bb9ca0b75851a7cb36f5359383c33763f871c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LeprechaunHvnc", "colour": "#471618", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078566, "uuid": "d4df4dd8-9014-468f-83a6-fc2eeb634dd6", "comment": "Malware payload", "value": "f4e698915ed880ce0691c108489456166af920ab386ac130e1420f22801806815f96a3a126bd98531a7bed3bb6401ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LeprechaunHvnc", "colour": "#471618", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078566, "uuid": "d89db5c2-a147-4cb1-aa50-1e4c85ab58d7", "value": "T1BD722810EDE08F22D4F346B864FC6796493D28599F7581FF299124B8CC716C3A936B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078566, "uuid": "017b7095-912b-405d-b10f-1c7278171427", "value": "7b4aa3f51180154f434776a3c7ed1e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078566, "uuid": "68a66a94-487a-45ee-b2aa-9de468a26b90", "value": "192:D+ACeYqeviSJDCWzvYeFqfrPwolraE/cmOPoR4y3Qkuu5LjjfO7If++7uLa3wRy:qqYqepmsvVFqf7kmOPoR4XkHoIzKfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712078566, "uuid": "a16723c3-f3ef-46f7-9e10-b915b7ba63c7", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712078566, "uuid": "3eba0278-3319-4f13-8a72-9edabe21aeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078566, "uuid": "6c04cc05-5da9-42b6-a32e-8aee503df0c5", "value": "6fff48b0487aaff9d4a7e9032f1a9aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80639bb-f107-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712072702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072702, "uuid": "e7f9be29-8e93-4028-a6c6-1cfc449fcf21", "comment": "Malware payload", "value": "3288c44d80826c41da4af9f71590ef0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072702, "uuid": "e7e5ad8f-4580-4055-a314-4d3cb238da7f", "comment": "Malware payload", "value": "1e2ed0898aa875d7dfb97b65a67be55f0aabdfa1c80a92c6fbe57bdab44bf66e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072702, "uuid": "a35b8d89-732e-45cc-8146-15226bdcaa30", "comment": "Malware payload", "value": "6f0dbaf49d3405cdce8030b10bbfebd2cda1545e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072702, "uuid": "265dcb31-b4e0-4dac-a697-ac465f944ab5", "comment": "Malware payload", "value": "57ffa4ebb8982a0db92b374a0a886492d96d28eba2a51888d0dc0cc8a58e64b538fc90342d4c23f354acc5a63e950936", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072702, "uuid": "073d75b2-28b3-4e58-a19e-847fe4823e9b", "value": "T149C32086BFA03FBFD81ECD324198CA0612DC4A5953A4AF7B5E74D404B69B14E5AD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072702, "uuid": "d9b0175f-a69b-4f01-be9a-94394d1f4348", "value": "768:GNNT1Nc12cVJ4vTYAc02GeJy3B2LGFMahPur8zhkbDrjeQ6BN8YJq6J9yx9Ly7YW:GJ2GrycubDr6HBN8DCoyEElqXyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072702, "uuid": "b6944ae0-19f2-4d09-af51-df82a8d5417b", "value": 120016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072702, "uuid": "001c5b48-4125-4fc4-8e48-ffa507136bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072702, "uuid": "17c2176b-ed23-40a7-ad76-fcfb89d2140a", "value": "3288c44d80826c41da4af9f71590ef0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bca8996-f0e4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712057300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057300, "uuid": "5fc94fe0-ba12-4a81-a228-74342fc2ae93", "comment": "Malware payload (AgentTesla)", "value": "d948d1ccceaa9804844616cc8e2f687b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057300, "uuid": "e5094601-24ca-4bd0-a6bc-bbe198b5a2aa", "comment": "Malware payload (AgentTesla)", "value": "1ed7b5ae3de3f7028fef983aa3bc6be21b537803d70f1cb8e3fc43c08f22c766", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057300, "uuid": "75ebec6c-0c8b-426e-88fb-9ddbebbb5990", "comment": "Malware payload (AgentTesla)", "value": "d22ae8631c117e10b323ad9ca8109f17963bd435", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057300, "uuid": "d27e5e17-262f-4081-a9ce-34b11a8a2324", "comment": "Malware payload (AgentTesla)", "value": "5a20b23903e8c993e3ca924d51807434cd5d7755774da24090e7323ec60974b48e733780a8b3278c5645075057269328", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057300, "uuid": "ba606900-7c28-42a4-8d36-82aedaee251c", "value": "T19CD423D292134BCCB9B085C5D801D9606680A672F19AF9ECD76567F6F6FA7FC30C9820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057300, "uuid": "af0fef46-dea3-4853-9486-891a3cc6f1d1", "value": "12288:qIa6h+zSJJXJb9JobSNrtgTe+1HUrG0D32csMRziZan6oJbeGu:/a6ozSNb9KbSU1Hoxh5iZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057300, "uuid": "c0d7b22d-84c0-44aa-a20b-1d84e4cf4b86", "value": 623479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057300, "uuid": "3d87827a-3804-40f2-b2b5-f89b4cde778b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057300, "uuid": "9f41230e-f2d6-4625-8e5e-df001c882486", "value": "Halkbank,doc.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c973a23f-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1712082502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082502, "uuid": "a395f488-a057-44c4-bd32-7882d7586978", "comment": "Malware payload (Loki)", "value": "3842b1edecf680ffcc5b589954b1e2e7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082502, "uuid": "5d6f9caa-d5df-4d56-a8dc-0493a8324b64", "comment": "Malware payload (Loki)", "value": "1f8b2fc02c47e074671147142b921f254d34a5808d25a130bb653dcb4f66df11", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082502, "uuid": "16214358-38b5-44c4-96fa-a2c21361f95a", "comment": "Malware payload (Loki)", "value": "d65c19110f0b3a6a93d9e5da6b6c13314c8cb9f0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082502, "uuid": "f2f71c51-17df-4bc2-84d2-8a1608e0e9d1", "comment": "Malware payload (Loki)", "value": "4280f17db0f4bb5f2087bf64049606ac36065203a2d72cab81e52fbb80b36ff71541a99a9d36544d6734f9881cd27e69", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082502, "uuid": "3f7f137a-1748-490b-a379-7464f2355f7c", "value": "T16282A2D0CB0D8BAD19475BFE976C2466812C45F2C9353262E86AF52CB82075C6FAC58E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082502, "uuid": "a671ef74-2605-48d0-a647-f66a0132df8a", "value": "384:Keg1Q1pDecxHUlxLDC1nLgl81sm4+ReJfC7EQ:KeVTecNUlxyOme+Rya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082502, "uuid": "349dd71e-13e2-4afe-9855-774e55111fbd", "value": 19035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082502, "uuid": "4da799ab-5d17-469d-8f39-d4fd86f6a569", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082502, "uuid": "08085a8b-9d06-4b1f-8e22-86e5142fbca1", "value": "UM-L24-433-50\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74781d3-f0c2-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712043038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712043038, "uuid": "9cd355c0-dd9a-4c62-9079-224b0d7dfc6d", "comment": "Malware payload (Formbook)", "value": "eebd4ce7d4ae2ccf575a02578f5408b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712043038, "uuid": "38e6e825-494a-4b7b-8437-45e79878e3a9", "comment": "Malware payload (Formbook)", "value": "201659dbdfcf74863cd21befac24ee34f3a1fd86985a2a5b4077810f7156e993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712043038, "uuid": "3201002b-53d1-40b2-b65a-825bf0bdfb1c", "comment": "Malware payload (Formbook)", "value": "bec0d8d1471487090a3698865053d1e63cbdd67f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712043038, "uuid": "58669c89-d1b5-4024-86ff-fa7984cd231b", "comment": "Malware payload (Formbook)", "value": "19afeed25ce199897946dde2790044e85b92757ad43ddd498676c177866742a381489d3e801ae8aac00abd36f4e7011b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712043038, "uuid": "3a24f50f-0947-4abf-bcce-dce5f81421a7", "value": "T13F05228477B88A2BE27F2BF634381590A7B878536134F7CE5E5120DD2891FC55872BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712043038, "uuid": "6452ee8e-80d2-4749-8626-a128051dd88a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712043038, "uuid": "8363e063-0c98-46a7-8785-4367f5b70fcf", "value": "12288:uPGmMZcdFaRNj61FQ2azZ1G1BLR3RE5grPtG44n/TAU5iu8QjxefnuYQgbI5m:uMEyoo2p7HE5QtwUeiAN/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712043038, "uuid": "a0c8caf7-15c1-4609-b5b5-7791ef153763", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712043038, "uuid": "11aaf03f-7289-4ad6-933a-d49c9b93dfc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712043038, "uuid": "80b69f95-ec37-4f58-92aa-3179cbba5406", "value": "SecuriteInfo.com.Win32.PWSX-gen.12092.5437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6159def-f104-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712071303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712071303, "uuid": "7d08ea8d-3093-4f4a-b4d9-5677b3dd76c1", "comment": "Malware payload (AgentTesla)", "value": "d92a21c6a7dd87615e5a92a5b29e6bbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712071303, "uuid": "1ae6d39e-7568-41d2-93b4-88da024ae804", "comment": "Malware payload (AgentTesla)", "value": "22724a1696221a7dd681f07484ea97a111e290c2b3c29d9b65142846c027ea7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712071303, "uuid": "af7c836a-8e9f-4077-a316-c4fc5058431b", "comment": "Malware payload (AgentTesla)", "value": "0fea4c51350118244e221dc42aef220c50586759", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712071303, "uuid": "0a3a869f-0ea4-49e2-9f87-abf89fdab5be", "comment": "Malware payload (AgentTesla)", "value": "f2fdb0c2034af5a97bc5ec75b2fabf9f98335f952c93d2b5af272e2f4b6c413b87bd8ee3250a68d29c72635d2dcfa9a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712071303, "uuid": "9eaec84f-a994-4f25-85ee-c5b40151a15e", "value": "T147A423EBE9E7B0B1846C3359FB3D9C5A382FD0652473E16E66D72925BF802515782F00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712071303, "uuid": "756e4839-f46e-47d5-b52e-409922dd33b0", "value": "12288:O/vRsxDjqIyfZZUxVKtxNpw0Aq8l6PkXqNGerHt:O/vWD3yfZSMZ+0AD6cCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712071303, "uuid": "85d89af0-ef0a-45c4-a4cb-19408cffa6d2", "value": 484528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712071303, "uuid": "91b95df2-aa4d-46a7-ae7b-e2e84e3875c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712071303, "uuid": "4f50d42d-2e9f-4db1-9978-fba8300f8967", "value": "708e198608b5b463224c3fb77fcf708b845d0c7b5dbc6e9cab9e185c489be089.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a190e77a-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (MyDoom)", "timestamp": 1712041633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041633, "uuid": "7581e87a-2d67-4b40-82fa-351bdff7a710", "comment": "Malware payload (MyDoom)", "value": "3f122d9a0b7a9f1aa8c973d170ee8d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041633, "uuid": "dd251f51-4d00-4a62-bfcd-64dae6d81f0e", "comment": "Malware payload (MyDoom)", "value": "23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041633, "uuid": "5b3b6ca8-876c-49da-8e8f-86355020222a", "comment": "Malware payload (MyDoom)", "value": "3fb032e1a7a3a9cc5ce0d5f03fbb7f74a063ce39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041633, "uuid": "c6b426a5-0de0-4718-a10a-9d5f05b94f25", "comment": "Malware payload (MyDoom)", "value": "d310d085a2c95e1e0de8d8098ce8d604c341844941e44c4aee2dc4bde1cbf0edd0a4f8443071cb24a70a339da6889de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041633, "uuid": "3b9a1bc9-b614-4b7b-ae18-d56cd40bfd30", "value": "T13DA2C09777AAA8C5C15541774963ED7038657C342AF8862B2F50FBAFB939B282D04132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041633, "uuid": "0969ca65-bb25-429f-964c-5d004be40d70", "value": "5d02f6de12eb07fb22fe87e05e50d6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041633, "uuid": "173808e8-76bb-44fe-9574-d85f0ed1fa5a", "value": "384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUEBI:SCIqdH/k1ZVcT194jp4ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041633, "uuid": "3e95f9de-b7f5-48e9-971b-416c20d6d20e", "value": 22020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041633, "uuid": "e4bed8ab-8647-4f0f-b5d9-c891995d3d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041633, "uuid": "6e03a7a3-bca4-460b-b985-9326ebbf2d99", "value": "letter.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8034dd-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067258, "uuid": "8c281791-dd27-47a3-b2ac-9ae2f621f5da", "comment": "Malware payload (Mirai)", "value": "0e503fa6f7a3ac50c7a32bd42c2a4083", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067258, "uuid": "4565c86f-e355-4a6c-ac0f-87b8187be7fc", "comment": "Malware payload (Mirai)", "value": "24c3b67d90f98e4bc7d6d55f4a8d2fed5fc2bbd3e5ccb9448e6eb0f2336fbdf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067258, "uuid": "5672da82-230d-4488-9643-be390952379b", "comment": "Malware payload (Mirai)", "value": "6add0dae7d316c495222158b6ea845ad37574e7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067258, "uuid": "02af3d8a-182e-49d9-9d34-f0482b606ac6", "comment": "Malware payload (Mirai)", "value": "d76989c0b3b5bc593390ad63251ed3dcd26c3664ea2f8da9c5c293ca38aff1ae1d99eb4e66ded13dcb95e6d0328aff9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067258, "uuid": "1da678c6-0128-4cca-bf2f-2b19fad7ee32", "value": "T1D643187A724AB22CEAF65074F44325E52951075C33CCE2C3B2E31579FEB0A097966E1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067258, "uuid": "f4adba0d-a565-4278-8d94-249121ebbd3d", "value": "768:45N+J7dDlYRAEVFghArN/BAuf5yuVultnhZR:2A1n8N/B3fbVKtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067258, "uuid": "98bfd842-00c1-4fe6-b856-9141545da0fc", "value": 59248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067258, "uuid": "48cbb4ed-620a-4040-964d-55ecc6c4850e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067258, "uuid": "fbc290eb-7383-4e0d-a86d-6ac0fcf8c3a5", "value": "0e503fa6f7a3ac50c7a32bd42c2a4083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728ae2c4-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712038977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038977, "uuid": "83b61885-4ec3-46b8-8aba-c8bf752f6030", "comment": "Malware payload (Mirai)", "value": "4390c57866b76dd2e8b6b4ac97045d02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038977, "uuid": "e3d00cea-1ea2-4ec5-a06f-219bc28fef50", "comment": "Malware payload (Mirai)", "value": "2551cdcf3e07cdb98bbb3a6b9e9e2b0bd6b01d9cfd73decb6d0bdd1af36123f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038977, "uuid": "3fb6ffb1-35ef-4a49-8962-766617586541", "comment": "Malware payload (Mirai)", "value": "709002392059493f9ce2a06ceb6e6daf2b62ef19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038977, "uuid": "24388c72-e8d9-4844-aafa-3e6854fa76df", "comment": "Malware payload (Mirai)", "value": "3ba01a118ca6df21c677946fd9e91e13a7dbbb33223fc82bd388abf4bd575972b2a841051fe8b321cb3bf0ce23812160", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038977, "uuid": "a9453974-c235-4316-8e37-8dd08f6d378a", "value": "T157333A8A64112E6DE9DB5CB981764F0ACE541220B093171BB3BBFDC339333A4FE66549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038977, "uuid": "fd682f52-a788-4932-b9f4-a05eec75de15", "value": "768:oaXTrofl4ghoueg2me2nPQCHEM/ArPwqLWZm2T6oxol7gSu9+f1prtkO00eViM:oaKdhoRg2mew4ChAVL557gSyg1pRrfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038977, "uuid": "43560298-4933-4b26-9c67-690517f6c246", "value": 52820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038977, "uuid": "c62df302-ebf7-4bf9-b2cc-4f550ebe31c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038977, "uuid": "ce29be6c-08c1-4317-8b86-732c899d38f7", "value": "4390c57866b76dd2e8b6b4ac97045d02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be076d6-f0c0-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1712041811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041811, "uuid": "8897709a-e30f-40d4-863e-1f7682295de2", "comment": "Malware payload (Loki)", "value": "a1995d868283174aa130cf719291bd39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041811, "uuid": "7fdde601-ab8a-4a78-8ea0-0e3b6c486962", "comment": "Malware payload (Loki)", "value": "26094e54ad508b3dcb6e865f95e9d73f921ec0c3b869616fc772a9b7f9218462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041811, "uuid": "b9a182c0-1118-4d8f-970f-ee6ab9fc2865", "comment": "Malware payload (Loki)", "value": "585c1302132bb9acb7b56a1370a0cc609a6cc380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041811, "uuid": "6173363a-32db-4f7f-bfdd-a4a2561c1cbf", "comment": "Malware payload (Loki)", "value": "f49ea552b647b9ca8c6c427e9bed6d16f2f94f76cabb27402a6ce811bedd79b3cc830d55ed75c007eedc99234bbe1c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041811, "uuid": "436941d2-0422-4e2f-a815-856bcc377438", "value": "T18EB412607108CF17D5125FFAD850A1F12371EC2AE801D6677AE93EAEB83275157823EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041811, "uuid": "fb27c506-2448-4314-97b5-0f11312fb2ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041811, "uuid": "f50a38d2-1d9c-4682-af5b-805ad32e3001", "value": "12288:aZcvS2s4WGURNzPhzUQXDbAvScXotUbL:aTBB3RRJAetUbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041811, "uuid": "91d35b89-2f7c-4b9e-8944-70cc8bcd4cc2", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041811, "uuid": "579eb6e2-fed2-4c6f-ae4e-8ddde4dce74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041811, "uuid": "29cee1dc-680e-43bf-8661-393976c75eb1", "value": "update statment of acount.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcdabe1-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038973, "uuid": "38bd1496-3c69-4f56-8149-4604f02fe409", "comment": "Malware payload (Gafgyt)", "value": "db18abdf021967390d4b4ad8c67f9907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038973, "uuid": "a805a8de-ee37-43da-937d-3f9299a2de20", "comment": "Malware payload (Gafgyt)", "value": "2672f3374ffe82754cf3a54047edcb4cb286f14b37e55ed6e60e6041423abb73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038973, "uuid": "49e5839e-1430-4536-8a95-31068fa28b07", "comment": "Malware payload (Gafgyt)", "value": "3e1d4af7dc737738a4ae435f4339cb2cbd687650", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038973, "uuid": "f0dddd87-2904-4158-9d6e-f6baebd095c1", "comment": "Malware payload (Gafgyt)", "value": "fb5368d5daa4a921fb6bcd88c9a5fa617b81c154807febf62e88e1e2ec4b1fe527185befbc4ec2795893265e73e42672", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038973, "uuid": "43bc035c-3b74-4569-9b97-34dda76c7bf9", "value": "T1DED34A37E4518F73C0836AB11C6AAD310F1595D31BAF268A267857F08B4F5CA744EFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038973, "uuid": "75281dae-71e4-4db4-bf70-400878e7aba2", "value": "3072:B1E8x83QHjqmgjHmhQXnE5hZttT5I7mAK0qW6MyoQ6:/E8q3QeXrHXnE5hZvT5SmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038973, "uuid": "be0da6d4-e593-4980-8b7f-548ee0286fac", "value": 140225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038973, "uuid": "332f0c18-bcb3-454c-9d6e-b606d514d778", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038973, "uuid": "99801e79-bbc2-4f05-bb1a-12c40456f093", "value": "db18abdf021967390d4b4ad8c67f9907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e46e0d4-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039480, "uuid": "844f5808-ca3f-495e-a911-b9856fd0f365", "comment": "Malware payload (Mirai)", "value": "998aafafbbbd88f4be57d3a3e3398170", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039480, "uuid": "9ae01d37-9532-45f9-a083-ab718261664c", "comment": "Malware payload (Mirai)", "value": "279b07a7877703530fdfbda4d5d08e855055d9778a99d8ff75e0fd93c17ba08b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039480, "uuid": "410ddecc-17f6-4113-81c3-4f6093c20ad5", "comment": "Malware payload (Mirai)", "value": "22b4bb2459497a28acc237e8ec62ca40a14bfac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039480, "uuid": "458e3fa3-b29f-4785-af45-56571021988d", "comment": "Malware payload (Mirai)", "value": "a3129f4050a7a36c269a7de4c0a4a89fde24df09084b0fda05ef098b3d9ce31f607f4bc02227e8461e52449b69543180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039480, "uuid": "f1207811-3cd6-4b91-8cd7-ac13d86aef61", "value": "T14DB37CC9E243D4F3E85714716036E73BAF76D0AA2119EE82C7689D31ECC2541E627B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039480, "uuid": "71ac3e04-9a21-40e4-886a-d007b4bd9c2c", "value": "3072:47C2+ooVx7TmYDI/kawmPJNTkpmJ7/vUzlQ:47C2+ooVx7TmYDnD4O4tHUzlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039480, "uuid": "f554a6ee-346e-468e-ac98-60bcb4b857a9", "value": 108676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039480, "uuid": "9a4f7f08-a3aa-4650-b879-c54e9dbfc63b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039480, "uuid": "a746e9fc-a472-4f84-86f2-10ba45829d48", "value": "998aafafbbbd88f4be57d3a3e3398170", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6735a3ef-f0be-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712041106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041106, "uuid": "5d68d7cf-a7a7-4e75-bd25-31bd43f001f3", "comment": "Malware payload", "value": "bb0fe7f4b81b5aff8e08a573a4af5afe", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041106, "uuid": "5f9f8884-07c5-4163-a221-cc18aa4489ca", "comment": "Malware payload", "value": "28250f36a6a812013ee5ca63a240e906bb6bdbc8449c98f2a637a9b8224a8f83", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041106, "uuid": "6c078482-21d6-479d-9ef1-9b34e11bb268", "comment": "Malware payload", "value": "7c50ad41b1294181f31f5ff21cbe9fd259f4368f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041106, "uuid": "85b67f19-f7f2-4e9f-9f5e-412e4c3bf023", "comment": "Malware payload", "value": "fde4d8691f810a9ec6a6af96497f0679deb741b52aeea79b48b13f6bfa49a22ce61ec1c66dd29448c6eee4861811c985", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041106, "uuid": "d8daec2b-dd86-4d12-b48b-8917eb5ff4ae", "value": "T1B4F623657AC78066C94D00B6EB2AFEDF0276AEA6077144F376C538CE24F1DE0A179903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041106, "uuid": "9aff0e1d-31e4-4135-84cc-c83a75847980", "value": "393216:Bm7XLb67QY8qqA63ME2FRBBvBYDyHOevu+P:iTYp63+nBgyH9vuk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041106, "uuid": "aa90ac8f-ad70-4498-8282-e1e50e930045", "value": 16158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041106, "uuid": "13a0aa6a-94ec-4c38-b6ff-a307905acbd6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041106, "uuid": "ed003c92-2b74-49c8-a4bf-f330fc037889", "value": "SOAPrenovacion.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2219b037-f0f3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712063753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063753, "uuid": "a7d33bb7-a453-451b-bbe9-25b707c68cb3", "comment": "Malware payload (AgentTesla)", "value": "cb6a3132c426ff0155f2f7a33c7ae78f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063753, "uuid": "caec9b4b-5598-4351-a071-210a64bf2248", "comment": "Malware payload (AgentTesla)", "value": "2950be5510110fde97d4cabeb69070d8e029c8cf717c3f500fdd843dc7f93347", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063753, "uuid": "90ee884e-6bed-4a67-be95-54c43ca760e7", "comment": "Malware payload (AgentTesla)", "value": "504e0bc115b213ac8e8e775f3fd762c56debc97e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063753, "uuid": "3b2797f8-e48d-4e02-8c88-d5d9cab06ee0", "comment": "Malware payload (AgentTesla)", "value": "7f623b7ac51dce71a405d4541dcf56d18d66b215fbaacebdcd087a32ec125c95a4d805151f0eaf6c7a2fca7b38259896", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063753, "uuid": "7863a9ca-ba4b-4402-976b-59aa81dc8447", "value": "T188B5334AC2F2A0B3C5218ABA01D5E197EB364A97972DE39E2635351E30C77B2C5017F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063753, "uuid": "0dce0b4e-9293-4625-8bf7-3083ede4777a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063753, "uuid": "af65973f-a692-4ded-b132-b864e3a00f76", "value": "49152:WMmT9Y0kEhXYpYMLhm8gYIg6cnpXXZZl9jhGzEuRY5:u1J4m8gvbolBhGzEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712063753, "uuid": "de837858-adf8-41e3-9fda-90cc31a304c4", "value": 2273792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712063753, "uuid": "f6a9375e-198b-4807-af04-3183730cd35d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063753, "uuid": "d534ee9a-aace-4ce9-bdc8-0b8d087eb908", "value": "Idthjqzannj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0ca19c-f11f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712082936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082936, "uuid": "6f8de07d-099d-46f3-9749-7e618717bfcf", "comment": "Malware payload", "value": "cc4542d0f27386e42bebedfb58eaf2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082936, "uuid": "54ff2cc6-fca4-4aed-ac75-3a083d14bb12", "comment": "Malware payload", "value": "2c34ff6ec34bb71edb9e73f29af4cbfc610da2c99e18b7f3c85535c097b1a87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082936, "uuid": "5156d7a0-6997-4f3a-948c-8d0179d4e4d4", "comment": "Malware payload", "value": "7404d837116b090d2be4747211d3382e3f0fdd8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082936, "uuid": "a580f435-0548-4b49-b8b4-8bab34795e08", "comment": "Malware payload", "value": "b2dfa73a5304440c22396ce78cdd39ae1756ff6ed5d45acc86cc4f48cb01f05035ace68b64d29823d9738bed480b0299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082936, "uuid": "733d7170-9ddf-464a-9d2b-df2f4e3e2272", "value": "T120D50222EF305826D45241F43039DBB1A737AD130760561B22F5BE67BA396CBBD5B20B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082936, "uuid": "e5573b3d-8851-4cea-a6d6-9003d6a7fc84", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082936, "uuid": "157b9dbe-3189-47c0-b80b-3eb069e36400", "value": "49152:cYo75tM5lJmO+X5SFvi9IOSG92+j/twFZCPG2rUKJtTAPjmZcR2:ZY5WD+X5SFToQZUveucR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082936, "uuid": "005d9c2a-7ebe-49a4-86c5-19a1a1178201", "value": 2933821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082936, "uuid": "82211372-e624-485f-8281-1f6109ad7b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082936, "uuid": "86b1123d-2b0a-40e2-a7bc-dc6249101163", "value": "2c34ff6ec34bb71edb9e73f29af4cbfc610da2c99e18b7f3c85535c097b1a87c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b53782-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712064376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064376, "uuid": "174057a0-044e-47ec-a99c-15e27f7743ff", "comment": "Malware payload", "value": "cd27d87f15dfcafb2b7686404880b686", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064376, "uuid": "032dc0ff-b6be-459c-8dbc-7a1dda05d92e", "comment": "Malware payload", "value": "2c5e28cf4335982bcda39bcfa174a9eed9cc9cccfbc641eea5ea6a958809cdba", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064376, "uuid": "1eb754a6-6f99-435f-af77-914bb0ab6240", "comment": "Malware payload", "value": "6f934958475906b384c503e4cff2718700ca535c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064376, "uuid": "d9887978-4e65-4f67-bf4e-5ce08db454f0", "comment": "Malware payload", "value": "5a0faa031a33ecdfd4bd9607b8f732aa899ce7f0f4902bc97ab542f97eb83b34f15ae5adbebd8cdf2680338fc1daf503", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064376, "uuid": "6de9e743-580d-4507-b22b-2ae71989d84d", "value": "T102B1541663FA4104B6F35B4C993216B84F77BE6A683CC20C15DC285D2FF3A8498667B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064376, "uuid": "ae00f03b-c33d-42c6-accd-7e174a5fc448", "value": "96:IQeTdirSA9ADNI1uJ0ASbqK/x5hrZooCQlkc8fyNGZ2kI:u6fXN17C/2kI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064376, "uuid": "9f7fddd5-155e-49f2-a443-bbc02c266227", "value": 5498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064376, "uuid": "1fc2435f-7df9-4138-af06-99a3bfe91623", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064376, "uuid": "b204e919-134a-42b3-a415-c05b5a2ab5c8", "value": "Account_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54409b84-f0e5-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712057824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057824, "uuid": "14d3b2a5-b483-4a43-92b9-a98bcc2e14b9", "comment": "Malware payload (RiseProStealer)", "value": "a4702dad93dc851947aa6bd7b9652c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057824, "uuid": "25eaec43-4dd0-4b12-9672-5074ccb7e531", "comment": "Malware payload (RiseProStealer)", "value": "2cd378dd3e9c3ddb6196c7c8a9dc1c88ecf74b2371f1394bd01ff37857a8c7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057824, "uuid": "ef245d7c-a037-490c-82e6-22f4221b4ca7", "comment": "Malware payload (RiseProStealer)", "value": "99f23b3077fa0f57c3c0cb95341adf38fdeb6142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057824, "uuid": "7fdf2b55-f37e-4863-a71b-2288e78693b4", "comment": "Malware payload (RiseProStealer)", "value": "825eb900f50f48635154f68a1d6eee49388da7c149735be0347f32ed6402719695589500afe0761868dfbb639688ecff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057824, "uuid": "0d8245bf-a83c-4f38-966a-e15a30d30afd", "value": "T12E35BF69ED02207AEE02ECB48599F7BB8253D80BD534BEB3DF4FC511F8331556286A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057824, "uuid": "03807c24-f02f-48ca-826e-f694e2899f6a", "value": "9f16b23518724d32f6bdada66281f695", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057824, "uuid": "66ba6b8e-161b-4887-a1cf-3067a7423dad", "value": "24576:SyvFWZZO/TzAEuDtTVAxn+NZh0ocqB8J+zFX/DZCtkY:Tn+NZGolS+5/caY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057824, "uuid": "4cd17b3f-da2d-493d-81fe-39f6308f11a2", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057824, "uuid": "a26ade37-591c-40a2-81b8-2f09f2a90aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057824, "uuid": "62d927f7-3e55-4808-be68-fb5f18c82379", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aacb76-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039363, "uuid": "ee9eec76-19ab-439e-a915-6b8552bad7cb", "comment": "Malware payload (Gafgyt)", "value": "080ac9573cef252446c672757fe09f3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039363, "uuid": "f2691cde-1e3e-47c9-b01a-feee9eab4c72", "comment": "Malware payload (Gafgyt)", "value": "2cfa87d85fee32a220fb2798f8551525c8e2b2901b15048f34d86ec03f3d415c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039363, "uuid": "2fe2f58f-1e1d-40fe-bd93-63e069b1a303", "comment": "Malware payload (Gafgyt)", "value": "537a9947bcdbdf800c9f772555fc70cbfe5fd36d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039363, "uuid": "ce650c04-42f3-4f3e-9aed-af3929877409", "comment": "Malware payload (Gafgyt)", "value": "43e4c06622f308a426f7201c6ddccf4a8e2b22e7ede6e5080701112bb120c9fd9e3001973cec0f5ec1f04ca1ff38eb87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039363, "uuid": "990625d1-d227-4371-af3e-49eb2feab38e", "value": "T1FBC319F9E30BC6F3C40316F2125BEAA70D21B1B7166AA945E7282D70EF734C62555F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039363, "uuid": "f7f1e763-195e-488a-b237-644ece2b9057", "value": "3072:EWpbc37+Qp2nrkGJc/R5h1Y7rCmJC0OzQaGyPZk:E9Lyc/R5h1XmJC0OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039363, "uuid": "99aa4624-eb5c-435d-a66a-de2cf2596907", "value": 127460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039363, "uuid": "2d00988c-1f90-4a2b-b7ba-3b0a1666a8cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039363, "uuid": "21857dda-be57-48ad-a6ac-58e5feed164a", "value": "080ac9573cef252446c672757fe09f3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535d767b-f0be-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041072, "uuid": "a779c639-f038-41f1-8a86-d41db57bd2cf", "comment": "Malware payload (AgentTesla)", "value": "97e1f9609fcd20f20353c62a2d8b7cc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041072, "uuid": "2317d3b5-5d7f-4b6a-98d1-0ab362a836b2", "comment": "Malware payload (AgentTesla)", "value": "2dbee3107b081e1b44643142cdf08647540ace2889f1e0d17747ac3a08617b42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041072, "uuid": "a88d2733-0216-4b1b-9926-abef63315f8c", "comment": "Malware payload (AgentTesla)", "value": "a37c194e9692b5e796ffb18a0a4f20207ac1327d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041072, "uuid": "9f2b3db0-fb87-45af-b598-c435edb59269", "comment": "Malware payload (AgentTesla)", "value": "569ef2a834ef41f7adaa349fa4eeaf4037c8072bfae59e13d141d2a8f714746c5f615073d31d04c9eb405cb5cf3212f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041072, "uuid": "9c99f128-5da7-4e81-b89a-35ed8b83fae3", "value": "T16AE4E0D9361076EFC85BCD768EA82C64EA6168BB571BD243A013259CDA0E9C7CF111F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041072, "uuid": "362f3cfc-2b8b-450d-81b2-aee7327e565e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041072, "uuid": "3723c897-9a3e-4973-945e-18a3a7a3b576", "value": "12288:rw3PqListE16kPgSyFOh2Hvwr1iFOtvpdyMpMF7SsbUBtcn8+G6B1FGrZ0XyBdC:rw3PqFBknyFG2HvwrQaR76NSsgtcn83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041072, "uuid": "e73c7d62-a0c2-4e75-bbe8-26b7162e72ea", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041072, "uuid": "6c166dde-2b3a-4375-9001-801aeb5a279f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041072, "uuid": "0acba69b-267a-4875-9405-22f01e479ca1", "value": "RIVISED INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026bf603-f118-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712079591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079591, "uuid": "5149568f-0d78-42ae-8a22-2260cf38f311", "comment": "Malware payload (RemcosRAT)", "value": "215dc8f3f75f1d67d9b6fcec09cb4d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079591, "uuid": "29461b26-65c7-41da-8ad8-a13e43ee11ef", "comment": "Malware payload (RemcosRAT)", "value": "2e368631139e75aa6cce30aef3ccdfe59dc2131a7f5166fa5b0e36c969eb5ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079591, "uuid": "557e56ec-2b21-41e1-901d-8ee217c5b510", "comment": "Malware payload (RemcosRAT)", "value": "b78ba4e1350b1173b1a2457209993f439fa7e199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079591, "uuid": "efa34deb-3e91-47cb-a38c-4c865174f0d5", "comment": "Malware payload (RemcosRAT)", "value": "c10717ab262472268cb97f2bdbaa0614940243cc952f1b6d17ab53756107374862c6faad45a47f1944d62d351676a34a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079591, "uuid": "91cb1f6f-02b8-4081-bd76-e6564a1265a7", "value": "T1BD15236172A9E702C5259FB4E828A0F19235AE1BF875E35B3DD23CCB3A71B458441EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079591, "uuid": "db70369a-ed77-475a-80f0-1de87ea49dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079591, "uuid": "3d6bb76f-bf00-4829-a5cc-9120aa95cb7e", "value": "24576:R6SNOGucnCSGYVWX54fKQ7ov6pASCDvHKfpket/0Ms20:kyOPE4WoTQa6pA97HqeeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712079591, "uuid": "ddb79c0b-aafd-43fc-a6ba-c76602f09f5d", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712079591, "uuid": "92503adf-153c-451d-9a61-1455b4f41b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079591, "uuid": "35957457-9fd7-4dfa-a1fc-1c7718f82d02", "value": "SecuriteInfo.com.Win32.PWSX-gen.12553.4077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f4c1d1-f11d-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712082127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082127, "uuid": "9bf18285-93fe-43f7-be05-12ce5617c122", "comment": "Malware payload (Stealc)", "value": "628d81697ecee7c6007efcfefb7105e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082127, "uuid": "700e6277-4ac2-4596-906b-7dd982d5e92b", "comment": "Malware payload (Stealc)", "value": "2e404cc6b00ec53566bf8bc3a6fccb165eb124129234b6b0ab42fce29543737d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082127, "uuid": "ca1772dc-ab66-45a1-b6ef-9d442d2fb899", "comment": "Malware payload (Stealc)", "value": "4934a0b44d3d80dd387588b0ceb559e1783f3be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082127, "uuid": "a55f4989-665c-4068-936b-6964d2ef1043", "comment": "Malware payload (Stealc)", "value": "651505f3e897758023f682ed00599680b6c91ce57912ea612fbafd19515696e7bded610cbea8ccae86e27842bed9d904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082127, "uuid": "cb96a66e-430f-4ca7-969d-e701c6927ff4", "value": "T1E194E022B6E0D070F2B347325D34D990063BFDB39AB58AAF3394169E1D716C09A66773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082127, "uuid": "2fe8f488-472a-4bfe-8f7d-74ad794811a2", "value": "ed6f0fda63fdd551e8ccced55764b87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082127, "uuid": "81c10a63-0ed3-4ae6-a99d-8d478799e0f8", "value": "6144:BVeibTH/gXMkkjS7+YfhPIQl61800RNmeTkKmDe5uMuNdvZ9zg8sQXFtTcbaQe:aAzgXMtj8+Y5Al18XgFFVBgbQXrcbne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082127, "uuid": "1f21166f-2796-4d1e-ac84-71bc65a312b4", "value": 415233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082127, "uuid": "b15ba257-52db-4f06-8e62-54fa642d8a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082127, "uuid": "45eb1871-78ae-4614-8736-a9055a2bc4fd", "value": "628d81697ecee7c6007efcfefb7105e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b05e167-f0f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712065003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065003, "uuid": "4423afcd-6a61-4131-8848-7a27854c14bf", "comment": "Malware payload (AgentTesla)", "value": "c0a4376bdd2763730a6b6aaa2d18da7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065003, "uuid": "bd865cd3-9975-4f46-9ce1-2fc6b0240ba0", "comment": "Malware payload (AgentTesla)", "value": "2f7ca180c50ce99d164b5601826e648f88d6db9b932b052dfea9d59a7e2b78ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065003, "uuid": "5ac4c4c7-29c5-48ef-bfa0-350fc76eacf8", "comment": "Malware payload (AgentTesla)", "value": "edf05d5fab2368e3c1ca2c5b26b1a68dac8c9971", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065003, "uuid": "ae014500-b95c-44a7-a44f-e7d766f850c9", "comment": "Malware payload (AgentTesla)", "value": "477a054554a88dd79b2533e4345792049e6c610329312d7c8d594805c3746c2b8fcac1cb6f7f8c38b6773d9d48bda002", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065003, "uuid": "ed90f9e9-5af1-4127-a6b4-a936cd0c3ee1", "value": "T136B5333E970193EBC697A4B2AE56BD00CAC20D7C512A13CBCB55E1347971FA8F782994", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065003, "uuid": "c295d244-f686-40bd-8dfe-391fb5ac588c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065003, "uuid": "67ad2a28-5cc7-4d26-bb92-a11f4980564b", "value": "49152:mvNj/8+yJ4SfHEOZlJNKzaPZSuTEva7uigwk5IxOqsecH:W8ISfky5KmPzTEzpIEqsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712065003, "uuid": "712f168a-b061-460e-ad3e-3c10deab4211", "value": 2275840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712065003, "uuid": "b0a8da28-f5bc-4a09-8423-0718a484c80c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065003, "uuid": "09b74e0b-a6b9-440c-b7bf-0705047e99cd", "value": "dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f550477f-f0f5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064966, "uuid": "d5b5413c-7ae6-4e00-8727-2277bb13b809", "comment": "Malware payload (AgentTesla)", "value": "16776384a26dcfe6842f21e941d7981e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064966, "uuid": "ab533e5e-1bba-45b2-8055-c1bbfcc7b62b", "comment": "Malware payload (AgentTesla)", "value": "31462fecb3ea50e9d958b14e99acf10b91ef3207224f82a90c6b15f0f1d1285a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064966, "uuid": "553e1783-7fdc-4f56-aa2b-0f2d37dbfebd", "comment": "Malware payload (AgentTesla)", "value": "142d514252c6a4df6ce557db717466f957ba7524", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064966, "uuid": "876a22ab-c644-4785-a7ae-65b49f66d3bb", "comment": "Malware payload (AgentTesla)", "value": "66abc937ffa0bcd4133a8c0bf3c5c23cc336600dcb31d11820739f4c01391c209e2e74188a24df40b2b954109b8593d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064966, "uuid": "cecd68ad-09c7-4074-83f8-b892d00c5529", "value": "T1E5D423C9B619CB12C5A42BF0F81C86F482346D9BD017EAAB3DA93C9E757E7645000F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064966, "uuid": "8d50bbba-f2ab-4f56-a151-83403a1cc700", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064966, "uuid": "b002fe86-e98d-4c66-8321-92de37d88aec", "value": "12288:FZcaUB+1F8+iGmSQ/q74i6FPvLzWXuu0OjcaTgmQ9gVWMtwi4NzMmSfDEdhPfHpf:FXjf9MM4XPD6Xuu0Xa8YWM6i4Nsrspfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064966, "uuid": "6a2aab9e-e386-41be-b0da-aec38f689ed5", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064966, "uuid": "ccbeb3e7-6e57-4979-9df0-c970cb7bb1e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064966, "uuid": "546b132e-fc77-499a-9f75-70527f16be04", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9831097a-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039040, "uuid": "22578aac-4700-4bcd-a999-eed68faf27c6", "comment": "Malware payload (Gafgyt)", "value": "85d7f89ea25375913c9c1d53856f3734", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039040, "uuid": "8afbe049-539a-4e23-8ecb-8fb509ee671f", "comment": "Malware payload (Gafgyt)", "value": "316e1a6dfeaec359dc964644a4115421f5e04ab78b517203d1baf449984ff0f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039040, "uuid": "60568109-5c3a-4926-bba9-a4b7e7660f47", "comment": "Malware payload (Gafgyt)", "value": "8c16ae7f1e31f56dd5f503549a676e89bc462a24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039040, "uuid": "95d4edd1-858d-4e43-82d4-2d8348d50a6e", "comment": "Malware payload (Gafgyt)", "value": "a5b53f19b2d23cac27ba87c1d941b652161a034ae9e6b17ded3019afbbd8751d5bc30f4578e1084193bdb0788c664452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039040, "uuid": "fc2a0851-7846-4eda-a7db-685adf650b3f", "value": "T1DCE32A24F8404767C3D323FAA64D879E7F3517E623CB33116A389DB45FC2B992929960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039040, "uuid": "05d48702-4c71-4861-b92b-4b6d23940a2d", "value": "3072:6hlLp1zWvkO0PXs/DiW1Vrdd5hn8eoadVjkmOMDQ4DtsL6Qse:O7J8/Di2Rd5hn8eFkmOMDQ4DtsL6Qse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039040, "uuid": "c9205711-3303-4075-bccc-79226c2520c0", "value": 149019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039040, "uuid": "e3665997-5d36-4c8b-92ab-fd413de79058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039040, "uuid": "0d077d97-dd7a-43bf-83ed-112bca3c3812", "value": "85d7f89ea25375913c9c1d53856f3734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7ba2a5-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039368, "uuid": "69a95d0a-af0d-4f0a-adf4-038312eb75e3", "comment": "Malware payload (Mirai)", "value": "79a6dfa52809672f23951914aff1e988", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039368, "uuid": "9d76f2ed-77f0-4618-804b-eb7cab8c71e1", "comment": "Malware payload (Mirai)", "value": "317f02b423fd0f9e46558a0a130b506fb79dec6855e0174ee4cb13b02525c64a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039368, "uuid": "b317990f-519d-412d-8baf-56054696a100", "comment": "Malware payload (Mirai)", "value": "d48ad29491b7ba8e7cff27b6066d3ba17e3b6418", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039368, "uuid": "657c3a3c-a7f2-4ab3-9070-a56de26f30c8", "comment": "Malware payload (Mirai)", "value": "bb902755b3c17c5af96d2b8151e6ac8bd91c34e1e1ddce7a3fc35e0eebfcfcc526e53c0aef9bca09dd8a407708bda49e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039368, "uuid": "a924e900-a11e-4e4d-ab05-377eba1b1334", "value": "T131332A35B6761A17C8D5A87A22F74724F2F54B4E18E8CA1FBC720E4EFF51590221B2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039368, "uuid": "e29e71bf-45e5-4625-ae3f-dddfda81c3d3", "value": "768:QqJtTA9TrOboYWCJ5X5XNxql7CigrhIMuqslm53kClhqO+prQ8nRf:D6lrWoHCJ5pLMQIv3lO0Clim+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039368, "uuid": "6881783a-f502-4820-aa75-7298c0a7c47c", "value": 54180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039368, "uuid": "3dfa64fb-2076-4d91-bf56-1525dee71e4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039368, "uuid": "54dc464a-060a-4882-94b4-05ff71e4af3b", "value": "79a6dfa52809672f23951914aff1e988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6861561-f0d2-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712049882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049882, "uuid": "65d848f5-2b4b-4317-9888-62d7863ec622", "comment": "Malware payload (RiseProStealer)", "value": "d5bbf22862dc13f2e55369d2940591e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049882, "uuid": "53be57f0-cabd-4bf7-89cb-f13e6d6be450", "comment": "Malware payload (RiseProStealer)", "value": "31cc77ac0f64f6aa552757bdb58f3bac1e6f3686aa984b2afa28d2f1f08f4d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049882, "uuid": "67347098-16e8-4e21-ae95-c3e0f2b53b98", "comment": "Malware payload (RiseProStealer)", "value": "da691b351bc7f986adf63d6107e3b90d9225462b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049882, "uuid": "634f829d-20e7-4986-9e6f-3e182df3c5ce", "comment": "Malware payload (RiseProStealer)", "value": "a70fa494251afd67f44be374eff63cbde81da2295beac5fc16fe246202e27244e5ef198a4214474e9613c961c8e2d72c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049882, "uuid": "116075dc-58fa-4f13-9430-33462397ba0c", "value": "T154A5336A4D61FBABDFA9633208F1D8596CF8760380A1F60E06447DBBB58F74E8306D45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049882, "uuid": "d5279b6c-6369-4e1f-ae45-3ec694092a66", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049882, "uuid": "7a786c3d-dd47-4d41-91da-68f47f7339e8", "value": "49152:1aR2wtFNbcdc16urgEPUZJ+Y9e6WvkUjsd3jrtk8TTxINr3DjdG:1aRjO+XrgZsY7WMUm3jZk8/Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712049882, "uuid": "b1299f1a-c9e5-469e-889b-9ccd6914c361", "value": 2075648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712049882, "uuid": "a0765128-70a5-4279-a1ea-3f4167bae060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049882, "uuid": "9a187f93-aacb-45b0-8829-41805ed4ce83", "value": "d5bbf22862dc13f2e55369d2940591e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97afbd5d-f0b1-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712035603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035603, "uuid": "233c9fd0-4147-480e-871e-b19998632932", "comment": "Malware payload (RiseProStealer)", "value": "c15c849d734d3ecdf8d29c9188170b83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035603, "uuid": "e0eec90c-de46-41ae-8488-58b6200b5ad7", "comment": "Malware payload (RiseProStealer)", "value": "34ceaff04dd17d8ccb1e3f49af44983c36879600d9d1d41a927bed7ee20e66cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035603, "uuid": "95bc82ba-88a3-41f0-ac67-ec1cb5e08b49", "comment": "Malware payload (RiseProStealer)", "value": "0def8920c1b3c5549d731cd473b73e7a4551dad8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035603, "uuid": "0a8f329a-de40-4824-b87f-374d368cf074", "comment": "Malware payload (RiseProStealer)", "value": "bae3396c1e22d83f6c115e5736a932a4deb4843eaf90fa3b586ce3c1730cde079f72432f69eb58679cdaaa8e0379a774", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035603, "uuid": "c24c50c3-ec87-42ac-9ccc-067803f7d8a1", "value": "T11DA533514D6063AEDD02473984EAEA4A7EE03612A1F7F40D0BA47F37FDEF61A6B16050", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035603, "uuid": "d8639b52-285c-4e37-aee4-d3add45f7680", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035603, "uuid": "e5985425-d10a-41f6-8d18-6782b63df60d", "value": "49152:taR2wtFNbcdc16uNtyRdpiu+n8D26t5drphWBTJ4frJwt:taRjO+XTyRbr+O22vMBTCrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712035603, "uuid": "590d253b-dece-49b2-9455-c3548658a9a1", "value": 2129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712035603, "uuid": "f88dd7e6-291b-4d4b-965d-0cd5a0eda6d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035603, "uuid": "d8c97d35-78ed-4eb5-b568-b6185fe16aae", "value": "c15c849d734d3ecdf8d29c9188170b83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49208dcc-f0a8-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712031606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031606, "uuid": "2ba02bb9-2e00-4351-bea5-248cc0a3463a", "comment": "Malware payload (RedLineStealer)", "value": "48bf3772cbc93109287d1254b8a64683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031606, "uuid": "268787f2-fe0f-49ab-a244-8653bc53692e", "comment": "Malware payload (RedLineStealer)", "value": "361b53f4b3e887b963bd607d994f9f42344b39e871b1142c8e56ff7182e4c96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031606, "uuid": "9d3b0974-175c-4574-8c68-db140435c28f", "comment": "Malware payload (RedLineStealer)", "value": "7ba5be5f07d63597c71bdfc0032365b56a3a26e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031606, "uuid": "489449d8-9e22-4347-bf97-8441f1946863", "comment": "Malware payload (RedLineStealer)", "value": "e7960a1662c755e57756e78e9771b7eeed50ebbde48a715b4dba8df7126612217fc921b539673f94bdabf6d9b3c1428f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031606, "uuid": "2b74a13e-04d4-4d96-959c-e9610febf538", "value": "T182552300B7F64B86C7A663BBBEE1C372532C5C800566914B69E87FDBBC7ACD60C45225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031606, "uuid": "8505ddbc-de71-457a-ad5b-ed118be9c5b9", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031606, "uuid": "773adbf7-b007-4000-aec4-880e1da4b5db", "value": "24576:Nmmy8RvF09ha/j20zJgxHgShHls6P9eQ7FYxM8/ta081:N/y8RvK9Q9B76PZ7GxM8/tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712031606, "uuid": "079fc4ee-2f3b-4fdf-add6-113c23c62ace", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712031606, "uuid": "1324d884-4240-432a-b0d5-c9ad289c0ea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031606, "uuid": "46ba4943-23c0-4bbb-af8b-8afc3acad954", "value": "48bf3772cbc93109287d1254b8a64683.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018d98e6-f110-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712076154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076154, "uuid": "fd070ce0-13a1-4828-8222-1d5650406007", "comment": "Malware payload", "value": "39aba7aca9c35d2f6c9e4182475bbc90", "object_relation": "md5", "Tag": [ { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076154, "uuid": "69d8f1a3-4294-4eec-a655-58032f863718", "comment": "Malware payload", "value": "3629ec4b91f9cbecd7d68930af8df4ca77e92262490814cd06ecba2d1a5deb48", "object_relation": "sha256", "Tag": [ { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076154, "uuid": "c5c4ffb5-829b-402e-892f-862b08f62ac5", "comment": "Malware payload", "value": "e1754760fe6add882f60a1a9d3fbab06acca22ea", "object_relation": "sha1", "Tag": [ { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076154, "uuid": "c096cffd-10a4-411f-b467-44b96cc3a936", "comment": "Malware payload", "value": "00668a8786613d916cbc10f9d31fd79d40e26d46ae67ddde015a7e9a35b7b47769064a138d592d0c4b796e905b56e0a4", "object_relation": "sha3-384", "Tag": [ { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076154, "uuid": "a411dbdf-a7a0-4c64-bbc3-5568ba206265", "value": "T17D08339C1FC0BC46E4AC7FBA5A2779BBE77394581EC05C1231B869C25C26C571E0F26A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076154, "uuid": "6fabbf30-6d6b-4c43-82a6-538eeba50b40", "value": "1572864:Ar6LBYQ8ujojYQi2NAgJnsI0SNcucgzxTMWIyqi/rydyQh:AyufuQRjJnsqN0QMWMMrEyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712076154, "uuid": "dee98628-5b76-4e7f-b334-a7c1659ec8c3", "value": 78056342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712076154, "uuid": "3e7b0b31-4bf8-448e-b203-e672149ac308", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076154, "uuid": "d114e041-99ae-4fb7-a20c-ba06d87a0ae0", "value": "HealityTherapy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b97e8f-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041640, "uuid": "dd1b7fef-c481-4cd7-9ca7-18e9c52a67f0", "comment": "Malware payload (AgentTesla)", "value": "d421445e71753122336bdeb24c23ed67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041640, "uuid": "31b237e3-17b1-4041-adc3-e23a3f639ce7", "comment": "Malware payload (AgentTesla)", "value": "36f4e49adc2815a78c71b38747d710fa40de1ed4eaafa9e296c6cc5fd8a873fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041640, "uuid": "205a0cdf-ac77-4bc3-8032-79e5c8822b32", "comment": "Malware payload (AgentTesla)", "value": "16a7127374f9ae36be765703aa9629d2508950e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041640, "uuid": "f90e4632-a317-4e8d-8149-e81fc507def6", "comment": "Malware payload (AgentTesla)", "value": "5b11a344e104db758469eb3e0a7017e80f9b0d11483ac479a416b56fb0cd06e8baa35061ebb7e351377ea80b561ec293", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041640, "uuid": "d3e8f794-867b-487b-accd-12e638ce6bd7", "value": "T1E5D423A66A537DC1F0D12BD2E92ADC001601FE1C614F47B89F508ECEB1A58FBE370A65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041640, "uuid": "8a52838d-690c-4117-a441-0f42dd12ac70", "value": "12288:CDduQS39kDrvf9u852AUYbMOUr3TWM+SoLD6PZRd2PLuZh/GS53yHx13V:CDdutk3vf08MPeM+Sq6NF/RIbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041640, "uuid": "3d845a42-0367-409c-88e6-e276a6bd0629", "value": 626175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041640, "uuid": "8e102e8e-77a4-4b79-b081-031e21a41b1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041640, "uuid": "c60d4305-e189-4e7c-8636-8983b038fe4d", "value": "Quotation - HDPE Fittings_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffe50ef-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041630, "uuid": "18acb9d0-acc6-453e-8604-05dff0075434", "comment": "Malware payload (AgentTesla)", "value": "5d746371f87bcf28109e60c5d9bb97b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041630, "uuid": "de3f7ff9-d553-4772-be01-271b50b9b57c", "comment": "Malware payload (AgentTesla)", "value": "37ceef117299d8364cf4449ee7478248ac5bdd503d3ec86ea7879d020eab99d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041630, "uuid": "56996a30-eda3-45de-b636-948d369aacbb", "comment": "Malware payload (AgentTesla)", "value": "2cdea81a1f59cc8fd73d6749dec26e0cdb098be0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041630, "uuid": "02b1a675-77e3-4ea5-82f7-5437ce5dca70", "comment": "Malware payload (AgentTesla)", "value": "ea49a52205bab47ee9038dba0d2cd7e57a8967d00284521085fcabee6163b8829f37f96836658c71456ebcd15f4fbd8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041630, "uuid": "f9ec43ef-f1a5-4d4b-8d0f-1797b991d5e1", "value": "T14D06AF15E3D806D8E4BFC634CA2A8723E6B1BC674331D64F0A3552492F77A914F6B722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041630, "uuid": "df0b4d5f-79c8-4817-96c1-7ab0a176bd71", "value": "f0dff0695f7ac0dc7528d6d72ed9263f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041630, "uuid": "b9ed5e4a-bb21-4957-90e7-db4a6b8f897c", "value": "49152:GJ7LEl+l4XJlckAoYPnNoQML7o5xLUgFevNebNxisUH+xiwO:6lCsIYGQV5QzHwid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041630, "uuid": "ed969fc8-d230-4581-9365-e7fac956a372", "value": 3709058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041630, "uuid": "98fa679d-daed-4e32-af6d-7a75057d4adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041630, "uuid": "b87312b4-f4f1-48d3-9a61-92ca6ebd2fee", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307ba946-f103-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712070649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070649, "uuid": "7de7d479-5d67-4c3b-8faf-06000da768f6", "comment": "Malware payload (Socks5Systemz)", "value": "1c0f42a6fd2d7d498e847de53d3420f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070649, "uuid": "f3d550f7-0d4b-42ea-9ffa-4c670bcf2ca2", "comment": "Malware payload (Socks5Systemz)", "value": "3a3061d7547f8ecb4970f753a2d08848d7781e664765c771a20884029a9a60b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070649, "uuid": "0c5e2d04-dd10-460b-b8e3-588663c75c87", "comment": "Malware payload (Socks5Systemz)", "value": "f72447ab1ff7da02f925584c9361a045420a49a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070649, "uuid": "85bdd43a-edb4-4b68-9f0a-c747e26f09d9", "comment": "Malware payload (Socks5Systemz)", "value": "797545971db10e9d942b1dd8037693e390e9c1e6fa2cb31778786cb92130800bddb00d41cf5f7e5669fcc7c50aa2b81b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070649, "uuid": "9afd4ed1-3a6e-4c8e-b600-6ba715044b7e", "value": "T17BE49DB13A0AC1FEC34A04B4E813A603C57867F18B64E657EE6C7C7CCAA349471E9749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070649, "uuid": "37663f85-ce60-4d65-b036-7763ee48bded", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070649, "uuid": "2ac9dd88-ea91-4f42-9d0c-ca0541636c9a", "value": "12288:LZRsgiZdvAeRwV+a1HGJ1L+ouonOXPD/OyZ2Pl0o2GG8cr93nG7zlTXXrVlhfrYg:3sgwdvA8u61LxuonOXPD/OyZ2Pl0xGGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712070649, "uuid": "095013ba-de90-469e-99db-d424a2d3a933", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712070649, "uuid": "9a88e74f-1dfa-4905-8bea-c6eb2144b9cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070649, "uuid": "984bc122-116c-445c-8824-4bb3f7d14354", "value": "3a3061d7547f8ecb4970f753a2d08848d7781e664765c771a20884029a9a60b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524f3e67-f11f-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712082732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082732, "uuid": "ceb5e2db-236e-4837-aa51-675c7484ce1b", "comment": "Malware payload (njrat)", "value": "96cd415a0f90355a4679948000125af4", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082732, "uuid": "ac3451b3-cb29-4dfa-a812-1805ff66e333", "comment": "Malware payload (njrat)", "value": "3a4d23fab674bcc2a42b6dbbb404adc74f597b25b71cc2784107918ae029ab74", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082732, "uuid": "d4be4506-78dc-4cdc-ab46-3afa23876352", "comment": "Malware payload (njrat)", "value": "901447f12dbfa7ab4a163061dd7306dbd2945044", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082732, "uuid": "3d8b188b-9377-4268-8b0b-221416dd9e30", "comment": "Malware payload (njrat)", "value": "124a5043c2daedb3fd73a5ae9f4ab60d70bd923291a74671914dc4bbe2743805cabbbfaff4e4980b52619dba15c64627", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082732, "uuid": "a974e513-b098-41bb-b218-2e09efb5f49f", "value": "T17BF1AE9F467ABB4BC3B15A3F9B1AC8FE7C64F011AD01DE2D301EB4820009ECB1B459A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082732, "uuid": "47fc8ac1-39cc-450c-9ba1-eac0cdebfd66", "value": "96:ZEKr9NP11fWmfnGNu24cl3pbkxIjNd7jjJQEfjVs2ekMlsJ4ivhLDzssDPrBFfto:xrXP/fWgnGN/3pF5LVDJDR/m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082732, "uuid": "05def894-f340-4e4a-9d39-c526e743af12", "value": 7726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082732, "uuid": "9faee1ce-db9a-4f7c-a253-19e03be88a56", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082732, "uuid": "dcb06500-4bfe-4aa8-ac24-35bf75ed65be", "value": "Dados Da Reserva.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5473c9-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712082237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082237, "uuid": "37a1efc1-008e-4523-90c3-1d6a5e96a805", "comment": "Malware payload", "value": "6ea52f4e5dcc20313e025ecd13129dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082237, "uuid": "611a9582-5c03-4806-92b1-ad0a9865690a", "comment": "Malware payload", "value": "3bff8ec4456616d0e3e8ad827c281836e8255ec2bccf88852228723560d27685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082237, "uuid": "7e6c28a0-8435-482c-b0de-6e8963f806c4", "comment": "Malware payload", "value": "bec4b5c5fcf413ea225c00f95fcd72a64aca745c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082237, "uuid": "cbfa9df5-6bb8-44c3-b3dd-0b56f64070e4", "comment": "Malware payload", "value": "f83b8c7a9af83461813b6c653a4801b1c667222f85223d02c585ba78dd937fbdc14199d58ae6ada1eaa2b538cda7314b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082237, "uuid": "497e3867-f8c4-4ae6-aaa5-4b147f4aeba8", "value": "T1D8F4122370D0A870D59703720F2D9BC96F3DF9659EA35BCB63485A0E19762F0D6873A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082237, "uuid": "eb8be591-59dc-4ec4-8b47-12a9381edb7e", "value": "9fe2fc9a00a9d9a4ef36bccbaa078a27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082237, "uuid": "c370525d-80b7-42b1-ae94-6a8f6f74373b", "value": "12288:jmam9eDNMZqGUlNrdKrz4c99NwSES4s1yEJ12rk/ZX9DQriahAV3a:weK8GUPYXNmSES4sz0rUZX9DQ2Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082237, "uuid": "5c3e8fc7-4235-4668-80f2-470d2e154d74", "value": 776458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082237, "uuid": "fca0bd6c-b705-4aa9-990a-d3c81fbb09f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082237, "uuid": "ec090f46-3826-48a8-8ff6-51a0d2061866", "value": "6ea52f4e5dcc20313e025ecd13129dce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3334fd79-f103-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712070654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070654, "uuid": "39a2aa33-ecc4-459e-a986-3858844b194d", "comment": "Malware payload (Socks5Systemz)", "value": "93614cef4491ce84b14fea3fd8486c65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070654, "uuid": "34da867c-872c-474d-841a-16470555d9c3", "comment": "Malware payload (Socks5Systemz)", "value": "3c6638b94e1e0efeb277a22facf547c7893099528b65d7b5db4df1aba3129428", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070654, "uuid": "3f6d81f0-468e-4ebd-ac3c-e4f21f5579a8", "comment": "Malware payload (Socks5Systemz)", "value": "c2451e7a3d2341a00ae65b87cba3dc988db3b66c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070654, "uuid": "5025cf0a-576b-4e4f-a2a6-ed457f451c15", "comment": "Malware payload (Socks5Systemz)", "value": "c67915a55d31d2ea257f2350dd69edb4eb76d427e7ddd9c1199eb2130f93e8ef3a350a70e776a1c42832696cc55be1b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070654, "uuid": "ec78f6d4-58ed-4605-beb8-432bebc0f80a", "value": "T124E49DB13A0BC2FEC34A04B4E813A603C57867F18B64D656EE6C7C7CCAA359471E9749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070654, "uuid": "4dc2c2fc-1a0c-459e-be48-cb735662300b", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070654, "uuid": "5a9fd0d3-a7ef-40bf-9a14-00dee8da7736", "value": "12288:LZRsgiZdvAeRwO+aTHEJ1L+oUonOQPM/OyZ2Pl0o+GG8cr93nG7zhTXX1VlhfrYu:3sgwdvAzAw1LxUonOQPM/OyZ2Pl0pGG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712070654, "uuid": "ea1408a5-575e-4b6c-b1c0-71a58b097f1a", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712070654, "uuid": "ac92661d-c178-405a-bb43-631b601849c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070654, "uuid": "8a82ba8a-cd1a-4329-b98a-15b3e8a79827", "value": "3c6638b94e1e0efeb277a22facf547c7893099528b65d7b5db4df1aba3129428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e710ceaa-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712064513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064513, "uuid": "8c1a14cf-290f-44f1-9136-d7a2007d3e5f", "comment": "Malware payload", "value": "38f58729c89acbbd2aa4066f9680dc08", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064513, "uuid": "bf4dab4c-600a-49a5-8e17-b1e96aa7c14f", "comment": "Malware payload", "value": "3c7258e3571d7a469e2115f5ac6c9c2d239f84ddf0798d458d64c4df0e9970f5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064513, "uuid": "9596fb06-e9b3-452b-9582-0e5e99828cc5", "comment": "Malware payload", "value": "5c13c0c0f23aaffc219dec88a7592930da971a1a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064513, "uuid": "cfe9d2db-a52c-4962-84be-11d4f64bb0ea", "comment": "Malware payload", "value": "b0484ceb5ea9f2f04d2ba8184db15edb2ed15db72356a892346409ea78e5debf6af4a17f9198f04261ff9f785fce7866", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064513, "uuid": "b1877787-52c8-448f-8f61-584d1ca5bc75", "value": "T158A2E1BCA761DF3DE9886F3100F029EFBA363546591092A808DF9C64E2DAC0F2825757", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064513, "uuid": "465175a6-7a6d-42dd-b5a8-ae71106b0ad9", "value": "384:s48ySA/eGGA2r9dyUR61iljZeC9GsY7YAibfpEgA0V:Wm2nAUogZPGsY71ihb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064513, "uuid": "f694687f-7fe0-4ff7-bcd2-21a79d790a52", "value": 21398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064513, "uuid": "66edcfba-0bb2-4d6a-a754-2fad799b42e6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064513, "uuid": "352d0da3-2522-47ba-84e0-f3c3269ed71c", "value": "T_AGM__1651.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e54dc49-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067236, "uuid": "ffe716a3-741a-40f0-abf7-9825913d3684", "comment": "Malware payload (Mirai)", "value": "c7804a439b4f0c1a9c64956535faf60b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067236, "uuid": "5ed82f8b-d100-4528-b8e3-70e68a02d711", "comment": "Malware payload (Mirai)", "value": "3cc9b4cd10351613e6ee4bf53180db35e07bab44cc81110652a7a6ad074c688a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067236, "uuid": "9352a819-54d3-49af-afbe-a6224fedc8ce", "comment": "Malware payload (Mirai)", "value": "0fe1525ef6b7e121d33984c0445c4e905b94ef7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067236, "uuid": "20d0f752-cd65-42c8-ab4f-5cff7c96562d", "comment": "Malware payload (Mirai)", "value": "399c6f4ac5e2779840d44d58b615b57e23ebffaab7160f597350496a60a77148aa7c596d9fd87f03c88b6a70240d784d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067236, "uuid": "9fac2ad9-7616-4b8a-82c4-4ec4129d86e9", "value": "T1E9532952B9C09752C1D415B7FE0E018C3B6613FCD2EE72028A65DF21339796A0FFAA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067236, "uuid": "13476433-9129-4780-8781-bfe060d33941", "value": "1536:s6vDPn+ffFlyyro5P2YkUi8Y6ZvmjKV4Y+UNFxzhJL1ewFF6EkvxfZ:s6rPn+ffFlyyroB2YkgXZvIIjXFxzhJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067236, "uuid": "d9e8863a-46a2-4370-ae94-f780b608d520", "value": 62964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067236, "uuid": "0fd1ccbe-9609-4cc2-b9c1-b7e616a175c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067236, "uuid": "df53ed8b-3726-421e-a9ed-3f066297d860", "value": "c7804a439b4f0c1a9c64956535faf60b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97db4ff-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041646, "uuid": "b2e82d92-07bf-467f-8cea-07be8db9e97f", "comment": "Malware payload (AgentTesla)", "value": "f86a4f1b069336397bbcc5de2c7018ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041646, "uuid": "9cd72ec1-dd7a-40cf-8fbb-742ff3cc5b86", "comment": "Malware payload (AgentTesla)", "value": "3e07072a24a7032d2c8e411f9fd163bef48023f8aa7c0a8cdd6d8562d3ae84f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041646, "uuid": "f45627fc-973a-455f-b132-d09491429756", "comment": "Malware payload (AgentTesla)", "value": "2a6c3019cc42eb04facca1c771d586e04f55ed4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041646, "uuid": "3ee146cf-9c34-4eb4-a273-651d7a4e0879", "comment": "Malware payload (AgentTesla)", "value": "20aee232753d68b873452dc080efa2b8ba8e8f8703807d24ecfc3c3f9ff69a717831939fce1f9f09062310ca571bfea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041646, "uuid": "33544b08-5d0d-47a7-9004-15493e2b5248", "value": "T114E42357291382D2BFDFA07BC487A7BC145098D02A614E02BFCD78A1DBC6F607BA155B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041646, "uuid": "b41487b3-7d07-4b96-95b0-be7d0ee8baa1", "value": "12288:D8vbEG29/4eoggsXMGH4YOcGkXCiw4E51t8RUuy+USVYcFPccLMlxY65FW0U:D8vbED/VgiOvcCN4E5oo8/ixY6fW0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041646, "uuid": "68b0cbec-b8e9-4553-91ef-93ba8b7149a4", "value": 679337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041646, "uuid": "23542ac3-2718-446f-9f9d-2d054561085b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041646, "uuid": "b7266360-4cd3-4c80-9028-5a2689e38644", "value": "Statement of account_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f02dfc-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712038949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038949, "uuid": "e44d9a66-bcc1-442e-8ce9-896e265ce75b", "comment": "Malware payload (Mirai)", "value": "572d6a42f9bc68e938779b29b62a972c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038949, "uuid": "6ffc08cb-edfc-404e-b267-42d5077f3b4d", "comment": "Malware payload (Mirai)", "value": "40d40a262b1b902363476419f3df17f46532da158fcfca784340bc300021bdb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038949, "uuid": "1f4fda44-eb4d-42e3-8e6f-248bb3dd49fe", "comment": "Malware payload (Mirai)", "value": "2aaabdd2d7026b4b9041792375ac08e454dd8489", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038949, "uuid": "2b6a6e09-8398-496d-b9d7-bec92b72c065", "comment": "Malware payload (Mirai)", "value": "f5945efe99a2e76e47c79759122a158085fc0ef4593854bd58fea74ca69abd987ae347b45fdeadf8ca4d44750c945fc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038949, "uuid": "a2490e28-37d3-43bf-96db-30aaa288bf19", "value": "T13B43022DB1A0DB12CCE987B6596A06C9331837BFF6E7A0F01C201176E69378D99F5852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038949, "uuid": "ec5ac736-04f3-465e-9677-8eeb7135c90f", "value": "768:sC4XHv/Sh7iJexikv4B0+56ETZFKcoqjrha/SaNyor+loRc/CdolRwGjFhs3UozP:+XPs+ex74WETZFrzrI/Sag7pCdGNCzDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038949, "uuid": "72cf2e5a-f09c-4e45-a1ca-2da03191c288", "value": 57808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038949, "uuid": "86ff72a8-b291-4594-b9bf-92093805947a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038949, "uuid": "09c9a215-91f0-4726-8f8f-0dab72dc1430", "value": "572d6a42f9bc68e938779b29b62a972c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf528f0d-f0e6-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712058460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712058460, "uuid": "a0221b1d-8a90-40f1-8a7b-3639f5cbfd4e", "comment": "Malware payload (LummaStealer)", "value": "42c98624d1685084cb8e7be79c0d3b37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712058460, "uuid": "9f7b5b58-7668-4b21-aa74-835bdf2580ca", "comment": "Malware payload (LummaStealer)", "value": "43e05559001aa39f39eed23d0aacbdbc15ba9aae5921eefe42c6bdc1d0b766e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712058460, "uuid": "ca66eccb-189f-496e-ad8e-9f748e35d1d9", "comment": "Malware payload (LummaStealer)", "value": "97f0818929ddbbe4ad7654cae7ddd9ede267888f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712058460, "uuid": "3321784a-9a9a-499e-aed3-4d653fd1fd31", "comment": "Malware payload (LummaStealer)", "value": "cd2275539f2d50c97108f973049696466bdc607ad9c25084320c06d6867e2ef7cd1dbf95419b4ad1f66ad2210d24193c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712058460, "uuid": "996dddac-f086-4ef0-8b2f-5a5be8cd8327", "value": "T1C6642357C7FC6161C843977537B4DA81BAB0F39914604EA37925D9A88BBB3C38B443E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712058460, "uuid": "8d4f49c7-25e9-4e12-875b-2deed53f7455", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712058460, "uuid": "49d26442-7221-4c30-8db7-debec56567ab", "value": "6144:LZJFcA6O6u1kegpGpqFPsVnK2mwg+UwxpM5RxIwYMznpyx:NJFulykegpG8yKJwtrxm5RHYMzYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712058460, "uuid": "ffde5900-a252-4d3a-bfc5-58603067fbd1", "value": 324232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712058460, "uuid": "2773f730-03c6-4a40-8258-6cbb16cc5678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712058460, "uuid": "d4ea9cfd-ae8f-4606-b7ce-90b9e2300055", "value": "CMSTP.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d58e91-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041632, "uuid": "19da0fe1-0592-48d0-8cbb-1df91335c24f", "comment": "Malware payload (AgentTesla)", "value": "df21e7236b4e0a78b651c74ce5b816d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041632, "uuid": "799493d9-fb18-467a-9f59-0d96ce4f643b", "comment": "Malware payload (AgentTesla)", "value": "4556056653d8de290ddf3f0ad366838d6736a6479f6a61bfc37d8f26992c5454", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041632, "uuid": "9d93f5cf-c97f-4c23-a9b3-8824b66cfefc", "comment": "Malware payload (AgentTesla)", "value": "7fc50c5a5cacb6e5a27f505f8172acb844ec3c7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041632, "uuid": "5f2c2dde-8360-47d5-b219-f077f3b7799c", "comment": "Malware payload (AgentTesla)", "value": "a37b0b437408ea1e1ec10cd5c4165b53b0daaf8d7957c3bf3bf40a4da90767de1af21ad3ec07fcfbf2cb062093d470e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041632, "uuid": "1e0ae238-6529-4107-a955-5fd83b7f8cd9", "value": "T1C6653363B5CCAAC1784D79C3DD3D6413500F626F986862202568C72ABBACDCF3CA595E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041632, "uuid": "ca92379b-5bc6-4f6d-8471-a48044b99d37", "value": "24576:YRrEY6Ggessh4VR0rIyNOKQGZfuZ/+JEhh8iB6Ej3umXsCM3aayS1EpPnSoW/rWk:dY/JY0h0KNmluEv8SZj+mXsPaafep/98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041632, "uuid": "b3ff13f8-aacf-4979-a173-f932cba8c67a", "value": 1452997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041632, "uuid": "d2d2b259-72c6-40ca-815b-fcf61cefba64", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041632, "uuid": "c5db8c1e-36dd-4eb4-ae4d-e44fea786627", "value": "e-dekont_html.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ff5fe0-f11c-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712081713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081713, "uuid": "a62aef9c-ef1f-4688-8e1a-d3c5c3b712d7", "comment": "Malware payload (njrat)", "value": "1872473cba74f66c0e4802ea5b6f00d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081713, "uuid": "3dadef62-804d-4450-9aa4-d9a1d2036e0c", "comment": "Malware payload (njrat)", "value": "45d7bce22cce33ea4504c160818d2dfac9c22637d13ec3a9be8d712d0b90ea0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081713, "uuid": "6d085050-3855-41e6-bab5-0815c4a42712", "comment": "Malware payload (njrat)", "value": "38d83a2aaddaf2526f680656deb8efbbe3260ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081713, "uuid": "781f91a6-e3dd-44a3-a330-8f22178de652", "comment": "Malware payload (njrat)", "value": "1202ab346192089ccdc9d9e0b2150168d8f998c33f5cf2595ccf90f7df5e552ecd627a63b2180b8ebcb0eabdbca418e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081713, "uuid": "35fb098b-7f15-4ea5-8087-8426b6bbccdb", "value": "T194347C4273E41074E0BF0AB35972B6018E75F9521B21E74F8BE1589A1EB3AC0CF55BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081713, "uuid": "6ccae7e1-c745-41e0-8309-93b04a42dc38", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081713, "uuid": "8bc34934-2953-4cdc-a5f8-f5f3369cd58b", "value": "3072:rB5vKB1ELeP2N+S0atKSPfptuaNH4XkOdL1E7Bd95UXRPmGvMzuvOMi1dKQ+:15vpLe7S0EKSnptuaB4BZhPTMzuvi/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081713, "uuid": "3160da63-a4f3-466b-af44-f5d8d958962b", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081713, "uuid": "847ec67a-9929-41b9-9a11-cf5340a37a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081713, "uuid": "aba88782-3849-4b91-9016-0b8efae4764a", "value": "1872473CBA74F66C0E4802EA5B6F00D9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136c4bbf-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712067164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067164, "uuid": "c90ee633-b635-4008-bd6b-dc70d13fa68d", "comment": "Malware payload (Gafgyt)", "value": "a479a03f77007562d6ccb98a4c1204d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067164, "uuid": "0d98434a-0653-4f6c-b8b5-2b669d9fdc71", "comment": "Malware payload (Gafgyt)", "value": "460678c60810fb388ba3b35325204c4f88266cddf25541f18434c7a1b854d4d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067164, "uuid": "1e921ea7-8289-4666-abb4-51fa234fc89d", "comment": "Malware payload (Gafgyt)", "value": "e9c4afe8dd1a9007ededbae2db5ebaa8ac48f699", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067164, "uuid": "d44c90f0-cf79-4294-a01e-f0852057e6eb", "comment": "Malware payload (Gafgyt)", "value": "9ebec04d4afd273324f19eea4ac8f46c4fe1083ab93bae56b38c83cb6797f369e2b22d7030e6664472a454e5edd04bb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067164, "uuid": "eb9abe9d-e3bb-4c8c-892e-8b606da58ae0", "value": "T184A31A44F841871BC3D327BBE78E479D3B355A9467D733116A38AEF42BC1B982D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067164, "uuid": "79190d64-0b6a-45f7-b2ac-e7afaf3740e0", "value": "1536:DoZlzYPSf5l9vrV0fRRLT5e3Xx2uknBmOCQUHpQLcjjY4ttpm8QqS7ojkEEXaZk:oYsl9vrKfs3CnrUHeIm8QqS7ojfEXaZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067164, "uuid": "ed299a6a-1cbf-4aab-940d-c6ba058d8536", "value": 103758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067164, "uuid": "d71d381e-2021-414c-a832-6b253fd686d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067164, "uuid": "291981f5-2ca4-43a7-924b-a8461f32029c", "value": "a479a03f77007562d6ccb98a4c1204d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d641d9-f12e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712089361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089361, "uuid": "c5212fa2-6d09-4a2e-a53a-aafb5e4a996b", "comment": "Malware payload", "value": "d9b34a5d20cce6b325ee7faa90256a06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089361, "uuid": "5f11a96d-1708-41e4-bff7-0266705e96d0", "comment": "Malware payload", "value": "470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089361, "uuid": "39549188-4d7a-4b15-bf7d-92d409fc09f7", "comment": "Malware payload", "value": "d71e29f815151a74205b14c371333d691ba9830e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089361, "uuid": "27e898d7-c1e0-4e29-8e4a-a8b5c35a5f5a", "comment": "Malware payload", "value": "b66f6c1db319f4b4f716d1435c72da072cc45f24e9125de6ecc2f37f413be0013d6bb659dcce52d25cfcd7bce1f7d66e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712089361, "uuid": "a1bb96f1-9023-4c2e-8f04-2b87fec83b6c", "value": "T16A55C00273C1D062FF9B92734B5AF6514BBC79260123A62F13A81D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712089361, "uuid": "9a69d3e5-f009-42a4-a058-325376a3c49e", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712089361, "uuid": "c0bc9cb8-3a19-457c-9c56-5492bdc539b0", "value": "24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aMSAweUh8tsg+4yNBb:iTvC/MTQYxsWR7aMSAEG68y/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712089361, "uuid": "2e6863c2-5793-4104-b13f-b9e3a41cbd5c", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712089361, "uuid": "b3a1057b-e054-4d23-9f0e-a4fc77ec858c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712089361, "uuid": "d780de10-618d-449c-bf15-14fbe86e7f7c", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776ce99a-f0ff-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712069050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069050, "uuid": "3ad2844f-b099-47e2-a73f-1f2225407b12", "comment": "Malware payload (AgentTesla)", "value": "dbeae5c7f578647f31c8e9c9c389765d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069050, "uuid": "f0bc0abb-e507-40e7-9cf3-051dce1abda8", "comment": "Malware payload (AgentTesla)", "value": "4793f1dccdb904bd88c26018b236dd95171a90404df8665652b44b18ba01b6e0", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069050, "uuid": "971c6d67-526e-47e4-9159-22fc1673a786", "comment": "Malware payload (AgentTesla)", "value": "ab8d94bf57f55a49e5f488d5f1ec2acb396799c5", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069050, "uuid": "8f2ede51-2534-4a45-95f2-422a8425ac97", "comment": "Malware payload (AgentTesla)", "value": "faadb220abcfb33c44a5d530387698281662bc74753df058b6294592e1061a88c140b8d698ca34d9bf72d275930211d7", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069050, "uuid": "688fc710-61c6-4ab1-a5e4-35e3b213580b", "value": "T19CE423BA728BD0A3B5455A7097DED4C0961CCD39CF38D65F98A39281DFC8C40A523B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069050, "uuid": "f52f9692-a364-40df-a81b-6645e015003f", "value": "12288:Io8Hwlx42FduZBtKgUjhKZ8sBuMqETdmBfWL954t1rifOxrRaQACD9rJ9q:I0xZKKzjhDs8MBTdmKrOkgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712069050, "uuid": "2226d5ae-be2a-46c3-88e9-6fa4aba22d28", "value": 659164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712069050, "uuid": "4e286027-c8a0-464b-adde-67017ff346e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069050, "uuid": "66e6c768-be8d-48f5-b675-130d44711636", "value": "MAR-888201-2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eceb6f-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038612, "uuid": "0d7366c5-8aa6-4406-8854-99723c45816e", "comment": "Malware payload (Gafgyt)", "value": "cf85fb4e6139f12914e30a8bedb52a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038612, "uuid": "8994bd83-2845-4314-9abd-33bdfd3e5f4b", "comment": "Malware payload (Gafgyt)", "value": "47b6b6eacf2b5d74e2cb0bc94ab3f93c7475ebe4669d2a4fd1d1186cfb9a3aaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038612, "uuid": "7b7d7735-252a-4f91-9aab-0a721e990391", "comment": "Malware payload (Gafgyt)", "value": "9faef9802001a822493adca959cf18f57d6af9d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038612, "uuid": "a58e4a61-60e2-4cac-8202-0fe1e92f8c25", "comment": "Malware payload (Gafgyt)", "value": "5d1c0b3fa17e2040fbca4507027d2cb5a6168c8b6344a51bce7ef12fb45a0301e5e4882aac7ecfd7fb2118b4ecc26e05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038612, "uuid": "9c84722b-c31a-4348-a0fa-60b853d08523", "value": "T12804B63E7922AB7EE268827107F76F71CB5511D333929392E13CDA145EB224E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038612, "uuid": "597a81d8-0f9f-40d8-bffa-4c4c10ceda47", "value": "3072:UhZRj5n9EmzUyMhD5hWTt5s1qAuhmv8uqx1BVnKoe:mjrYZD5hWJ5Lhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038612, "uuid": "35b2e3ba-933a-4ec1-be54-73011a114bbf", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038612, "uuid": "1c1285af-d0fb-44c1-a3d1-005d9e909127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038612, "uuid": "b62aa9cb-a326-4bb9-bfa3-40969d2df754", "value": "cf85fb4e6139f12914e30a8bedb52a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0824440-f11c-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712081655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081655, "uuid": "b1658ace-f394-491d-a083-10743b0f5d41", "comment": "Malware payload (LummaStealer)", "value": "bdb4cfee0367a611ae3ebc574048d14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081655, "uuid": "cf4ce893-5b9d-4bc2-a9f9-86d6e737c883", "comment": "Malware payload (LummaStealer)", "value": "49a99ed198b1e48e1c08b5e4f0e193b6ff9bc1856b0a611c2ac7dbc6de05cf53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081655, "uuid": "50d1d566-ccaa-4616-89be-b812ce13b6d6", "comment": "Malware payload (LummaStealer)", "value": "7911149e05928bd29d235f8d3b9fcf361eedfb3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081655, "uuid": "4ae96c78-1190-4f29-a053-fda8c1d937f4", "comment": "Malware payload (LummaStealer)", "value": "a00367674f6efe35fed3394a0b455861441e2d78036ead7bf5da3e629d95f3811599f0fe7b9a5f2c8301ff1fd6e5bc84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081655, "uuid": "b4bd5dc9-8bc8-44fc-a43c-52ebc933ca07", "value": "T1A5747B0362E17C90E5E647B14F2D8AFC772EF8624E246B6F225B5E0F04B21B1D663791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081655, "uuid": "e33918aa-17e3-4565-a066-635e5d0f2eb2", "value": "ba98ed9b6030d773e739745aeaf6e0bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081655, "uuid": "f8c3a6a8-d6bd-4546-9fb2-0cd6343f49b0", "value": "6144:RvfEt66OpJ9IvEv9f/6Zn/vQELaa0NybYBC+yD:RXEt66iHv+/vQELaaqybGsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081655, "uuid": "12e01c87-3311-4e17-aa86-c915a6f771cb", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081655, "uuid": "e743bb02-6c81-4348-9a3c-fe50c78cbec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081655, "uuid": "294d0567-499d-40e8-9df2-71171dece2eb", "value": "bdb4cfee0367a611ae3ebc574048d14b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f722e9-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712064355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064355, "uuid": "4d2d8aae-6456-4bf7-80d4-465f24669d36", "comment": "Malware payload (GuLoader)", "value": "705249f16740c70ec1722d8acc2d8f0f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064355, "uuid": "e949b8ef-5584-43c7-9d3c-3dcca919a09f", "comment": "Malware payload (GuLoader)", "value": "49e60a3accca6e70cc350dece43583bfa93c47686cc1df3f7f116a647cd35df4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064355, "uuid": "323f1c48-5662-4caa-9477-adaa6ef4e018", "comment": "Malware payload (GuLoader)", "value": "50db397c0c845449ea46d80a979907783bede551", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064355, "uuid": "389b5155-be97-442b-8abb-c65c2d7723ce", "comment": "Malware payload (GuLoader)", "value": "057f768a530b7ae45e090d9fdd376e03c6f8d29ec3a1264aa391dbb19499c7b6988c5d45030b4b1eadbbcd8cc7388b92", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064355, "uuid": "d41526f1-834b-4c45-acf5-14db19748169", "value": "T1A5B31A8AB7561FE86C272FB51D8E204DD4B40C22D53604C0FF67A3C93A125A9FF2599E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064355, "uuid": "c9b04e3a-2dda-446e-a5ef-bdaad456450d", "value": "3072:K5oZaGnVaQYAXwbzr0GPyxGkhx7aPjzL4CzjxxxVoM5BGPbvcIst4TsAar:K5oZBVaQYQ0r0GIGkhx7aPjzLz9xxVFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064355, "uuid": "ec058350-c4fd-430d-b0db-242639a8e845", "value": 113456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064355, "uuid": "eaf4e358-ac27-4229-8ff1-90cfde57ca51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064355, "uuid": "0c94eee9-5521-4ad7-b919-74b563818bb3", "value": "detalle_transferencia_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9c7087-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039476, "uuid": "83799fca-7f66-4f3a-b08c-225506edb2ef", "comment": "Malware payload (Gafgyt)", "value": "92cfcd34d5d449a1cb3c266c7001b13c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039476, "uuid": "535bbdcf-2c3d-451c-ba64-0828c3b1fa34", "comment": "Malware payload (Gafgyt)", "value": "49fd252da53b26b52952c9b639c81052f4baefd3f7aab967ff11bebc714bca0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039476, "uuid": "206edefa-1068-4285-ad30-a1ced0e2f1af", "comment": "Malware payload (Gafgyt)", "value": "0ac780cafb653f224a75b5204fa02293e9c80cea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039476, "uuid": "13300cd0-e348-4b84-a48b-01e935e25beb", "comment": "Malware payload (Gafgyt)", "value": "9b1355db7cdf2d1e3427ba7e2332f0a7b1a809f0f268d1bac8380b002a4d36a719f4b316ba65279a01eddec44bad756e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039476, "uuid": "c095e026-8cea-438e-9b7d-bf197ed167d0", "value": "T16C04717AB7618EB7D80FCE7305DA4912188C968642E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039476, "uuid": "4315a654-96e7-40ba-8e1d-bee30ee25d86", "value": "3072:aaF7XSy6Cv9RDf5his1ZPhmv8uqx1BVnKoe:aICGVFf5hi2hmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039476, "uuid": "f0bed932-33e7-4f2e-912f-04f6ae9f4c21", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039476, "uuid": "63cd402e-60f9-454d-bd98-8dd567ca987c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039476, "uuid": "14f74714-3df9-44f9-b3e7-a65a5cb0106f", "value": "92cfcd34d5d449a1cb3c266c7001b13c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5b6ce0-f0ed-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712061359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061359, "uuid": "aac452d6-65fa-44aa-af93-094f6c36cff7", "comment": "Malware payload (Mirai)", "value": "86a296f1d23a49282edbd800f92b9c22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061359, "uuid": "ed4e6c83-626e-4098-9e98-0b8add0dca1d", "comment": "Malware payload (Mirai)", "value": "4a4d13fcbf7f64bbf1580df382faafa271232851cc3c96a10271b4034737fca1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061359, "uuid": "a0f0d473-43e0-4160-9076-e3300b51931a", "comment": "Malware payload (Mirai)", "value": "6f93015888b9ceaaf1bf05201d46b59a3def8584", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061359, "uuid": "10923b1b-07ff-479d-a7e3-9063946d61f0", "comment": "Malware payload (Mirai)", "value": "334cbb186c5221ec90c92ca780c7f2eb59443a8b591e5cf9e57b4f22a9dafd5933c19950495849e99dfa229cd7d3ffb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061359, "uuid": "85c99d20-ba11-408d-ae2d-7e932fc1ef51", "value": "T1F3C31A45FC415B13C6D212B7FB5E428D3B2A17A8D3EE72039D256F60378B95B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061359, "uuid": "9049e064-585a-4465-954f-f1f2e0df99cb", "value": "1536:JkvvsE3G5qB/Rpd8FEYY1XANIK4V02RTV5tntyHjx2jpChCDklUuwyw8FLRXB4J2:qvvTQOdNZ1X44DRR5tntydIpCQt9bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712061359, "uuid": "716899a1-c0de-46b2-a6ba-f323da6ea202", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712061359, "uuid": "f5395f6a-b79a-422d-8b86-fd2aed7edad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061359, "uuid": "147ecde5-37ef-4dca-a4aa-91913cc68beb", "value": "86a296f1d23a49282edbd800f92b9c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a20a867-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712047123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047123, "uuid": "e16d53f5-df03-44ac-9409-8fe995c3e750", "comment": "Malware payload (Mirai)", "value": "9908e7ff75221f39cb7b57e86fd113f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047123, "uuid": "c57b4913-6e29-44de-9a2f-d13779a80b4e", "comment": "Malware payload (Mirai)", "value": "4b7d6a3f81110e6866aea309ec2cc870abbbb7a80450fa8fb2781d6d5aa8da23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047123, "uuid": "1c33f053-be99-4887-9215-1333b6e7d2b7", "comment": "Malware payload (Mirai)", "value": "e1740ea7fcfeeb6d839c177d0f3cb66445e7f0ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047123, "uuid": "74bf1ac7-3841-4bbb-b495-99db8afb637d", "comment": "Malware payload (Mirai)", "value": "04d85f3296aade9618ad10bad0947c5d02658ae729ad6dcc9b6bffd1bfa59a66d1b109b4f15d8b1da5cca9bb10e11a39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047123, "uuid": "a40c4e5f-3dcd-4559-8d5e-21e2d28bee36", "value": "T17C5302B29D73F512FB70AFB35E66C6587E4227ECD4AC70A62AD48F0C63E09135574086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047123, "uuid": "bfdab37e-41d9-4e85-9667-1bf83e3bfc1e", "value": "768:Ev/KCmvR5QiZZpjFGZ1oGUbjadfZMFMe2dzt3mZB1fBi5c9q3UELgu4LppojjJZq:EXAvR52E4uM3t3KNBglLgr9Pxwc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047123, "uuid": "41d90dcb-3272-4a91-bd17-1b7f8fd08678", "value": 65304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047123, "uuid": "4889695b-f586-46c1-8100-a95f81e3a28c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047123, "uuid": "45b9295f-b812-4eae-b8ab-78711e364da6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaf6e4b-f0e0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712055641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055641, "uuid": "b059f0c5-0db5-44d5-a0dd-59d094504e14", "comment": "Malware payload (AgentTesla)", "value": "1f2d303afc56148ea7b988c5cea3eced", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055641, "uuid": "5c2e15d3-fb5a-4e54-b406-3e0da9c8bbb3", "comment": "Malware payload (AgentTesla)", "value": "4d62deb9e012ee45a9b2d5c90a15955965957d3c8065b24efdde65a9c8a33b66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055641, "uuid": "ea500e2e-a065-4dc5-b19b-e2983bb1dfb4", "comment": "Malware payload (AgentTesla)", "value": "ac4e07420bef8b2a96f28503079e350e986cce36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055641, "uuid": "3108bfd4-5cd4-4d28-a330-5065fcb2ea43", "comment": "Malware payload (AgentTesla)", "value": "eb0af99d53025eb25dff07347f9bbacba17f33b869840a7d6032f9c30a06f2c8fc43ec3f9218c9220b73593437da7e80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055641, "uuid": "bd2e3f97-d86c-4b57-9820-b4af0074ca7f", "value": "T105E41264B3FC0537E1FB26F67824116067F27807A034EBCE5D9920DE99D2B9249B2B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055641, "uuid": "bb6c669d-d256-4605-b704-98a6e022338a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055641, "uuid": "446aea48-bba7-436c-b60b-c227e146559e", "value": "12288:wPGmMZcyAbu08Mu5uj5/brGDkIUDnvGXdNRlVqi2HYZFaQm:wMWbudF5M/3DvGtNtqi24n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712055641, "uuid": "2225e71b-dea1-48e1-86d2-1591aa4a3674", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712055641, "uuid": "54c897cf-0cad-430c-b27a-bcab18bc2f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055641, "uuid": "74c4f230-6543-4626-9592-52a1cce90e98", "value": "quote N4302-088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8374bff-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041644, "uuid": "b104e0bf-2f3e-407c-b59c-65fe33cd2108", "comment": "Malware payload (AgentTesla)", "value": "6b3ee9184b7b18f3985ad3b87f78f2b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041644, "uuid": "e1812f72-f11e-4772-9a2a-c0ec065cfbb2", "comment": "Malware payload (AgentTesla)", "value": "4de6a298a55d719a8b618fc0c2978ef40d0f8536a7e5e0a038be7c4cf7501778", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041644, "uuid": "827e4f32-5480-4434-b1c6-eae41e2b4b37", "comment": "Malware payload (AgentTesla)", "value": "352fbbd82a731680d6b7dfb2df6078217f65ae2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041644, "uuid": "7eb0dc48-3081-40ec-937e-d63709d2eb5a", "comment": "Malware payload (AgentTesla)", "value": "d3a0a8ae8e6204e86e416b7eb1bb2bd75f2654f9a4ca6fa5c1a8da6f27429dfd0f905a7d274ca253cc8f7782439ecdeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041644, "uuid": "593cfcf2-c809-44bc-8081-449aad122a6c", "value": "T135D42350B7B83F61F53E17F420F568604BB1BA1B1A19FA9C1F95A0C2213BF5C4261EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041644, "uuid": "504fc681-9067-4f8e-8a7d-2c2de5f7788b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041644, "uuid": "ea18f656-5cb1-41d9-8605-c034310be9c2", "value": "12288:q0i3UE9kDrTIl2AUCbMOUMoLDk2jPd4hCPjv0Qdv:C3Uok3kgNMqkCPAqjv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041644, "uuid": "d6992128-382c-4c30-b4a0-a0a1cfd2bfb4", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041644, "uuid": "4ab0c9f2-2f5b-4476-ac3f-7fd39ab89986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041644, "uuid": "e2f393e7-bf37-4512-93a1-5a098ad86cd0", "value": "Quotation - HDPE Fittings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe92fb80-f107-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072713, "uuid": "567da15f-ce16-467b-bf5e-2c62428a3a78", "comment": "Malware payload (Mirai)", "value": "908689f47d5bb4ca340c9041c4325d76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072713, "uuid": "d88cc7cc-d9c2-4ecf-b1af-09b4316754d0", "comment": "Malware payload (Mirai)", "value": "4e4d058a84a1be954a7b49eecff8011a0dd3c1972e0ba6054ec73d75a09fa13b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072713, "uuid": "91bca60b-b376-4d98-8b38-7ed2ab7fe5fe", "comment": "Malware payload (Mirai)", "value": "e253ebb9c1a6731a1828afad9ce78ae61aadb706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072713, "uuid": "ccbb8b67-9fa3-40c0-abd3-58668a17f595", "comment": "Malware payload (Mirai)", "value": "b0a37aecdb35471eb03383c968ff25bb963cd4910507568e259b4d678922c4a76fc66ad3a7f2660081939126d29e3c4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072713, "uuid": "f146bb14-693e-4bc9-8858-3642b33b0395", "value": "T146532A52B9C09752C1D415B7FE0E018C3B6613FCD2EE72028A65DF21339796A0FFAA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072713, "uuid": "f9932790-0379-4fa1-bbfb-2d7e50f8ab36", "value": "1536:s6vDPn+ffFlyyro5P2Ykl8Y6ZvmjKV4Y+UNFxzhJL1ewFF6EkvxfZ:s6rPn+ffFlyyroB2YkOXZvIIjXFxzhJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072713, "uuid": "9ed2ad77-55b2-4efc-9d31-53de408232a5", "value": 62964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072713, "uuid": "ee6efbd4-e32e-49f2-8337-2925433bf5ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072713, "uuid": "d44d6ea6-fef4-4ad1-a6a5-f655578c9c31", "value": "908689f47d5bb4ca340c9041c4325d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec907c6a-f13c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712095446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712095446, "uuid": "601d48cf-13d4-460e-856c-20680a0501fb", "comment": "Malware payload", "value": "d03bfc8079284f50346ade38cf5cc09b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712095446, "uuid": "bcbcb02c-3a2b-43b9-88d2-728e984e292c", "comment": "Malware payload", "value": "4ea74d638cf40fe1f40e6cdfe564cc55e9d2546ef856ce261a1636fc83d02a32", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712095446, "uuid": "1b60f370-f20c-4b6c-b184-c4cfc04802cb", "comment": "Malware payload", "value": "7a75359a165e5325a80467a1debf273f47a97ec9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712095446, "uuid": "11676d55-a9ae-47ed-87ed-605eef37df9e", "comment": "Malware payload", "value": "e70c2ae3f0d63f18b7503d6225e063b786bf95075581cac101772d0b1b1a3bedfb69223a9d705162fb2d509a07e1a966", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712095446, "uuid": "23a57963-a412-4b10-81c2-626978f3a078", "value": "T18D815C3DDD97D91EE400C5B62039EA4C09A355B15D9EC1280DDFCB784A5F6893A8CF2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712095446, "uuid": "786aa430-040c-4a40-a8d7-b3f69ac91d68", "value": "48:9B2t19SbcKvXbTfe+GSa3yb+NmeN9hjlyJobL7SV/TD42kKv85VbW:qsgwXbBGSa3y6N7BlwGL7SV/QDKMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712095446, "uuid": "1c245906-5785-4331-a395-f67ccd884c08", "value": 3859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712095446, "uuid": "cb189b98-c185-413f-84d1-a27e40587da0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712095446, "uuid": "5485f1a9-abcc-460d-90d8-9cb4ce4585c2", "value": "d03bfc8079284f50346ade38cf5cc09b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ee7480-f099-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1712025314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712025314, "uuid": "ee60828b-fc22-4fa9-9c68-ef545df547de", "comment": "Malware payload (STRRAT)", "value": "d3750bcff315622063c92704a3247186", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712025314, "uuid": "0aea3c9e-be43-42d8-9b0e-1148fb4684e6", "comment": "Malware payload (STRRAT)", "value": "506208ef17c137ddc100e316b394479251184e622bc81a54250340d525e20a53", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712025314, "uuid": "4212cc7c-f89d-4589-8c84-4a513b3901ac", "comment": "Malware payload (STRRAT)", "value": "9f3807e776dee2c7fe0afa370c8ac8c6971dfab8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712025314, "uuid": "81899b0e-8d91-4650-a0ad-4d8140eb29f6", "comment": "Malware payload (STRRAT)", "value": "194298957b97511e296ed7b8b3a26042e11fe7ef4ea03cd261d9d7312d051f93161e5d42457cc24ef4d6c8a089963512", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712025314, "uuid": "690f41e9-b213-4b75-b848-efe7d6216f94", "value": "T1EC63E1F5AAD0C1B7D667D1B3050CDA97B5D8409C846EB3BA0B60D80BFC239136B52ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712025314, "uuid": "d939baf7-2882-48bd-9c25-c5258b913b46", "value": "1536:txuvjSsHfnuZ77A31Za/dDcvNrx7H2ldh:yvjSmnaU31ZOKNN2Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712025314, "uuid": "e677c49c-012c-44d5-9d7b-64d9957ddeff", "value": 67927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712025314, "uuid": "4cc05c87-4456-4b40-81a5-ce210b6facb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712025314, "uuid": "034ae25a-0508-4e02-8993-9b54ab5c4e23", "value": "Talep-Formu.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebb662e-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712082243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082243, "uuid": "daecd9d2-94b6-4c2d-bd44-fd45d851b886", "comment": "Malware payload", "value": "1c536e893ec4fe5726f329b9830d817d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082243, "uuid": "46fe3114-690d-4243-b3a1-5bdc65db8cf5", "comment": "Malware payload", "value": "50ffcb700e478dc5e5a6df362dedac289f9faca88a6dd02efed4ce4f8571c2a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082243, "uuid": "fd39a63c-08a4-4ead-b986-e54b4a2228a7", "comment": "Malware payload", "value": "be010e021ab13004bc1dd80cb27fc02a28258e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082243, "uuid": "15b0e666-165b-4f44-91d9-e2575bc7bc89", "comment": "Malware payload", "value": "3e3b60f232f16e3abc926cb9cd01845085cbdcc08d5ff48fa0d31fa139d1a8fd1e168054e0fe5dee417976eb4551e2c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082243, "uuid": "4d21e889-c7a5-4ecd-9c0b-38a5fa53d267", "value": "T1B4C423D4E26384C3D270BBBB5C1C1E6C51330DBD176568A2BA9C0397960AF76ED085EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082243, "uuid": "3491d4de-f31d-43e8-b210-d1cbe5ca1119", "value": "12288:pmBol1eKXZcY7sQpyKCADWxa+ZhEFM8AZqCc+X0Ge5hVC/MO:YA1eKXZccsQpVrk6iHIXTCkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082243, "uuid": "fba9283c-f1d4-47b3-a1cc-9edf590328ff", "value": 543827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082243, "uuid": "e03ab118-dde3-451e-8dde-ed0c71b32324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082243, "uuid": "ce96b1f3-450f-4cb5-a7a9-424fd5f0bb01", "value": "1c536e893ec4fe5726f329b9830d817d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8262eb0-f0b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712035685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035685, "uuid": "86631c06-877e-4e3e-9feb-a9b9337895ab", "comment": "Malware payload", "value": "b49d64b3f4125426092d9c31ffc62cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035685, "uuid": "b21fd4f9-d66b-42da-9de9-79a27ff08f49", "comment": "Malware payload", "value": "513c857dcfdb5c687f8ad12511cf5d74c8a002181c86ac6ad6fe1deb574dc4e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035685, "uuid": "f1bf30b0-8cf2-41c5-a799-496f5a00ee31", "comment": "Malware payload", "value": "386ccbbd288d5af9ce099962efa1e9469fc5c179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035685, "uuid": "d7876af8-d2b8-4d32-891a-90d1dac69658", "comment": "Malware payload", "value": "101d8d059dbe764a6910d633cb419ced9f46de1f2cd2ded493dcfa97788d0206e9bb591aec10d7e95c09c7d0068ee47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035685, "uuid": "9603de5e-fb64-4868-a159-10062937decc", "value": "T19AB381017D5AC026EC410471DD488BFA6A78ADA2F55134B7E79ABFBFF830744440DAAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035685, "uuid": "c582f136-40f9-49a8-9856-b65f438bd0f7", "value": "dbe920731c41982a49f842ad1020d762", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035685, "uuid": "20932086-02b6-479e-a8b2-a198d6ba2736", "value": "1536:yQ33zXMzdkEZTEvGVwa2QirA9Sw2/o4RE2rMIE:RzXMzdkEZTEO8EUw2/o69wIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712035685, "uuid": "31b489d1-3e29-48c6-8874-1045435370a7", "value": 107531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712035685, "uuid": "c5eabec5-0444-456b-8148-70e22883ee9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035685, "uuid": "d6ce6043-0134-46d7-b4a5-146b0d100114", "value": "SecuriteInfo.com.Win32.Malware-gen.10105.2645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead76548-f115-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712078693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078693, "uuid": "796288eb-a339-45be-8114-214946e1c06b", "comment": "Malware payload (PureLogStealer)", "value": "6a2575c58e16930a2c7d55cc51f6ac18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078693, "uuid": "e939a19c-ff17-4b80-9eca-3034e837d05c", "comment": "Malware payload (PureLogStealer)", "value": "517a6ca5a586f06151a786d6b9c8579f7c5fbcc8bf1174c784dc943bc9b88dfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078693, "uuid": "475e90b7-88af-4204-8902-eff1c6d92841", "comment": "Malware payload (PureLogStealer)", "value": "b4eca8bb8ad703a8060657334241abdae1b11a7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078693, "uuid": "28a2a327-9839-464e-b6c9-223f8553f051", "comment": "Malware payload (PureLogStealer)", "value": "3d68560963e2287d4ae6444fe0b575e99680fc4cd28a6a7e12d856507f9a6082cd7447ecde96bda5e64039d3e63275ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078693, "uuid": "913fdde4-bf5c-4743-9993-32cd96d0a226", "value": "T141533B12778B0250C46585FED1F3A07403F6A78B2773DB4A3B45C38A4E527D9EA48BA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078693, "uuid": "62b8076f-c814-4a06-ad26-61bd74b20e06", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078693, "uuid": "1e7adc92-a166-4563-9d09-f661efbd1fd3", "value": "1536:RsPPA1El1GZ6uYsnjCNV529oj68yEWL7:RsPVi6uDnWNV5FjryEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712078693, "uuid": "bb13fce7-0667-44d7-b44e-6794fd14acb0", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712078693, "uuid": "5c02150f-faf3-4a9b-b031-b269a74c6156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078693, "uuid": "18adb72c-5333-4652-889f-5e42ecfd73ca", "value": "6a2575c58e16930a2c7d55cc51f6ac18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32044a82-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712067216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067216, "uuid": "7811e774-4acc-40e7-843d-fb9acd5d4974", "comment": "Malware payload (Gafgyt)", "value": "969ea7efbe07e6e4a4744b09c8ea9e36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067216, "uuid": "5e177197-80b5-4e83-b124-d78a7519c648", "comment": "Malware payload (Gafgyt)", "value": "51f5959595c911de226d2a7149147c2b331b97d2899a774634381a25dd497ebe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067216, "uuid": "56c1c2de-05bc-4c0f-ad36-37d5a888418a", "comment": "Malware payload (Gafgyt)", "value": "43fed12933c8d89708cdca8a551642912a5b3d27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067216, "uuid": "c940a24e-510a-4700-948b-9e3fd1784e86", "comment": "Malware payload (Gafgyt)", "value": "fc558826a60da97f406b87cd5857fa90f2cd286922e13f0235abb5a4e1de857b6a6434d014fbb90d1c7599a182d7ac0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067216, "uuid": "d9d9db6f-f5db-489a-9525-58bf649d0208", "value": "T11D932947E9659FB7C0866AB125EB5D300B12B9911B5F1B8A3138A7F8074F5CDB80EF24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067216, "uuid": "c8fecc2a-7d90-4233-8cb1-0c541eac1f98", "value": "1536:JrKOyODNjpKlrLKSKAQg86nGtC1FhmrOem+pVLbE9jf2hk:FkODNjQlBKAqtCHgnm+pVLbQjf2hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067216, "uuid": "2c952753-93e6-408a-921f-826bc63fe0f7", "value": 90768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067216, "uuid": "077b850c-6167-47d6-a658-ce7270ea8c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067216, "uuid": "36eaba1e-6151-4de3-b436-e71c0535cdb7", "value": "969ea7efbe07e6e4a4744b09c8ea9e36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8da33e-f0c6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712044655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044655, "uuid": "20a1ea96-ebfa-43f8-92c7-f0abbe1d696c", "comment": "Malware payload (AgentTesla)", "value": "7194cb298d9d3a39f24f6cf9369a8c6e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044655, "uuid": "d1f59d02-5629-4659-bf3b-7aa0b6fd81f1", "comment": "Malware payload (AgentTesla)", "value": "520bf79393c516e5665eafc36b3d5179b304ece829def596fc5e5708b08e4e59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044655, "uuid": "db92a38c-9d1e-4334-b0da-99a9c1385516", "comment": "Malware payload (AgentTesla)", "value": "c5adeeb7692597cb9f0dabed83042d0a53da1c43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044655, "uuid": "86826976-9ac2-4afd-8b46-cbfdad6645be", "comment": "Malware payload (AgentTesla)", "value": "1683b4ed156952cfe466c810b77f463720e15fb2fd001a97819e95d26366d58072d89b30649ca9d666db7160b2527c4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044655, "uuid": "0c0f96ca-8a16-4995-b5bb-8a24e2b782e4", "value": "T1E4257BB52304BB98C4BD673264233844C7F6A4DAE3A1938C38983BDDB731346E5A755B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044655, "uuid": "44953e90-c3b2-490d-b6bc-64dc0a061cc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044655, "uuid": "43292307-c558-492e-b84d-2675f0a49ac8", "value": "12288:qNObOHtiarGxFiymY3E8IbJqUKC+PdrZARVZg0YerE4Bw48DcZzKomUC3sic:wtSxFtE5cG2VZAR88V78mmUSZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712044655, "uuid": "cc8a0f53-509e-4b48-b187-73ba3f66e266", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712044655, "uuid": "1c687507-2a34-437c-a9b0-3c637f4717f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044655, "uuid": "5ee5d822-00b1-42e5-bde4-75e5cf4f8c7d", "value": "UTF-8''Kwiecie%C5%84-2024-faktura.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4655b0f2-f0e0-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712055653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055653, "uuid": "dce5787f-d626-4d23-9ef2-dbd1ab9da1fb", "comment": "Malware payload (PureLogStealer)", "value": "b8e9ec0cedba5373daecbf2a39f901cb", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055653, "uuid": "7bd924d8-e89a-4d64-a62e-564adde4a7af", "comment": "Malware payload (PureLogStealer)", "value": "52501396a535fa409f71a5ed5fe4070f39451d95e7e3b0f078f918ee91874b4e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055653, "uuid": "24c1d024-0a29-47d0-8109-709e0324b790", "comment": "Malware payload (PureLogStealer)", "value": "6437ee39381faf3f9ed07fd3d6ddb92417eb6082", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055653, "uuid": "10669a36-9def-4340-b494-8ab132b0f136", "comment": "Malware payload (PureLogStealer)", "value": "9e245a5040e7f20dc6b89a7e5d480d22ddd419b2abc2f968388c8c6ac521782ce1dbd962f87de38f58287b64bce1b3a7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055653, "uuid": "446c7bfc-5825-41f0-8897-3552049d6e3b", "value": "T13B352370FD70ACE3EFA883BC257E5F9917BC5B8141DCF6D60A54BD82434EA28680E456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055653, "uuid": "749cbcc9-6d2d-4284-bb33-4e4f13a08f36", "value": "24576:BHpbJ6X869EsjqBWgO7nsB+fhdWQcAJSkW8F3UomTvCl:96H29+Zt/mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712055653, "uuid": "fc104a82-629f-459d-991e-07e2b00016b7", "value": 1159035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712055653, "uuid": "71d136e1-98c2-4b37-94e9-2c7621e1b5c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055653, "uuid": "ac5bab47-1772-4ab0-a901-efe4a70f6ebe", "value": "VALUATION NO. 2_SC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfe1cf1-f0c9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712045999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045999, "uuid": "804a540b-b6c4-4ab4-837c-eb04c49c6b0f", "comment": "Malware payload", "value": "7d7d052b4c64085a821376fb359579ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045999, "uuid": "9d614c1c-ee89-4b9a-8014-58e356a818a6", "comment": "Malware payload", "value": "52a5d1ed9a45fa84027f17a93366828ddcef615756c016dfcddf5ade99ffbada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045999, "uuid": "c3cc1d4a-a925-4ff7-a092-753ff76b0aa3", "comment": "Malware payload", "value": "2617e14ed98c7f1d60c481b440d52ed98c4712cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045999, "uuid": "4e3c0c17-cd8b-43f7-a925-551d3e836802", "comment": "Malware payload", "value": "760e07364e074540a11fb5e24f41094f0f4f972132ab29adf49ab72556aa12a376f7123965755ad08e3a073a35befaa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045999, "uuid": "ee2709b7-e92a-4a0b-abb4-184690fd08dd", "value": "T16A47BF23B891C070D5A312F1CAAE766E51BCD932833886C77B8C59541FB18E2773A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045999, "uuid": "e11f0150-45ab-4e2c-96ce-503248c62cb1", "value": "1de48e3206b216f41befe7593ebb28fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045999, "uuid": "24077704-4661-4bc2-b6fd-675fcdeef95b", "value": "393216:smfY+i7FoSc3AX8EcoGV8NUz0cNgaPTAhUYn2nT:smw+i7FoSc3AXryGNUzpgaPTAhUYns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712045999, "uuid": "56bda16e-7cae-4be9-bd0b-aa2565c09795", "value": 24752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712045999, "uuid": "0273d758-bf2f-4ce5-b9b9-aa57093a2d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045999, "uuid": "dc20ff2e-a149-437b-b12a-8b3fc88857a1", "value": "\u56fd\u6d77\u8bc1\u5238-\u5415\u534e\u65b072700168\u8d26\u6237\u5bfc\u51fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d8dab8-f108-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072752, "uuid": "1604b180-6fb3-4da5-8fd3-c47a9ea57f55", "comment": "Malware payload (Mirai)", "value": "aa7f2e87fca0f93fd8606f2cd6517cb3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072752, "uuid": "e3bcbb7d-1e4f-49c6-a6ec-e33c023b9972", "comment": "Malware payload (Mirai)", "value": "5526facd562439675dc002bc2fb46a5b064a434494516cd1a48796a4d3997d8b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072752, "uuid": "e586f312-1e52-4ee8-9231-c257ff16ad1f", "comment": "Malware payload (Mirai)", "value": "dc093f06e566557217a493f8a135b2f1815dfd67", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072752, "uuid": "956fa013-9e1a-471a-be39-35bde595b6da", "comment": "Malware payload (Mirai)", "value": "2415705a0f1cad82f554d4e2dcc1723de46a119af48410a5bdb6df77c7e035111f040eff7f6b8fcfe1c59862c25e868d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072752, "uuid": "2c382e0a-14bb-4d58-a5c2-8801b58534cf", "value": "T141331903B846C0FCD55AC2B199AFD572D632B8AC51307D6F0788FA722F29E31665EB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072752, "uuid": "ae95bb48-1713-4f4c-bc92-76ab3c079752", "value": "768:NgplhD19+0yAuhIlCm0RP0IuYebtkaBLtR40Nj5UEr:ijxyUCm0RzL0JtZNjZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072752, "uuid": "9ff1adb4-674d-4080-8dcf-3246fd97478c", "value": 52296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072752, "uuid": "ce64de81-e670-4b3a-aac0-65ce0cd062d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072752, "uuid": "13e9066d-a109-4e17-80b4-b1309cbdb287", "value": "aa7f2e87fca0f93fd8606f2cd6517cb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41661be-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712041637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041637, "uuid": "bc1f9412-1872-4d2c-8667-4c19cb4cb0fa", "comment": "Malware payload (Formbook)", "value": "fda96100e356c6eda9eb5f52028937b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041637, "uuid": "86d029f9-d852-4199-bd9e-06c087494a9b", "comment": "Malware payload (Formbook)", "value": "55361f8482fd227474151e50de9e1e7a4c82d6b166caf9a8208d0c0ce8907787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041637, "uuid": "ec1eae0b-f2de-4fa5-b1f1-9c8e7a37c223", "comment": "Malware payload (Formbook)", "value": "c33531153c59191cb267168808205e0347b870bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041637, "uuid": "e169607d-8bd1-4d05-9ea0-a0f6e4b62345", "comment": "Malware payload (Formbook)", "value": "568c65c570c57885beca6e96e9784936f11af72e394bc8d1e2f7bbc0f84a335eb2d7c526e3d991b2f6ee55554019b996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041637, "uuid": "f64267e7-145f-420e-ba27-47ce9c1601b4", "value": "T1B0B52203BA1E45A2C6C4EBB6CAEA45D407A0ED80B653D689354E37F9583377BAC15333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041637, "uuid": "b9e1cf54-d3da-4b19-a7e9-6c9a0d6b76a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041637, "uuid": "ee5b1c16-686c-48b1-a728-0ae7ae1aaa44", "value": "49152:ESRDpw0i+iiOhSy1/b4+UbcvqeUbN+XR4i0RHW6epfaCQg4YBZwTPrdgm:EuDpw0i7hdR+cvqerT0ZYZaCQIBZwTPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041637, "uuid": "f8734d56-bff7-4da9-8c97-1a73c47444a5", "value": 2477568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041637, "uuid": "42f4e995-8888-4b61-92ec-7354f9ff308f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041637, "uuid": "428f99bd-82a8-4371-b6b8-baed92fcddb9", "value": "QUOTATION_APRQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68345a7-f0eb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712060673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060673, "uuid": "8f534897-4dae-43a0-b548-99a86899ce0d", "comment": "Malware payload (Mirai)", "value": "98937fde57ad6be999edd53abf3f8aa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060673, "uuid": "abbc37a8-ae9a-4725-bdc6-d5f0d643506e", "comment": "Malware payload (Mirai)", "value": "574bb936d5c5720a7b8872dd42e334dbda407867dff5c8f2a4ba6c99c29af005", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060673, "uuid": "9c0eacc1-60f9-4476-b99b-02c00bcfddd7", "comment": "Malware payload (Mirai)", "value": "fe7d94fd11f90a8b98ecd150f70b92bb04aa3027", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060673, "uuid": "5383e803-69ff-4817-91ee-1993d71ebf92", "comment": "Malware payload (Mirai)", "value": "2e2b45660227b5b20a26dc51dd303d240388df268e7182ab2c6c9c60ae88d14943f9b6bae6365c0797bccfea4815aa69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060673, "uuid": "1c117946-c1a1-4c34-815a-efe36d281796", "value": "T12DE329D7F800DEFAF80AE33748530905B630B7E245925B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060673, "uuid": "69aa9673-6fab-4afa-b2f6-482545cbc3c4", "value": "3072:GuRsZS404+TW7j2o/wjAR8claTVrjbihL3d2m7yyKwDW:fsgS1/oAllawL3d/yyxDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712060673, "uuid": "e82834c7-d76f-4f38-af56-13ec3d42bb22", "value": 150496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712060673, "uuid": "7d5dc29d-c99b-4452-9580-d06bc603ebe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060673, "uuid": "60e756a1-13e3-45a6-bfb8-36ffe1b1bdef", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841af3f3-f0a1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712028699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712028699, "uuid": "e9059efa-f5b9-463f-98a1-a3c1aac1880b", "comment": "Malware payload", "value": "096f76392a217e46270b77d5e32cf6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712028699, "uuid": "72da7756-1149-4cbc-8633-9b6cc3c27ce5", "comment": "Malware payload", "value": "583c494b8ee9adc6e1446145322fd350134eeb1070e669fade25856862a68ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712028699, "uuid": "4d727c07-dca1-4888-ad15-0b19a11711c4", "comment": "Malware payload", "value": "e04574d6bb1fba3b3adac36c5b74311faf10792b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712028699, "uuid": "a7400429-94cd-4536-823b-cfa51233a082", "comment": "Malware payload", "value": "6d1c56b5e4f71a0e1818e4ab72e161b20bc7e1eb14b772fdadf208ae360cdf534609ef48f61256bdc43cae484893ad26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712028699, "uuid": "a3ff08fc-dd0c-4d8f-969f-66756765440a", "value": "T1DB6649C2A6458139E1DE163480626BF6BA71FCA26B339DCB43AC7D5F4EB31C05935E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712028699, "uuid": "4f0694cc-91c8-42e2-9439-235f3945aaa6", "value": "e5a4e66a647cd6b465cf7893c0fa91b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712028699, "uuid": "c43adf56-2f9c-4d8e-b299-efe531c7cd3a", "value": "49152:FPztyBvgvHPvgTCGVLyL663TrGVbW2b93B11Ni/qn9emfM0y3RzvMl330gH:FPgBiGO6CGt93fMT+nD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712028699, "uuid": "9f50edfc-3102-42f4-9b27-b2f07e13aa88", "value": 6491648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712028699, "uuid": "b439bad8-5066-45bf-a745-70c9e0e52a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712028699, "uuid": "bed18b17-bca1-43e7-973e-7f65c75ec62c", "value": "SecuriteInfo.com.Trojan.MulDrop15.59823.17539.21046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fdc427-f12f-11ee-a120-42010a9c002e", "comment": "Malware payload (Meterpreter)", "timestamp": 1712089816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089816, "uuid": "5b56c0ba-be0f-4c19-b58d-9aaeb9d7be4b", "comment": "Malware payload (Meterpreter)", "value": "5269efecee3f7c86ac81e694f86a88e9", "object_relation": "md5", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089816, "uuid": "88bfad8b-c743-4dc5-881a-3596873c68ea", "comment": "Malware payload (Meterpreter)", "value": "5883edb9925918fb783261b08751ebdbf487811269643dae5ab55029d301ff52", "object_relation": "sha256", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089816, "uuid": "71f05f5e-4836-4b16-90e2-5e1a7fab8f83", "comment": "Malware payload (Meterpreter)", "value": "5cf41171bbc75097083f1453fc54a1fd39ef873d", "object_relation": "sha1", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712089816, "uuid": "6dfd657d-a4cf-4941-a786-05606cd45342", "comment": "Malware payload (Meterpreter)", "value": "77868ce858894634cac76ecd1da363f3a4a17ff1b648061b53f6d04b8b4256b485b6aa50a7b1cffc51dead6a156bcb95", "object_relation": "sha3-384", "Tag": [ { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712089816, "uuid": "056ff656-4d9e-433e-a4c1-313a8b5651f7", "value": "T185F3B6373600A331C14607368A9FD7E58F29AC5B4F27112771AAB35D2FB199056B7AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712089816, "uuid": "e8d1b4b8-9958-479a-9dff-0d0a4ab9c5bc", "value": "384:iHpe4ZvJXK7gzFM7Wu8A7QoXgZs+5BCq26yy3M5BCqPN:Zmxa7gBMyugDCUyWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712089816, "uuid": "34561656-6fee-44ba-bc5a-570a00b21409", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712089816, "uuid": "0145d554-89b2-42df-b57b-6a666bf5ac85", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712089816, "uuid": "d7640fe1-b16c-4ab3-a407-0b2a30954682", "value": "SecuriteInfo.com.BackDoor.Shell.244.27733.28070", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6cc69e-f107-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072708, "uuid": "c95e8b7e-1f07-4adb-a3ce-629139f2a1d4", "comment": "Malware payload (Mirai)", "value": "66c0f188d1a5faf1491805cd1ce11f41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072708, "uuid": "73636202-b1ae-40a3-9b65-246f18331fba", "comment": "Malware payload (Mirai)", "value": "598f53bd00687bc7ec2abb05ffe906450cb9722037fcc7b98e0d42d5ff5ad117", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072708, "uuid": "87387679-ad90-424a-a7b8-f93137bc9439", "comment": "Malware payload (Mirai)", "value": "db710c019d12b403f30348d77ba2405f11ef10ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072708, "uuid": "dadbad16-b39c-44a8-aa85-a87fd86c5f9e", "comment": "Malware payload (Mirai)", "value": "d27e38c38c2a3309ae7b0a9a729f71983e784c436856b82e55dd104d20c1534fd1d90a01800c4334a693f075045072b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072708, "uuid": "47798353-234d-4526-8ff8-e2032611cb8c", "value": "T1CE337C65F8642CF8D8120174E4788AB9D3939EB641C90CB62CDDE65008FBF5DB68DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072708, "uuid": "005c77e5-19dc-47a2-a761-dd54f37ac973", "value": "768:YHm764mELERgEpMEFH9YBjsxc4ea8MK9f7UnGOA92ntVsRaDRmhqmq+kSjkFHgfE:12kQnzFH9AkFH4sT9rPDEwhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072708, "uuid": "b9cefdc6-7cb8-4dd5-adf3-31b132505e4e", "value": 54144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072708, "uuid": "b1e5f6e0-8b41-4291-b519-a5e3e4b1939f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072708, "uuid": "f3d599ec-3346-4b8a-8166-68aa5a4c26ec", "value": "66c0f188d1a5faf1491805cd1ce11f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225273cf-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1712046573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046573, "uuid": "3a31ac79-2f61-4f73-9b13-4019628c6917", "comment": "Malware payload (Vidar)", "value": "a17efa3f07ace71dea8c084c1a502f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046573, "uuid": "496203c8-7a6e-407f-aaeb-399d2df5b87a", "comment": "Malware payload (Vidar)", "value": "59d959aea023ad0840ab3694261ba36c4590f65f07ad5e500e791c64a3455142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046573, "uuid": "3b87e342-0b6e-4765-b54d-02944ee76505", "comment": "Malware payload (Vidar)", "value": "08c0d817dfef6c1ce36dc1c20390f5c8f7ebee07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046573, "uuid": "be297e38-1a73-49bd-af85-9b7736cf8d6e", "comment": "Malware payload (Vidar)", "value": "d6a2be579d1e6d0f8d4beb34fe6dcfc57a38d35e044e6d5f32ab4b8df0c42cb6a15a9990a901122a0bf7b70c3e0e0ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046573, "uuid": "d597db59-9d3e-44e2-9d3b-db2716ac1eec", "value": "T1033412C2DDFC9C56EC938D3078A5A2272B78B5834550D62529CAD0F02F463D3BB593B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046573, "uuid": "cfeed1c7-31e5-4076-8ea8-cb84b774d335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046573, "uuid": "694a069a-d35d-421b-af7b-86d913a9b1c7", "value": "6144:a+DGkIHUIHBZpFVa1QEiJGoWsEWVLNjTqN:xNtqZp+9iJG23NjeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046573, "uuid": "3ee2c0e4-85f2-4ae4-b211-81d0f10a104a", "value": 240264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046573, "uuid": "3d204fc1-39c3-41ff-881c-e0f3a2f0c8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046573, "uuid": "656f7d91-d125-4143-bd27-edf9fd7c9097", "value": "SecuriteInfo.com.Win32.PWSX-gen.28191.20359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9599f225-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039036, "uuid": "ff1fc642-8c72-4dbc-b6b1-ef561dd5d5da", "comment": "Malware payload (Mirai)", "value": "ee5671e5a4842f5ff1c8602fb517e704", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039036, "uuid": "dc6d197d-9499-41b4-b501-877b1c10f468", "comment": "Malware payload (Mirai)", "value": "5a398b28cf269567409e3b71c4cd9973075da51b19ccaed07b012f55e1537316", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039036, "uuid": "13f05571-e914-4f53-9a23-7bd6ca4b0d2a", "comment": "Malware payload (Mirai)", "value": "fbc49e3adc594fdb9752726a0a888371aa13c2d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039036, "uuid": "71ab9701-a045-4cad-8ef9-52fc8794d85a", "comment": "Malware payload (Mirai)", "value": "8a4297ac68f0c1a55de398beb133776601ec16149157ec6dd0f71a5fd533076b6c86f998f4e9cde3adf2143927a93be2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039036, "uuid": "1c3e83c5-d475-4f07-8cdc-61ff8962e784", "value": "T17863840A3E254FBDF7AC863047B74E32A79923D726E1C681D15CE9101F6424E685FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039036, "uuid": "97eed69a-23c5-4458-9f26-9037ef9a3d26", "value": "1536:bS98k/2xmqUhrhVyOUf2hdPwXj+xijd9KQd7T/:bSR2xZ2yOnYXld9KGn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039036, "uuid": "b8eb41ab-4ce0-4202-a32c-5e4f54e8969a", "value": 68448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039036, "uuid": "232f37eb-e41a-4e25-9d5d-e75856190c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039036, "uuid": "5ad81482-8d8a-4ad1-8b96-5ef91fa6f106", "value": "ee5671e5a4842f5ff1c8602fb517e704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e3dd4d-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712041639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041639, "uuid": "61e21cfa-9ddc-4f44-b67a-a103c5e7ebc4", "comment": "Malware payload (Formbook)", "value": "6aa259ef29d633a6fd695d4a468a7b56", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041639, "uuid": "bbfefd64-e5e8-4523-b191-d2e0a7062475", "comment": "Malware payload (Formbook)", "value": "5a627fdc7fae05d32ad81a2005f8f81cc68e81acc09f7f7d23720938dc60cdd3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041639, "uuid": "728fda5f-237e-4673-831c-6d5f69429b0f", "comment": "Malware payload (Formbook)", "value": "2f1bf1a5d9c589a3823b123d877046c675fb206c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041639, "uuid": "44797972-b679-405c-a323-3648d4ccbbfc", "comment": "Malware payload (Formbook)", "value": "bede24a9bb921de61cbc1ff7ff63d2ca93a6fc0ed4b04e358fbaa41b1505bdc7439fbe7f3cc5627d89a844387547ff58", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041639, "uuid": "327836fd-5693-432f-b220-1205ab6e7a83", "value": "T192B533B5D64720A3CB0E2C72703CF9946773E7847289AD627CC627D17ADF6E19839A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041639, "uuid": "dc1363c4-0c5e-48de-ad77-d7ce55fd8e85", "value": "49152:FRIRYRxTzt1GEugWSURgOp9qXtjI4IPpoBW/7:NRxXtsEutSURgQU8hJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041639, "uuid": "78af8f01-2e16-4e4a-af26-d5d980ae711d", "value": 2364034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041639, "uuid": "e95cae33-29c8-4948-ae0e-3f3c2901e841", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041639, "uuid": "52a17545-004e-4b07-b587-cba6e8be62a7", "value": "QUOTATION_APRQTRA031244.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9728a0-f0e4-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1712057461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057461, "uuid": "0d6c3fdd-31f7-4ee9-9881-93b6d6cc5bbb", "comment": "Malware payload (Vidar)", "value": "2caa34244dd6726f37dbccc7fe9b59fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057461, "uuid": "5878e32f-d7a6-45cc-a59a-ba48a4534482", "comment": "Malware payload (Vidar)", "value": "5bde316bb02a4d1c0e5530093c04f48e6bb862a828f154b5ad2a19c3a032937d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057461, "uuid": "284339bb-5584-4589-818e-8791989dac5a", "comment": "Malware payload (Vidar)", "value": "0ec728e4614ae0f3ae5db4ed255a1a344d654659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057461, "uuid": "4b5d3bf8-e9fa-49d8-9da1-0a41c2ed62aa", "comment": "Malware payload (Vidar)", "value": "11afbd1044832324f29dca490a849a080a2c0c1143482513b92475f763b6d79ea21ba49fe4d61b2251f1ad5a75dd69e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057461, "uuid": "d5126b7a-d539-4980-814e-ff547ab9a321", "value": "T1CA34123057E70456DD0758746890EA28EE30B395A7A3C16B60C9C01C9FEB3EBE3959B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057461, "uuid": "07a93438-db2d-4e87-9fb2-7a2240dfdc94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057461, "uuid": "5ba6d712-eb51-4a2b-a70a-0f3dd6b11017", "value": "3072:jp3BvL34Ph1UOpbqWvhSveoQxd0+4NB4F/8CUKnozHZHeV1HLVA8959eQAOED:Nxvz4ZxbVvhweoQL0DNBKn6H1w5AENo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057461, "uuid": "9f7607c3-519a-4dc4-8ae8-48bd8c164cb4", "value": 250504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057461, "uuid": "a11ff314-34a1-4b4f-a991-7ac5962b8e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057461, "uuid": "ea059e9b-b785-4329-9d76-3133f095e0bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b2613a-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712064405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064405, "uuid": "e2ba24c4-2c44-4314-8844-53c86c7c462f", "comment": "Malware payload (GuLoader)", "value": "ee821a04d0c5b5b4881bbf91891ba0a2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064405, "uuid": "55f08fca-ff8e-4acf-b64a-3fd3f8b16cbd", "comment": "Malware payload (GuLoader)", "value": "5bdfcda502ae7000a76023494d0af913a66b69b34b456927f26a35f8e1cee731", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064405, "uuid": "fe2164ed-f435-4d87-a922-473a3b316b60", "comment": "Malware payload (GuLoader)", "value": "161fb039917cdd767cf0e26ac41daad63672f1c6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064405, "uuid": "547c698b-a91d-49ae-8ed5-6280d53377a8", "comment": "Malware payload (GuLoader)", "value": "52f1b07a9e7da450a58916981edda33e7b7983bbd7bbd5ee77085736df79e36f0479d32bb43702d957e3644d9e500cc4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064405, "uuid": "4921297d-ae1e-4a9c-98e4-c4c266b2a4b1", "value": "T10A342BF0CFCA26394F4B2FDAED24446289F981990212247DA6D917AD7243D6CD3FED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064405, "uuid": "b8bf9757-c8fd-4617-88ca-dc73a90dbd2e", "value": "6144:hthQMLtOBxJrv5lttSP4KuK8jWwoipSRUiGT9rS2fTicm7OIkvBAa:zkVBCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064405, "uuid": "2c677428-f4c3-414d-8611-4fa293262e4f", "value": 242927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064405, "uuid": "25b73a05-c7f0-47a4-9f92-5081ca589509", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064405, "uuid": "69a47d94-c70d-4836-8d64-7a99d5683a46", "value": "awb_shipping_documents_bl_01_04_2024_0000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9449d4a4-f0e9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712059650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059650, "uuid": "6e35528b-76c3-42be-b35f-e9e495fae71b", "comment": "Malware payload (Mirai)", "value": "0c94287a98729ccbdf38fdc8335b14c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059650, "uuid": "9e2af116-7b7b-4f7d-8294-d485a869e787", "comment": "Malware payload (Mirai)", "value": "5be55f6d733427ba028d179e9c434dd421de8c9895dcff07a8e74220cacc898a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059650, "uuid": "bc8692a7-9406-40f6-9cce-d9047cd25e60", "comment": "Malware payload (Mirai)", "value": "e35aa3b49cb4f7273925c96c869e8e27ecc98619", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059650, "uuid": "1b04f7cb-4d1b-4da4-b871-c7b4db9b274c", "comment": "Malware payload (Mirai)", "value": "f812fca357ff6a077a2bdf2f10d8f5b0afadb4e87ad8e961358db45a46e3ab3e9cd53886f08911ffb1e169cd1187bbdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712059650, "uuid": "15e0f373-8f05-4344-9644-6642eb9d2be3", "value": "T1ABD30845FC405B23C6C612B7FB5E428D3B2A17E8D3EE72039D256F60378A95B0E36942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712059650, "uuid": "4f3c6032-059c-424f-b0bb-07cb7d09815e", "value": "1536:3HCesIjTbgff1IcBh3GPFfAOgGj4V7Cs1qT+PBOkPrVKGTkuFIl1k9wywAF5IAOq:3HCJwcPEFfiK4wLaPBOkTgu0ziribA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712059650, "uuid": "cbb67f31-52f6-46cc-87b4-0e96bbe36a6b", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712059650, "uuid": "d3c4e191-bea2-4583-86c9-e6e39a032032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712059650, "uuid": "a6bbc37a-6968-4b5a-ab94-94b58d55befa", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48962a23-f10a-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkGate)", "timestamp": 1712073696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073696, "uuid": "30987db4-9b7a-4a42-9af0-4de34a475ab0", "comment": "Malware payload (DarkGate)", "value": "29552b793e8d97538afff1aaf566a625", "object_relation": "md5", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073696, "uuid": "08a6bcc3-91ed-455e-96f1-911b71694f37", "comment": "Malware payload (DarkGate)", "value": "5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831", "object_relation": "sha256", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073696, "uuid": "f0f1afe7-f233-49c7-b8e7-b98f208b9ae2", "comment": "Malware payload (DarkGate)", "value": "e3931fca0386f00e1c246039c3491b686e5d8354", "object_relation": "sha1", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073696, "uuid": "929b5372-a5fd-4d3f-a990-fa5576472b05", "comment": "Malware payload (DarkGate)", "value": "1dd33043a5808574588c0e0f7406ada8d4dfe2692961bc6376cb9adfbdfbf8a9fa7cb98c5312388f067c3af254e97007", "object_relation": "sha3-384", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073696, "uuid": "4df05ee3-2d4e-4e1c-8712-31cbaac3401d", "value": "T16A02E203BD578434F0341C175D23642EE750111363A1FBE976ADC39B8B2ADAAECB6D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073696, "uuid": "82946b8d-acee-4b66-ab90-b460ea525180", "value": "192:YMg119gkCtL3IqSPN3QzGNzUoNJnN/Y99957:jy19gR3IquNgzG2oNl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712073696, "uuid": "656e8963-ac9f-4b85-814c-ff4ded091d5b", "value": 8262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712073696, "uuid": "08f1732d-d224-4ddc-91fe-ada09ee74010", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073696, "uuid": "41b7bdd8-1077-4b4f-b3b0-28bc46944d89", "value": "QB-04_02_24_inv765541BA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d854c7-f0c7-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712044806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044806, "uuid": "f7963ae4-a386-475c-b854-b7f6342bff69", "comment": "Malware payload (RedLineStealer)", "value": "54a764920f77d7fa6e0362c87fef1a00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044806, "uuid": "3f6980fc-629b-4e97-bdd6-32786a8752e5", "comment": "Malware payload (RedLineStealer)", "value": "5e9bcca94777fe32ffbf38991c2d7123b26bc0e7bc7a347683f66d19d298fa57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044806, "uuid": "cf2d8bb2-5424-4233-96d7-314096b7abbe", "comment": "Malware payload (RedLineStealer)", "value": "bf50ce0c1086fe415dea79aecc1f484922a3a723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044806, "uuid": "96146bea-b78d-47a5-ab22-93a5ca9677d2", "comment": "Malware payload (RedLineStealer)", "value": "4bf22b10527616b7e65aa8d7c7afd9341cafdcd27ffc861ca268a2943bdf477c62fbf4c4cf12d5e6bfb3f5899d0aa4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044806, "uuid": "6150cafa-a1df-45c5-8cca-07dc7febd53d", "value": "T1DB5523B8B7DC8D41C66187B09E60CB76F355ED88826A860373ED3C8FBA7D8C5068165D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044806, "uuid": "4c2dffe6-2f02-49db-b562-a50d423310ed", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044806, "uuid": "ee896599-a662-4cd2-af46-fad07e0aa0b5", "value": "24576:U+f89nBWLj7rv8/VOWEsS0rfB2f4w/mWCOjwWKQBXFoLi:UAKnBs7rmVEkbfM9CxGX2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712044806, "uuid": "c3525905-8078-4484-8836-300433f41c97", "value": 1314816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712044806, "uuid": "b82f6e8e-6c0a-4786-8b8d-ec87f71da211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044806, "uuid": "d303af7a-60d4-4e45-8262-0a3221f5af07", "value": "54a764920f77d7fa6e0362c87fef1a00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9295e246-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064371, "uuid": "d69b3afc-b546-4297-b205-fd74755d1b70", "comment": "Malware payload (AgentTesla)", "value": "1a0b5737bafccc42d756440cb443565c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064371, "uuid": "d8d1aa7f-18f9-4f88-8d55-620de93e33e8", "comment": "Malware payload (AgentTesla)", "value": "60a586cfdeb27912308567c991ed006c8701ae3987a780b393059a484ae24347", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064371, "uuid": "d4529426-aaa2-4204-9030-62ad438f3294", "comment": "Malware payload (AgentTesla)", "value": "f8ab9c9894d5191822837d643ad6091154c02b91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064371, "uuid": "59ea28c2-dc4f-485f-98a7-b27ca5af1b28", "comment": "Malware payload (AgentTesla)", "value": "79cd26f92db6875f1e7d4eac706c72e9f76b1d3fa17f36dda73191e50605b2dca8ec2a4d810267070f988b371bafa237", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064371, "uuid": "c9eb2c5e-70e2-4e16-b5a9-277d42866bf4", "value": "T126724C5B76430768DD331AD24D490949C5B08E36E43249D0BA7BE3CE69039EEF33959E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064371, "uuid": "81e9c782-24ca-44ea-bdb6-2811b6cfc2d7", "value": "384:dGSstmM5Cw+tn9CdmClvqrUxzqHzjGiAU/fqg:ditmMgFt9CdmClvqrUxzqnZfqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064371, "uuid": "b11fcfb7-4b30-4398-be73-caccb1105a6a", "value": 16563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064371, "uuid": "612447fa-b4c2-4d4b-8a97-356cc5395415", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064371, "uuid": "f1ab23d8-8afd-4682-89c2-9a26bb729119", "value": "RFQ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e022582-f0e9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712059424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059424, "uuid": "a442efc0-7575-4fa7-9b35-4de40076047b", "comment": "Malware payload (Mirai)", "value": "14ce8b9d6767e70fdd70828ec7e873d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059424, "uuid": "2d6abd23-7dc8-46d1-85ef-15d8d7249c32", "comment": "Malware payload (Mirai)", "value": "60be1199fc92a7cac47a7db28d5a0123eecc5275c2ef4c1169b29b88f4a39a6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059424, "uuid": "902a1265-6175-408a-b358-93539bb06801", "comment": "Malware payload (Mirai)", "value": "0f14273680c89cdb629eebef44766b65f3c7b0a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712059424, "uuid": "0e3c55dc-b190-49a6-98c2-eb7eef8106e5", "comment": "Malware payload (Mirai)", "value": "4822a78cbd42e0c4c59718f4c065cf52bbf80c1a90eb9ea0991db3631355aa98d08b768ae6ded8e51d0b412d329e371c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712059424, "uuid": "d893ed9a-4f29-4e28-aead-d99f20b8ae60", "value": "T140D33A17B5C180FDC4DAC5B44F9EF53ADD32B1AC1238B16B2BD4AA221E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712059424, "uuid": "cb8c87c3-3258-438d-bf94-3d6b58d75105", "value": "3072:tGtwnNiaOnUTzFKPT9OSQ7AOaogjV2iZlBWCgCiArQPdL:tGtwnNiaOnUTduLyqrQPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712059424, "uuid": "ae526bf1-d793-41f2-8b3a-f0275c5ae439", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712059424, "uuid": "43ab5401-3ee6-4e5f-87f4-24eb150ecf67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712059424, "uuid": "830a7c80-8c89-4f92-a99e-c7e296defe22", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc23b6c-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712046566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046566, "uuid": "60b47d21-ab9c-4b60-b9fb-b99fb3bf7d78", "comment": "Malware payload", "value": "674b21c779958fe66a74ce9e894a8363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046566, "uuid": "af2e1395-f7d1-4c95-b292-c3246b078c1b", "comment": "Malware payload", "value": "60cb56218ecc73cb4262f363c8563aa42a1bff63e5d8b218d79702567b908ae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046566, "uuid": "120507d3-667f-40df-8482-191ed3427fb9", "comment": "Malware payload", "value": "e735e34e31c98b72f7793527ff7200d594142581", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046566, "uuid": "c78aca65-5e0e-46f1-8a09-943a33b8f1fe", "comment": "Malware payload", "value": "92d4095b19fbcccff166ed7f83a3e6a2c533f7b0846e76147f7e47f12c763f9666d31542dec6cd82911d0d3b29f7ae36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046566, "uuid": "5d3cc95c-1646-4965-8207-7da12503467d", "value": "T153828587F792CE37C494927808DB4634A3B3DCB59B627317150821F23EA27C91F2E696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046566, "uuid": "9343874a-702f-4aba-b028-6a2bb66640e8", "value": "384:NF67oHEwsPw2wtwFh5gxDyaSe+v1dPtcUPD3H9yPDw41n1:NUPPheSgn+0Dp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046566, "uuid": "5a00322a-ace3-470d-8981-ba52ba097626", "value": 18256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046566, "uuid": "fdd8f89d-35cf-48b5-b3f5-1eb85ad940f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046566, "uuid": "f7308314-a762-4a7d-b8fc-768bf044fc1c", "value": "SecuriteInfo.com.PUA.Tool.Linux.PortScanner.66.12368.11322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7d4855-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039395, "uuid": "e4e90b10-6dbf-4fa7-bd5f-7747b121c42c", "comment": "Malware payload (Mirai)", "value": "1bc0efa0b671df31697c2786592ba4c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039395, "uuid": "322226f7-0a94-443d-ba1b-ddce88f298c3", "comment": "Malware payload (Mirai)", "value": "6100114b483e70ce4618cc4d486de215d385a4aad6b3a393f46b50fe70183ecb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039395, "uuid": "55b2a4c7-79d3-40b5-808e-66629d6d9df6", "comment": "Malware payload (Mirai)", "value": "751c53900af31d93e1de74b097bb1ce0d323aea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039395, "uuid": "065a5d70-b2ee-4b5d-b87b-b656f32445b6", "comment": "Malware payload (Mirai)", "value": "629b5bcca7ff8fe4045366c8db16f3b9720445abb33c442d8158d84043e8bcef56f70824f66c5fb6d36eb92434d5ed94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039395, "uuid": "281e3142-4a67-42a1-b0b9-5467fd786a9d", "value": "T186E2D199FAA574E1CE8DD83E619E112ABADB70522265DFC413B10D849F3D82DF88C02C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039395, "uuid": "159554b8-7bf0-4d34-8d1b-65203876a266", "value": "384:X3fpCLrsjHIX69URc+hmnulYX83zZA95DpMpL7C55cIc0NnJEOruhmt97Usjva3W:nfpWceh+4FSDiZO8j03fsgUsjva3LWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039395, "uuid": "412d9a03-111c-4691-8270-6fa6e4cef4cc", "value": 31960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039395, "uuid": "3b85b7a7-08eb-431f-b9a3-188c4a88a447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039395, "uuid": "07958003-e65d-49d0-be40-d4c4982381a5", "value": "1bc0efa0b671df31697c2786592ba4c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752e374a-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1712039411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "b820f640-3ac8-4716-bc42-9ac9ada009a8", "comment": "Malware payload (STRRAT)", "value": "6be27e5e3901ee3d96af16033fc38225", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "0e6ca065-ddd2-4ab6-b83c-94b847fd9a6a", "comment": "Malware payload (STRRAT)", "value": "63262891ac6fefea1093be2f08c838661d2d5894f3b6c293ace8ca8767b7648d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "58d22cee-3b41-4322-ad5d-f122e0f76122", "comment": "Malware payload (STRRAT)", "value": "d91f834305d126f0ac2ec29f97fb7c72392135d9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "5487722b-48a7-4011-b428-43774558d624", "comment": "Malware payload (STRRAT)", "value": "fb805d3c524178bf3dd3240957c31cce5caca032c0f93a2b77619b0a0d67fb15b937a760ce6597d66cf4f3b092a10a61", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039411, "uuid": "0a4fe9f1-508f-461b-83b9-0f6c44a07070", "value": "T1DE04F13F7E4ACAB8D023547A28088536EA8E826DAB55634F35FD559E4E30C4D0717ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039411, "uuid": "e3445001-7594-44a1-91c2-51b0a7b79292", "value": "3072:3iVaVsGjCCBAexRY7hPGj0MdPnjwE1CXW64Ke6yLohgoHFpjpIU630WGLGB6nOc6:SVaVsecORYwd/jwE2/LyEguHv+0CB6BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039411, "uuid": "d3d319ab-732a-4661-a108-35d38dd5f700", "value": 176534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039411, "uuid": "2b6ae632-0712-4dcc-b24e-95ae0a272337", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039411, "uuid": "01c77797-4673-4b12-9f20-5f8a5b0e853c", "value": "Windows Data System.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355344e8-f103-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1712070657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070657, "uuid": "9a1b3446-8d77-47fa-9171-ce4fc8366272", "comment": "Malware payload (Socks5Systemz)", "value": "cc519a2bae6e366e5579cb4eb7b18f40", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070657, "uuid": "8888aaf7-54ad-4e84-9a8f-f1bf1e02fc29", "comment": "Malware payload (Socks5Systemz)", "value": "64867dfe4646ff0a4204a7d3c81670da7612e8a74f6da27c28159cd3b70d8425", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070657, "uuid": "220ee9e5-a57a-451b-81ec-ac0b71672e14", "comment": "Malware payload (Socks5Systemz)", "value": "59d567a04a79f754bfa003c5166efcc86bfd31f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712070657, "uuid": "7cbe5d8c-680d-44d2-aeaf-9e60f6526307", "comment": "Malware payload (Socks5Systemz)", "value": "e199c664dfd4ed0cf2fcde084e8a6ab00e2fb897eb49fb87336090428221841b50fb13e8f8eb5614217a2894c6b52d74", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070657, "uuid": "bb6ba2de-09d9-49df-ba52-4c9bf20d4cfd", "value": "T1BFE49DB13A0BC2FEC34A04B4E813A603C57867F18B64D656EE6C7C7CCAA359471E9749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070657, "uuid": "1db0c870-a57d-4b1d-afb9-69e7560530c2", "value": "eb9d6ffddd190d49eba975e74b68f8b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070657, "uuid": "fbefb884-4897-4344-b66c-50f535af7584", "value": "12288:LZRsgiZdvAeRwY+axH2J1L+o2onOnPD/OyZ2Pl0oaGG8cr93nG7z9TXXPVlhfrYs:3sgwdvAdqK1Lx2onOnPD/OyZ2Pl01GGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712070657, "uuid": "7aeec162-6b21-4fd6-ad9d-7c5c335616d1", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712070657, "uuid": "dd95f382-689f-40d1-a78b-02e18f43fceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712070657, "uuid": "eb97c998-1214-4aa6-8a9c-2c1afb57a4ff", "value": "64867dfe4646ff0a4204a7d3c81670da7612e8a74f6da27c28159cd3b70d8425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61793c1-f11c-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712081637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081637, "uuid": "4d2fdcd7-abc5-44e3-8074-3ce825b3c416", "comment": "Malware payload (PureLogStealer)", "value": "90d9ef26e134b9a860b6656e24b2deaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081637, "uuid": "908bedcf-522f-4dee-8954-93bd8feeb7ce", "comment": "Malware payload (PureLogStealer)", "value": "65a1e79c969feffa12cec0fafc652d612e1a9fe55f18dfe2200ef57ed5cf6310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081637, "uuid": "a9c04812-8ed7-43e9-9d23-e5acd255ab5c", "comment": "Malware payload (PureLogStealer)", "value": "46e24e9ccc54c30405c50e29ae72c0d31220ba2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081637, "uuid": "c34adac3-91c0-4430-b52a-2ed49dd4bf7b", "comment": "Malware payload (PureLogStealer)", "value": "c89c3219eec0ce30df5efde6351f0e3f58ccaf0401d270d952f3e1ece0fb9c2e119543b8dd0c8bb84940882530f563e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081637, "uuid": "9d7e4d4d-69b0-4985-91f9-7b725c4cf57b", "value": "T17D84E00176E3C031F2A294745878CBA14E7FFD626EB581CFF6842B6B6E712C05A35762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081637, "uuid": "950a1721-6a92-4b75-813a-db816012eb5e", "value": "c75f45a03d3400ccfa6b600376f72245", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081637, "uuid": "4f634b1a-3618-430e-98d3-ef8623dd2b10", "value": "6144:1Zb3D3+Smmo46mYqTXePdAEodIvAPUv0V4A6Djj1vnAjPIRzEB1eHCXi/+HmvDWE:v7D3hm9478A6vA4md6Djj14jeEBYiO7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081637, "uuid": "1a5c1c7c-ccc9-475a-96fe-3ed4ba8d6ffe", "value": 371713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081637, "uuid": "55a81543-527e-4a21-8e6c-22431aa85e6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081637, "uuid": "3973a5e5-fa48-4a2e-8013-cfb5ba44924d", "value": "90d9ef26e134b9a860b6656e24b2deaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ac5cd9-f127-11ee-a120-42010a9c002e", "comment": "Malware payload (Latrodectus)", "timestamp": 1712086435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086435, "uuid": "9ae657c9-43f2-4654-b308-bb2011904877", "comment": "Malware payload (Latrodectus)", "value": "0ad82a3b229420b4cf52959f85cba82d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086435, "uuid": "2b0377b6-72ac-43d5-b0c4-a54aba9b0b5c", "comment": "Malware payload (Latrodectus)", "value": "65da6d9f781ff5fc2865b8850cfa64993b36f00151387fdce25859781c1eb711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086435, "uuid": "e89e0f64-a2bf-4243-8ccf-9c8a58f9f351", "comment": "Malware payload (Latrodectus)", "value": "f59bb505d1ed4a7492c41195f19e99f1d568ef95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086435, "uuid": "2c79296f-2915-4c20-ae80-422426009814", "comment": "Malware payload (Latrodectus)", "value": "9ceeba9c73f307175c6edafdc18dff0a44782757868000c52606a465efca7535704a827862422287d89490b3765729ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086435, "uuid": "998568cb-d3d1-48a9-a3de-a19ebc733174", "value": "T1BE635E87EBA261E8D8B9D134C2A27627F970BC5D5038BB0A8F509E175F62B70F52D344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086435, "uuid": "6962f9da-990a-4eac-a2af-3bc14ca7fe3c", "value": "ecb712bfe0d1558ffce8f8c2df526278", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086435, "uuid": "71d180cb-fcd4-4882-9d22-6e0f60eb27b5", "value": "768:RDrkZkx7jOxAi0IIO99dKJKbATQVuyQw4n4mjlQmLvniWiMfDeDvCPdN:RD1dj1pO9CJKoQF4n4mjltqTMKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712086435, "uuid": "9ec575b3-0549-48ac-96ff-a04ea41b346c", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712086435, "uuid": "51828933-32ff-481d-928a-423df4349f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086435, "uuid": "cb508cd8-2ac3-41d7-a45a-a2201b8f44c9", "value": "update_2ffaca76.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ee7835-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067187, "uuid": "b6a6249e-2e7c-4633-b620-2b106afe5296", "comment": "Malware payload (Mirai)", "value": "fc9e3049382f523687736b44654b9a35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067187, "uuid": "e8014efe-5d96-4b5e-916d-e21594b328d8", "comment": "Malware payload (Mirai)", "value": "66b4148bc5ac7ee043d25f6fbe83a44b6786f1941ff5c22cad5653d1c6ecdae5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067187, "uuid": "6e81b0e7-6c49-4ece-afba-e991196ae6e0", "comment": "Malware payload (Mirai)", "value": "7747c9555b1157ad95fd16df455b721454e8a90c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067187, "uuid": "dbf9eca2-30eb-4c33-9a13-fe376750ec41", "comment": "Malware payload (Mirai)", "value": "bf82acddb19bc9211eb07ed798c34eb94a98a113ab07bdebd986729526b7c4569a27b4aaebe4a06540ed186d7580c063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067187, "uuid": "206682cf-bdd4-472e-a856-d06b2a2e4e06", "value": "T181C3505B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067187, "uuid": "d62895e5-88a9-4621-8be4-c5ff4ed6a90a", "value": "3072:QISPhPh28cVCS0dCve0uPgrUiyeVKfj/GPIBWhFb1lqQl:QIyhPh28cVl0PgrUnas/GPIBWhFb1ltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067187, "uuid": "6c25f0c5-ddd8-48de-bf68-50ee69245db4", "value": 127632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067187, "uuid": "27b546a6-70b6-4602-b9ae-3638a4c30962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067187, "uuid": "299f50b4-6633-4f79-8178-91b601a44ca0", "value": "fc9e3049382f523687736b44654b9a35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2685799-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038628, "uuid": "f2d0b970-7b54-44df-a3f3-f8269ca3e13d", "comment": "Malware payload (Gafgyt)", "value": "b1dbafe0778308ade929780eb6eece02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038628, "uuid": "736fe81a-24e6-440a-bb35-23d696044f54", "comment": "Malware payload (Gafgyt)", "value": "670a5d2558c9c99fec72ab4b4541ee757f862fa916966849e41637b23c5ac6b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038628, "uuid": "e072852c-7c9f-4ea8-a054-b173f0eeb125", "comment": "Malware payload (Gafgyt)", "value": "1ae74236290a3f289f69139f5185d2837c18ef4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038628, "uuid": "e4579390-2af9-4954-9eb7-3e12f9b05053", "comment": "Malware payload (Gafgyt)", "value": "ec92b549ddb663aa74707547d4f117c5e079b00d7e2dbe7c11e4e040dcfc8a8a3aac2a14c36eb1ba6a3386ad2a9b8990", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038628, "uuid": "e410347b-7bc3-4381-8313-382cc77c8e69", "value": "T1ADD3E876F401DFA6F00B96B104D78F216E30ABE30B9261167366356B9EB31D63C63E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038628, "uuid": "29e07826-0988-4670-9eca-72a5dc0abe75", "value": "3072:ViCkklgjsV5JHgwTuyDXrGSrQ/MyQ17J3CO//mzj0qDJNYyoPe:VvVFTuyDXr7yQ5J3CO//mzj0qDJNYyoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038628, "uuid": "fe6131fd-ae55-4def-bef8-b82b46b94a0e", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038628, "uuid": "07e56364-d7b6-42e7-a95a-491ba35701b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038628, "uuid": "84109dcd-f74b-4b11-8ecd-c2a05ebf0e41", "value": "b1dbafe0778308ade929780eb6eece02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0735620c-f0f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064996, "uuid": "bb030e98-0774-4c31-95ca-cc306517f45a", "comment": "Malware payload (AgentTesla)", "value": "29ab712fc93efb3cdc8da1f02681cf7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064996, "uuid": "3b63dd89-43d0-4061-a42a-4f5dd424484a", "comment": "Malware payload (AgentTesla)", "value": "68422d64e61c6a3e2735c5d0270d203612dac080689762786f2eec9b61768e3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064996, "uuid": "0ef0e380-c230-4b88-b8d8-258523084dd3", "comment": "Malware payload (AgentTesla)", "value": "e5e14ee686e64419865e3c4aac2e934078568169", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064996, "uuid": "d895f35d-55f1-4a78-bc22-3470580db404", "comment": "Malware payload (AgentTesla)", "value": "634ed1dcacfadbc4fa4959fb24e1b03ab2ab3f5c802538ab31cb5e5464cdd2af61591a0a02a05ba55c61527894e42a2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064996, "uuid": "da8edfee-8b69-4489-b094-6699a17c929b", "value": "T1FAD423446FB82F32DB3D93F5606062261BF62B5A3E07D7845F5AA1C316E2F048631D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064996, "uuid": "01539f36-2aa5-49af-9e54-95900c2214d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064996, "uuid": "d6300d7a-b940-4e5b-be4c-66b16492dd1b", "value": "12288:50d3kUOzw6LEZ+/bEGJ3cMsy5p8tYBqKr2vBwouildVMG583CDFt/TN43qHgv:Y3QTX/bVdWtY4Kr2Zgir2y3/TN43e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064996, "uuid": "bd74efdf-b7ad-46cd-b513-8175e80c93f9", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064996, "uuid": "ccdfd39c-4216-46de-ac17-dc7bfa5166e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064996, "uuid": "4a65bf54-f315-4796-97f4-217f52152261", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25db3562-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712064189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064189, "uuid": "a9151c95-7043-4961-9d12-a7c92cdb1476", "comment": "Malware payload (RiseProStealer)", "value": "1f3e864a338535e78391706a36779415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064189, "uuid": "43f6f694-ffe8-4d7e-be8c-8c2ce0d4dc6b", "comment": "Malware payload (RiseProStealer)", "value": "68e5335ef6066297ae018a6ed5071c38659d8edad80f79099a17f6fb7b2f07d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064189, "uuid": "638b0cd8-69cc-404e-a279-399b94fc1e7a", "comment": "Malware payload (RiseProStealer)", "value": "611c1fdc38ff4032c7912b2cba74f8608b2e9082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064189, "uuid": "f72bcd46-a5ee-43c4-b70d-32f84644212f", "comment": "Malware payload (RiseProStealer)", "value": "f9e56480d6b8db0c3f5a066894ea4d318c0fa551a84663b9d5a2bc12c3b8beef0605c55e4deceb453c58e66019fa6699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064189, "uuid": "909e571e-e349-4600-ab1c-1c23b3ce15f0", "value": "T14B5623CDF389944BF47D103EF9926B3CB1A7BAA670920E2C64581DC588B33855D37E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064189, "uuid": "b24aee92-2eed-4546-b8fa-058e4751cf5c", "value": "4c8cb173aa80ccd2b7b9e8523b514fbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064189, "uuid": "99b60365-7547-46a2-9eab-9b609280a0cf", "value": "98304:bDaih55bwCbRdjgHJsrEN7gJu3fRRujdz13l+iLG9tAjZbgPi7fU3FkWSQl8QOK:lvJ7gpsrW7hf/q3E4hpfU6QiTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064189, "uuid": "a730e816-db71-4af1-a731-7597e451478c", "value": 6173472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064189, "uuid": "3f3c90a1-5cda-44cb-8b87-d98d4400e057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064189, "uuid": "30a2ce8c-f9bf-4c29-baac-77d159486677", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d28e4a8-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038968, "uuid": "f5c61279-5128-492f-856f-64b437881fed", "comment": "Malware payload (Gafgyt)", "value": "5df39f2576745d9035a656c21ec88287", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038968, "uuid": "15eb1809-8236-4376-9b03-224ec520107a", "comment": "Malware payload (Gafgyt)", "value": "69a9df74ac21d95eaa2491fade47c2bb787afd9cf1de5c9200d71e5dd3debd48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038968, "uuid": "ec382e37-c134-45e7-80c2-5b3ed4b9dd69", "comment": "Malware payload (Gafgyt)", "value": "82a9520b5ad1fa8fe82b7f5e34f1a6f9b6e8c196", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038968, "uuid": "9aae109f-189a-440d-a563-5ef57ed93b7f", "comment": "Malware payload (Gafgyt)", "value": "18bedd187c37b37b6dd926951d34bb9c6d850b2402fd3f5a70124f36c8e67139a7807b69bb4b7045beb33c11ee94e7e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038968, "uuid": "f3bc699d-80e4-423e-af04-5720256f11c3", "value": "T14AD34A37E4518F73C0836AB11C6AAD310F1595D31BAF268A267857F08B4F5CA744EFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038968, "uuid": "975f0cff-38d8-4052-bb15-d75610c44b59", "value": "3072:B1E8x83QHjqmgjHmhQXnZ5h5ttT5IMmAK0qW6MyoQ6:/E8q3QeXrHXnZ5h5vT5VmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038968, "uuid": "19d44ae7-31b9-40e9-9c3e-68a6c8b0b439", "value": 140225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038968, "uuid": "cf54b0c6-e44e-411e-9083-b6ed12ace1c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038968, "uuid": "8086c556-0877-4e34-81ff-6d1d32a79d2f", "value": "5df39f2576745d9035a656c21ec88287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947851a5-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712039464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039464, "uuid": "07a15381-179f-43ce-9eb8-88c181064675", "comment": "Malware payload", "value": "54414bdcc8b2fc8f0f31894dbd6b072c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039464, "uuid": "e174dc81-c84f-4f40-a835-126f32b9ddf5", "comment": "Malware payload", "value": "69ab63f33a2388e85dde103955bc4447e5ab83b220f0c075a5e7d5bfb04bdbd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039464, "uuid": "0f6111e3-b9d2-4a85-88f1-8141b99f7c46", "comment": "Malware payload", "value": "a76b464fc3d78272c250a91f9011c326effce6ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039464, "uuid": "cdcdd927-101b-4278-8b9c-acb4eff0c432", "comment": "Malware payload", "value": "01aaa730cf25140388944c269da9153a55dbcf546b749c5f7ca54166f235b327c4e2478f9a77449099fe50385b9f97d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039464, "uuid": "fc608b90-2d9a-4bf5-b503-d3d29d1b5107", "value": "T1F4A38D8FF24B5861C46247F40BC78FDE3E2362019E63C8EB6C0D5A3929762DB4D1A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039464, "uuid": "2361b9b8-136a-4418-abbc-a5df62a69d2a", "value": "1536:SRUB2u4fxSH2QSFECjqG0mYn+Da8Z95BKIVgAr/LWxF:SRUkZe1gEOqLBn8t9TKIVgQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039464, "uuid": "f0381727-6b44-4554-a7ae-8b51d33f940f", "value": 99716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039464, "uuid": "157ffdf8-48ac-4278-8021-7af8173329b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039464, "uuid": "0e26e2f8-011b-4dd3-98a8-ac9c9456e5d1", "value": "54414bdcc8b2fc8f0f31894dbd6b072c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2166f6-f0f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712065035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065035, "uuid": "09248d27-852c-49c6-a5af-22f0025582f6", "comment": "Malware payload (AgentTesla)", "value": "b81eee39584b8c0aade18421fbb9dd4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065035, "uuid": "55b1fc88-3320-4659-b8b3-9f9220ab7bb5", "comment": "Malware payload (AgentTesla)", "value": "69ea9340276650865e2fc2fdd0a0f5e2ba3bd1882ffb6c9ad9dfdc66ba50593d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065035, "uuid": "db6999e1-f8c7-463c-a53e-b14be7f4f9e8", "comment": "Malware payload (AgentTesla)", "value": "bb82a587c179625e40abb99f5ed6191125ade1d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065035, "uuid": "b300bfc1-b761-444a-b67e-d8ce8064028e", "comment": "Malware payload (AgentTesla)", "value": "4386720ff32a6adf6bbba8954ee4441bcb298bd8e3c2edb25dd75f04e7b1debb90358e69ad5be6fe6c09f0bc0fc78787", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065035, "uuid": "d3f8bfc2-d1f4-4a59-adce-27b74aabf7a3", "value": "T122E423297374AF07EEB940FB887139171BF13A4D2498D2D52DC224EB99D5FA84306A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065035, "uuid": "d97d2d0d-afa6-432c-8223-336a31cb530e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065035, "uuid": "60b89c67-d551-44a9-8d70-92e0980721e0", "value": "12288:B33bGaKy8Q2R/ePOIvUmKQ7+DXaMiPEENokjRdXk3nr7:R3yYx2RIr9ZeIzoIdXkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712065035, "uuid": "0f34c924-22de-4481-869b-6474589af5eb", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712065035, "uuid": "183b1dd1-cb5c-4415-9663-f3931627d755", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065035, "uuid": "a4aad25c-1c78-4a22-b7e8-2c49c743c251", "value": "fiyat 01.04.2024 - AT-24-0186_ unit order .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955a9dd8-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712082415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082415, "uuid": "41eca41e-755c-41f1-817b-fb2f0b7f1680", "comment": "Malware payload", "value": "5e65c481c2b722579adbc300c6319ec2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082415, "uuid": "a42bfe64-a5b1-4f0a-bf81-235de3a22d4f", "comment": "Malware payload", "value": "6ab9f1931bbf8a60dfb1dbe8e5e13322690b32c63b6847030f0cd4711089aadc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082415, "uuid": "4afb64dc-20e3-4ac2-b3b8-45b35d715edb", "comment": "Malware payload", "value": "a937c850461bde5c16b225da631b123fcddcb0e4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082415, "uuid": "dc9e90d8-71b4-40e4-9bef-24e7194e4631", "comment": "Malware payload", "value": "4af2f9a83f2f280bd42bc8358c0530b3ce88387dd59101d8220545b0ecd918fa256f487449805c6567dc4571dbef4823", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082415, "uuid": "a0541a5b-3a21-48f9-8403-bdc8e073ecb5", "value": "T11192B1F058310FBF3ECF57F6828A6F25852105AECD31C864A878B724F9216412DA9FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082415, "uuid": "2d8f7e76-e267-4f8a-ae38-92b4f5b1a179", "value": "384:tgZlX/YXcGFOj0vVu4L8jcDFuEXc8ge9PVweGMi:tg3PYXe0/YGXcGlNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082415, "uuid": "60a0e72c-4fa0-4d33-bb2d-00ea0c2f708e", "value": 19512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082415, "uuid": "46149aad-2dca-4fdc-b091-c761735f903c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082415, "uuid": "c17a56f8-8243-4f96-83e0-947014d1b8fc", "value": "Consulta de Cotizaci\u00f3n UPRRP24-04-02PR\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c4c2bb-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Adwind)", "timestamp": 1712064511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064511, "uuid": "164964f0-d1c5-469d-bf5b-0bfa0fbfe65c", "comment": "Malware payload (Adwind)", "value": "b89dda25f60ddfa925a76ece2f1e9d61", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064511, "uuid": "e492b28a-b5ff-45d2-94b8-feb9d144cf54", "comment": "Malware payload (Adwind)", "value": "6c7790241adefbf7fd60643ba4160b47b3e005e1f41e4189e2b023a9b1c5147c", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064511, "uuid": "4721b2c8-f093-4803-a2df-bf59424ed474", "comment": "Malware payload (Adwind)", "value": "813e3d84f32582e0b63ac7ebccf958425f7d79e4", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064511, "uuid": "8b2de431-beab-479f-8061-7c9bacb0f3a7", "comment": "Malware payload (Adwind)", "value": "c5aa6c4a16db1c306288dcd06cebb3feba6e6c9236bd45cd7091b0650d786e8e6ed1167a0442fbdaedee28a66fe06149", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064511, "uuid": "a87a763c-81f8-4c4c-9afb-6511c3aefb7d", "value": "T181A4021559817D3AA294FD3302B34AB1A3FF4ADC8E5B63EF96611013D36629C4CAA1B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064511, "uuid": "1d49c89a-4e86-4ebf-8cf6-bdce23aa5a7f", "value": "12288:aeTM7gqC7J80DGkJQUSX2WSfnzb595VyRq6h22zEQ:a1SJ8tkJQUSmDXyRqSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064511, "uuid": "571a3e71-bd5c-4ac9-ab5e-371ab73f3b78", "value": 460119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064511, "uuid": "65b12929-43d7-474b-ba76-aa8c49d3aeea", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064511, "uuid": "344cd8b4-fa60-4f56-baa1-9678680c7ba2", "value": "01.04.2024 - S\u0130PAR\u0130\u015e L\u0130STES\u0130-2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92813069-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038601, "uuid": "426b7d87-2cea-4461-8032-2bf33ff01bf1", "comment": "Malware payload (Gafgyt)", "value": "dfdd39a7bb5560ae0a3ec8ef21c02873", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038601, "uuid": "e441e60c-71bb-40f7-bd7e-9c955c477dc0", "comment": "Malware payload (Gafgyt)", "value": "6d315357984956be65de62acd8c4160dde4388f389e005a13c1ebce50a283eff", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038601, "uuid": "4ed96d0e-3134-4003-824d-824cd361e55c", "comment": "Malware payload (Gafgyt)", "value": "4c60c11445d0537c5fd6003243a74375cdecaf78", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038601, "uuid": "8c610540-cdcc-4fc0-b177-64fb6f3a4e46", "comment": "Malware payload (Gafgyt)", "value": "faf75e03b531bd4d2c13f3816d683df9d36bc4241f5e7e0805d45ef3392da3b9af2c8ede89fc9e90ab10105aaa5e972e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038601, "uuid": "2634fe64-bfbd-4ca5-9aab-33d79536a565", "value": "T1C8E3D733B2E18DFAC14652B026EFDEB29C31F1FE0672312B23A41D605F2D9D61D99A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038601, "uuid": "1183c817-6be0-4fc3-9099-dd5743b10e9f", "value": "3072:UyUyaJ3LUQEWuZI3zKZPhJ8phadZtwkt3m+QVOXFNqOPPe:m3OI3mqphaftwqm+QVOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038601, "uuid": "dc6f3fd1-216d-444d-80aa-29a304bfb77e", "value": 144121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038601, "uuid": "e4354b05-7dfc-4ea1-84b0-2c0493cce1ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038601, "uuid": "b59279ee-ad3f-48b5-bdb6-ad511fbff4b2", "value": "dfdd39a7bb5560ae0a3ec8ef21c02873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13d0d2b-f0e3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712057148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057148, "uuid": "51e4c0c2-c6ca-4743-9f14-8f8a8f687dc0", "comment": "Malware payload (AgentTesla)", "value": "9416e34152a187988c70af4af3fd3662", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057148, "uuid": "b8f1eb61-42a0-4cff-a4fb-2beeff928960", "comment": "Malware payload (AgentTesla)", "value": "6d403993569310692ad2442da4bbe4a85314d6189b6ff8031aab8c90da1c1c82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057148, "uuid": "d9dd43e6-10d4-42bb-a688-0b73087a6f99", "comment": "Malware payload (AgentTesla)", "value": "174cba29e19a2d1cf6c50bba9c18edb4c7c43c42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057148, "uuid": "511a45aa-f864-40b7-8170-47c0c56d6189", "comment": "Malware payload (AgentTesla)", "value": "8cda97f9a5a5f1bd14bd1df6afd62b787419d40d7bd98dbb675ec5c18a25f15e749bba3c4168826d9962139d6cd6ab3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057148, "uuid": "f0895e33-5bcb-4f3a-81fc-422021e68dab", "value": "T1DFF4CF9C7250B1DFC417C976DA682DA0E6217C7B970BD203A4633AADA93D997CF104F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057148, "uuid": "7f06848c-6235-4f75-b1a6-1991ded46029", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057148, "uuid": "35ad6e98-7e71-43df-abc0-ea78c82dcee6", "value": "12288:STZZcWXx/GxM1zsLDLHyYpjnmTt416Q84SzZwSJmcdJ5FoMfRU8LJNO:STZX/GVnLHyYpjnmT216fzZPJLv5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057148, "uuid": "537f98f4-ff86-4915-89a2-5d03bb31c0a8", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057148, "uuid": "c6bd2f7e-183b-4250-b0a6-f0dde92f1c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057148, "uuid": "c6926b38-3d29-4708-bc26-b6c12d4c4ac6", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.11744.1980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a548a8f-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712047070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047070, "uuid": "6fcb6fb9-394e-4eb6-a511-68dfc069a8ad", "comment": "Malware payload (Gafgyt)", "value": "ee1e3a312c073f20b3fd1b808da04173", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047070, "uuid": "1b93db0f-a216-46a8-9b69-516af67d558a", "comment": "Malware payload (Gafgyt)", "value": "6da4c2b94f8ad65c1080c088351914c469cb5b19cb800ed8da06a6edb39f15bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047070, "uuid": "e03df5e3-e7e1-4195-991a-ea5f2337bdec", "comment": "Malware payload (Gafgyt)", "value": "b5e4bc6f82487a19f8fb2083d70ef0f256fc8747", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047070, "uuid": "2e7d7b5f-0778-400f-9f7e-130f2e4e4f81", "comment": "Malware payload (Gafgyt)", "value": "ce5f173b0bc9876f60b7878f48256f5e43014b8824ff27daaa9ffe58f285a5499f8f21be2cb0a4d49079b21286ac0202", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047070, "uuid": "c7ecefb1-7c6e-4e85-96a9-82eda870ce94", "value": "T187F3B63BBB160F23C0C500B111E76632ADB5C7DA34F952D76AE06DAC6F2A5883465EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047070, "uuid": "90ea9cd9-d63d-4477-b6a4-ddf061fe6f29", "value": "3072:Mqnuwd00SXON8CSphaBM7I5n3ANsmzjEq/dNYy2Se:MqD+fpham7Ix3gsmzjEq/dNYy2Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047070, "uuid": "17249733-6201-4bbb-8c74-f596c6fa857a", "value": 157989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047070, "uuid": "bb965124-1c21-4a92-9e63-21b812240377", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047070, "uuid": "791d5e57-77d4-494e-baa3-347ccd72665a", "value": "ee1e3a312c073f20b3fd1b808da04173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393db17a-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712082260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082260, "uuid": "ed89c57d-44a4-4f0d-b2e6-db1ff5561a78", "comment": "Malware payload", "value": "613312c47c053f1a7e87941a57368799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082260, "uuid": "56d08982-2083-46a7-82f6-ad45d6add95f", "comment": "Malware payload", "value": "6e532350198d6760c6ae34cfb67a7157e36a6990a673bcb6fbd344e789daa3d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082260, "uuid": "8d4845be-2429-460f-a192-082dddb80f35", "comment": "Malware payload", "value": "68c6d468acc23c80acd6be52a7cdc3a6cf49feae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082260, "uuid": "6fb04c1b-f84d-4dfe-bd91-e65d16deddf2", "comment": "Malware payload", "value": "cc2835a93bf15d6907eba0b3e95ed07d705763d56310c828ee688184dcd31d34ba4e16557d4cc86dee1fe2b2f2d89994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082260, "uuid": "f6a5238d-c5f4-4166-8cb9-47d45ee38bca", "value": "T1CD151A5B9CE540F4C4FED275C62AE517BD62744803387BD72EA08A602F6AFE1E1B9704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082260, "uuid": "3728c862-eb94-40be-824e-9d280848fbe2", "value": "12288:UxO7neyvjIt7MT2B/nKo4yEKDYr9yd6NLivhrBIIccXdc:f73I9//nKlEGyd6NGJr0ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082260, "uuid": "46a5d5c8-6b8c-41f4-a5c9-d3e405fdd983", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082260, "uuid": "21e8481a-2fff-481d-b6cd-315723de1164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082260, "uuid": "58d5e902-3df0-4f55-af53-9004920164a4", "value": "613312c47c053f1a7e87941a57368799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7165e5fa-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039405, "uuid": "172aa79d-c7ae-45bf-8bd6-7bdea18f2944", "comment": "Malware payload (Mirai)", "value": "adbb4a4aeca9232376b2805bd0f6e785", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039405, "uuid": "1a71bcf8-2183-440c-89cd-4e428680b2c0", "comment": "Malware payload (Mirai)", "value": "6e78b1b03fef559748718c2eb196767779b433c075e5b3661deedb95af75f2fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039405, "uuid": "65b3bf47-645a-45e0-9831-2b04002bba21", "comment": "Malware payload (Mirai)", "value": "69256138ec6b4fc714698c609ec7d625ff219d4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039405, "uuid": "6dcb8e53-d55d-4b30-930b-01e30af83332", "comment": "Malware payload (Mirai)", "value": "358179566228172ebb12fcd9b1e84159358f512a2411e2ae3c4bf34c939cdf25d99eafe2fa782ae573541d96869a93f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039405, "uuid": "f5548c7d-6445-4b73-a4c7-c8e68b58885f", "value": "T1F14302F5B40CAD418B67E1396CA0DD0E385313B5C4F6A2611190015A7EF7C86BFF9422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039405, "uuid": "faa24dd9-fd5a-4aff-8b36-3656ac55f0f7", "value": "1536:CXCJbdLlwYOXX86kVyTDSBDSaX84fKVgz+:CyttlwYsX86A+DSAaHK+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039405, "uuid": "9677d4c9-b3f4-4ab9-9bd2-b1f4e38f1e60", "value": 56056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039405, "uuid": "43dbf645-cdaa-452d-b574-36661540ccb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039405, "uuid": "ccb0a3f8-7323-4ef7-a401-213af0e30240", "value": "adbb4a4aeca9232376b2805bd0f6e785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68840c82-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039390, "uuid": "5afc0a58-0251-4adf-972b-b0f376031b59", "comment": "Malware payload (Gafgyt)", "value": "74543886e68105c88ece01d466cbe14f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039390, "uuid": "8153a0e2-d35d-4d16-87d9-6bc20d45184f", "comment": "Malware payload (Gafgyt)", "value": "6f1b236e27c01dfa1c53fa923ca5a8265f57c391ff270d5e82445beb25fa95fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039390, "uuid": "33b92929-1d34-4b67-9540-6efa865ca615", "comment": "Malware payload (Gafgyt)", "value": "3888fb28137fb2a2ee98676af1480c04df42cfd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039390, "uuid": "bfbd0f19-42ac-475e-bfee-38ea1666a5a1", "comment": "Malware payload (Gafgyt)", "value": "c4901740f708729d0a0e52ea63a16cb62df0f0955c66d5ae760f73ece2d44bc45277307d05ba2505e2c4168387983368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039390, "uuid": "5fcf2663-faf4-4621-9d3e-572824f328da", "value": "T186F33B24E4404767C2D313BAB69E866E3F321BF653CB33115A349EB41FC2B992D69874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039390, "uuid": "40984b84-c2b4-45ce-8cf5-1e3fff0e88cb", "value": "3072:cyd1BPL8Z60aMnGjuog68Fi5L95hM1D1/6JrTRxmfQOYbr5Wn:Lz060auGjJ5L95he/6XxmfQOYbr5Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039390, "uuid": "21d1ecfb-d0c4-4638-8e64-41a8164fdfce", "value": 170949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039390, "uuid": "87a073fc-d9e4-49ad-922d-4f14c7dd0cee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039390, "uuid": "c62a95ff-d8cd-462c-bcde-22186805901d", "value": "74543886e68105c88ece01d466cbe14f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56e1bf4-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038633, "uuid": "5772f627-3826-4886-9143-dc54baf1cdde", "comment": "Malware payload (Gafgyt)", "value": "6c9c173d5823958af284d262d98f99df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038633, "uuid": "2bdef32d-5532-4785-979e-c04541e9286d", "comment": "Malware payload (Gafgyt)", "value": "710aa18ac6b2186650ffd1388a1200204b0c6250304bcfe520bea8d2bc6c8b31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038633, "uuid": "23953e0c-15bc-420e-91d0-deba205570cc", "comment": "Malware payload (Gafgyt)", "value": "702c310f9854542ce0ad31d7302d96da83e8a24d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038633, "uuid": "fec7f50c-9c1e-46e0-9f93-f309adcb9f1e", "comment": "Malware payload (Gafgyt)", "value": "e85e5b8445c9b611edef45f98f350219162d007be9887abbe94c0362243f500cfdfc618e2b9826b393bc59ed97340143", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038633, "uuid": "5d80fb3e-b6a3-48c7-8680-e18173c396ee", "value": "T1AAC32BB5F740C672D18301F2119BDF624D32F2F7169AA54AE3682DB0CE6A1827563F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038633, "uuid": "488e2cd0-1431-4b0c-ae63-ae9eb1f34a75", "value": "3072:SNhAfn3U8UXULUwUbUJ1hYlHRRDsBOnRg5hgkEemJC0OzQaGyPZk:SMf3ts05gehYlxO4Rg5hgEmJC0OzQaGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038633, "uuid": "c5e928ac-2166-430d-8b3c-946440b75f3a", "value": 123364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038633, "uuid": "22c2e518-2d51-412b-9271-910b39a1c4c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038633, "uuid": "a4b9d203-5b79-40ab-a5bc-1b9c3f958c89", "value": "6c9c173d5823958af284d262d98f99df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc6f6c4-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712038617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038617, "uuid": "ff98353b-2667-4463-9bb1-31d4f84e3565", "comment": "Malware payload (Gafgyt)", "value": "3b2892024943da89f678d22947c39567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038617, "uuid": "9d7c5c1b-d35e-475f-a104-032b22751a19", "comment": "Malware payload (Gafgyt)", "value": "71bfc552d310221df83950d040e7d16b2eb5bfb5cafce1cfef40d2f080da5a9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038617, "uuid": "1deb878e-12ef-4731-9f64-855e51070795", "comment": "Malware payload (Gafgyt)", "value": "324ac0baca520e26442edb420affc4b5215d2521", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038617, "uuid": "e139d346-c912-43e0-8c9d-4633b6654f34", "comment": "Malware payload (Gafgyt)", "value": "02e701e25da15ae07f4c4d5e348d66fccc850a1e0bf06e97462c2a1865b8bebcc64fc0c880dae8a32293870d16889f8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038617, "uuid": "ee0f0234-53a9-477c-b6f8-7922a6d2e219", "value": "T199D30977B61C0793C4C706F11D6B3BF28F68A2F312E761C5661ADA908B739B61412F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038617, "uuid": "dae598f1-d0ca-4811-bdd0-28794067c3fb", "value": "3072:eVrQyEDCvqBvpnTy3L5hArJ3JCI/Dmzj0qDJAGyoze:eVrQyEOvqbnT8L5hA6I/Dmzj0qDJAGyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038617, "uuid": "eacb0bf9-fc19-405d-9ff5-04cee6a28c58", "value": 141485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038617, "uuid": "176a2ede-7c5a-4753-9060-b007c4d1289b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038617, "uuid": "cfcb478a-e576-48ae-917c-ef99784bc8f9", "value": "3b2892024943da89f678d22947c39567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ec0e17-f0d5-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712050822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712050822, "uuid": "08a12a54-f872-405e-913f-e7a65eb7c13d", "comment": "Malware payload (CoinMiner)", "value": "48b1db9a7781ed87d495ccb71a9fcc1b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712050822, "uuid": "51460e78-564d-41d6-8ff1-9ea94ac576af", "comment": "Malware payload (CoinMiner)", "value": "71f2254fef13e949e8e35950a9d2ec2a235229ed5e157d0f887d16886dac5587", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712050822, "uuid": "f35db95d-c435-4012-b10f-89d6f51b595b", "comment": "Malware payload (CoinMiner)", "value": "3f35a397742733c6902aeaa96e12f401cb928166", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712050822, "uuid": "8e0df40b-bcd0-42ae-aec9-57940b148eff", "comment": "Malware payload (CoinMiner)", "value": "67973b800362af77a5a4a56b443f3e71221a3dd2edc1788c604252f6300e63711b9e4a0837b4b1ad63053b387c1f9e14", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712050822, "uuid": "3cbe33d7-08d8-4c21-909d-002dd7050e4e", "value": "T1242733818580526DCE56EA3AA5F54C24C6733DB4AD44E74E78AC32A37FB73E18531B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712050822, "uuid": "3904bccf-d257-477d-9bcd-e9b37cef3b1a", "value": "55fbcb1e16120dea0345f7226dde65a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712050822, "uuid": "f2242c72-feb0-47f5-b80b-6d1da21aec26", "value": "393216:9EkMQ2Lnendi4vpG4C+7UR4EYvEpEWe/inoWcCEDLJ83a10NWJsdB1bL3oiP8:9EQ2KdNxGjLYvEpEWVoxCEDtEa3Jy1HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712050822, "uuid": "ee217fb1-b32a-4b6e-be66-7a4f4a3c3749", "value": 21350768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712050822, "uuid": "3c774a99-3641-4d4f-b1ae-041b606d7d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712050822, "uuid": "26003887-c15b-4461-b84a-6c35627e1fbf", "value": "mnmg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd18fb3a-f0f5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064979, "uuid": "74cec7f9-23da-4125-8ef5-235fa7f1c550", "comment": "Malware payload (AgentTesla)", "value": "92474670917ecb055e79cc71662a4497", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064979, "uuid": "7b6efb63-335d-4bd4-afee-1eba3a66c3c1", "comment": "Malware payload (AgentTesla)", "value": "72b200b09db73d3be94180f09caae9d503053d8bfc2f7292c63a82baeffbbc05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064979, "uuid": "f5a6a6d8-cbf6-46be-a0ab-738cf3162635", "comment": "Malware payload (AgentTesla)", "value": "d43e1cba1ac700040e97d4aea7560dfd0f0dd357", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064979, "uuid": "44f5b08f-4ecd-423c-9e68-6a516cc3068c", "comment": "Malware payload (AgentTesla)", "value": "667e8e132e0720dd999cfc65dfb541cc3ab638b642a9ac835c1f186fcc85cf3549c510776ce1a2996e43580485809b60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064979, "uuid": "b6e7aa47-4270-455a-9793-bd83bf66947d", "value": "T10E74E08A26EC66B9CEFC9776F4CD4247F2A1614F7AC99D9602BD804C213EB6410711FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064979, "uuid": "da3c32ae-1342-48a9-ae76-d6858afafa87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064979, "uuid": "287bf0ba-6fd2-4086-bb9a-3386b870625a", "value": "6144:yc5oqzOTnZdP85QrRw28fslkO5IOa5T3RAQjv0OD:n0ZdP+kgsl/Xyzjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064979, "uuid": "e54f8e12-5df2-41ac-9c35-54b00851c58c", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064979, "uuid": "00c128fa-6e29-4502-8830-77febd241514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064979, "uuid": "85694e60-6237-4aae-8855-902b6eea37b8", "value": "hesaphareketi-0112024.Scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6275c742-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039380, "uuid": "ba69c724-3cfb-45c4-9580-81d67e4d01e2", "comment": "Malware payload (Mirai)", "value": "158954dc6b702be0b8bba118dab551da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039380, "uuid": "6bbb5435-3cc4-4aec-a059-05bff4006828", "comment": "Malware payload (Mirai)", "value": "75cff1c1abde02183b639e08688ff43941acc6168b57d407f417d9433abbeff3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039380, "uuid": "e474ad93-70be-4dbe-81c6-48f336324a3f", "comment": "Malware payload (Mirai)", "value": "487c739ef50ac1bf793975d7161bbb28be04edf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039380, "uuid": "4794ad92-2cf8-4b56-b8d2-647271298217", "comment": "Malware payload (Mirai)", "value": "6db312fbc5543a694a4c272dfb7b38c733c4d802c58a0030bfdae29a6836d61dacf6d2a55e45f7943d74570777f3176e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039380, "uuid": "a12dcf5b-813f-4131-83fd-6b2a6bf96d38", "value": "T196C2E180C3F07DA5E98FBC7DBFA9D4CD379727DD2261D4B223A99B23529150B4A01AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039380, "uuid": "97032f50-a97b-4349-8974-62a55fe483fd", "value": "768:wUbgeS1f8Dnz+XpeIvlE2Sjl4jit4uVcqgw09r:wUbfapvlEEit4u+qgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039380, "uuid": "ce60bb5b-a170-420e-a189-d522c221fcfa", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039380, "uuid": "54f824cb-efe5-44ad-8ff6-ff60ba6bedf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039380, "uuid": "2bee3072-cf27-4ed9-87a7-7d0619f2da2a", "value": "158954dc6b702be0b8bba118dab551da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a91dd8-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712038962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038962, "uuid": "a9aea0bb-06de-41a2-a79f-12b82b405cb8", "comment": "Malware payload (Mirai)", "value": "85d43f2a6a5f1172ee64131c61b7d7e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038962, "uuid": "eb60a72e-0536-44d8-b165-79c9ba0c3c66", "comment": "Malware payload (Mirai)", "value": "75f2881f3225eb03d4a623c0382c92631e497761710b0ac47f1288e0e0df9c7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038962, "uuid": "5159f4c6-0545-4bd6-b20c-9d80ceb74596", "comment": "Malware payload (Mirai)", "value": "0905f4693a463cbb862ccd0d6f1f459a787a8a6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038962, "uuid": "a484efee-f44c-4b02-a731-5ce9a9cd04f9", "comment": "Malware payload (Mirai)", "value": "47e01960b149ba58ff4349775745dcd641192f14c63d17e3078e0e63d3d2dd0415caa1687b16be4d0741af6c5f3436e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038962, "uuid": "87e27f32-946a-4ee0-a3fa-05405055baa4", "value": "T19B53094ABDC18B16C5D412BEFE1E118D33276768E3DE7213DD246B247B8B56B0A2B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038962, "uuid": "8e06acf8-51f2-47e7-895a-d5ecc7107802", "value": "1536:+AnRKjnrRmr5jne6eZKvI3+EMSipoXh8AK:W7I9rjP9oXh8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038962, "uuid": "a151fef9-4269-490f-aba7-6fc5e528686c", "value": 62804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038962, "uuid": "4e4fc289-b905-48ff-9c9f-448c9dabc43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038962, "uuid": "9758a091-6274-41c8-824e-ea8932a306d3", "value": "85d43f2a6a5f1172ee64131c61b7d7e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d0941d-f0ed-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712061365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061365, "uuid": "32b11959-6341-4a9f-b2df-9bf70ef0d35f", "comment": "Malware payload (Mirai)", "value": "8ef59b8e6e3114adca34ddcc51125ab4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061365, "uuid": "45194383-10f9-4842-b4a9-1bb6e8228311", "comment": "Malware payload (Mirai)", "value": "7728e7fcd9cd5d6de684967867933ee5e9fdf13803b0c96e2289d4eb2d4f6969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061365, "uuid": "822a7b5e-b8ed-4c50-8e80-cfd87d911680", "comment": "Malware payload (Mirai)", "value": "ed63c73b2f74f29b6286515c06594570ecb3c823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061365, "uuid": "4578a49d-96e3-4c3a-aee4-0e26c523dd97", "comment": "Malware payload (Mirai)", "value": "249b7848911fd546a5d9aaae077c07dd1560d8c432a8fda5b36d219a28dd5b9647d3eda0eab476d0000bf78e37774647", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061365, "uuid": "52e62fad-4813-41dd-9723-3faa75e37505", "value": "T1A5E30B56F8819B12D5C111BAFE1E124E37131B7CE2DE7202AD246F747B8A97B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061365, "uuid": "5aff9932-444a-466b-b336-287d6d92d0c8", "value": "3072:5U0sHcUhrphbXBM4Lgmaze0GM/bG4CO3jGRp7:5U4ejbXu4LraCf8H3jGRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712061365, "uuid": "2d8fd935-14a9-4e35-acfd-bdaf1fdd3608", "value": 143292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712061365, "uuid": "32d21e2a-03eb-4ba1-9b6f-821e17550d2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061365, "uuid": "2393ed72-b44e-4db4-9ad3-e16141a010a5", "value": "8ef59b8e6e3114adca34ddcc51125ab4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75664221-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712039411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "64825304-fc01-418e-9e12-263fedcf18a3", "comment": "Malware payload", "value": "92e4d1e82b2e82103182f84a39e9a7eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "763dc155-8e2f-4f7e-98d3-bd4ebaeac9f2", "comment": "Malware payload", "value": "7787a3cadbdc8dd68bc1308fe9da2dfe5ce3cce5966264a953833e8c03b3e2be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "bd13c44a-9c37-42a3-b7be-75629c770272", "comment": "Malware payload", "value": "db3cf35454daa31cf181f06dedbb4e874f7aabd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039411, "uuid": "27cf3d8c-b71c-469e-89ab-987be005dc18", "comment": "Malware payload", "value": "8a0781cde570f0130a0c5b24fcc0da21ee5306c6d2a6ef3d3568d998823563c1a1d4edb5ee85d3b94546fff7c0523986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039411, "uuid": "87bef527-4e08-4ee0-8d5d-e61124a95f8d", "value": "T1FE238CC6F812E0B1FC2601F42566EB915E76F0F67839EA97CB672934F462D10E60136E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039411, "uuid": "5dcee418-8ba2-42db-ba99-f01ec0744384", "value": "768:1s577jG2gNxO4IWGIfCCIGFXE41b3SsV3raF0:i51gNxtR7CCpFXNb3SS2F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039411, "uuid": "644589a0-05ca-4a4d-996f-960daaf56cf0", "value": 46020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039411, "uuid": "c2467e98-583d-4006-b7b5-2af9b215327f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039411, "uuid": "c49deffd-d64c-4514-a480-9bce979bfdc4", "value": "92e4d1e82b2e82103182f84a39e9a7eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3186446-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064399, "uuid": "e9ad4915-5c6e-40a4-85bf-8cbcee0da934", "comment": "Malware payload (AgentTesla)", "value": "7293729e6039225908f616ce83b13fdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064399, "uuid": "a39a7871-a2c7-4c7d-a3e8-aecd391a0d29", "comment": "Malware payload (AgentTesla)", "value": "796e5778672ac70c4a34d54bd9321039668772cddb487fc96ba555ffb77d4112", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064399, "uuid": "8d850804-e71b-43dc-924a-d5e0eb727ad4", "comment": "Malware payload (AgentTesla)", "value": "626c6b947d96ab04957561d72d911ac7a9a9b5da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064399, "uuid": "33f544e0-8418-49d7-9a41-b4d1db055046", "comment": "Malware payload (AgentTesla)", "value": "d8e1f2cc030192e556d793198afd45c4e750ea1fa47aef54f2f629590714310aed5da730e8625106d391567cafb638aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064399, "uuid": "9dc786b3-2bf7-46e3-bf4d-17ba5fc6fd83", "value": "T1A2725C1B3BC30364EF731EA54D49050AC8B85E22E63684D8BB65D3866A135D9B3793CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064399, "uuid": "564b0550-9e4b-4102-a2cd-d6cdc7bc0e63", "value": "192:mIEM/fG1RRflGgKh9YQGaBen2FFbf4/92Q6E4vtIJrzqHzjGiS8BqUn22csqd+:dGdsgdupHf4IQnxzqHzjGiAU/fqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064399, "uuid": "18996204-61fc-462b-a3e3-95b4b844c395", "value": 16422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064399, "uuid": "fd15f108-83e9-4305-acc2-ea4ab897ad29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064399, "uuid": "3e815836-bae4-493e-bc0b-32156e6bdc86", "value": "shipdoc_PO_09042024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304c1f7d-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1712082245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082245, "uuid": "8082ad7a-3454-4ad0-a7bc-f2af6808edce", "comment": "Malware payload (Amadey)", "value": "d24872cd73ee41b6033b7b7745127b7b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082245, "uuid": "c3695aea-53fe-4f4f-a3ee-8642a19f553d", "comment": "Malware payload (Amadey)", "value": "799a6b321775fbfec1f788b7de5a4fc8e1c4bbe7cdbc7a9aae5f205e4422a57e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082245, "uuid": "ce1e3c01-c7c0-42cf-a0f9-2a7771cc9244", "comment": "Malware payload (Amadey)", "value": "14513408b8e470eb2e7dc5154e4db4fa4af02b54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082245, "uuid": "8edd6983-2836-4a47-bd26-19dbbfdbc1e5", "comment": "Malware payload (Amadey)", "value": "e0aa93b9907d3325649852c7c64b006be31747a2c0f4666a4cad6e9021d1cf3761c775aacdf9b9d3c8ed131967f63108", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082245, "uuid": "5ce2ab69-b554-44fc-ba32-20d28b975932", "value": "T15995337F299EEDCAE9B85BB04CC722401797C96170A321853B196B2F63F3F500A6D1B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082245, "uuid": "a07ed166-a917-493e-8d6c-0fd561e98687", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082245, "uuid": "094c5c27-113e-4b2c-a721-02b0abaaa241", "value": "49152:y76S9gYTjVmKZmry5xfut8R0pPutaTTrpv:wR998m5Et8R4TrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082245, "uuid": "f3fc6f60-dbcd-4fb4-b31f-098bb59374a9", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082245, "uuid": "75bfcc48-42ef-4f29-96a7-dcec94d1f835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082245, "uuid": "b7b0ebe1-6998-49d6-9fbb-0365696cfa8b", "value": "d24872cd73ee41b6033b7b7745127b7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f3be27-f0f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064988, "uuid": "8588fdea-b505-4fc2-981e-0f2aac28f209", "comment": "Malware payload (AgentTesla)", "value": "8faa3ce49d635578ecf9e83dcfe76ce1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064988, "uuid": "47c8379c-9d1d-4f7d-9f69-51c557395170", "comment": "Malware payload (AgentTesla)", "value": "7a4c2dd51f51dcb5cbe4190ba3713047c7fee995c5b87ee44aa55590a4e533b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064988, "uuid": "f186c3dc-473e-48e9-96a5-325898423be4", "comment": "Malware payload (AgentTesla)", "value": "a8cc67061127f35c4f96835c7dd9998af596b607", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064988, "uuid": "b3f84c0f-a94b-4b82-b98e-eefae149bbec", "comment": "Malware payload (AgentTesla)", "value": "20a5f5e4c4c499c53410cf4da06d3be35f128754e637370b0311f282874914029edb149123c2d7f202c554f53849eea6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064988, "uuid": "4a2f2a1b-5718-46f6-a035-99facf91ca6e", "value": "T1D1D42349BFF42F26E97C53F9607AAA2253FA710F3995E24C0D9630EB85E2F448150E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064988, "uuid": "b048d6b6-fd29-4a5c-8bfa-f4937328dce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064988, "uuid": "2ba1eba2-1dd3-4600-aeb1-cf348e7294fd", "value": "12288:C0d36IMU28ZwZhqNdfier9LrVPJ1AzYo3kFwc5+WKZVc9HNb:F36Iz6Zg6mlVx1wYxFwY9HNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064988, "uuid": "fe19be63-b372-4f93-8f56-f790b4a0a712", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064988, "uuid": "5500b5b0-bc7f-4467-9d6f-56cf5fa75521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064988, "uuid": "8c82e182-6cf8-4b3f-b736-e0e9198e83ba", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71f8f2d-f0c6-11ee-a120-42010a9c002e", "comment": "Malware payload (PythonStealer)", "timestamp": 1712044756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044756, "uuid": "d44498b6-248f-4d95-8bad-4558d8b8b14d", "comment": "Malware payload (PythonStealer)", "value": "7b97dd62af41954e057bb5c09dadaddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044756, "uuid": "7e9e1df2-01cb-43e9-82cf-9e8bf19eba93", "comment": "Malware payload (PythonStealer)", "value": "7ac48e775b3b41cf280e75a4abcd9af08c72c8d6f345a454e80863b3bf04fa49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044756, "uuid": "35b695a6-e4a9-4255-aea8-0304dd69518d", "comment": "Malware payload (PythonStealer)", "value": "6fc35db37ae9c12f49e2c141f39cc987af9d3ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044756, "uuid": "15473d04-74eb-4159-91ea-366a97f5ff2c", "comment": "Malware payload (PythonStealer)", "value": "7d415b4a581a913f78a39b5c43cafaca10cdaf0feb4d835a1b98cfcfaf7503abab94bb5e8d67e23ca25c57e136469cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044756, "uuid": "3041a861-84c8-4a42-8a4b-f74a32e35f71", "value": "T1D117334667A40CEFF9FA8930C216D3A4F0A07D556B92D1DF8A64139A2FE74D31DB26C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044756, "uuid": "e14911de-c5fe-4402-840c-1b27409817a8", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044756, "uuid": "be6c4581-0d32-4ca6-ab55-1c56f91256f9", "value": "393216:vu7L/m1lc3GH6YkDInEroXz/m3pmsKkXggwW+TA39BYBJHanvhfRDl1WNHS7u:vCLe1cGHfjErUzKmoxbQA3ryMvhn1Wwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712044756, "uuid": "eb319d21-3bb6-4a71-bd44-16fc94b69b10", "value": 18599930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712044756, "uuid": "6a4b7571-34d4-4532-9033-0eaa7cf63401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044756, "uuid": "e5caba1a-6f7f-46ae-9a58-3d77e00201ad", "value": "RO-EXEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75e0e86-f0f5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064970, "uuid": "aa465b77-94e1-4f1b-9e0c-f79d0518a3a7", "comment": "Malware payload (AgentTesla)", "value": "5ba1fe705b2155d50b6bd20d63b3b1f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064970, "uuid": "6577571c-1d7b-47e2-86e1-151badf92ea1", "comment": "Malware payload (AgentTesla)", "value": "7f610fb90140292d4a5dfcb4bd0e691833307a428714f6381fefaa6c39bc5bed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064970, "uuid": "fc16cf2d-bdb3-4af9-b6fb-1a2c164f1304", "comment": "Malware payload (AgentTesla)", "value": "0edb48dadb156f2a3e42a097c481f07c7f5278ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064970, "uuid": "9c0441ed-081b-4e54-9310-0e67597b9558", "comment": "Malware payload (AgentTesla)", "value": "ca0c27751cc4a766580e0a0d870c4497d317c22933f0828b91bf012478f9e4ad16ce7e988e8050d409361a6484d02200", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064970, "uuid": "631f9885-d449-4b98-84b8-507e3500502e", "value": "T1EFD42302B1DE2BB0E59ED77304FA3114377AB5676CA1E14F2C6525BE071BBA2428335B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064970, "uuid": "e9f904b9-638b-4efc-a6e8-93f61d5f8e9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064970, "uuid": "14ad62ec-6c7b-425c-a76c-03585e268afb", "value": "12288:73VuzRbYnLt30LR4NVslAR2GtxdAR4j8wdoNbxI4tzdMzkls:73VuzR8nJi4NVsWR04jfA1ICzdhls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064970, "uuid": "42e12ae6-dbe3-42e4-8dee-7675bc626907", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064970, "uuid": "7f06efc8-dfe7-4af9-9528-1925a3e1d94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064970, "uuid": "fe01003b-8196-42f5-904a-283591a7610a", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd35c3ce-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712039102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039102, "uuid": "051b008c-2cc7-4936-9f76-723cf62b35ee", "comment": "Malware payload (AgentTesla)", "value": "f6465ddf55beb2c8d460fe397603b2a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039102, "uuid": "2a6dd6fd-5561-4561-9a0e-03dacd29bade", "comment": "Malware payload (AgentTesla)", "value": "8057f4c58127f42b4d16a598fc7729dd847f5930b65dd13f54c048de5f1ca2b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039102, "uuid": "4b1d7e64-94f7-480c-8e43-e1f9f7d7b485", "comment": "Malware payload (AgentTesla)", "value": "d9b725d90a30693bbd5e2346f2f77fe5afc17114", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039102, "uuid": "a7a6d42c-58c5-4869-baff-05182b8336fa", "comment": "Malware payload (AgentTesla)", "value": "45b35810e32b5ed95a3e68323cfd7510476b4d6106b8f63eaa0a25491b52bd2400fb2b1c1c4ff48dc3870b5d467b7864", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039102, "uuid": "e7498532-1ae7-4546-82aa-d24c3e594fe4", "value": "T186D4238DAA1F3955DF7AE1037D32B2E3D11D0D037ACB17106F5CE0BBA50AA558602B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039102, "uuid": "a9f43c51-2a69-4bb4-b2af-cdf765e52bfc", "value": "12288:je0d9MFVykSZvYf1p/uLvws9P2V1VPDtk4EQFfVP3Rx2K+STM1nDsM4pua:j9da+7v41iNwVPDtlfVPj2FvnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039102, "uuid": "c81475e2-665b-4206-a93c-0a17a698328f", "value": 648225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039102, "uuid": "06c7904b-c170-42d9-a361-92ea584e208a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039102, "uuid": "4e03d5f6-7fc2-4d9e-aa65-e1b35d47a5fe", "value": "Order BR004389.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7434ea4e-f0d1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712049288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049288, "uuid": "74942d17-58a3-4be6-b963-b7b73d323c59", "comment": "Malware payload", "value": "812a7c7eb9d7a4332b9e166aa09284d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049288, "uuid": "a7a92bda-0cb8-42f0-b921-c3d799a93341", "comment": "Malware payload", "value": "81a10784ae60a58a969e858c9c4a2ae0d4ebe46e9bd6776992461c062f70099d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049288, "uuid": "c2cbea28-0deb-442f-b8a3-244210965073", "comment": "Malware payload", "value": "ec0d565afe635c2c7863b2a05df8a49c58b703a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712049288, "uuid": "c0fc0d99-6e85-42d3-884b-5952076b5ac8", "comment": "Malware payload", "value": "a49158e828b0d6d46f6c9c4dccc77894585a392359ea83ee1e38be11744b6bccdd2c5ee8930b574b1f8c26957b1c8fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049288, "uuid": "8fc14228-9384-415b-946d-30c0aa44b9fa", "value": "T11BC35B21CD03E0B6CC233A718CC3F4BFC6699D4049A2CD84EADD4F559E6317665DEAA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049288, "uuid": "eac7e3fa-e579-4d4e-b362-29b3437e08de", "value": "aace71b4596556dc5194d2689cc908e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049288, "uuid": "c234a4f9-c3fc-4f19-999e-0d08aad1519b", "value": "1536:tgoohQsgZFWcDncj4gg+IhEASPwgGsjjpzP8IPqJ9+DXmjPAbw5jdsGr:tgorEcDncsg4MjjpDlPq3+XQAUsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712049288, "uuid": "985d4480-6c67-4104-9578-24ffe301c366", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712049288, "uuid": "e82a3ccd-0d85-48f7-9bfe-667d3d1ee576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712049288, "uuid": "36d6d7e4-3242-4336-b0c5-083516d05c3d", "value": "Malware.unknown.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2640c8e6-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712082228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082228, "uuid": "c8a20df0-3ab4-4e07-aac2-9ce9bd8d3ec6", "comment": "Malware payload (Stealc)", "value": "1c9f7a7f37ed9143b8cbefe285b96419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082228, "uuid": "f966b91a-9ac7-4276-a07a-7740bd0b8911", "comment": "Malware payload (Stealc)", "value": "81b64ff8f989f5a498e306b5f6f08e92b1d2d0a3c4bfc73b464f257783152c83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082228, "uuid": "4cfd81e6-894f-4d51-a659-31cfccd6d874", "comment": "Malware payload (Stealc)", "value": "8b5d5d4c508106c9958fb33116e8b4eac9e4df8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082228, "uuid": "d22055c8-f45b-40b4-bfdb-f1ef2c03e828", "comment": "Malware payload (Stealc)", "value": "0ffc28933901ea9e2cc4ad92b5b71e7d4633aa4f5f4ca165b4949f4c4154ed397ce79788c173c43f9e83200eb2b2b3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082228, "uuid": "573105ee-e288-485d-a1a8-1328bc6902af", "value": "T1A4949C03A2D1BC61E5664773BF2E9AEC372EF9615E286B6722487E0F54B00B0D253753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082228, "uuid": "4772e6af-de75-4a0b-9ad2-4ec1b5ea8929", "value": "c4a60923dba9ba09eab802a43aae91ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082228, "uuid": "efd09bc2-cada-4481-a877-c45c895ee2f1", "value": "6144:6vZFT3XcbbLvNeULGRvdEvUkiHDdBonjSdwn6O9F2AiX:6vZFT3MvLH+GUB4jQwn6wF25X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082228, "uuid": "d0286ed3-5cff-4be1-af3e-0afbb16e1d39", "value": 419841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082228, "uuid": "c69ad167-b1f5-48b9-b9fd-f40806e5591d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082228, "uuid": "51e61aab-0eb7-4b80-b029-e60a59efe942", "value": "1c9f7a7f37ed9143b8cbefe285b96419.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a7083d-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712047086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047086, "uuid": "070ecade-f921-4a3a-9ea2-e5c55d309149", "comment": "Malware payload (AsyncRAT)", "value": "8df47fa5b39878fb3d17c6fff264e1a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047086, "uuid": "eec0af23-aed2-4f6c-8b79-16e2735c556e", "comment": "Malware payload (AsyncRAT)", "value": "829371e9f7b8108a3597cd80e432557069b217a1c3dd01b6d715597a82b611ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047086, "uuid": "20af22d5-770b-4495-b838-c61a3174b9f2", "comment": "Malware payload (AsyncRAT)", "value": "425862283b0fb65ad75138203aa2d4fe331febd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047086, "uuid": "0e5a706d-d4fd-469f-9687-605076878a47", "comment": "Malware payload (AsyncRAT)", "value": "ce0c5420f1eb4174e53b2557d9d6b1c69661aacded1622e7dd2d5aa1ffb88bf68bff77c52439900b56a7a184d37c04dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047086, "uuid": "ec5078d5-b3b7-43b7-b6b1-4d1534e8bb00", "value": "T1927472E2B441A7A6E65855B0A81739234FB30FF30669E4775C8DE12F046E872197FC3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047086, "uuid": "ad359088-40c6-4242-9758-c86251b60648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047086, "uuid": "450e91a0-79f4-47ff-82ef-16f056ca46c1", "value": "3072:vfJO16Nb07wSBBaOtiG9b0z73iJUkXQdjxl/MuN1ScZN1OlU5Ypwguz:vQ6Nb0kSIGuz73VEQpPHNAcZN1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047086, "uuid": "b0426713-a832-4ad3-9a7b-e501e529a0f9", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047086, "uuid": "b87f1a3b-024d-43c2-85a0-a1aff2a6fc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047086, "uuid": "e0f1e7a9-64cd-423a-b756-21f2546cf44f", "value": "8df47fa5b39878fb3d17c6fff264e1a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8c3a74-f127-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712086378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086378, "uuid": "c4ebbe10-74d8-4707-8584-d99b607e5e63", "comment": "Malware payload", "value": "c32481f7e028e16b85aa3f74de7bf39b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086378, "uuid": "730e8ff7-b255-46a5-9587-139374c763c6", "comment": "Malware payload", "value": "830a7f6e58b3dfefbc665391bf947721a4daa51d8a16edbe484687cb86375221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086378, "uuid": "d16fa1a9-bb66-4d61-9544-5d105c3efa5e", "comment": "Malware payload", "value": "940161f4ca3da5b6306a970e515eace967cc493b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086378, "uuid": "89d3b904-eabf-42e4-8018-d090ba2289d7", "comment": "Malware payload", "value": "2f1e3d252c110f4d0fb1e9c13fef02631a4c43b3d665bb20ceeef9a0cba3bd3500baa4cf2920317c92864248f3ae6080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086378, "uuid": "3dbc37e7-469f-455b-a955-899d40b07fe5", "value": "T1CFD3E015B7A0C427DAB74B314AB683E72EB5F91128284F5777C02B1F78A1790ED1E362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086378, "uuid": "a056894d-6497-46c3-932c-768cf595ef3c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086378, "uuid": "7d657c34-cbb0-40a6-94f3-509526588e48", "value": "3072:sn77v00hEoDEtautceAgjS/uhMrwaDsaH2tvhOEA1RJCir86SrSr66Ia3c:s740IdmgjSWhsos2t0EyL+HaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712086378, "uuid": "9af91a0b-caec-45d0-8a3f-54ccd876df54", "value": 138796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712086378, "uuid": "e099247e-a51a-48b9-a838-1931063fdf9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086378, "uuid": "01ba6fd7-bb46-408d-b424-9aa5202e66ae", "value": "SecuriteInfo.com.decompression.bomb.2213.22361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be061179-f0bc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712040392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040392, "uuid": "5ab8b149-a347-4e0c-8b02-0cb2e604d030", "comment": "Malware payload", "value": "c2b5285108fe0bb9c585a8afd2029296", "object_relation": "md5", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040392, "uuid": "6f97b1d5-1704-4662-abaa-550ff88a91d4", "comment": "Malware payload", "value": "84319e9ec82b654438d8c26d8a93e9e3197dff0d93265e30f961b200bbb27472", "object_relation": "sha256", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040392, "uuid": "014f455b-9f18-43af-b699-480e4e6605b8", "comment": "Malware payload", "value": "8f69cb2b31ba165c3f6d73718d70881c9a02efb5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040392, "uuid": "7b37f3fe-9585-4c2c-888c-59d31113230a", "comment": "Malware payload", "value": "094b4999f9458c8c70519e8a1f9857b70a9a64413d4b045187ca257b994c1b70ed891f6f731b473eea822b5100ea016c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712040392, "uuid": "2c8574b1-5906-4674-85bc-abada9f86da4", "value": "T1A3345C19A5A1F4F8E15EC830C65B8B2322F1B0A52624753736CC9B7D2E6BF70665C723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712040392, "uuid": "7954693f-4641-4d0b-9d0d-5ca14500afc1", "value": "6144:5HnENsaYiiUoVfpfLmOp+FQ836k6tp9YOqo0:5HEKiiUKRipX3Kbt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712040392, "uuid": "a5e8058c-caa1-4b48-8202-83a959df2d67", "value": 249224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712040392, "uuid": "d486d592-edf7-4aa4-ba52-dc31cdb5170d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712040392, "uuid": "5ccf5e38-5b71-4654-a8a0-2754bad0a7b2", "value": "liblzma.so.5.6.0_fc40_build2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc31922-f0a8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712031671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031671, "uuid": "09b935c9-ffa2-4f65-a10a-661b6641b00a", "comment": "Malware payload", "value": "6a65a7ac21a837230f3a31e5875bda3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031671, "uuid": "7eef9b7d-6e25-4b66-9a09-84006e5328ea", "comment": "Malware payload", "value": "855ff58d45dec32c9583208aac737ce38f1a90aa0d903037c7a977399fb5bead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031671, "uuid": "47cb6f52-ac65-4b2f-87b5-2c0b48af0ca4", "comment": "Malware payload", "value": "4fa18424665b21e34f5f4ab50ad06eaffa0e9e11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031671, "uuid": "773afe33-bccd-4d44-a87e-8988e61ebea9", "comment": "Malware payload", "value": "1b19542eccab430721c67cb5e0f50b60c77b8a1c85920a2613d7741f78d068772586cac38e6d7923127af80aa7f93803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031671, "uuid": "bc6c4dab-a21a-4b7d-921f-c3a01c936f96", "value": "T1AC577C82EAC741F2E8170971416BF77F67346F08C430CE66EE88AA45FE73B61191A359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031671, "uuid": "9398ac52-603f-42b7-b0ea-755bbbc5e48a", "value": "63711b64cb11295885c1bbfa156f6dfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031671, "uuid": "85792e9c-26c5-4260-91a1-abec2c208295", "value": "393216:pfxyqrX9St+5/YKDpsUYlmZtTu3TpQTfgvK:5jStyz9KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712031671, "uuid": "c21dbe78-d175-405d-a33a-79dc6168ba99", "value": 28720640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712031671, "uuid": "87ac5d84-dedd-445e-a8dc-c74687ef735f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031671, "uuid": "66bc60a7-5083-4cd5-a027-75a158ca8722", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.27093.17592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce7d904-f084-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712016446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712016446, "uuid": "e435c003-857c-459e-89ca-055b909a13a8", "comment": "Malware payload (AsyncRAT)", "value": "b87d31f518b16e93556670d5ba517906", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712016446, "uuid": "47caf050-6b73-4c3c-ad69-24a8c5e2e24b", "comment": "Malware payload (AsyncRAT)", "value": "8579bd550e62d5c01e34f4fefc627374d7598d62aed57dda018ae2804b1219fb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712016446, "uuid": "a14dafd3-81d7-4948-8cb9-c60809497678", "comment": "Malware payload (AsyncRAT)", "value": "eb583edd8fd4459a64a8e2a5489345447acb89e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712016446, "uuid": "abb75690-ab20-4989-89a2-21fa95e9f36c", "comment": "Malware payload (AsyncRAT)", "value": "f024c8cab0cedb30c98fae888a6b4caea39132ee312d0a18851471a2e7fbe7675800d22b7e0c0ee619e41fdf315a2733", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712016446, "uuid": "c9c0ed58-d3a8-4c64-bb40-7a099416d3f6", "value": "T15453F8013BE98029F3BE8F7469F6618506F9F5AF6D12D54D0CC914CE0A32B829951FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712016446, "uuid": "4faf95b0-a939-4e18-84a7-68316ea5c702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712016446, "uuid": "05e787a6-d600-4278-bd0c-dbdb98daa249", "value": "1536:TmImx6tX2kNff4sKu+UYFAQzq7bwAPJVSLgprPlTGlx:Tm9x6tmkN7Ku+UYFAQzq7bwkSLgpdmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712016446, "uuid": "7b9499e6-1e80-47db-9691-a78128bedcfc", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712016446, "uuid": "cb9b771f-ad7b-4d05-a5a5-b0e84c0e4f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712016446, "uuid": "73bd0682-34bc-4075-92ce-f397af61a0c3", "value": "bUxt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c82a282-f098-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712024713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712024713, "uuid": "38d06594-3be2-4312-8c44-8a65ebdde266", "comment": "Malware payload (DCRat)", "value": "4222f1a32b7d4002b67593ebcb230828", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712024713, "uuid": "787507af-935c-4b92-9c22-a6d32c0ecd57", "comment": "Malware payload (DCRat)", "value": "8709a2d366b5a25dafcda279a431d07da457676948024ee28e60e7848b7d24e4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712024713, "uuid": "b57ebd40-a836-457d-a77d-035e96de2079", "comment": "Malware payload (DCRat)", "value": "697f7669480a86d6b8f7fcd257d4b3f86e3a6eab", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712024713, "uuid": "0672f638-13b4-498e-b652-9f0c4a89009d", "comment": "Malware payload (DCRat)", "value": "9ace4e875102a66586d32e958c390f413dc6b24214210b0d8525dff28dbc98c53066133ef668f3027be2b34882c04e5f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712024713, "uuid": "6c8e8096-2006-4585-a348-8417a3cec354", "value": "T1C65530342EEA102AF173AF7D8AE47596DA5FBAA33707985D10B103C60723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712024713, "uuid": "9e5bb9ae-38a2-407f-bb18-752caebc5d0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712024713, "uuid": "980deeeb-2989-40ba-b92c-98b0182209c3", "value": "24576:kBS2XXH/gZwbxOULoo8Px6J/EM2C2jNiL:piXfgZY53So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712024713, "uuid": "c8743c7d-e5e9-4c48-abc5-b3d32b89a495", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712024713, "uuid": "1fe09ba6-8b56-42ae-a4d9-2c2a6924d032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712024713, "uuid": "9ac04ba6-8c11-4cd5-9bc4-8c68a08c7107", "value": "4222f1a32b7d4002b67593ebcb230828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c01da82-f0ed-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712061381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061381, "uuid": "f8ef8861-855c-4e1b-87ab-7e3b64c39ab9", "comment": "Malware payload (Mirai)", "value": "cf6f69017f7bd9441a6c9fa61ada537f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061381, "uuid": "66bdc4c3-81f3-437b-a48c-05038c817b76", "comment": "Malware payload (Mirai)", "value": "871cda12fb56a98adf85eeeeab0c16b7a3eb5a90450d3f29e344404b5389a8fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061381, "uuid": "49b34aeb-1782-430a-a650-c713c09d78c6", "comment": "Malware payload (Mirai)", "value": "86bb0027619bfcab0221161dfd6c3f9161907a30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061381, "uuid": "dd34de40-d4d6-4ea7-b2ce-cc835c934b3f", "comment": "Malware payload (Mirai)", "value": "895206e2ecba18b95d57ade7b95464b89d8e5cece2849048cbefc88743ca54df96fa864fe8bff4dac358b6f66c170816", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061381, "uuid": "7cf95353-1454-4113-9ec0-ee49407fe627", "value": "T1CB04D81AAB550FBBCCAFDD3706E90B1139CC954B22A83B363674D528F54E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061381, "uuid": "0c471e67-08a8-4940-9f49-8038318c1001", "value": "3072:ueEksFM+wX5OLaVR8H3NaMZOTTMJxt9U+7fKb/E:ueEnO+wXfVWdaMATwJHy+u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712061381, "uuid": "fb168c23-0fe8-4fff-883b-d84829348168", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712061381, "uuid": "db8d4371-6c94-4a66-a9b4-88cbfec711a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061381, "uuid": "2de9d56c-824d-40ce-8ba2-d715087489a7", "value": "cf6f69017f7bd9441a6c9fa61ada537f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb9681e-f10b-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkGate)", "timestamp": 1712074376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074376, "uuid": "fe10a29d-5cbc-4bf4-99df-95244942e9cc", "comment": "Malware payload (DarkGate)", "value": "4ff404ceede30c0ca73b97e26f20dfa8", "object_relation": "md5", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074376, "uuid": "27058f1a-7e5b-4005-9813-6efb2e8d6a41", "comment": "Malware payload (DarkGate)", "value": "885eae8e4d2788a7c54f4123cbf84b4e897082f8388a7b3f3c2bace9f9419e13", "object_relation": "sha256", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074376, "uuid": "7072afb8-f569-4fb2-8b70-ef1ff0f07ee2", "comment": "Malware payload (DarkGate)", "value": "5b2644004b27a4b39502ad0d4a0193d0124588cb", "object_relation": "sha1", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712074376, "uuid": "b239675d-2d49-4293-808d-af63b3613a01", "comment": "Malware payload (DarkGate)", "value": "972944bad154a6feae8f7049a839c554b37162d80fd9a8b216a8760b52ab33acb9b8ce6e4b5ea8c84f72ed0e88c3768b", "object_relation": "sha3-384", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712074376, "uuid": "a14c0667-fe12-4154-ae86-ac100e7d0ac2", "value": "T1D0F1F143BD578434F0341C075D23642EE750111363A1BBE976ADC39B8B3ADAAECB6D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712074376, "uuid": "a03447c3-94fb-4ec0-8a90-d050e3cf86a5", "value": "192:YMg119gkCtL3IqSPN3QzGNzUoNJnN/Y999E6:jy19gR3IquNgzG2oNla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712074376, "uuid": "1834c809-af52-4bae-9bd7-a34fe2cf2326", "value": 8111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712074376, "uuid": "b5044ba2-2488-4752-a529-357b715030a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712074376, "uuid": "513368c3-df88-4a6b-9728-0e8dcd97be41", "value": "quickbook_April-2024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398f439e-f0e0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712055632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055632, "uuid": "0baa0132-7430-4568-a839-9e6ef756b17d", "comment": "Malware payload (AgentTesla)", "value": "62d12064e940714d40d2154a600746fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055632, "uuid": "a629c55d-446f-4979-8204-8cda17a734f4", "comment": "Malware payload (AgentTesla)", "value": "88750990adb66bcd3435e4920b626aaccd51c5c13d778e8e1bff5bd51813b3b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055632, "uuid": "6c18e258-de25-4edd-a6c9-f5d076d4c7c9", "comment": "Malware payload (AgentTesla)", "value": "19c655aadebdc0419ca43bb51ed85ed3559b433b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055632, "uuid": "fab60395-8dd2-4be0-b0d7-fd66650dbb6d", "comment": "Malware payload (AgentTesla)", "value": "cbb5a73eef6e7a3f8d002b990ed503843a05452476f44c0ace3a24b0e3918b563336e1320208b0ddb39e4d0200937406", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055632, "uuid": "35da6070-bd31-4a57-ab7e-a2b0da9eb355", "value": "T1DD45BF027381C062FF9B92734F9AF6515BBC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055632, "uuid": "1c7e40e0-82e6-4c43-93d9-58ab0604fd75", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055632, "uuid": "5bbe9495-e834-4d2a-8a76-9dfee7086d0c", "value": "24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8auvCb5Hn5GxXOgF:fTvC/MTQYxsWR7au8kO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712055632, "uuid": "6e2a5615-63ec-4cb8-bef9-735cd081833a", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712055632, "uuid": "4d96d247-8428-4013-ba81-e59857807c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055632, "uuid": "7152810f-1adc-482e-acd7-15160e56aff6", "value": "DFG_6288287882891_6729919278.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73e3fe8-f0b1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712035683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035683, "uuid": "12657a32-611e-4a24-81b4-34005ccd1253", "comment": "Malware payload", "value": "9b8dbf3ace929883c635c22b17df28f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035683, "uuid": "3c7f0b16-5415-44aa-8310-4f9eb0d7b2a1", "comment": "Malware payload", "value": "89e30db025153818fcd5ad4b431ac54a00656b19aafb3ab023d395b1a83f4b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035683, "uuid": "b5e50d19-f187-473e-a5e1-2821ea40d9ed", "comment": "Malware payload", "value": "a7fa46fb4b2a1b5867713bb87c740ea7e20e21b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712035683, "uuid": "19a05bca-1032-4a72-8cf7-108aac7dca3f", "comment": "Malware payload", "value": "42920b2ab1e17e3486cd33f4a6145f23e9207ccc6525757887f8bfb489358312e8fca05852dc2aedb78a5c6e07376cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035683, "uuid": "9cea84ab-5337-4e88-8925-f1d6e5649c16", "value": "T118144B1178A8C1DAFE3D8732BCDA56E61D28BD7A5E50801B75E1BBDF0472312C913D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035683, "uuid": "12a00fce-b6ba-407e-8a07-c01cc7b9a17f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035683, "uuid": "881558f0-34c7-4b95-a0a5-ce074a02e46e", "value": "1536:iu4xtpuhgDc+skyGz2V7G9D38VRO+3nt22jNVxWXU+5i9XqD+:Z4xruhgDc+skyA9AVjZVxh+E9K+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712035683, "uuid": "0248ed78-ce65-47bb-9ccc-05f314ce49cd", "value": 197432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712035683, "uuid": "115c5581-d291-4a2b-aabf-7c6c3a556698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712035683, "uuid": "8dbcfa0e-49f3-4689-a050-e70b2b00ac30", "value": "SecuriteInfo.com.Win32.Malware-gen.9369.5671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a7db5d-f10f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712075832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075832, "uuid": "6272066c-44b8-4d11-aa90-cb5e4f45a153", "comment": "Malware payload", "value": "e50c3746652b93d4f621b82163025fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075832, "uuid": "8679f64c-6886-45f6-8d9d-cbc8af88d77d", "comment": "Malware payload", "value": "8a16108c6a9e29bccc4e7020b0bde840d18fe5489c8f365726265f11f80c1f88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075832, "uuid": "513cc548-3bb1-4635-88a1-58e70253d788", "comment": "Malware payload", "value": "9d4b4f97b6d6875dfbe41254c61dc2181d6b618a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075832, "uuid": "4c17f3d8-6953-4c93-aaa6-06febe71688a", "comment": "Malware payload", "value": "75c7230c44e7f78b240456f83d468c551405cb30f9e0ec510ab398c84df97ea626c84688138fa37f5311e40b4ff04c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712075832, "uuid": "c075c9cc-b40a-40a4-9f93-3b4c923cf064", "value": "T155E733B03540E553C918A5FA625443F68A6C532AD5CBC30ECE697BAF0CA49D6831F36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712075832, "uuid": "9a5c3b94-4302-499d-b296-b7f6de9cc57c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712075832, "uuid": "74f7af65-d44e-4688-a7ac-ae6638ed05e0", "value": "1572864:pj8ka6PJFHFX5NBoeMvd8vaajhSisiZ2HL0RJ7:Zvx7lJNLMV8vDhVsLr0RJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712075832, "uuid": "1f77be12-f73a-489f-9240-195d785bf867", "value": 67804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712075832, "uuid": "4839e1d9-3e7b-49f1-bf69-7084e5a19fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712075832, "uuid": "1edca545-8c3b-4b0c-aba8-7b48bfbbfcb7", "value": "Legends Utopia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9364c7a8-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039462, "uuid": "e635ce12-86ba-48bf-a3a3-3881e9c6ca63", "comment": "Malware payload (Gafgyt)", "value": "ef45b903623d079a75ad23b4f6a1b358", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039462, "uuid": "1b28cb0a-4b46-4280-85e4-0caea1b9a155", "comment": "Malware payload (Gafgyt)", "value": "8aeb55f033a3059d0600c727de5564ee02dd5d2794e6f949a4e609c782266e81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039462, "uuid": "54bd962e-0a1c-4a63-b22d-e9a5dff5adbc", "comment": "Malware payload (Gafgyt)", "value": "cadfa2275785e195c968dbc22e35c04776e3f6ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039462, "uuid": "c821c37a-f1e5-415e-9834-b6e14b9de6b5", "comment": "Malware payload (Gafgyt)", "value": "36eec531769943b524669ceca520e619f8178addce88004b5adbc078bf913f125eae09c78e1f21377008681e81095b08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039462, "uuid": "9c0ebf51-c23b-4d1d-92d0-f709d1214b14", "value": "T1F5244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB43FC2B9A1D71925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039462, "uuid": "8f18abe1-0e6d-4b8f-9730-5716dd8dd35e", "value": "6144:FZzyacCwXJ4DbpW0v95hbL6+uM/9Ocgym0wfB5RyAn:FZzyacCwXJ4ga5hbvf/dgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039462, "uuid": "052374ff-2d7b-41c7-bf00-f62f3fb589ef", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039462, "uuid": "88d959f2-6442-4540-89f0-227e63335259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039462, "uuid": "d7cb78bb-671a-4c36-8932-48002ec352ca", "value": "ef45b903623d079a75ad23b4f6a1b358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f571ca71-f0be-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712041344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041344, "uuid": "f44f8e34-2778-4713-af27-1d20a5cb257f", "comment": "Malware payload (Formbook)", "value": "0b9273379154c4aa08253e7fa8e63acf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041344, "uuid": "ef2c411d-29c2-48c7-9616-1ff2bfcbc27c", "comment": "Malware payload (Formbook)", "value": "8e0cab6e15c8ecf53d170b396a5cdb6db74f1a8cc5bfd408ef5d480f25fa358c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041344, "uuid": "7ad1e750-85f3-4857-a6c4-6ede79417cf9", "comment": "Malware payload (Formbook)", "value": "2204765403517080e653c8171fe30975d43c681e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041344, "uuid": "0fbf5c54-0b85-43ef-b88f-acd240f9afbb", "comment": "Malware payload (Formbook)", "value": "cdafb253d813a2fcdc99d32b5bd9f39ccbc081d11cda6006f12ece39e9e33046f8b0169b9ddbaf5fab68d8165aaaf60d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041344, "uuid": "3288c40a-3caf-40ff-b374-2cdfa196035d", "value": "T15DC423CEC529672A7824C66E5247DBDB60B4AC1414F96E1B8BBB8FD1113D6C036D0EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041344, "uuid": "e89d383f-2796-45c8-89d2-146ed6141a8d", "value": "12288:IQQYDSNgtDd84RF1WcEoKGH0nRj4GscglyOUTPEfVOUhZfxovrDvgBSNt:crw1WM0JrmlyOaPEfwoxxQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041344, "uuid": "8e808fd6-7c75-4efa-bf98-90354b0d486a", "value": 577088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041344, "uuid": "c7e08c9d-204f-465c-9da0-2b26699b4785", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041344, "uuid": "f0e7d687-347a-499f-921c-c4f7922a60a1", "value": "PO.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c2bf8d-f12a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712087541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087541, "uuid": "387e3eee-0142-4291-b51d-e9a24d383509", "comment": "Malware payload", "value": "f66365289faba04228bb36e7af6d160d", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087541, "uuid": "42a4ca9f-3c26-4fe6-9275-73428902ddb5", "comment": "Malware payload", "value": "8e99bdf3c7257e5ba99d55e995d1974836d563c30f77843ba2e8a0dcb70d17a1", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087541, "uuid": "6708c8d7-e550-49a0-893d-8fea9427402a", "comment": "Malware payload", "value": "39d8e4977b831ec3cd4ce04bd66f67dde193c4bb", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087541, "uuid": "e919b422-7312-46da-baa7-18ae46dc991d", "comment": "Malware payload", "value": "06b4bb035f265041871459db6a6dbe07472882f25b6687333c76e37510a59db9e6537cd5f22d30b40bebe13da641a155", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087541, "uuid": "36f17ab6-be05-45dd-8fd9-52c8e81d3de8", "value": "T114363330A82CFEB69913F10908158BB05DCC72B75AE2191A7F1DE1B7F0AC4A617C7979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087541, "uuid": "b466627c-0339-4055-b05b-762745c3504a", "value": "98304:7DXtg0KmW5P6vSRWLCTutdgVR+3k1uIV7ifKqdpNV0RxeVsHl3rJeiQ1O/RMO:3LKmW5P6vNuWAw3g7V78ndp70RNHxYiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712087541, "uuid": "0d4d9239-50ae-4914-8039-df5a0f9a3ef7", "value": 5140409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712087541, "uuid": "115815c1-0b5d-448c-93a9-bbe9ffad1dab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087541, "uuid": "4ce8229f-d3b3-45b7-8533-e104ece0316b", "value": "Co-trustee_delegation_agreement_27306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453541c2-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067248, "uuid": "d8513a43-1cb0-420e-9744-10ce25d450fc", "comment": "Malware payload (Mirai)", "value": "485d09dd83d291aefff9fc92f353e286", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067248, "uuid": "78ab9806-475b-4932-911e-0801c108c338", "comment": "Malware payload (Mirai)", "value": "901e308ffa995050c58d8b49204032f2cc439b69e77187209d57b14fe5fbb073", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067248, "uuid": "43ba098b-3a94-4bdf-a351-cea4764c3ccd", "comment": "Malware payload (Mirai)", "value": "c72fd24bcf418a407ae10783648c5649c95b43d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067248, "uuid": "0c5ca078-54bb-4d23-ab59-f6626f987703", "comment": "Malware payload (Mirai)", "value": "fd70ca2ffceb8a6964a3a98bd99737e41772258958e946a07bc2985776a0235dc3f21906d7c9ffc57e43932bcdd46837", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067248, "uuid": "4f362345-c57d-4fa4-944f-3d5f86e36a6a", "value": "T13B337C65F8642CF8D8120174E4788AB9D3939EB641C90CB62CDDE65008FBF59B68DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067248, "uuid": "815e5771-681f-4aaf-b972-5ae76e3cf189", "value": "768:YHm764mELERgEpMEFH9YBjsxc4ea8MK9f7UnGOA92ntVsRaDRmhqmqYkSjkFHgfE:12kQnzFH9qkFH4sT9rPDEwhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067248, "uuid": "609a2a78-f7db-45be-b0bd-338714fd0f03", "value": 54144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067248, "uuid": "e1b73c93-6330-4e56-9ecb-522044e189e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067248, "uuid": "49ce1245-d54d-41d6-9123-40248e1798a6", "value": "485d09dd83d291aefff9fc92f353e286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c641e5-f128-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712086798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086798, "uuid": "7ab028ce-c534-4a2b-bbf4-ff9298d16760", "comment": "Malware payload", "value": "07179da6df86114b5caf3059d5a164bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086798, "uuid": "2c5d40af-b425-4002-933f-e8c27deac425", "comment": "Malware payload", "value": "9033c775f745a97799a7935194bb49b1bba024739a5688ce5c307571d3a76bed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086798, "uuid": "d57c9f72-bba1-4a43-9fe2-03482ac6b933", "comment": "Malware payload", "value": "a7105fac1a50a767425344960fc4f21a4e210f73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086798, "uuid": "8318b95e-1736-4f39-b9ec-e9391318caf9", "comment": "Malware payload", "value": "a65780cbf00f9e7ac012ea6e219eb0bae41b829ab91b4000bcf2f039eabbc6daba5097bab03751630e915db45e9b1dc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086798, "uuid": "84ec7898-4865-46ee-a66d-7d4c39ddb58e", "value": "T18A5623CFE28A4B56F57C123E7986A57DB1B6B78279920D3CA0401DD164B32C46CF3E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086798, "uuid": "226c28e3-09e9-4629-99e7-7f2df45c38e4", "value": "781c86f538798e5b8b2b3427fdfc978e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086798, "uuid": "4b62d5d7-8c74-47ee-8e6e-703a59a3b4c9", "value": "98304:ENQfBH7YwtRdsri4LYtuI46Kx0tsNeTNBtJ5HOMzhfyD6rKE/f3tcqh78f9TyW:gUl7RjNtRR20hTN3RfqyKK/6qqf9TyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712086798, "uuid": "2316720a-aaa9-45d1-b769-2f3895c07ebf", "value": 6079264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712086798, "uuid": "8083eae1-19a5-4fd3-9759-435e56fec3f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086798, "uuid": "68a31dd0-84f6-4a22-b3f9-63f87df65ced", "value": "07179da6df86114b5caf3059d5a164bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2bdcb1-f0e0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712055848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055848, "uuid": "1a4520a9-54bc-44a6-8cda-53cf489a2e1d", "comment": "Malware payload", "value": "ccadd02dfee2735b574ae321fa81c654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055848, "uuid": "56783622-2edc-4297-9a57-12560c9f0935", "comment": "Malware payload", "value": "914cad877a41f12bb0998bc1c28d04ee2fb33c4538707547cad726b41f7d01c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055848, "uuid": "578c1f56-ffe1-49bc-a91a-de52f6e43bf7", "comment": "Malware payload", "value": "5510b3eb8dfbe523946fadef2ac6dc0123e24412", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712055848, "uuid": "deeeeb58-faa3-4b19-98d9-684bac5e37a3", "comment": "Malware payload", "value": "62b683c279f1c397c07aacfd8ea4d3591af6e070b82f38024f85e0bd93fd8d9e040c2d68db939eeba74fc095b1c2944d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055848, "uuid": "be65551e-7e99-4f53-8fde-98561cba20b4", "value": "T135768C03F8A635B9C6FDF13085A293227A7178A543327B939FD4896B1616FE07E2D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055848, "uuid": "5663aac5-fd44-4788-9027-673b2fced763", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055848, "uuid": "52ea88df-9dd0-42f3-a1e7-7461b2e980cd", "value": "98304:/9+X32wuYrYmC/eQelGzR03PUh/iPgwjM7yDvLT/2lj:/9+H8YrYmCGQeYzR03PQSM7yz+lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712055848, "uuid": "072643da-1747-4154-bfa6-6e4fee086988", "value": 7292928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712055848, "uuid": "05f77795-a0ce-41e0-b585-969bd0e5dbc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712055848, "uuid": "d2708208-8ef5-43ca-b839-7a1f0eb79f29", "value": "Backdoor.srvupdat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadee0a3-f11c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712081646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081646, "uuid": "5781b344-1458-467f-80ef-1d1d0026b2de", "comment": "Malware payload", "value": "458cd83e99d40276aec2e4b228a489f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081646, "uuid": "dd513821-f6a1-47b6-bb04-fe2ce3586b52", "comment": "Malware payload", "value": "93054e7c6e9a5b37312288c07cbe810a702f1dbc50c904af130715f6eb623c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081646, "uuid": "6fe009f6-943f-43a8-afe6-f56af35bff5d", "comment": "Malware payload", "value": "ac3e8318caf07b65bfd6f3a0faa323365a757f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081646, "uuid": "21d66eed-3994-4f9f-ab93-3c09cf8e3266", "comment": "Malware payload", "value": "9e4056792e74134f369a7994edf9464f4b69b75d5646b274503fc643c4c5aea118dc72c113e0c6f9ef32cdbd002f745d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081646, "uuid": "63a716e5-5d15-4a43-a08c-d761b8654ac6", "value": "T1A6C32767B2A01198EBF581F6D5920746EB7074311B15A3DB2B7863B31B2B8C59F3D3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081646, "uuid": "16fb79d0-62c9-43e0-bff9-85720228fbed", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081646, "uuid": "7b615e3d-911d-47a3-bf42-ea656eab26cf", "value": "3072:8V3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnP9j:Rt5hBPi0BW69hd1MMdxPe9N9uA069TBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081646, "uuid": "da0fb36e-5e01-4ecd-bed9-bf2baef9c29e", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081646, "uuid": "a2a6bda5-263d-46fb-bdc3-24d36a6f608d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081646, "uuid": "b49aa89c-de50-47de-ae09-c940d240bdff", "value": "458cd83e99d40276aec2e4b228a489f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90234f93-f147-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712100015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100015, "uuid": "38070684-8e6c-42cc-bc90-2599a732de99", "comment": "Malware payload (Stealc)", "value": "96b934f9b7b5127c181664ea330696d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100015, "uuid": "10a62d22-9996-46bb-abbe-bf0f1030f871", "comment": "Malware payload (Stealc)", "value": "934eab53b5d80f81fba87e45826cb5fe7b486a86cb41d3c8b2ff583b7b697788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100015, "uuid": "d171b6b4-2c8c-4340-8631-7b94c6db33b2", "comment": "Malware payload (Stealc)", "value": "2a0ffd9e57c4f61ba185623ee1670d74a4601bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100015, "uuid": "31b2e13e-260a-4178-bea6-146554e5ca27", "comment": "Malware payload (Stealc)", "value": "82eb85907d21c38a360e44331765aeb3f7d599077ed1f017401722d2651a7c84007ee93e3d18c29b8db5bbe83221040c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100015, "uuid": "135f3c40-e221-4174-9059-a4b5730447ae", "value": "T12596BF12B384A13AE46B0B3B5877E658993F7E713A13CD5B27F0198C4E366406B7E607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100015, "uuid": "627d7a74-6498-44f8-98fd-2232c6bfc5cc", "value": "e08f6e10e6bb16014c912a3aaa4e07fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100015, "uuid": "ec0724d1-283e-48c2-9663-8d8627b6b1b6", "value": "98304:/KJ/pwjdA7UcfB0PVckwiBpk6QWS1xxgWg8dFSFW89ntTJzzixDe8C1Ve7didOuB:uAaXgcf6M1HFSFfnFJzSRAkuCBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712100015, "uuid": "0a180092-75f2-47d1-a336-926cea0f1b48", "value": 9256544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712100015, "uuid": "6c8e02bc-ae1a-45a5-a7b5-623067e96fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100015, "uuid": "02527082-749d-4141-90c0-89bb23fa0ae0", "value": "96B934F9B7B5127C181664EA330696D5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d530b10-f0ff-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712069060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069060, "uuid": "342ac168-5852-418a-aaca-e377a532cd29", "comment": "Malware payload (AgentTesla)", "value": "2f1b9750761d6d9f4cd6405994c6727a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069060, "uuid": "ea284f01-8e47-4ec0-8967-73bfa9fd9ad1", "comment": "Malware payload (AgentTesla)", "value": "94279f693b7bb1c21594d96e572ebc15e6aea416816b03d677a3875ebb84a99b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069060, "uuid": "83420507-74c0-4a09-a74c-224b9d1c52c3", "comment": "Malware payload (AgentTesla)", "value": "26790b3350263a5287e56a71ca4ffb2befcd66a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712069060, "uuid": "98ebb717-9937-4404-bb82-7cbb2687ff24", "comment": "Malware payload (AgentTesla)", "value": "2ac2f74d15754a02d8de65aff18a1582036ce33d9595773b43daa6bfa737f86a49dc3198fdbc9ad64a9044a1c5272cbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069060, "uuid": "961fe903-4952-4329-ab46-24eb73b323f3", "value": "T127F4CF9C7250B1DFC857C872DA686CB0A6207C7B970BD203A0573A9DAA3D997CF115F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069060, "uuid": "89ea36d8-fe39-4cf8-904c-df62018a6eef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069060, "uuid": "9914c56b-9dcd-4660-b740-634c6b137f1e", "value": "12288:HcZczVtcgkFZ2ZIUVuM6ERdgBfiL/lUO5ifExVRaQWzJJ24YhDdFAgTnaR0T/rR:8qcxFZxUYMRRdgi/lGHb24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712069060, "uuid": "52aff535-4462-4257-973f-99ffd08d3178", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712069060, "uuid": "b5a13c7b-ee15-4c57-b80f-58d783b02dd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712069060, "uuid": "65593704-2e31-4367-9f44-ba83b3123fa8", "value": "MAR-888201-2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65721933-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712038955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038955, "uuid": "ef1dfa57-eb73-4ca8-9987-f01db747c545", "comment": "Malware payload (Mirai)", "value": "1d82fea262c1760795a5a53529fb4f28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038955, "uuid": "82dbaeac-7026-40ed-9a22-31dad50c11a1", "comment": "Malware payload (Mirai)", "value": "946b21be202bf0aa0db816c72450dcf42e36ef67f1f80d018e6f2c8ee9c704c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038955, "uuid": "938a7a63-6364-4f9f-bc27-4e355ebe593c", "comment": "Malware payload (Mirai)", "value": "4ae9bd38a23fb5519e548a796329425b8355e04c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038955, "uuid": "ef333442-53bb-485c-8354-b89e54c45346", "comment": "Malware payload (Mirai)", "value": "4f21634c5959887f1deb8a863601cd18ef0824140de0bae73d4eb5f9700c40055b289e8c6b84e0c251f6b1ab67f69273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038955, "uuid": "6483e222-4b35-48b8-a0c1-28b3c3d00634", "value": "T19D3301559448B227D6700673EC3916093F8B0FF8D0E2706384955FACE8E06667EB9CB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038955, "uuid": "7f625606-181c-477f-bc44-9bf6ea18b7cb", "value": "768:xMte5B4PACtw/YcQHzqFKwf3CfUNrmRpycZdTfPXsrWGla9q3UELbOs8qMLPVhMU:xM84IuDoAUNr8yGPXRGZLIVmWjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038955, "uuid": "60bf23cc-d249-48cc-a776-4f380803f63a", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038955, "uuid": "ca353072-9193-4232-89c4-2620e4a824d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038955, "uuid": "b331534b-8eb3-4308-a662-016fcb8ac10d", "value": "1d82fea262c1760795a5a53529fb4f28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dca2999-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712067182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067182, "uuid": "9c46f2e9-e47b-47d9-bc60-16c53d549424", "comment": "Malware payload (Gafgyt)", "value": "b565402d701474f9211c0959ee9ecbd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067182, "uuid": "16ce4f93-0a2d-4c95-b5c6-0f569ac89df8", "comment": "Malware payload (Gafgyt)", "value": "9479a24d6dc667f1a15a8b552db7ba079f44f1004141edaee6e5ada0a8b6841d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067182, "uuid": "5a43dbce-a49f-4a5c-8d6f-ca2133e5c898", "comment": "Malware payload (Gafgyt)", "value": "a21c10b47e28b3f97a62bef5eebd1f6e07059638", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067182, "uuid": "0ae62a1b-cb04-42cd-a01a-3ab3fd6c4daa", "comment": "Malware payload (Gafgyt)", "value": "910b03dc01f61318dc7cfb62d32d3dd6963ffc4f642291aaccf8b4e15d036ded01802ed56fa39f55ec520efcddb09389", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067182, "uuid": "45b7609f-470d-45c0-b476-23701d7f2d51", "value": "T142B31A3B7B170F63C0CA117116E31732AAB5D7C934B99397B9E02DAC2F16A843416BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067182, "uuid": "7701c324-b8c4-4c79-9a5d-dcc1254cbb55", "value": "1536:vQTv/soNM5rtw3GtURoAfFXcmZpFL0Ps9NfgSXk:boN82WgoIBcmZpFL0P4NfVXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067182, "uuid": "6ae82216-a756-4d38-aece-7224fc8d47e9", "value": 108784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067182, "uuid": "c44c7679-6245-40c6-97e7-a2855f01a2ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067182, "uuid": "ffbb0a06-add4-45cb-bf2c-2a773fa47d8a", "value": "b565402d701474f9211c0959ee9ecbd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5c9974-f0f6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712065008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065008, "uuid": "c0c9ea3d-72c3-4d90-a455-c8105e5d4c6e", "comment": "Malware payload (AgentTesla)", "value": "ea35bed10f48763c125c105bf76c412e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065008, "uuid": "9b68ec03-5339-4baa-a785-ae43134a32f3", "comment": "Malware payload (AgentTesla)", "value": "95abf9af2641a81a79013a5b4db8b9b8dee2dfb370b12b0e97add77146dbcded", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065008, "uuid": "431db572-50e5-4a72-a67d-8b5e04b9ecc1", "comment": "Malware payload (AgentTesla)", "value": "ff80d00915d76774fb8f4599da22dc10d4e071b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712065008, "uuid": "3daf1924-c918-4c98-9866-e88b82786c83", "comment": "Malware payload (AgentTesla)", "value": "4c186a4f6b8cc3d670f9a50fa46086d2ef122c63a1fb219abbc529421050288a9740ca7623859af437823190ec7b5502", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065008, "uuid": "99f82c15-3c96-4425-88cf-4fd64e93a313", "value": "T177069E25E7C406D4F8BBC734C92A9317D6F1B85A4731D28F0A2A164D1F73B958F6B222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065008, "uuid": "60ba8e1c-b409-4320-9e6b-49d6de848468", "value": "316e9e27e68c4a0fac588866004dec69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065008, "uuid": "8cf13684-7760-4842-8de4-d36cf211247a", "value": "49152:Z8Vt9txR1lHWcpFA0IRzSde7rQQFXgFgFO5rV0Nr+knE73OoR2:ZUb3O/3UgS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712065008, "uuid": "d15d33e0-0da9-4ca3-a084-651d8cbec273", "value": 3704962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712065008, "uuid": "f02f0a5b-c22a-49f0-8f5a-b77c1eab0c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712065008, "uuid": "4756399b-7ee7-4aa2-a890-8e60178997a2", "value": "DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdd72a6-f11f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712082640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082640, "uuid": "3bdeb4e7-f644-4940-9454-65572947231f", "comment": "Malware payload", "value": "3b0b31f238d3685dad907d5d195ab79d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082640, "uuid": "4665dbf9-88ef-422b-a47f-1d55fefe5ede", "comment": "Malware payload", "value": "9655d701298f5c63a0643966196b9f8a6202486fb88d7bf03c07539228b4136d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082640, "uuid": "8cb67576-9249-4348-ba38-bc985d816efa", "comment": "Malware payload", "value": "754ae60bfaaa8bfcc932b6f2dd28828e9cccf981", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082640, "uuid": "ee8a96b1-a0e4-4704-a8fd-a8e5069096d3", "comment": "Malware payload", "value": "8d47dfc054e6cca5b651da07387992d3b029d5a6344727b57862a7b51669491c72028a0a6e9b3ea66233da9db563d505", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082640, "uuid": "7b3e4b77-256c-4918-9474-cdc825704069", "value": "T10913CF22C96B4082D34217F6E3190E0BDB3BE9BEF5937E5A7C0EB6D91D111B90946E4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082640, "uuid": "facb184b-7133-4ee5-9878-dab79753ce48", "value": "768:0/l8sza3bmkCRg72dxLsGCVVzWXfjXoatuNokSZDsYgrPh:YlwbmkCRDxLIVajXoYuNokkDsYg7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082640, "uuid": "a1e07033-6384-43e6-bf88-1500e791eb8a", "value": 43596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082640, "uuid": "618acdce-d391-4a5e-9e34-ab4e6bd8b7ec", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082640, "uuid": "d256d0b5-fe5e-49e6-afb8-3bc1f5a70692", "value": "2024\u5e74\u4e8c\u5b63\u5ea6\u5458\u5de5\u8865\u52a9\u6d41\u7a0b.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557e1462-f0fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712066846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066846, "uuid": "5d3ad604-46ae-40ae-9440-e74fc658f948", "comment": "Malware payload (Mirai)", "value": "8eaf2b1df081fc3ae8e748b792106499", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066846, "uuid": "595e36e3-5944-4dae-84ca-7bd2331068da", "comment": "Malware payload (Mirai)", "value": "966f663ef80638b12a3f7d0e0c1d0bf791021ac3527b5a0c1e190a687a3f6e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066846, "uuid": "0ecbe88d-d962-484e-851d-f4f67685585d", "comment": "Malware payload (Mirai)", "value": "c9068b5b4d8e8f4164ad082ed258d86193917315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066846, "uuid": "29e711ad-c9b8-4eff-9ecc-b1c65e0e048b", "comment": "Malware payload (Mirai)", "value": "bf44223068f284d6aa4d6207363860a95a60c8fd5e3af2f2380181d95fd2c0e7d0e3be972a3bbdbee14e88914ec1cf91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066846, "uuid": "303a481d-e78d-4a4b-8d70-8ca663869c69", "value": "T1EC934B32373A4A23C4E6643881E78737B3F79B851D30411BBA956F887F5AAD031937A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066846, "uuid": "e44bb963-14b2-4310-8a2c-9fd594f1fd52", "value": "1536:RMtmq5+UhAgokKSUyAVv9Ks4OL92l5sdxt/+DQnqt+Aecm5jSa:RTmokFUyQvB4fsdXHnqZeDYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712066846, "uuid": "6d85ed2f-96d2-4dcf-93a0-984c5c88157f", "value": 97283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712066846, "uuid": "7efa206a-3bcd-443b-9c7f-269cc5928df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066846, "uuid": "1e1f0b11-a781-4673-9f5d-fe3f931fd0bc", "value": "8eaf2b1df081fc3ae8e748b792106499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63eea5b-f0c9-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712045990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045990, "uuid": "162678b4-2f66-4865-9fa0-feb63cf93ce1", "comment": "Malware payload (LummaStealer)", "value": "bacd186f7bb627c4de020b7ca860e17f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045990, "uuid": "1f1bbfaf-1f7a-4e02-8949-cccf4e648326", "comment": "Malware payload (LummaStealer)", "value": "967384f7ff48f55f1e90a759357cb0e10618d795008f3d17ca0ccc33fd64ea50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045990, "uuid": "2ccf5c1f-3faa-4d97-b4b4-9bc0df5c709d", "comment": "Malware payload (LummaStealer)", "value": "6c5faf980a3c5756770ea2df79f44eebad171978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045990, "uuid": "d13ea1a2-3ee3-436b-a100-9c395c4fdaef", "comment": "Malware payload (LummaStealer)", "value": "042b65a25778eb901cd69ae6260b3c4f7fb345925bdfd273829519ebb8b63bd7ec0028f616725f0fbd87af92e7e36c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045990, "uuid": "0a22d5e6-82a6-4a6f-ad20-6a343e73cb6b", "value": "T1C8374B43E9A140E8C4EEC574C5669222BF727C484B3437D72B60F6682F76BD09EBA750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045990, "uuid": "b64dff92-4dbd-43f6-a59c-d94048349f42", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045990, "uuid": "b315b4df-e8e4-4776-90df-428466a75b7e", "value": "98304:pq5nkxDxTwlV6q9VhV8VnYuE78tDZ34xGi4s2MUGDrIUGLrE+Tn5/rMrTGQOD0U:HTgV6qH8VnP3E4s2MUGDrIUh+rmrOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712045990, "uuid": "37ddd37c-f6eb-41bf-86aa-f01de740777d", "value": 22556160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712045990, "uuid": "4b48834d-8314-4d9f-b8f4-2224ce694e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045990, "uuid": "1264dc0d-f8ba-4a33-929f-310b3ae77e6a", "value": "967384f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c9b538-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712046576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046576, "uuid": "0d74ac2a-dd41-4570-a1df-874aafef4887", "comment": "Malware payload", "value": "a843f46612680bec6d989d02a1972586", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046576, "uuid": "39cd30e3-8f2d-48b5-9e00-694902a0cf49", "comment": "Malware payload", "value": "96a04c090758e94b6f8bd145cc15f5facc915a4b5665dd8281db7a25ebbf14d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046576, "uuid": "25722c15-7951-400c-95a2-c325921427a5", "comment": "Malware payload", "value": "d3ce420d095117f2117570f030cc43e92294fc67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046576, "uuid": "4294b206-d76a-4478-993f-86e84bb5ba67", "comment": "Malware payload", "value": "7c67ced1d727ece84df53f994e3b9b0e2e7a95ace83e7818df5c670e8884fd48e8f2100e8ee03a9e717a06eb7901af28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046576, "uuid": "e38f76b1-ad44-4a67-b9d6-d45a4193189c", "value": "T1FC5301F5609BC0DDC384C4FA04BA8B703F735807D952FEE9311AE286E6CB6C826216C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046576, "uuid": "7bf4201e-16fb-4a99-b7ea-a605c77d0d69", "value": "1536:ATTP90aYnxrpZ3plsWJcjtRULdeqI5fECDlh4bVJuf:0JHY53nJCkAqIjiVQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046576, "uuid": "1c8dd0c4-a2f5-456e-b0a4-de94de7f874b", "value": 63892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046576, "uuid": "7f038a8a-2624-47f3-b389-566dedc5ef98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046576, "uuid": "53c5600d-dfb5-46d4-8457-04eba30d94ba", "value": "SecuriteInfo.com.ELF.Agent-BQZ.3977.9243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7f6dbc-f12d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712088653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088653, "uuid": "953f5ec9-a822-426b-aef8-7dc2e1e69488", "comment": "Malware payload", "value": "0eb5ee530f71aa14ea699e269d58e51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088653, "uuid": "f673ce7b-cad2-4b4a-946d-4b3bafb14a31", "comment": "Malware payload", "value": "97137acedba1ac921b69cc15d65e9c67edc13757f28874129744926c17c0230c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088653, "uuid": "e978776f-768e-4ebd-8f27-378ea1f9c14d", "comment": "Malware payload", "value": "3788793637bc32bf1b42eaa9b0b71e7b0a678295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088653, "uuid": "78070473-3f46-4e1c-b41f-6776cfd8f319", "comment": "Malware payload", "value": "64b234fb74ef9e7ef1554eb445382bf2ea5d8e4fe8aaa6829ff9a76727bfd18fb0726817f8e58c20159cd9bdb26f62f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088653, "uuid": "0d2f7890-b98a-40fb-af00-28ac1354c903", "value": "T1FDB533E1E6345824D703E83FA5969624033A1FD01297C70ED798974E90EAB57EE0FDE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088653, "uuid": "eee27138-39b7-42c5-9ee6-34cdb794a5e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088653, "uuid": "641559a7-c5ce-4974-8f04-f1982017172c", "value": "49152:Pl3H4WIwyiyXrPAaHj732ilWpXB6gyuhMqo16om6yRJwjnp4nV4rT:Pl3H4WPy7Rv3u1y8RElF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712088653, "uuid": "50eb4b93-0c4a-4591-b867-e4b33b5ad562", "value": 2362880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712088653, "uuid": "c1287356-39da-4b49-bb80-082d85392a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088653, "uuid": "ac02763b-e682-4704-8f5d-94164b3d0108", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988e453e-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712082420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082420, "uuid": "20979f9d-b1a2-4ee5-8e34-8646eb5111d9", "comment": "Malware payload (GuLoader)", "value": "e1d1515bf8db4617134b8b37ba6461bd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082420, "uuid": "6a97bb2d-f7ad-4601-abc6-050cf4e9ff53", "comment": "Malware payload (GuLoader)", "value": "9955428ce13df3dd0fa130e19ee75ed7429a93d622a79b5cba5a6cfb8835d638", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082420, "uuid": "385d6396-caca-43fa-a6fb-a0b0180810ae", "comment": "Malware payload (GuLoader)", "value": "adc2d7d5ac282b89a73fa8636d3300e554869f6c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082420, "uuid": "cfe065cc-fd46-4b06-ac32-0e39f4754384", "comment": "Malware payload (GuLoader)", "value": "01c7f4be6be052233bcb1c2334779c02cdee50f40d2b995ef2c5bcf8467dce45dafd68fd81f6a0c836874322957c0a4d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082420, "uuid": "621a1a71-b3ff-49a5-a21e-96e97804f3aa", "value": "T18792A31C4A075FD72FF777B188292BEC902475A68C3D082C7958B564B7256887EE83CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082420, "uuid": "0fb939a8-73c0-40dc-95d2-1a8772fc758c", "value": "384:UcCUA5pelJYpBuiy+DNNP/proi9vvp0s3/9EYt403L8BfW:UcC95peliBlRCi9T3/WYtF6fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082420, "uuid": "a92c4ce2-cef6-4316-b748-ce191c3040e9", "value": 20234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082420, "uuid": "705889a0-d719-4219-b45d-f969be76ccd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082420, "uuid": "f0da8227-6c69-4b17-a4b9-af9099ae79d2", "value": "Solicitud de presupuestos_CA 4-2-2024\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac79c3b-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712041648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041648, "uuid": "c9d701db-8040-4b3d-aa65-2aa6fbaadae6", "comment": "Malware payload (AgentTesla)", "value": "89538a91eb54a2109105bc92218d2f1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041648, "uuid": "9fec66ff-04e6-465f-b4df-20ef4082f8cd", "comment": "Malware payload (AgentTesla)", "value": "9a2f315bd234cc0164ba240137b92ccdc3736e2f39474f32a57e037e87e73498", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041648, "uuid": "51829992-2e19-4b2f-bc1e-a26076d28b79", "comment": "Malware payload (AgentTesla)", "value": "1c2e92a9d1ca38937fcb4d36008db197ec26dbd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041648, "uuid": "1770271c-f303-4135-8530-96f72ec24c3b", "comment": "Malware payload (AgentTesla)", "value": "c3dd7746579a13510ffd1049f1edadd0499b6c56fe0073f9d5bf9dad79b83194af540253577bf90bddde3d5909d39fb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041648, "uuid": "a68ecbb2-3b44-4088-bb7f-9739bf3e8444", "value": "T1BEF4E09D3660B2CFCD6BC9B3CA986C68AA706567170BC603A44315DC9A0DEDBDF105E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041648, "uuid": "8af53fd6-e363-4de9-a8e3-46104b174388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041648, "uuid": "6c002823-2252-4750-b7a5-9bd92813b2ff", "value": "12288:1b8zvfz3H33bgO9d4Kogra7XM4XvH4OEikrCiwuEX9J8DeuygUSjYcFPccLMljGG:1w3z3X3LxVrabf4Ox2CNuE7+Gq/ijGFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041648, "uuid": "95fba745-eae2-4588-960a-9ac7084ec8ae", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041648, "uuid": "cff21d41-499b-4b49-9bfe-fe64f81ca272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041648, "uuid": "2c436bd3-2a61-4ecf-9851-93b0eb45386e", "value": "Statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efad54ce-f0f5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064957, "uuid": "2a0540e2-d0bb-4ce1-bfcb-2ba6f4c4d85b", "comment": "Malware payload (AgentTesla)", "value": "07dea71052ec05d6957158d90cbd3b66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064957, "uuid": "fcc70ea5-36a6-480f-ba93-bd94cf684913", "comment": "Malware payload (AgentTesla)", "value": "9ae07d0154fb02732fc009f43d854b0cb691cb44a84eb2dabef37e53ebbbbb93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064957, "uuid": "17d50356-1f45-48ec-991d-bf04c6ef1072", "comment": "Malware payload (AgentTesla)", "value": "107f0c83991e511019cb3f072edb1304ef8f6bc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064957, "uuid": "6e8fe013-9fd7-47ed-9eec-36d11c874b2a", "comment": "Malware payload (AgentTesla)", "value": "e4b7190c75769bc1560298aba20fdc2fcfe7365858f72a2da2628f5b62d7968ead9852bf8c79998cb46b263945764dd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064957, "uuid": "7119b2b9-6273-4772-8191-1682cc52ce36", "value": "T13CD423943354CB12EF6E1A7AE544C0F203307D63D415F61B2D91BEEE7972B9A0A70B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064957, "uuid": "c9629e73-e6dc-4f1e-8e32-0c6cb12fa3f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064957, "uuid": "eedaf011-3234-4fe1-b4dd-2851127977ff", "value": "12288:IZc8YZnc5MLkU6Imm2z1SKYdI2zc89o7IUqNhk5L:IJYZkLmS1SKCII3sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064957, "uuid": "48078e68-3e6e-4a8a-ae6c-6ac7465a8f79", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064957, "uuid": "3ac56fc6-9717-4cc0-b76b-a6343fb41c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064957, "uuid": "bb2fe430-e1af-4ae7-a188-552f0d6bc4c1", "value": "Fiyat 02.04.2024 - VAT TR-24-0286_ unit Siparis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7864ea50-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (c)", "timestamp": 1712039416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039416, "uuid": "95c3db08-8f65-4094-a578-d1cfbaaae35a", "comment": "Malware payload (c)", "value": "f02da8c9695a813019e04a41ebc07caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039416, "uuid": "22697ab8-b3ed-43e7-aae4-45dc36de96aa", "comment": "Malware payload (c)", "value": "9c47694130c53f8fbe6b50987de52802ebc02d40a2a7b0ed5cf6e4dffa067a39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039416, "uuid": "e87e5a7b-a3b4-4211-beb3-22e6c150ecdc", "comment": "Malware payload (c)", "value": "f395ccd596984834487ae13e73ab1120b4505033", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039416, "uuid": "738cf3ec-714b-4938-bc37-93f177684301", "comment": "Malware payload (c)", "value": "0a4104a8f69f589095ccd3ee8734ba4d8f869ba8f5497a044b8b63d194960f10d80841a7dee8c8518cd1511e4a85cb8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039416, "uuid": "27bf8897-4bd1-49ce-bb49-6adc5aba2923", "value": "T18B04717AB7618EB7D80FCE7305DA4912188C968652E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039416, "uuid": "cc8adb19-2bd6-45a2-bad8-fc7aef941f22", "value": "3072:aaF7XSy6Cv9RD+5hCs1ZQhmv8uqx1BVnKoe:aICGVF+5hCZhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039416, "uuid": "84196c02-8cd2-4b56-a9ea-b319f3a89f43", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039416, "uuid": "d02e181c-b316-40ea-8e34-02ed44f8666b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039416, "uuid": "8b78dd55-bb9e-47b8-8b5b-11ffd56dbdb8", "value": "f02da8c9695a813019e04a41ebc07caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55540c5-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712038687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038687, "uuid": "590413d3-f572-488e-840c-4e7cbc5ecb8e", "comment": "Malware payload (AgentTesla)", "value": "5a87e33f23583d17373333c0def72581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038687, "uuid": "2891fa44-a6cc-43b2-9b2e-25429837a397", "comment": "Malware payload (AgentTesla)", "value": "9deafcf231a2603f660970083c2661ea86eb470e0693537b68147b4c418d9534", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038687, "uuid": "bae527eb-fb97-4944-9ab8-bf2b1bb75f9c", "comment": "Malware payload (AgentTesla)", "value": "49f7aecffde3b3db715579fd35377ed12e8cad1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038687, "uuid": "530c378c-3a95-4aff-965c-8e1fa82002bf", "comment": "Malware payload (AgentTesla)", "value": "f676d8b41cd180e8ac3fb6297e33811990e21f8bbf48be6cea7e435c5cbcb5f5595ec197fc49de0004c34832fbd83e3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038687, "uuid": "ee5f2bde-77f8-46ed-9d57-e4b9637297df", "value": "T1C1E42318337C2A13EE7A84F3B57535678BF56A473DC0D2C82D8A20DB9AD6F844941E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038687, "uuid": "55cb24dd-7254-41fa-8da1-7c9395acca60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038687, "uuid": "169fd4c5-9134-4fa4-8ca6-e32fbd31c627", "value": "12288:w33bPzZRY31pXqLLw2130V1jXD9YEmFffPTGkjxyK+id6VfrJkR:I3LlRq1sJajXD98ffPnyFMiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038687, "uuid": "96f6de9b-46bc-4b90-b4aa-a87d45e7a06f", "value": 680456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038687, "uuid": "9ea9da7a-675c-428a-95ff-6d27a39f904d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038687, "uuid": "c4adad56-0e93-4383-9926-9246cb7d7ee9", "value": "FEB-MAR SOA 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d177634-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712047075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047075, "uuid": "23c497e2-ece0-4d3f-a246-bc82f9ddf05e", "comment": "Malware payload (AsyncRAT)", "value": "884939ef6ce29bd82add03e94a61abb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047075, "uuid": "6d363450-e24f-4a6f-8dc4-a26c6cb60301", "comment": "Malware payload (AsyncRAT)", "value": "9e5865fd21de52ffdfed7301c0542693d1a5a066c49dfb197ddce0acab589b7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047075, "uuid": "9247a84c-19b2-4fcf-9903-aa6a446a47eb", "comment": "Malware payload (AsyncRAT)", "value": "ae52176f4928a3bf19513bd95fc4251ba8db5d5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047075, "uuid": "9aea7d57-11da-40f4-84c0-ac539118e488", "comment": "Malware payload (AsyncRAT)", "value": "939d8caf0190c48de0348c465a4b6624300395831589d598776e7f5d786a861b8d7b5d77cffc9a77fc46a354fa1b8707", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047075, "uuid": "4e72b668-8473-4c59-89f8-0e8c0ca27884", "value": "T1CC94AE962F89095FF07EC97D9AF0D0235F2379B9789D862FCAE03DA71012A44C6CDA54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047075, "uuid": "85ee3cd1-dd95-4eba-81ef-c4d0c12fb0c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047075, "uuid": "06c870c4-6cf2-4780-b9b5-8222ed0429d6", "value": "12288:iXQhmNReC7nFPfkhkyDW7AUz29BbOy9Md:ighY57nyNUzcAMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047075, "uuid": "6a192a4c-81ac-4e0d-b937-79ee76453d0b", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047075, "uuid": "41e66b1d-420f-4a21-b9ed-48b363f7cc41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047075, "uuid": "77de361d-04a5-4ed8-a9f1-86b25da4e56e", "value": "884939ef6ce29bd82add03e94a61abb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6873fa48-f148-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712100378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100378, "uuid": "cacdff3a-38ae-4b82-9193-2ef0adf2673e", "comment": "Malware payload", "value": "197162d27c7179f7eba50c76ea07cfa2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100378, "uuid": "4ec680d9-3f50-4305-aa01-0c6a94119168", "comment": "Malware payload", "value": "9e85595b92f1f709d1cccff16da97f0bb0e8ff6664926da7e81ec12d05a7ebc7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100378, "uuid": "7aee0bc4-b4b4-424e-baca-d36172c0716d", "comment": "Malware payload", "value": "57b57081f69dad59960634a3cfd998d4d4e9ef83", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100378, "uuid": "c0b897f3-cd1e-4178-85fd-9b58484e4c0d", "comment": "Malware payload", "value": "73d4d70f764eff71e23b549e9a5a5d3ba368c839157b74797dbb78975b067a9242918aa5decc1c0745698af97b2510fb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100378, "uuid": "5cc80ec5-1163-48e3-a2cc-e7951f2c19be", "value": "T1AAA423602A7A045DCB1C0BEEC7DACA1E7B30A918CA8477AD836846C16D1D5DF16E1F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100378, "uuid": "0109c181-4c5a-40be-87e1-e5ee2b978168", "value": "12288:hMpiilUI5uWJN2t6HXuNM4psXlkJJ0gmkLpqw/:hMp7USJAN9sXlFgmkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712100378, "uuid": "fc91b474-2b9c-4fe7-bc49-d81949df9738", "value": 478241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712100378, "uuid": "a6ee7dbe-a315-4231-9f2f-b0dff00148b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100378, "uuid": "bfc87ae0-d53e-45f7-a19a-5e7312b0e5e2", "value": "Aimmy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aaf1e00-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712064358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064358, "uuid": "861c09a5-0a22-4e7d-a181-d7dd9452e2ec", "comment": "Malware payload (Formbook)", "value": "cc54a0d7c9fbdf633b6bd2f8613e179c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064358, "uuid": "9d5080a2-649e-4faf-8c7d-2c1685802f27", "comment": "Malware payload (Formbook)", "value": "9f586373713feb004b4bc48a2b41962933f4f4d0fd44dc2c9d402e3bfdfffef0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064358, "uuid": "5b9f2857-7d61-4975-94cd-91e0ac1a53f9", "comment": "Malware payload (Formbook)", "value": "721eec20349534de85d4feaef4fb32064aba11ee", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064358, "uuid": "9ef77d0b-0c36-4b58-a276-9ffd525094a3", "comment": "Malware payload (Formbook)", "value": "1b19d7bf672ca54b6eb3ac66e006104117341925012597b0f9279d5d426d1653e69808b5ce5a6863b8b295bd85583221", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064358, "uuid": "de2f0822-d7c9-4d7c-943f-18217adbee9b", "value": "T1EFC40167FF337D9A7D1441C24E1D1BCE6DD41CEE80A0CBE0629EB6A8311C5B6196DA2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064358, "uuid": "10c89348-dafb-4f3d-bcb5-573ba242efdb", "value": "12288:jfdS6w2qbNnbk1a7X4dLmoJH8Q1bg4qRYweoOKso:jpK70moJQ4iaouo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064358, "uuid": "6a398d82-d52d-4779-af19-2d2ca21f9ede", "value": 577503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064358, "uuid": "0a8cbd3e-d4da-44f9-afa4-4c902f163b55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064358, "uuid": "568fd1a3-4169-4d2c-98c6-800a28cb4da6", "value": "order enquiry PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a5a995-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064422, "uuid": "6ab7c7c2-ac36-48b4-a5d3-f6de04dc4a00", "comment": "Malware payload (AgentTesla)", "value": "6301d517450f3466697df1c18c4109f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064422, "uuid": "c8664dc6-760e-4237-9258-843ee7f082a3", "comment": "Malware payload (AgentTesla)", "value": "9f70d8532d4c8655671ecb52609c6ba9e8e34dc0b08cbb92ca795b59a9bdc862", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064422, "uuid": "e1f0cb75-c939-4f03-b2d1-1b688d0b3ede", "comment": "Malware payload (AgentTesla)", "value": "6700e5441f0458364917455e7fc5aaf50c3bc726", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064422, "uuid": "f60fc222-7fb8-44c1-8b68-74ea9206961f", "comment": "Malware payload (AgentTesla)", "value": "1b7b9c1484e8f7c2bc4f55679c21dcbb86d3bf8fc57f988bd19ac6219c1088f9bc43efc5758eb5d88ad09517610b48ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064422, "uuid": "51f3ea71-f799-4a1e-b975-0706eb54b44b", "value": "T18FF412847BB89917C2FB2BF1316506A06BF97447B934E7DA2C9000CD1EA2BA55A31773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064422, "uuid": "30d820b7-1311-4795-ba77-c7dbd6493697", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064422, "uuid": "a5f7cece-78ce-4f45-9012-8445bc637cb9", "value": "12288:KPGmMZciFaJxyWZNh9qs26vQkq4Jx5YonKCmQwVMmciHc893rQI5mmkR:KMDgxpZNh95xvJq4JZmQCMlccEbQIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064422, "uuid": "3ae2ab2e-b286-4c06-8ab7-5b29728ed6ea", "value": 775688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064422, "uuid": "2e681f57-1b2b-4e7c-a6eb-654677228329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064422, "uuid": "49c433e9-600c-43ec-89e7-26e32a6fa7ca", "value": "DHL Receipt_4901049985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e056e268-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Adwind)", "timestamp": 1712064502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064502, "uuid": "156f76dd-219e-48e9-a463-2a8b96e9af04", "comment": "Malware payload (Adwind)", "value": "259a657fece35d56141d9dffb42970fd", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064502, "uuid": "af92db4f-795f-40b8-8774-0b80125fb322", "comment": "Malware payload (Adwind)", "value": "a05701b074726b841c2a7566512d56bd097406b13fe6df5388969e5ba653107f", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064502, "uuid": "0924fe4b-9dec-47ac-8a1c-250a956ac72a", "comment": "Malware payload (Adwind)", "value": "c87c175d05d0cd2cfb712459fbd26c2fcb1e7434", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064502, "uuid": "59d2fa35-2c74-4812-8397-7aa497edfdbb", "comment": "Malware payload (Adwind)", "value": "b4f4c1fe1dae4569d6790540e5dd2aaaef4913fe33c0ad6bd8ae4e4d89f1d531de46340fc74311af8f4f3461d25355d0", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064502, "uuid": "3f24f14b-cdf6-4cee-9021-8ef23533fcec", "value": "T19B84120010473D58AE34356EDEE72D66E7A8EDCC05E35C9A891C7F4C23646B474ECEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064502, "uuid": "a06053c5-cb36-47ea-8d83-c2ecb95ce0d0", "value": "6144:4xl/ALV5+k+4tmr3HsXLHyv06vBu0ijHcbsBJjlfhcxP032QJwS9sjp7k:oGLV4kiczaH5uBxBJjk9032Q9qxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064502, "uuid": "7971b975-87f4-408a-84d8-8cd3a2f71b32", "value": 404969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064502, "uuid": "0598c0a1-345a-42f2-bd3d-f22ffa9ef3a8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064502, "uuid": "3294d613-32a5-4ce3-8710-a7cf8b04f02e", "value": "01.04.2024 - S\u0130PAR\u0130\u015e L\u0130STES\u0130-1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d7ce91-f08f-11ee-a120-42010a9c002e", "comment": "Malware payload (LimeRAT)", "timestamp": 1712021103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021103, "uuid": "b8357a2e-af88-443f-8e4a-ef5d0e2870d3", "comment": "Malware payload (LimeRAT)", "value": "ad997dc4ee32ab469e45009f218175d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021103, "uuid": "c094816f-e28a-44f3-a728-baa41945ebee", "comment": "Malware payload (LimeRAT)", "value": "a1f8bb5990775f277540eb4c7579695477445afd90262cb819567cc9b3042166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021103, "uuid": "86f5d185-cd73-4043-92ed-370061c9b506", "comment": "Malware payload (LimeRAT)", "value": "17ef145486c494ea9c727972c501471e720887f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021103, "uuid": "fdbc844c-ac99-4509-90d2-d2295a8c532f", "comment": "Malware payload (LimeRAT)", "value": "8505d8b63cdeae60cbf96ee5e1c3d44006fe52b5d8b3a598e72ab4d2d898eaa0e89ebf2d62f40620239ea9780d129ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021103, "uuid": "3a94b58d-6de0-4c65-bc35-a64de25c2ab6", "value": "T12364075916E7CE65C39C8BBD8006E590A3FA8D0796E2E30612D82CE77D223C9DB145F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021103, "uuid": "c4ca88ab-347e-4d8e-9abe-d778c67af480", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021103, "uuid": "72f963f5-b109-4d7b-87a3-6d6b8e8d0130", "value": "3072:oiPK9mkbyBaKJyPATmiyAnY5o9BrFV0bIBVvBCj4EKK4h75AQ5ii:oCj2yBOiW5o972jEh75F5ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712021103, "uuid": "5b5d3101-4d89-4656-91af-2fc179cc12ac", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712021103, "uuid": "0b326365-7563-4a5f-9773-acaed78222bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021103, "uuid": "c6923d16-5f0f-4a2f-bb17-24bec54ebb23", "value": "ad997dc4ee32ab469e45009f218175d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4882a823-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067253, "uuid": "60cdd65c-b102-4179-80c4-c315f5b3cb9a", "comment": "Malware payload (Mirai)", "value": "361e38fae83185966f6a7c30bb93ee24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067253, "uuid": "dce1f95f-c349-469a-a3a4-72d23312eccd", "comment": "Malware payload (Mirai)", "value": "a34dee803c84a62b62f27f0a388699d198cbe22f668075c2f78116d3c57e34d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067253, "uuid": "2076bb83-5618-45e5-8528-d86e0f71e752", "comment": "Malware payload (Mirai)", "value": "ec82d8ee421e0e59029708872b5432c87e8644fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067253, "uuid": "19012db9-4a31-4d15-9b43-418bd0297002", "comment": "Malware payload (Mirai)", "value": "e67e932f1bad366d680f084c16e34bc6d137750ed2ca87541893c6f41f8ae473edfc4acd1da985c8f7d11d4e3a50dc50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067253, "uuid": "97fbfd6b-2e30-440f-8362-cee468d32c39", "value": "T1C2632BC3F410DBBEF418D73B0C6749157271F2604E870A266BA77B5BE96A198092BFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067253, "uuid": "f13f81bc-8814-4a33-b64d-c1de07753343", "value": "1536:LC7eMetlZ8IqFfzQekacWVcW0JcWcBuVbgRAgLTcytLxGwLc9Iis/0:LiedNqtzQekacWVcW0JcWcBmbgRNXd8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067253, "uuid": "b90c4f3a-b88d-498b-bd90-13b194d46207", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067253, "uuid": "7e4e5550-f501-48c6-bd06-3acf9967a52c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067253, "uuid": "9929a0c2-680a-4e10-889c-6ea7130bafee", "value": "361e38fae83185966f6a7c30bb93ee24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91cf787-f08d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712020198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020198, "uuid": "8f455e40-7b45-4dcb-881c-990425efe3c2", "comment": "Malware payload", "value": "a3c6b7c5368e283aca0f659c263d4d7b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Ustawi Loan", "colour": "#481C91", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020198, "uuid": "522f1519-a8b7-459b-a9ba-37bc1dab7f83", "comment": "Malware payload", "value": "a3d08ad6a4700036f6ee914405ef81a648eccab978f78209c574616ebb28b991", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Ustawi Loan", "colour": "#481C91", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020198, "uuid": "0e531bbc-766c-4cd6-a980-a8036b943c7f", "comment": "Malware payload", "value": "196a72fb087b913bb650927b7eb6d45aae8483f5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Ustawi Loan", "colour": "#481C91", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020198, "uuid": "998605a7-e97f-467b-bbf1-51b057106d29", "comment": "Malware payload", "value": "1a226c552bf3bf566dc26c77b45f2d81c390924f3a429e23a5135ec6546ee31dfda2dbc57f01e0a4213d0e6c441565b6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Ustawi Loan", "colour": "#481C91", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020198, "uuid": "f7ca3296-0535-40b6-88e2-d16f9910f425", "value": "T1E0161256E32CA43FCCBB61B24EBA523212564D8A40936B536E48735C2D77BC49F5AFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020198, "uuid": "11a85a8f-902b-4964-80ec-fe87f9def791", "value": "98304:CnUT/ab7AqJF+ZanIpb56PwWtPKnZiiuEj5+TfZrmRrTLbcS:CUTs7AqL+uIt7WtCn5z1+TRrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712020198, "uuid": "fa90eca9-7600-4955-a646-40ee7a3f0e5c", "value": 4079841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712020198, "uuid": "aaee4dad-e6b6-4e69-b40d-14deb4302573", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020198, "uuid": "c591699a-9559-4f62-bd7c-86ccf5f636fc", "value": "com_tanz_ustawiloan_smooth_v1.3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e235beb-f10f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712075799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075799, "uuid": "69dac09b-72c3-415c-9015-d17a6ef9c221", "comment": "Malware payload", "value": "dd3a21af6b2a18d392e400554b7c664f", "object_relation": "md5", "Tag": [ { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075799, "uuid": "32eeaaae-549c-4c32-93ae-a49480ca2c9e", "comment": "Malware payload", "value": "a3defd63dafe752086d9265377d4fb2922cadecd58b1eb9c3b93352f8d214ffe", "object_relation": "sha256", "Tag": [ { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075799, "uuid": "1483858d-eb95-4654-8dee-6417d212571f", "comment": "Malware payload", "value": "c6eeb15a5dc192338cba9d5b20fc6473011c83a0", "object_relation": "sha1", "Tag": [ { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712075799, "uuid": "207ca76c-e120-4246-80d4-4df1eeb5e070", "comment": "Malware payload", "value": "8ee5f9848f926995df1ff7c374b3f3a343cbbbf84b058221728196e90f698f589099d41ab02943ca13edc0c809299a61", "object_relation": "sha3-384", "Tag": [ { "name": "legendsutopia.com", "colour": "#848D99", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712075799, "uuid": "739befeb-2e01-4183-9cd0-3593d948bc54", "value": "T193E733B03540E553C918A5FA625443F68A6C532AD5CBC30ECE697BAF0CA49D6831F36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712075799, "uuid": "8f282d45-35dd-4493-a121-83a147448eb0", "value": "1572864:2j8ka6PJFHFX5NBoeMvd8vaajhSisiZ2HL0RJ9:+vx7lJNLMV8vDhVsLr0RJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712075799, "uuid": "c948dc07-393f-4597-9dfb-5226143b5115", "value": 67804534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712075799, "uuid": "67833c9b-ce15-4c50-b4e6-10f34c4dadfb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712075799, "uuid": "b7499477-d369-4855-953b-1bcd9984015d", "value": "Legends_Utopia.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204b2e69-f0e4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712057308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057308, "uuid": "8525ac58-0be2-4533-845a-ef975a93b822", "comment": "Malware payload (AgentTesla)", "value": "d4d56922ab93963b2dcc26607deebfe0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057308, "uuid": "5474382c-a3f6-4313-b38f-24cb3c26af8f", "comment": "Malware payload (AgentTesla)", "value": "a4b1168f95a6e4fb04f2b53e4d71ed2f75c585a012a449226881b90c7e40c2c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057308, "uuid": "9a35b880-1aa5-4274-b39f-25d7ee4ed3fd", "comment": "Malware payload (AgentTesla)", "value": "c7949f179af79f489c850e0dae4e4ba69dd00fd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057308, "uuid": "6f6ea3c4-0441-4193-b906-a85fd778fe36", "comment": "Malware payload (AgentTesla)", "value": "6fbd86acb6bdd3535411ee274965215a42884032bec292033c37cedf46ddfc55ad82036f9423950087ee2d5c994d49bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057308, "uuid": "83924678-0e8f-45b3-a8c5-10e105f68c2a", "value": "T18CD422383258DB2BC5545BF9C501A0F023707F26D834E9135D897FDA7436B228A96FAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057308, "uuid": "645ab9c5-1d5a-48c7-a60a-83b239d88276", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057308, "uuid": "be725d26-decb-44d4-b018-0c526d68f312", "value": "12288:bZcRvke+CAT1cK7JxhVHYdNEa50hPNai2vbh2:bM85CAT1cIPmNEa5UPaTh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057308, "uuid": "7c2ee479-e9e9-40bf-9a68-4aac8760e5ac", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057308, "uuid": "b4a0b956-d869-43e6-a6b7-b06afb8ec1f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057308, "uuid": "bb417e54-fdc0-45c3-be68-7bcbed90f332", "value": "Halkbank,doc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2ec0b7-f110-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712076494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076494, "uuid": "e1719ccd-1836-4399-81c8-99ff9e5b7767", "comment": "Malware payload", "value": "cb8379341c6ad5e59e73cf941a70e111", "object_relation": "md5", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076494, "uuid": "52d63e54-507a-42a7-95dd-844ffd5b4d49", "comment": "Malware payload", "value": "a77d8f56b2180ead05f4025a6910ce57ba98b0f1a4b4ecd98ec28cf47b4d9073", "object_relation": "sha256", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076494, "uuid": "7d3c0e8d-09a0-4f2e-b2f3-4bc02ae2caa3", "comment": "Malware payload", "value": "3eadc7263d8878bcdfaf4d7191c29f557b5dfdc6", "object_relation": "sha1", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076494, "uuid": "e076d34f-ed84-415f-a4c9-24234ec59f99", "comment": "Malware payload", "value": "732f75ed8395edcd75ac6ce909999bfb39aaf713ea24eeb4b4d57d333803c7defac3e470db86c8a273c3e7024643033d", "object_relation": "sha3-384", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076494, "uuid": "ffc26e44-c0d5-4861-a69f-611453564674", "value": "T1C108338C21D69AE057DF7838D61743C86CF582023788B78A59ED09703DDEC5ABE14EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076494, "uuid": "cd142311-9739-4a6a-9a40-416ecf7bf776", "value": "1572864:8v/2Ef2njOtzCwF7u3siqiTR+9ARdHqosltmd7Jpf3aMUoqd:8KqkZhoqRdvsHq7zv9Uoqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712076494, "uuid": "76e2055b-4238-4e38-915f-e99be62c2ccd", "value": 84164615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712076494, "uuid": "c30694f6-cff4-46c0-8f93-0ccc8c004710", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076494, "uuid": "8e8d7ead-0a3d-45c6-805f-aa704f867796", "value": "Sky-Beta-Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ae0698-f108-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712072802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072802, "uuid": "f9e0e45f-84bc-4cb8-8ba4-0d98eb442942", "comment": "Malware payload (AgentTesla)", "value": "5dd06b0b09be366fbe36fdb9452d4248", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072802, "uuid": "38c41d52-421e-4abf-8dd4-0427265d3fc0", "comment": "Malware payload (AgentTesla)", "value": "a95cba32c2d3029b634632c11269f7d5577a733e6de541781949761cb599c6a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072802, "uuid": "3bac8199-7fd6-4716-9087-014e0f7c0f12", "comment": "Malware payload (AgentTesla)", "value": "48b090d104471c6bb04ed85ab6f4d801d60c0a46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072802, "uuid": "ce79fb45-ea23-44e6-ae31-e862d372b4bc", "comment": "Malware payload (AgentTesla)", "value": "7fc2bd0a42624b5169f6db20ba0b59673e3d8dd142d7a6a422a6f755ddb06ac1c4889a146102f377ddd658a9d52cd21a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072802, "uuid": "f3533562-acba-4af8-80c5-fe02c61a2f32", "value": "T18DD423D0920690F9C3E89F0376696BC28E2D4954C19FF38DE50A8CACA17C3E476A5FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072802, "uuid": "660b74e0-0a86-4812-bf78-7fa8e46a11b6", "value": "12288:RbnWuSQRiKX1scfOJNSbzNBa0cuSJQ7pifrhnkCaULb27Gko2XH:RG2mJWzfa0J8nkNUPt2XH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072802, "uuid": "bc70f690-551a-45a5-8237-3dc4caad16a1", "value": 613157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072802, "uuid": "752550b3-ae53-41a7-b83b-41a5665ec870", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072802, "uuid": "dd7b0145-9d74-49d5-9b5e-bf4eaf44d5a1", "value": "Request_For_ Quotation.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28729710-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067200, "uuid": "20b6a77a-3146-409a-bca3-efcf73a18342", "comment": "Malware payload (Mirai)", "value": "94fb7eec219bd8c2460745f5b0d87c3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067200, "uuid": "ea26827e-614d-4fc4-beb2-8dd3603f5017", "comment": "Malware payload (Mirai)", "value": "a98ad5da0d0479242549b5cd7062c1148bbca92ef6385e4ac7f3b6e03aa1cb52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067200, "uuid": "bec10ca0-62f8-47f9-8682-96ba38f1e781", "comment": "Malware payload (Mirai)", "value": "910af26a6a78c33624def9a859a55dfc38cc86d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067200, "uuid": "087daa7c-3afe-43dd-9a8c-868008327501", "comment": "Malware payload (Mirai)", "value": "fe2013efa47bc5d964b1436ed34093042564119f5d73c910f4bf3dd9a699341259a45d551dd09a6e58b7178e4fc1a82b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067200, "uuid": "ddf17f5f-e4d2-4d72-8c82-0d6a00c075d4", "value": "T171330744EB87E1F4DD0B4C7104A3B1BF83369A569025DEAEE7887917F933A329025F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067200, "uuid": "c51402b4-e5c9-430d-9eba-bb3f10eff861", "value": "1536:3ESIuYNrHXitK5duFaEfUy31A9nfB2qrk:3ESIuYNrHXi04FK9fkSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067200, "uuid": "7e38a22d-8bb1-469a-a950-05647037deea", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067200, "uuid": "3e48f447-3bd6-423c-889b-2e8bea986149", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067200, "uuid": "60d360c3-007c-41a2-b738-490c5600940a", "value": "94fb7eec219bd8c2460745f5b0d87c3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d270342-f0fc-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1712067610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067610, "uuid": "351f5931-8a91-49e8-b3f0-4c4d78ca15dc", "comment": "Malware payload (DBatLoader)", "value": "8b51f11a2076ebb18f86c0d15e3fedae", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "renamed-windows-files", "colour": "#8E9B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067610, "uuid": "35b868cf-9dd9-44a5-ba9e-068182b37195", "comment": "Malware payload (DBatLoader)", "value": "ade7084f86d0e5810c86701767f66f63c58aa0b9514ee3cedb1dc5d19f7478e3", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "renamed-windows-files", "colour": "#8E9B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067610, "uuid": "98fc547c-93a1-446e-9f1f-40f714ab6ab2", "comment": "Malware payload (DBatLoader)", "value": "d03def5e74ac3fb3e6d9a64ed0ef9399bc75673b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "renamed-windows-files", "colour": "#8E9B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067610, "uuid": "103b4122-611b-439e-a4c1-dd1a8584ab37", "comment": "Malware payload (DBatLoader)", "value": "ab0d2b019da37514826e72ed3beb94bff04218fef47f8e3fe37272416268eb32a5b7ef5b777f72829c58db9884060e3f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "certutil", "colour": "#887975", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "renamed-windows-files", "colour": "#8E9B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067610, "uuid": "0c70aaa3-6cd9-43ab-bf4b-c999b5e5f260", "value": "T1E3E52DE3EDBD2BC6230523BB7B4BF5040A27CC3A6A822D9411D625DAB11D71F2D50D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067610, "uuid": "ef676083-50a0-411e-96d7-a757639fbbad", "value": "24576:yn8Rm6aVrLy7bOkM75parJLzx60bCNB0PEsNl36h3vKYtKYKCgsX9t6HtzA6GC84:KomdNy7bOT5u9zgvpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067610, "uuid": "20c0ff8f-4530-4b26-8caa-5aacc7db51f6", "value": 3026925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067610, "uuid": "0d309638-41d8-4189-b7ce-14de47ce449d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067610, "uuid": "41f61df3-7050-4529-9c66-dbf42bbdc468", "value": "ref_00845-25-03-24.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865cf30c-f0ed-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712061344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061344, "uuid": "41e0897f-734d-4f0b-b72e-5029759cbbae", "comment": "Malware payload (Mirai)", "value": "04856d2cfb6da2db66a2362b16435325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061344, "uuid": "8faa2d81-5589-4369-b517-3b044147754e", "comment": "Malware payload (Mirai)", "value": "ae13f445be124ad68d8c06f01adf5ec8a35ed52c136c23d62573198e1576e2e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061344, "uuid": "1aa4db62-5886-470b-8c2e-c6adf2a85bd6", "comment": "Malware payload (Mirai)", "value": "2006d3812ed368ce5bf0ba04676f4ecd47c956ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061344, "uuid": "68a9be26-9e7e-478c-a981-e9e5ff8a657b", "comment": "Malware payload (Mirai)", "value": "a063598da2961c64a8e603dbd55f5a93b0dbf95f8a0d94691a9ec8341de45a0df98b2b2a5b460fabfd5cb58e28da4578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061344, "uuid": "f6ade459-87ca-45ed-bdf5-8a5ebf7a845f", "value": "T1FE04885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061344, "uuid": "7a146fbf-78a9-4f89-bf89-c6959615cf14", "value": "1536:Cl2JvnXPvLXQuchMJdDNsCK9H1R8cA2iQembSM+xV7TfF+hPyO0Hb/z3t/Y:Cgv/LcwZsCK9VRhAX+bShFSP0Hbb3lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712061344, "uuid": "eb82cb3c-9b7b-4ca8-8928-4d4f9874a8f3", "value": 173796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712061344, "uuid": "6516d75b-b26f-4263-ab08-d702eacd9ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061344, "uuid": "69e6072f-b9b7-41f0-895d-f7d035a883fd", "value": "04856d2cfb6da2db66a2362b16435325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc3edfa-f0aa-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712032664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712032664, "uuid": "f4951f97-a678-42e8-8ff2-36c5faa0e2d6", "comment": "Malware payload", "value": "7098e2467a9d9569b0a8054b2d9d3e96", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712032664, "uuid": "0797e040-a567-46a2-b0b2-50af160aae11", "comment": "Malware payload", "value": "ae9c335764e6a21a6e09be414e3e6e41753e877aba6a8597fca2d7ea182006db", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712032664, "uuid": "1e7d7ba2-c949-4acc-85d5-e79903d6ad02", "comment": "Malware payload", "value": "26d8c5faa6cb7c85989c97934925c343771e8171", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712032664, "uuid": "45205fd6-0ba8-49ac-816f-ac76287077da", "comment": "Malware payload", "value": "3b049447c4b2af039cf71c2e62aae2af75fa780156c71e7f0d2e27351770c62e099119f468a5e6c1e938dd4d46b83e11", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712032664, "uuid": "dabe3eb4-75af-40a4-a612-7eac24eb40df", "value": "T1DAD37BC07A949CCAEA11227E61E6D3352B3CF6E1C65747076A3077360E13FD12EE652A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712032664, "uuid": "fa583ac7-8f77-47df-b470-08b9ffb22089", "value": "46f0e900dfa7e915e36f6b82189c55c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712032664, "uuid": "7afc0838-3219-4796-97ab-b7a5d1e22d0e", "value": "3072:fNJbKIhzzk7ScLU2ExfqZguySlk6VFYmOtomdB:fvXzqNL/ExfkguRFydB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712032664, "uuid": "924a5e30-d17b-4a8f-a726-7e69f997b73d", "value": 139738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712032664, "uuid": "bfc095bc-98a9-43a2-95da-e5c32db644a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712032664, "uuid": "5bad5710-7b13-4f08-8603-07c01c6b8623", "value": "7098e2467a9d9569b0a8054b2d9d3e96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e50995-f12d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712088672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088672, "uuid": "617ce1a9-74a4-474f-9080-6d61a842a6f9", "comment": "Malware payload", "value": "94d71d66415166e8ca9d01f0de2f6422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088672, "uuid": "d3f02dac-27b1-4198-941b-33d39c76a2b5", "comment": "Malware payload", "value": "aff0f558c434e6f1926e5702d858dc4a33997ef37fc42b4121c167a0f2e94ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088672, "uuid": "aa7aa4dc-8664-4bda-a94f-b970b7840228", "comment": "Malware payload", "value": "c5dc1afe7fede3032b2cd376f0e9ed5a36fd5c5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712088672, "uuid": "e0b86dbc-1075-4017-b899-0134021987c0", "comment": "Malware payload", "value": "a311df3df7a5c6bb02394fedd523358974da8c365eb387950a8b016277230f70ca5b13af8daf5a0aa9619c2b7bf299f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088672, "uuid": "9db97167-05c8-4e26-8d51-f8ae37348d15", "value": "T1E53412D1E36B1446EC5F1C30B2E9C8561FFD538139B3C8F7749692288FE27861392962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088672, "uuid": "7d52e949-805f-4123-9253-b6e78ee6be53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088672, "uuid": "443cd3bb-82c2-4db5-8050-a251c10bea47", "value": "3072:YsAeBz6deFpZ1ef943/mvHk0wp03I0xps+Ca+zkOJ7UI7eTlFZ38e39mXJbac0jo:wT6Z1BmvZ20BaTXUzTPpkZbZ0j01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712088672, "uuid": "c997bac2-6eb2-430e-8823-b3e20a4c2335", "value": 250504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712088672, "uuid": "66120e0c-f821-4738-9c1e-d295b006e555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712088672, "uuid": "943466a1-64ba-4fa7-9b32-d1622a56a4cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25035a5-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712041634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041634, "uuid": "6b446f30-c980-4bdf-a890-80c25966c3fa", "comment": "Malware payload", "value": "63fe823ce6937dbca1113688ebfa22a7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041634, "uuid": "69de242f-9ae4-4586-8d5e-a57a2698d514", "comment": "Malware payload", "value": "b15c0ac85b2b03075bf76f86a6a99fee780c2fb546b984dcbe7eadcf846f689b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041634, "uuid": "c554d6d4-8db1-474c-9f97-5aef94746a2b", "comment": "Malware payload", "value": "e8e8b88ab249aba207b011055a3410d86b8d8e4f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041634, "uuid": "b2240e8d-1861-4b46-9a32-c416d3c94a64", "comment": "Malware payload", "value": "418783cb880dc54766f4ad0c0e41d3c43cba50188aebe287282ecc1c15dd53a7e733bd597f710c9681613d4bdb7c71f6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041634, "uuid": "eadbcaec-a2ba-474a-bd78-aa4665811c23", "value": "T1ECA2C0967BAAA8C5C15541764963FD7038757C342AF8822B2F50FBBFB939B382D44122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041634, "uuid": "f2fdbd54-f201-45b9-8e3b-39ee94d19f95", "value": "384:OZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUEBv:PCIqdH/k1ZVcT194jp4EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041634, "uuid": "47b62bd0-05a2-4d00-9ac6-0280b6348923", "value": 22138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041634, "uuid": "b2e8fdec-a70d-408d-a4bc-8d8bd5dbe522", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041634, "uuid": "6be9383e-5e53-454b-94d6-41e81a52ae9c", "value": "letter.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd84d97-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064387, "uuid": "d1a50dae-b2ee-4d47-9938-aec3897bc473", "comment": "Malware payload (AgentTesla)", "value": "0002807e4db1898c642425b23eb4b91e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064387, "uuid": "0a4ff2e4-a577-4bd8-b7f1-916e20550fd7", "comment": "Malware payload (AgentTesla)", "value": "b3c805ec1cb67e970c0624e55676f7f0cdf026be3ecb6d1fada78f3fb64a2807", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064387, "uuid": "313e2ba7-6817-4f28-968b-ab98b38007fa", "comment": "Malware payload (AgentTesla)", "value": "403a28086c886ce45d6bfe3e2211be70a01b7466", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064387, "uuid": "01e0b31c-72f3-40a7-bee8-98f51b4ca4dd", "comment": "Malware payload (AgentTesla)", "value": "87e34c558257a1cd41ac1c3ba780342d7aa6a466b7cdad430a8857dfdddf0bebb5e48bdc2a8fb7b106253342eedc35cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064387, "uuid": "17216eca-81eb-4960-ba1f-881ff5301120", "value": "T181723D8F75030BA8DD332B655D8A0946C4F44B26E53254E0BEB593CD79039F6B33568E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064387, "uuid": "793383c4-691e-49cc-852e-2f9391fc5013", "value": "384:dGrsVirZ3H5ZHKQfHNjviIg4xzqHzjGiAU/fqg:dzVirZ3HLlfH9KIg4xzqnZfqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064387, "uuid": "be03c039-6837-4d7a-a00c-354d90805e15", "value": 16554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064387, "uuid": "e5615588-e042-4a6b-9b95-5eac061d9bab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064387, "uuid": "4bf0b207-4b04-48c5-bb43-e837466427b3", "value": "Payroll Authorization pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbd65c3-f11f-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712082647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082647, "uuid": "f357a145-3e09-42dc-a3fd-6a51bbd6b54e", "comment": "Malware payload (Formbook)", "value": "6e50d99a87832e28f61088eb38c5c69d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082647, "uuid": "db0fc6b2-46b1-4f19-8bf2-3e7301111b3b", "comment": "Malware payload (Formbook)", "value": "b40a76ca3b6098ed3e3c862442012dded937ee4c987d6fcb3e955bcbf36089da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082647, "uuid": "7bef4d9f-edda-42ce-a25b-c1135b8cf793", "comment": "Malware payload (Formbook)", "value": "7926a4ed4776d29efc7bd0246790e0ac37cf94ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082647, "uuid": "364aca83-a707-468b-ba7c-154e772dd9e6", "comment": "Malware payload (Formbook)", "value": "f31e6e19fcb6f211a3be818a23cee6c9a494e3824e908b7b6a744f9242d388834d5f30dcfc54fcc3e894dd4afb13c025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082647, "uuid": "84022eed-5e59-4a76-b6c2-f9087ad36dc7", "value": "T18AB51217F65744B2DF85377AC6DE65049BA0C580A28BDB8A388F53EA7C437BA9C41703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082647, "uuid": "c054b067-c74d-4b06-bde0-bdbe98626e2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082647, "uuid": "a3bb28c7-555d-4e0c-8c2b-e5fe60e16f33", "value": "49152:bW2HTozbt5c1WuYAvNVFUSazGy5QbjW1gXp0sA6YM:bLHMzbt5ckuYcFnazFMWUY6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082647, "uuid": "e427f0de-de30-487a-8d96-ea5d1a84197e", "value": 2486784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082647, "uuid": "8b5bd4d9-8f8c-4a7f-be2a-37a267bbef7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082647, "uuid": "61846225-9bda-4ee5-9415-2b71dfaece83", "value": "PO OAU_APRQTRFA00541\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa681e38-f140-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1712097053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712097053, "uuid": "08e39262-006e-488f-a9dc-a05576ae2c74", "comment": "Malware payload (GCleaner)", "value": "d28d4aa46be0cf143e5184703075b55b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712097053, "uuid": "9637e00d-84b4-466e-bc46-36d2582fb651", "comment": "Malware payload (GCleaner)", "value": "b57ce96ac5335440e14b952c52ce9df916b073825f0dbbdd24159c9a2d82e282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712097053, "uuid": "1e5bd1e9-6413-43d5-b35a-594c3f2a117b", "comment": "Malware payload (GCleaner)", "value": "a01e37f2390cb0707670609d928693b107982dc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712097053, "uuid": "0b760c9c-e100-4e25-a99a-b55aa8216f2b", "comment": "Malware payload (GCleaner)", "value": "1b1603d2cf070163f48245244d300c79d92513482a2ec134e03f2e1a9bf3062fe21e72551c215a4aba29dfd2abfc8d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712097053, "uuid": "34da6ee0-4663-4a2b-8298-773d1ac8e8ca", "value": "T1F864C016B3E1E832C5521430CD39CAE51B7EFC716E7596877BA43A3F2DB12D08A26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712097053, "uuid": "31cd6774-b4ff-4a32-aaab-83337e83e919", "value": "84fe06240982f1bd102fcac07fa31539", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712097053, "uuid": "1721eaaf-ffb8-410e-b3c2-130a5d667d08", "value": "6144:s3qOru3eMg0RqMZmOpV6SVgNCfVF8UQzd3SIf34XVe:JOUeMguqMZXpIwgNCcUQ3toV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712097053, "uuid": "9f7e9a50-e852-4883-b6b1-ae7b33cb1a96", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712097053, "uuid": "dcde06c8-2a89-4acd-8beb-18b793d5877c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712097053, "uuid": "089cb84b-fbda-47e4-a143-30077468f5bf", "value": "SecuriteInfo.com.Win32.BootkitX-gen.15828.15251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9450147d-f116-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712078977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078977, "uuid": "3fd67787-e358-49bb-b934-ed8d15adb9fc", "comment": "Malware payload", "value": "49277fdae29b778f4c78f4c16f5e0724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaSentinel", "colour": "#8C2A17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078977, "uuid": "c2180212-9237-435b-96a4-5c8863e17f6b", "comment": "Malware payload", "value": "b591c598018c7460e5d968e525acca75b348513c82efb99087baad773bfdff81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaSentinel", "colour": "#8C2A17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078977, "uuid": "15f41888-b450-423a-a0e3-4e3c3dd117dd", "comment": "Malware payload", "value": "a6dc29595217ccf86853a73caa32080c144b4c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaSentinel", "colour": "#8C2A17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078977, "uuid": "48b0dec3-a9de-48f7-84e4-e37b134ea047", "comment": "Malware payload", "value": "b60d1870fb68f30a46b6496850b0ae9061edf71513998ce458556e5998ca0dbaf0c056f103b8b6efa4b68ffab82edce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NovaSentinel", "colour": "#8C2A17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078977, "uuid": "6753b6ad-f43c-4b76-b8d2-d1d1ca4005e6", "value": "T17C18331AFE2F8984FA6D57A7C00688BA9636328B970D45527C6F0F070A31D295DDCFC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078977, "uuid": "01ce1507-c172-4910-83ec-cc73c90ac875", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078977, "uuid": "7a378fc5-612f-4c08-99dd-170d20de7ffd", "value": "1572864:t/WHHr9tr6pMMu1b8ifFpzjz3u5T6XFzWgrOGr5B3AJguO8h7CL7:t/8L9F6pvu1Bpzv34SFzWg9PhuOM7CL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712078977, "uuid": "3d383545-a6bf-4734-bb19-5172bcc97c0d", "value": 85447003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712078977, "uuid": "73660ca0-410f-4664-abd9-fee07946be45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078977, "uuid": "8373479c-70bd-4893-ae61-fe1ad0a81074", "value": "TeaiGames.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa6e2a2-f0e4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712057333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057333, "uuid": "13a93f76-f369-4bad-be91-e2b8c31655c8", "comment": "Malware payload (AgentTesla)", "value": "3f2cc517fab42ab25d6412924164f3fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057333, "uuid": "6b31858c-639d-4d07-b4fd-00b0f87004fb", "comment": "Malware payload (AgentTesla)", "value": "b6dba460089aaa0238c7dbc76f7a128636ff446685752ccea4475cdd81895960", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057333, "uuid": "d41cb7c1-72a8-44eb-a092-829d129490ad", "comment": "Malware payload (AgentTesla)", "value": "2bd293196b45174d6c4b3402912eb89763c5479c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057333, "uuid": "5a0a3011-dace-4ec4-86b1-b1255f83dcdc", "comment": "Malware payload (AgentTesla)", "value": "13fe2fc9ba5bdef891e070714d210e460c9b613f2d4969e9776e945e22fe0242cc6a7f60b127be19982b76fba64bfd78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057333, "uuid": "3796e1f3-daa1-45d5-9926-d25e31ff4e1e", "value": "T1C1D4236E0CBCB5543DF23D7CE2884039CA148B13D198DEB8655EA4CD8EF26526D48FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057333, "uuid": "152748c8-264e-4079-a3a5-cf69a239ad35", "value": "12288:8WvWle943lsMlkOao4etI4V4Nm1noNLeqpKQKHEtPabma:wlw0ite1MyOGTKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057333, "uuid": "e56f7652-207b-4957-8bb1-7043b5c3f404", "value": 623840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057333, "uuid": "c8e7d27c-153f-433d-8070-bd01d7bd7275", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057333, "uuid": "189bc5c0-d319-4a20-a902-0e97e6990de2", "value": "payment copy.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958e972a-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712038606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038606, "uuid": "e4670a2c-ca10-4589-839a-0c69e7d727d0", "comment": "Malware payload (Mirai)", "value": "836005be5664f74e053c2576364f8795", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038606, "uuid": "49b2d7dd-61b5-4666-b3b9-b01151955857", "comment": "Malware payload (Mirai)", "value": "b7037662ce5f539cf4f0a7e435d1b74565d0d4a498f19af5d357fb36d7cb61f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038606, "uuid": "dc327352-1e3e-4fce-8715-fd074d4eb258", "comment": "Malware payload (Mirai)", "value": "1a4407a96c491b181e9d49ca70c5046cd16b4912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038606, "uuid": "70acc0e1-2f04-4d63-bbb8-52507797fe7a", "comment": "Malware payload (Mirai)", "value": "485e0d133a482508eb0ba684b85dbfbbdd8ff8bc190fc3db1374793a7d87e5287eb5d0b3c4fdfdc63ad134e3e1a311f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038606, "uuid": "5a880374-928d-4244-912f-a709d24a88b6", "value": "T197C2D0A53014B415C3B0093EFFADC7923BAA05B4C1F83561066012BD9E869D765FEB8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038606, "uuid": "a93ea8b0-da02-4b41-ba54-f38445c7a7ff", "value": "768:GRSa8ZS/L6rze3OXu8V84kehEOEqH0Gs3UozYN:oSjFJX/+4khoIzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038606, "uuid": "9415b127-6014-43eb-84b4-b2b9f1dbf730", "value": 26292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038606, "uuid": "f412c273-70ca-45cc-9000-7575c19b0d15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038606, "uuid": "a5b8faa7-e875-4b09-8305-2a9b2abd36d1", "value": "836005be5664f74e053c2576364f8795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1be7039-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064450, "uuid": "6e22d841-49de-4f29-b766-1a6712e6824c", "comment": "Malware payload (AgentTesla)", "value": "d68d414e373080de951c095002ab6ebc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064450, "uuid": "4eecc49d-5976-4667-92ed-80c4cb533379", "comment": "Malware payload (AgentTesla)", "value": "b7661d817db31a91f0d502ca0adc46267774d7ea33808dfc6f8938d1ecb1a466", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064450, "uuid": "a6a4f452-5bec-4aa0-a858-c8a15b45d32c", "comment": "Malware payload (AgentTesla)", "value": "e817fbd363fd11129944b1b780d25f09752895f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064450, "uuid": "c4a60df0-6826-42f7-a9a3-391ceedb5466", "comment": "Malware payload (AgentTesla)", "value": "b408d4758415474a3a9e8398fa3f889e79c52529b6ab4db445f59e418c047560b65126f1193ac68fac3e687c6d35b73d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064450, "uuid": "18d558f8-0180-4290-95a7-3f8c71a94de5", "value": "T1F2F4125473BC861BD7FE7AB12A3814006BB2B682B435D7CD2D9440CC69E6F814A61FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064450, "uuid": "15a73821-481c-4bd1-83cb-11974b87a2f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064450, "uuid": "1978658c-1259-4558-a59d-c4eb40c0ba4b", "value": "12288:vPGmMZcraWX5BvlZ2tDW8wYCRTHYWqTUgIVSZxurA2ubzL24DEileNBqU48dJalo:vMm95BvlstiPRTHXgPkrAfzSMxejqUd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064450, "uuid": "00759027-c78a-4a57-b8c0-b45a6bd43a50", "value": 776712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064450, "uuid": "11cb7c52-6d18-4330-98f2-4583860e7336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064450, "uuid": "7125e6db-3b59-4bb3-89f0-cd9e6432d54d", "value": "DHL Tracking 02.04.2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a30636-f11e-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1712082257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082257, "uuid": "32d39eec-02ac-455c-baa6-5bf2accb6396", "comment": "Malware payload (Amadey)", "value": "505a95d9f55a23d8a9eb74bd4c1dacd4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082257, "uuid": "2f059d38-4903-41dd-a109-43075ccc283f", "comment": "Malware payload (Amadey)", "value": "b78cedb8b9f43c2e31e431e5e3f24ea2ec6f58678a2c417b8ac5f65b403f15c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082257, "uuid": "7e78db1a-643a-4220-a5b5-ec304ce17f5d", "comment": "Malware payload (Amadey)", "value": "538fdc3bb6d7a65530b7d6bf18a92908d3b4fc1f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082257, "uuid": "0c010d0b-fdfe-49da-a5ec-ae82cf6ea4b8", "comment": "Malware payload (Amadey)", "value": "1037c0e7d579aacd6919e0e53af00ffa2d74835d3912ab01ad4411f0cc00c2ff42bae99e541570b912d908838d25300e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082257, "uuid": "d0d1fb05-b0b8-4d55-88e8-f290ba1e5ef2", "value": "T1599533CDECCA64B1CA4B5333488B53A0666C5E1873DC8B547C5C52BC64EBB05BAE0F98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082257, "uuid": "90e1dd83-87c1-4e48-8590-8c885e872ed3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082257, "uuid": "f954bc4d-c2ac-4523-99e2-e9a6e0a4eb8a", "value": "49152:yDeaImQt22rYhJZdRYwo/242jZXxWge4vMEZ1W:uIms2qYhlRYjevjZIgxvMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082257, "uuid": "3231ec8a-35a4-4746-9d5c-6e78e4b51112", "value": 1893376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082257, "uuid": "55ae35b3-7270-4784-9386-41283c1d7a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082257, "uuid": "ab012e4c-2a8a-4acf-a396-54c03714f624", "value": "505a95d9f55a23d8a9eb74bd4c1dacd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9edd50-f118-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712079852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079852, "uuid": "3d96bf60-2288-464d-866e-af59f9984687", "comment": "Malware payload (RiseProStealer)", "value": "f29bb9918f3803046c2bab24c20b458d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079852, "uuid": "3c2d213e-391d-41fd-a9d6-d719096fa7c1", "comment": "Malware payload (RiseProStealer)", "value": "b84760ded0544c86d23849130082b99c3000b1e4ca5da0690fcdfbf2771b7993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079852, "uuid": "de357f4e-864c-4f46-85a7-1ba730186629", "comment": "Malware payload (RiseProStealer)", "value": "c162f42333a6a7ef23ea9fc17e470daece374b6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712079852, "uuid": "99a1bd56-503c-4c79-b7ac-bfb78bc71704", "comment": "Malware payload (RiseProStealer)", "value": "6ed5e2e1c08afc3fa9d207f158980ebd4ffae809ce12bc47b8c13dab16be4ee3ccb0fee679e8d21e2e6c648657555b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079852, "uuid": "703a0888-9c06-4318-b813-64f36d661963", "value": "T18E05126076E0C071F9B74431AB78C1954637BDA2A7B5A08BBA94231F3E707C08E3D766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079852, "uuid": "e5534cdc-29c3-4d4c-b218-aaab2e498fbc", "value": "eb67be19b81b44ee5931ef078192d536", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079852, "uuid": "b9e15e8f-c568-44a9-a272-bc666bd97b21", "value": "24576:OYHymN8tZiUqGvCBSYcjOaTKsB5Oih4un0:OYRNyZiUqwCgYWHhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712079852, "uuid": "f416278a-68f1-423f-8571-63bf493fd9a8", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712079852, "uuid": "98bd12b0-1176-4d62-aa27-27efb67aab00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712079852, "uuid": "1b2f8b47-e2be-428b-8f45-31332c101662", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ed6b23-f11c-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1712081664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081664, "uuid": "a386daff-b655-4feb-88cf-3ffabe5fda06", "comment": "Malware payload (GCleaner)", "value": "e5b185c02ef1aa5361ba6fb910758288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081664, "uuid": "7fef19b9-af14-4a8d-b82f-df2851f45ad2", "comment": "Malware payload (GCleaner)", "value": "b85e0613ef25472f1001e21c2cc4c80ccb133477751927cd9d885a6e2d5661f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081664, "uuid": "c8724be1-eb66-42a5-a4a4-adb48910e4d1", "comment": "Malware payload (GCleaner)", "value": "11b1c3187fbafbad7854c13db5eb476d31e58f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081664, "uuid": "6da33f76-8af4-4246-84a6-f305effd3d47", "comment": "Malware payload (GCleaner)", "value": "19b3f86ec377bce99a76eee016650be3fbb78cd90c44032b57e6de459593f8dfaa5a2c03a484d328ceeeafd37d7e5402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081664, "uuid": "59269685-43ee-4565-b172-15d5c41d4e69", "value": "T13454BF12B6E5C470E7F3463248749951063FFCAB9BB58A6F3394278F6D711C09A227A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081664, "uuid": "a004ba00-adc9-46b2-b41b-b5938db87e10", "value": "ed6f0fda63fdd551e8ccced55764b87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081664, "uuid": "2b126cb8-cfa2-4e18-9102-f1dd15d030d3", "value": "3072:Ci7IQBzxfISVl5RVEi6M+nbkaWIn0l7Ijw8RgHT7QQvecbOuXtTAb+IrChgrqm0s:Cizhxf/msEkzl0jQT3veunAb+yfjATw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081664, "uuid": "06b605e7-0eb7-4251-8ee6-8ebf5a8a31a9", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081664, "uuid": "3672ee50-bb28-43aa-9eab-6fa226c1712a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081664, "uuid": "51dd58b7-c8da-432f-a752-546ece2962f7", "value": "e5b185c02ef1aa5361ba6fb910758288.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86d0c29-f149-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1712100915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100915, "uuid": "fac1dc0a-a689-4907-b55f-38827867c3b3", "comment": "Malware payload (njrat)", "value": "97be7a8f10abee2f8595f2d91fabf2e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100915, "uuid": "483bfa23-1183-4a12-8410-4da28d206426", "comment": "Malware payload (njrat)", "value": "b92b3f06aef438a10c85773880193efba902c385693454b655002688dadd271d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100915, "uuid": "613e5ba9-e648-4b05-8b35-a068ee0e508f", "comment": "Malware payload (njrat)", "value": "2ab1c47a7164ac14c4ac94ba3344f77f6507b4d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712100915, "uuid": "9b25a71c-6306-4143-9675-50006aba2953", "comment": "Malware payload (njrat)", "value": "0b185a7701cac058d55d2f6d4dd9fa126f2c256317f130bf4a9fac7f86f55266ff60f02d3658db4356d64db76bfd4786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100915, "uuid": "e31a9220-49dd-4265-abda-e6cbe170f0ed", "value": "T177B30D387D952133C67AC1F689E50A8BEB69223F3191E8ED4CA752C418B2F156EC1D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100915, "uuid": "333a0754-d7ed-4276-a1ef-6eec85234791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100915, "uuid": "19334c95-6eff-437a-8ed0-b795b5ddbd63", "value": "1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMD:P5eznsjsguGDFqGZ2rD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712100915, "uuid": "66e2a7ef-8059-4a12-931b-55b5d178e4c0", "value": 115424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712100915, "uuid": "260cd4bd-0785-4bf8-8d1b-d11eb0abda7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712100915, "uuid": "c3e3d3f0-751c-46b0-8ddc-8a224a02b07a", "value": "97BE7A8F10ABEE2F8595F2D91FABF2E5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47231a57-f0e2-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712056514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712056514, "uuid": "f6c9556a-ef9a-41c9-b390-16055c32db05", "comment": "Malware payload (AsyncRAT)", "value": "5f7e0d25b165b9afcc3e6ca2bb135a47", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712056514, "uuid": "a732bd98-c354-4ee4-aaa0-baca0606b329", "comment": "Malware payload (AsyncRAT)", "value": "b94bb64c9f1e39f900c095b2034d3302a2a1cfeca08096ac71ecd24b5a25c61d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712056514, "uuid": "b9e86e2e-4ab8-4d5f-b2eb-e391eecae613", "comment": "Malware payload (AsyncRAT)", "value": "72cbc2583a2dd5078a0edb83b153f38fb5ddb085", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712056514, "uuid": "97f7f572-15a0-4df2-bc0e-933585eb19ae", "comment": "Malware payload (AsyncRAT)", "value": "58848c968cc2c8dfa1462f30b6d7c3d7cecaf4172b7463372c59d66919428fc70ffbfb6c44a454f188d20da98599b625", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712056514, "uuid": "8a9cc97c-425c-44bb-9edc-e40446e608b2", "value": "T164B63350E86DA862C72656F6DBF62D11853DC1ED1A0192FB470FF2603A0829F1ECB57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712056514, "uuid": "2ed7d355-d3c9-497a-9d9b-729992dc2c1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712056514, "uuid": "14bc2537-e22c-4989-a4f5-12315ad6db4b", "value": "196608:BVE0qzgg7MlG6g4kpQbjHqsQLTJeriQAu8VAbC7EzpIjtoTSam0nuYaf:BV5qz7J6gKbjq1d4iFuE+CQzpI2+l0nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712056514, "uuid": "78c7f20f-1c39-47a8-b6d6-561290e163da", "value": 11058688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712056514, "uuid": "5e2d61d4-82f8-4de7-be35-e59f925e3ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712056514, "uuid": "b3f3eb8d-b98d-40f0-b608-3b41fea6b5dd", "value": "5f7e0d25b165b9afcc3e6ca2bb135a47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8350f6d2-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712047166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047166, "uuid": "5640627a-b4f3-4d20-8b7e-a938f1f397fb", "comment": "Malware payload (Formbook)", "value": "6b47add2cf208a988c57c8f00461de0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047166, "uuid": "ab10386b-3f30-49f3-b672-431bfbccc598", "comment": "Malware payload (Formbook)", "value": "b9503635ef25a584476f71aa4a010b3978ee04e8a956e810b71b05bbef32bb07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047166, "uuid": "68314a9c-fe3e-4fe6-be93-b4014f5ab63b", "comment": "Malware payload (Formbook)", "value": "cf9518f4bd3cf94ab7225423e4365f4a262a9c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047166, "uuid": "1a964a73-39f9-4e33-8ef6-c96ca502014e", "comment": "Malware payload (Formbook)", "value": "8ad50aaeebd0e76f52e83a71e77f0e61bcbf389ddf1031cd22004743ac352c971ed05fd6c4ea9c4f772ac5890ad3ed7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047166, "uuid": "6b08c77c-0e4d-4f8e-b9c6-370839d0b851", "value": "T118762281AE7CEC75FAC8C4B8E484B351E2507E727CCAB136D4163F65A1FBC178889625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047166, "uuid": "d62a9aac-f96f-493c-bf39-85abc8a3df6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047166, "uuid": "1ecc9dc4-76a5-4bc0-a622-4606e2228f74", "value": "196608:oA+bmZgkjTKD4C4+e4YcJE4AcnPmP99j+zE/k:oAEGZjTvC4EtAcPmPJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047166, "uuid": "bced74f6-2788-42d3-9715-4f5b3e3ac3d2", "value": 7373824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047166, "uuid": "c54f4d5c-b1b1-405d-b010-b25ec097a62a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047166, "uuid": "294cce9e-361b-4534-b494-44b17edb0b4d", "value": "xSpoofer-new.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ad0f47-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712064350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064350, "uuid": "2137e609-79ab-4acf-85e2-6dcbe9e633cd", "comment": "Malware payload (GuLoader)", "value": "fdb23b9891221973396d47e3ebc1c8d3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064350, "uuid": "52a6e010-8165-44d2-9d2c-e095ce73b307", "comment": "Malware payload (GuLoader)", "value": "ba50c76372eb23a331f6fd3cb225340caf18e39f787d8981ac7fd09666cd2729", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064350, "uuid": "01b0b213-6e31-414a-a8e2-572fd23502d9", "comment": "Malware payload (GuLoader)", "value": "11330b2739fd63472743766974ad11f58babeeed", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064350, "uuid": "24e0cf22-7c4e-4820-a91a-1919f8f46651", "comment": "Malware payload (GuLoader)", "value": "c55813b6f6e1d9224401abfd6bad2c04f949dddf47ffb641dfaff849c5c624168606883d7b0319e133f5484845464742", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064350, "uuid": "cd182643-a482-411a-aecc-cc5636f90020", "value": "T1743439F0CF0936585F4F3F9AEC2445928AF89185152728B5BED8079CB242D6CE3FDA49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064350, "uuid": "6d164125-19cc-4f20-a1a5-8c6f3cd286c5", "value": "6144:ftIHlcRV3NJEpie4UVXBgykbaMhiK8Gttj7aTW1hAFbZolxvVe++SQBwu3/KHI:fOiAElz/ZMaVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064350, "uuid": "12f5c87e-2a17-465a-bfb1-68c857c45104", "value": 249826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064350, "uuid": "28e1ab69-37e7-42de-9ae2-c9f9c706c005", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064350, "uuid": "65224f35-1876-4570-80cd-63e60e395227", "value": "March 03-31-2024 statement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7981d7dd-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712038989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038989, "uuid": "f2ea0352-a23b-4e5c-a6ca-5f1d4b24b013", "comment": "Malware payload", "value": "0b1ac4c83cf37b0f0239ad2d654897c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038989, "uuid": "32e344bb-5681-4ac7-a351-e7cad8467c2e", "comment": "Malware payload", "value": "bc7bff92083aa08bbae6a3eb5dba60cdc0812fc9beaa17ceab9edd5859799ab3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038989, "uuid": "42574a13-16bb-4901-8f9a-146b899e4ef8", "comment": "Malware payload", "value": "c04e8f02afea746932eb64e7738e9958f48e888b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038989, "uuid": "40c1fdfd-5e2c-415e-92a9-6e31f7820f38", "comment": "Malware payload", "value": "122dd65bccce431811273934522b9964fe5dfd530d637ee1e5867949b8dd495da2e5ef6d93a11d65198a476cefb7ebd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038989, "uuid": "9680919f-b2e9-4a8c-ab6f-92a5ca5074f3", "value": "T121235BD9DD21E4B6FC2501B01122EB859E75E4B27832D957D3A33E38F471991EA0239F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038989, "uuid": "9ddfe3ee-9b03-4681-94e3-1cb3530ec2b4", "value": "768:E0XqthhepUyS7ZEYs74SmTAOef7xPQdtqFV/sMo:E0XmhhepU7O/49ef7x4dtIsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038989, "uuid": "33276416-e8fd-42a7-b465-d954e49c3653", "value": 46020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038989, "uuid": "56cca24e-7002-48bc-bdde-e6c656261d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038989, "uuid": "11566901-b7c6-43af-b1e4-4fb0d5a72af3", "value": "0b1ac4c83cf37b0f0239ad2d654897c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a5951c-f0fa-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1712067029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067029, "uuid": "3b0b0325-12e4-4406-bae8-56e94f0944c4", "comment": "Malware payload (NetSupport)", "value": "9809da8666f5d5e0c76cd52d197b0716", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067029, "uuid": "7b8fedcb-b5dd-4637-94dc-996f4a6983d1", "comment": "Malware payload (NetSupport)", "value": "bcdfe3693c83f9bfe85d5c570cba36e73bdfa5376eec451f8481f0908d2c586c", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067029, "uuid": "9dbace60-e4b8-41d5-9cd5-c2a8e49894bd", "comment": "Malware payload (NetSupport)", "value": "49c43e1178f3bf028b8b293c4888da5138520e09", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067029, "uuid": "48770592-ef9d-4ab4-9ff6-33296abb2d73", "comment": "Malware payload (NetSupport)", "value": "d540c75ca17e0d7a0cb6989576d4266ed78831719b0397486574b2c30f9f7d156e45362af416c0b71998ac529b42d0ac", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067029, "uuid": "3aa355e9-3f91-4892-9048-d8aa087fa9d0", "value": "T16AE533064B6547E3F13790EC51252F2340A4927C32BCB43775792AE3BCBBB71965BA88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067029, "uuid": "5c7a9d0e-828b-4183-abb0-7001428f2bd4", "value": "49152:Bn6J3WM202p5GutgAJuIxyxWqxbwOA4KXJBPic4VNQqFLbCNu/Se6ph5PWZ5FvcH:Z89i7JDmWKwOA4qJtVqFLCu/L6BP+UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067029, "uuid": "f7503c8f-f9f3-4ae6-9fd3-b0a3db5752a8", "value": 3100754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067029, "uuid": "7df1b434-f7d7-4fa0-86d2-2ec048125208", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067029, "uuid": "cecc9274-2b9c-4c61-a1a4-884d3e2c9374", "value": "WWW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50224581-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712047080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047080, "uuid": "a0c2b5d1-d4dc-496c-81c1-80566aa303c8", "comment": "Malware payload (Gafgyt)", "value": "adaa456b9a663b3325911e56f0b070bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047080, "uuid": "476cbcf7-a676-4242-8117-29c99a1853f5", "comment": "Malware payload (Gafgyt)", "value": "bd2bbdbf691c049aef5b01531342fabf0587b94cdfe439f54581f9e0613c5746", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047080, "uuid": "036661c4-dfcc-42b8-9438-08d7ffc7dea4", "comment": "Malware payload (Gafgyt)", "value": "a3d0986df9924d2a6f8522f404d007fc7c41206b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047080, "uuid": "892c9cb4-193f-414b-b7c8-b2129311511d", "comment": "Malware payload (Gafgyt)", "value": "e1073c9464b0b157717250f48333be3fc1adc9f995f1ae20f2fa3a3cc55434f44fbe6f21c1254c46c57a2ff3172b2912", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047080, "uuid": "6743c2c0-9576-4ea6-81a5-3df2ace4b8e4", "value": "T140E31814F801476BC2D323F6A65D879D3F3517E623DB33115A38ADB02FC2B992D299A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047080, "uuid": "4ebabb00-ea0f-4868-b922-863a4cc316a4", "value": "3072:Oh8pDxLxO0PXW8/2lMq9/5hhke+84+mzZQQAhtRq6AAe:lm8/2l9/5hhkeW+mzZQQAhtRq6AAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047080, "uuid": "d5208961-22bd-46bd-b292-bc347dd1209d", "value": 156077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047080, "uuid": "9c5c8638-c79a-45c7-8096-017863031362", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047080, "uuid": "cca2ad72-15c3-4b37-81f7-f45857c39d1d", "value": "adaa456b9a663b3325911e56f0b070bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d042223c-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712064475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064475, "uuid": "804ed0f7-54d2-4682-b189-63039289ca59", "comment": "Malware payload", "value": "67da05b9c341f84b8bc284b412e747b2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064475, "uuid": "2b02627a-d1ab-40dd-a8f6-5e6b4cdd9e85", "comment": "Malware payload", "value": "bd3bd605dfdc2cfef45c7481752fb643fbcc06ec80e2d479551fff7ade7f050b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064475, "uuid": "b81ee22a-0344-4ae8-aca5-f80b3aa444ec", "comment": "Malware payload", "value": "0994a37b5e155f1523d582f178064e500a1475ee", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064475, "uuid": "1587e692-a888-4d1d-a3fc-88a1d2cd9f3f", "comment": "Malware payload", "value": "79da0d0abf263d7cdbe6c7f87e9f15dc6037b5f05a72d5668c579814f6a1621365375b2e2cc86bc946187f37769a1595", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064475, "uuid": "01b1e13b-565b-43e1-8266-64e13f1cf493", "value": "T1A821CC127BE61702F2FB413B2BBA92D40F217352E466FB0FA141924D1960E44AC66E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064475, "uuid": "a1c0813a-d100-4c52-8b5e-1a58bd1934c7", "value": "24:8+ii7PL0+C8egYJ8SxRhe5F4I0QBPAIXP+56yxTm:8ti7PL0+C8en8SxRhe56I7B4T6yxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064475, "uuid": "2b5e9457-cb20-4605-ac76-38522df53d3f", "value": 1130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064475, "uuid": "a726a8e2-c565-4709-a271-e7101e275d43", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064475, "uuid": "cfec026c-f9d3-4109-9f66-f57334a8f8b3", "value": "parcel-label_receipt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ff258f-f11b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712081293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081293, "uuid": "2495dc54-f933-4e4c-aec4-1ed9533e4614", "comment": "Malware payload", "value": "66792d3ee7f967934583d5e81fdc66bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081293, "uuid": "6dc15868-80af-4f3b-8538-a1e9d70a3fa4", "comment": "Malware payload", "value": "bd3cb7333a97c82a6ab1939e343d2480bd60c4f643a61f6fdaf83679003e5f6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081293, "uuid": "d64cc9ff-ad41-4a46-907e-e2687e9d20b6", "comment": "Malware payload", "value": "001c65e0a33cd033e4b49487e9bd28607a1cb570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081293, "uuid": "bdcdd05c-4f60-4299-8597-b7ef8a6fed2e", "comment": "Malware payload", "value": "555c58a1715258ca630f5ef7f2da54081bd4fec3fcd1951470c0ab54fda160293f31fcd870372aadda1a16ad066e1d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081293, "uuid": "6c072b4c-7095-4e25-9918-1d7f4e1acf0e", "value": "T1F4F4C092BED0A9B1D02224333A25AB3877FD7D205F6149EBD38AA95DBD310D06231F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081293, "uuid": "2500d3a7-cae5-45a4-9d6f-307bb0ef22cd", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081293, "uuid": "df26195c-6e87-4566-a15e-7c9ac0919736", "value": "12288:GubsNSOetfARQAPyGUu7z4ubsNSOetfARQAPyGUfT+tkr+7u8MSXN:GubsnafAPyjSz4ubsnafAPyjZr+BMSXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081293, "uuid": "4ecc748f-219c-4111-8781-5f3c1e0f7b31", "value": 782642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081293, "uuid": "754cbc21-427d-495c-929a-19d37725ee35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081293, "uuid": "96f4cadd-5a6a-4d5f-a431-360ec9c579a5", "value": "66792d3ee7f967934583d5e81fdc66bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c645ae71-f14b-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1712101824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712101824, "uuid": "c1481529-c5b2-4952-b649-a168e4ecbaf7", "comment": "Malware payload (Adware.Generic)", "value": "876f22cef0d30ed6206fd209b336f721", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712101824, "uuid": "16a6bd6c-d67b-4c29-9249-52f7f509721c", "comment": "Malware payload (Adware.Generic)", "value": "bdcd758753f85c6556735024e8a0b0e702a64a91faa4f84f128edc7922a0f3c5", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712101824, "uuid": "023141db-055e-438f-9f9b-afbac9728852", "comment": "Malware payload (Adware.Generic)", "value": "b4b0a5a07caa40f029bfa6569c128af7a01b9337", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712101824, "uuid": "116f1566-ff25-4211-a9a6-aa85cfef6cbe", "comment": "Malware payload (Adware.Generic)", "value": "9e66ca1ff23f1c85541bbfc54bb98522c8b6f49f6a5a398a78f77b5ce6baa44e6296cc511490ff0c49df6672d4ece6b2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712101824, "uuid": "ee9fc681-a199-4b5f-8946-b401dd941cd8", "value": "T1915633C659C94005C4C4F24A988B73EB87331A93F164618ADFC9D4FBA78992FF78B419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712101824, "uuid": "83ffca74-fbc5-4b1c-972f-6b24386a3b6d", "value": "98304:HgzSVMT/GMBxzwSVwr3mb5bgD+78+aVc2hwkc24x3DSpsvHia9o1sffV0PJE3Y3J:H+pzqmFc+7Fdkcf3WpeAsffV0PJE3Xs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712101824, "uuid": "695b93fc-a6d2-42f3-a267-0309b7e6d49a", "value": 5922343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712101824, "uuid": "0f3be2d0-457c-467d-b797-cdb12143ac55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712101824, "uuid": "a1c6ca09-d6e9-485b-af8b-4a06bf46ac12", "value": "32904890320122_Drop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be979937-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712064445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064445, "uuid": "ff6ef5ad-7c95-468d-b3b6-87d41b2d3ba4", "comment": "Malware payload (Formbook)", "value": "61af9d6bd30dca0a81637bce9d679636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064445, "uuid": "05330797-db89-430e-8b8c-fb1300e43968", "comment": "Malware payload (Formbook)", "value": "bf1f882e2a1d0e35207cd7cab867bffe933e134e43ff317acf2db538bd4d7210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064445, "uuid": "5607c928-8b63-4ef2-ae6f-acdb9dbd22c6", "comment": "Malware payload (Formbook)", "value": "e7633d0c57090b02b02b14a0f3b83894f42e225a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064445, "uuid": "f93ae1cc-47d7-4d8c-8ffd-d92bd3fc8350", "comment": "Malware payload (Formbook)", "value": "7ffa1124aecdb98578ec7a32806eaf6ac45d589a4de235602d41d2ae723f7e4c39b80b982896b8854d623506d0aaf1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064445, "uuid": "733f062f-b14b-4f1c-99ca-d91d0d56ba2f", "value": "T18415F1993260B1DFC857C872DA685C64FB7175AB670BD243982321EDA90DAD78F201F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064445, "uuid": "3fd3087e-ff7b-4975-9070-3179722c40c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064445, "uuid": "e02d5293-5b6b-4341-8997-6e293766428f", "value": "12288:aoatPGmMZcYFaGVienx6Ps8DIlDnOc6C4ETCiwjI/ovwU+21f8Q7w0sdWrnZrY4U:V+MtrVBnB1nLHGiwwovVZnnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064445, "uuid": "c5a4fca7-77d6-45b9-8bc0-a581daa99b7a", "value": 879112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064445, "uuid": "ab603f10-6b2b-417c-b5bd-62245da03d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064445, "uuid": "a5643f43-b381-40ac-b48d-a7dd0575b348", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58df72da-f0fa-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712066851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066851, "uuid": "bcfb3ae1-116e-4bec-8974-82140c9b03c0", "comment": "Malware payload (Mirai)", "value": "8c0523e4960034080e41851e57787dfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066851, "uuid": "4b407ae4-1080-4a60-9e2b-1a1decc02c86", "comment": "Malware payload (Mirai)", "value": "bf454f76b2dd61ce6e6f1dbd2eb835c757ee2ee12c4105f990ac4f75beda57db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066851, "uuid": "bb69f39b-83c5-43a6-a739-8851712a9fb7", "comment": "Malware payload (Mirai)", "value": "f999bf6032f5378149f16fbbabe8c84a3671af96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712066851, "uuid": "acb7c6e1-3ac5-4b39-bdcc-8f9c788fc569", "comment": "Malware payload (Mirai)", "value": "5bb5f64ea072652776b42bd448c95b107314402ffea8237f14c18929471a457935bf0aea8708161d857d077187427b16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066851, "uuid": "850d4922-5da6-4bec-9378-29b2f8c6ce7c", "value": "T156631A46B8809B66D5E056BAFE0E018D33531FF4E2DE72068D15BB3077ABD4A0EBB541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066851, "uuid": "97d71f41-6fb2-4e54-85d0-a9852fd9427b", "value": "1536:qsn+fLTrZgsuI9DIOVY/BfROIusJdUVw/u/YIBE4KJGRr:6jhucHUGVw/u/h6JGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712066851, "uuid": "590627c7-4d20-4817-a03a-85a1ed299421", "value": 66912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712066851, "uuid": "1cc05c73-2f0c-4aac-87f2-4c8462c17752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712066851, "uuid": "c73c9e72-36a8-452b-b2ca-2c065a6eede4", "value": "8c0523e4960034080e41851e57787dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb5a93f-f11c-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712081650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081650, "uuid": "70ad3815-3146-4966-be4e-d7f5979ea849", "comment": "Malware payload (LummaStealer)", "value": "d4fd20224136517847bb5bd98eb2e540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081650, "uuid": "b5a4ee7c-7e64-4d8b-a631-65e07691c7ce", "comment": "Malware payload (LummaStealer)", "value": "bfb6ab0353115a52ed704111bac7464f4b2eff92e1411b07c376baa78a5e993c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081650, "uuid": "d0597253-400f-4b4e-82a9-3828eb1aa67a", "comment": "Malware payload (LummaStealer)", "value": "933ed53a7a54d298fadf2314d2e6590f037a5f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081650, "uuid": "df7d5829-4ec0-4501-8f6b-8f06fd729555", "comment": "Malware payload (LummaStealer)", "value": "b946a49e6b0585a93b5e6e3c37497d01372c94fd611f4e88a6fbe5e26508dbbf6dfc7bae7968a7f2582b7d2e03ef5160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081650, "uuid": "8d187ec2-31e3-4676-a024-1707a03e8fa2", "value": "T18974D02173A3E031C49694705E3BC6B109BDFDB26A7482BB77943B2F6EB02D24635356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081650, "uuid": "b5412e27-cf1d-4859-b855-a4fa1cba63ee", "value": "bea1d1150f59547a36828206b658e6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081650, "uuid": "d46f3d45-2581-4800-982f-4327e0795916", "value": "6144:NW23bTCeqvIMYX4egrruG0Ie5RatkX29o0tHbivtWqVgluKjwMMKS:gibTVqA74egrnerEkmdt7il5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081650, "uuid": "fa6afdfd-b747-43c8-9328-94ca8aa5d175", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081650, "uuid": "76a87fcc-a629-4bc7-bab2-0d5671a79cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081650, "uuid": "4aeddaa8-63e1-46d7-8839-cd119d5780b5", "value": "d4fd20224136517847bb5bd98eb2e540.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0cf858-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712067231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067231, "uuid": "833ce4c8-eb0a-4936-974a-56ec7c7978f0", "comment": "Malware payload (Gafgyt)", "value": "8995957c2614eba3398d77b794e39872", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067231, "uuid": "0c532393-5835-45f8-ab5e-2935317b10ca", "comment": "Malware payload (Gafgyt)", "value": "c002e77a1448c0826f3373a10ee2eb130ce17fc7ab1a048feb84571a01f34411", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067231, "uuid": "23f422b8-2437-43ac-b182-84a599c90c24", "comment": "Malware payload (Gafgyt)", "value": "af64d736739ccd2ff5aa4e381b18d55af0a36dd0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067231, "uuid": "e91b201c-4070-423c-afa7-4a5c9e1ab1d9", "comment": "Malware payload (Gafgyt)", "value": "c51c01e3b6ac44ba9d8e69de50349b9909f08601e138db96272fe9efdbf859b036df96441202ef19257086b851ffba48", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067231, "uuid": "1f640514-2ff4-42e7-833f-d30bf7b34cda", "value": "T1B6935C27A451C7BBC18352B52BDF9A629423B4BD0B32724737D47CB42F229C91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067231, "uuid": "ac8ac2ea-5b88-4ff9-981c-4cfa728a4884", "value": "1536:m17zwmvmJuvDM17i3micBiXbKwaBTDhotj+U3GMNcLUYDigEEamoHMurMhs9hZfH:CXmJmD82mFiXbDCdotj+AGMSDiJEamkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067231, "uuid": "e3530a54-4cc4-4bbf-b3c6-e439683c8ad2", "value": 96470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067231, "uuid": "26ded389-6e03-47a8-bb72-345a0390b0e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067231, "uuid": "98c8983d-4344-43f3-bfd1-a06458ad8481", "value": "8995957c2614eba3398d77b794e39872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48357496-f0c1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712042342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712042342, "uuid": "404d0609-c939-4736-8465-df1ec7e836f6", "comment": "Malware payload", "value": "dc4311fcf7008f7fd94ccd7246fcdb63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712042342, "uuid": "d7c344fa-c3ae-4f9c-a194-b1d9d6687316", "comment": "Malware payload", "value": "c05186378739dc98ff28f86388680fa3bdceab20d6e648e5d8fdd27bd938413b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712042342, "uuid": "c50fe942-43c2-4aec-a984-38f3f87058d3", "comment": "Malware payload", "value": "cf6ca02f119ccfe9608686f6b31e2951ecc76cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712042342, "uuid": "08441a75-2b6a-48d1-a166-cd3d5b72f831", "comment": "Malware payload", "value": "bf5b3ae7751e9c39221391e0fbbb5c4b6d70fc559fa3e7ed5cd950a14a883b90dcd1e4bb00b3d9fa51870d58fe11296f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712042342, "uuid": "b4bcec16-c76d-432f-9994-e33a2c96b9bc", "value": "T10827CF21B7C6D63AE8DB0B70D57EEB5E827C7621032495DB2198F99C1C723D29A31393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712042342, "uuid": "01b1bc0a-baca-470b-839a-7f3635246afc", "value": "aa9f3a2087e12b9bb85387e33424b173", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712042342, "uuid": "d316a92f-6cf4-4f78-9b18-d660cc3e5f7d", "value": "393216:QsJU/P2y1sMts1jY0xnJKo1C2WjD3OqfqlqI6v:QsJU/uB1jY0xnJF1C2eDXIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712042342, "uuid": "50daedc1-7955-4a0f-bfca-460d04eea794", "value": 20849476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712042342, "uuid": "fa5cbee4-040c-4265-8921-4db1ec28c128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712042342, "uuid": "92eac2fe-ac9a-4765-825f-cd99ddf769bd", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dd301d-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064534, "uuid": "fbf50bae-4322-4b30-ad79-2343558e5d20", "comment": "Malware payload (AgentTesla)", "value": "ed6e135e7d310da49a360f47044d45bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064534, "uuid": "c00928bb-cbd0-4dcb-97fc-4bd9672424f1", "comment": "Malware payload (AgentTesla)", "value": "c10a19322708c99c4ef58c4c756f9b9091375143e45bbd6511acce9ecb8a8d05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064534, "uuid": "27e88402-f9c8-454b-851b-b29f126f900a", "comment": "Malware payload (AgentTesla)", "value": "f4466db3fb4147a2e9c2f631ac254c9aa7caa879", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064534, "uuid": "d4ceb818-a097-4773-b362-9d8f07977a68", "comment": "Malware payload (AgentTesla)", "value": "a46e12637b1f7f9e51e94b568af93ff63829e017228e088a7f4fa1ff1a4f4007582d9119191dbf5390fbe11bc3c9ed43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064534, "uuid": "b691f6bf-f851-4d09-ba97-d8ab178dcfea", "value": "T1B1E423463670FE07EE7B95F290D454265B72AA5B3DA1C3C22CD730DB82E1F489A81D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064534, "uuid": "7980915c-f7bc-4891-b342-3197fd66b09c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064534, "uuid": "78a03b88-cdd0-44d8-b998-d407e009fb1c", "value": "12288:B33bFHOvpnP5022UWjmTl5eImwItNhwFMsEGOeZGEuhNU6sixkR:R3NA507rjmTveRiFRXZL6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064534, "uuid": "02dbc56c-b823-404b-b138-bb3ee82655fa", "value": 681480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064534, "uuid": "971c1a85-389b-4880-beba-5975921d8d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064534, "uuid": "3fd77659-3c38-48f5-a622-6750fbd3907e", "value": "FedEx_77354995161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf45cd9-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064467, "uuid": "5959f6d8-ef3c-4ba6-a069-e67f16807a3b", "comment": "Malware payload (AgentTesla)", "value": "ef19305834003a5157fe1f860e9351d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064467, "uuid": "ecdf16c7-0eae-432f-b619-6aca41a4bb95", "comment": "Malware payload (AgentTesla)", "value": "c1554b4539b962eeeb79e84058197827abae4cad2dbf81e5055f7c9259bb3584", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064467, "uuid": "aaf596cc-9ed5-4287-8b77-5b9f3c5ef0f2", "comment": "Malware payload (AgentTesla)", "value": "8cc11ce9c5164f2dbd13cd596e6247b8a7f590e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064467, "uuid": "86c1a8e6-d681-44be-aea9-14fb3f6ef795", "comment": "Malware payload (AgentTesla)", "value": "9489afea82546cafb2a59a098d95fb3097cbca9b56840f861f420d736cae8f0b511c6f404d0648b2cee7b1ca49aae96a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064467, "uuid": "b25548b7-7197-45ba-a006-285080b67d29", "value": "T1B5E422547678AA67DDAE88F1D1D97513A7B07A8A2CA1D3D93CC221CBC1C2FD40A41E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064467, "uuid": "afd2beaf-8857-4dee-b775-006510b4c175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064467, "uuid": "a1f8d6cf-379d-4595-90ac-f25a19024a54", "value": "12288:A33bBYlH97aC9Emn86WHHP8vy+vxSf4hBbWJIHC3vhLTNHWNi6hm4uLykR:43uld7aCamn86WHI9Qf4HbWaUpNHcrhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064467, "uuid": "206f34bd-c50f-41e5-ac31-a8d088ebab48", "value": 678408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064467, "uuid": "01ba8fe4-3e5e-4572-b7d6-71504ce62dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064467, "uuid": "08e9ae41-af8a-46e0-8189-b017163af397", "value": "DHL Waybill & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bf7612-f0d9-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712052914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712052914, "uuid": "0dcbd9b3-ea8e-4b69-bb0e-0892e93f849c", "comment": "Malware payload (RedLineStealer)", "value": "5c78467103a9fb1d14d55ec3b57e740f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712052914, "uuid": "5f450156-166d-47bd-82d9-0241f4c1c15d", "comment": "Malware payload (RedLineStealer)", "value": "c26bd0f7c7c00b7cbe2545cf2f9240020f9498928f96091da19e1af943ac837b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712052914, "uuid": "e7e45b06-2292-4bb2-a6c8-e1b3b77a0717", "comment": "Malware payload (RedLineStealer)", "value": "9f6805487a9a67f77e8cae1098ff9e8d24740917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712052914, "uuid": "14f5bff0-6fd0-4e33-aa12-ed758d77f378", "comment": "Malware payload (RedLineStealer)", "value": "bab95b0755e8e001a9560e8daeaaa6fd1e3b0702a11446440e08c0f880f4c7947ba25bd9225cf254bdeacef3bf660afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712052914, "uuid": "228e8779-a211-4f9a-a00b-b4588ebd4089", "value": "T137050222BDC084B1D87218360EB1A7745E3CF9210B369DEF6B944D1D9E606C15B36FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712052914, "uuid": "dab54c6f-d825-4bfa-9d1f-a0d6f88de717", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712052914, "uuid": "be1cf20f-f015-4a84-b6a4-d85b7d411af6", "value": "12288:bxjrr7F5qfMs8WdGk+08n4sHWihcNm2F0WRSl8CRHQSv+bEIFjJxw6ZqIZsCh0N:bxLsMs8WdZ789WN3F0KuQUQXXZl9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712052914, "uuid": "c11b6212-bb6c-4442-8ca0-12a4d7560c16", "value": 832294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712052914, "uuid": "26781bc5-3546-4d6c-9cf3-92882a5e08d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712052914, "uuid": "efac3b18-177e-46cb-9188-207306ec8706", "value": "5c78467103a9fb1d14d55ec3b57e740f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125624d4-f108-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072746, "uuid": "9d02e739-5c91-4164-82ab-b117acf39c29", "comment": "Malware payload (Mirai)", "value": "2258cb5a03e80a769aa0b9caadaf644d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072746, "uuid": "09671962-520d-42fb-939c-dec21bc851d5", "comment": "Malware payload (Mirai)", "value": "c312c60b007aeb069408e6c0c30ba9dd1a0029e583cd69e4d6b22035b83b8292", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072746, "uuid": "e9830fde-f8ed-45a4-b5fd-f6e3ae11a3b4", "comment": "Malware payload (Mirai)", "value": "be37277e181ba19c4ee90a9bb41668ce28ba64a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072746, "uuid": "c2b1d5a8-28dc-4bb4-aa1a-d54632de3187", "comment": "Malware payload (Mirai)", "value": "944e83fcbd05d40067627ba1eeefd04c6dd54100df93613c4dd453f17fe799af160b62bcd694b6878171514d72586b9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072746, "uuid": "ec3c1f5a-0c79-4724-bc88-4e3f3927b626", "value": "T1E8330744EB87E1F4DD0B4C7104A3B1BF83369A569025DEAEE7887917F933A329025F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072746, "uuid": "713fe978-42bc-4752-9cd9-9de7406014f0", "value": "1536:3ESIuYNrHXotK5duFaEfUy31A9nfB2qrk:3ESIuYNrHXo04FK9fkSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072746, "uuid": "b5569010-72f7-4c2e-8d52-c69af33703cc", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072746, "uuid": "5e62607d-a12b-454d-a57c-d53ff95c92d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072746, "uuid": "62f27cde-e9a5-4d29-bcf1-55db94266ebf", "value": "2258cb5a03e80a769aa0b9caadaf644d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9753241-f10a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712073966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073966, "uuid": "f504c41c-88bc-4000-a14e-cc10d5b4bd42", "comment": "Malware payload", "value": "9080bf37c122cdd9d4eb9e87e95ba614", "object_relation": "md5", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073966, "uuid": "b254c2aa-d990-4122-acf0-77b3138a9096", "comment": "Malware payload", "value": "c33f67a18ad931a7ae9957fc79e304178c7fa450aa471c544139018c45aad083", "object_relation": "sha256", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073966, "uuid": "271a6f64-2adb-467d-bf93-ba558ce25fa8", "comment": "Malware payload", "value": "fe65064ac58658c1941cc12c43ccc7c8beff8afb", "object_relation": "sha1", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073966, "uuid": "44a4e524-61dd-4da3-8267-ce6b75936693", "comment": "Malware payload", "value": "f2274a8c94f66c13199590cb9932391242f267684a7e10b6c3edc0209e2cf476c5e2585e51201d5509edf4344275a7c4", "object_relation": "sha3-384", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073966, "uuid": "96fba3d0-20ac-43b5-a1c1-219753ffe717", "value": "T14123F130DDC938D8FCA6DBFAC4267C2F82157C03A0CD779109281E575496D38EE92A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073966, "uuid": "30751506-6be3-42fd-80cc-a7bfd9975f9f", "value": "1536:Xuvu0f/2l2jAE1AibUZPfKBjcpzmMqgRJ:XuHfWAAEQZPfKBcz8gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712073966, "uuid": "35ed58d7-704b-4da7-b264-ad92e7982211", "value": 49272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712073966, "uuid": "9df2fd07-f177-4804-8c68-32fcd57038f0", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073966, "uuid": "c29fd72e-6b54-44ae-85da-53144af69b81", "value": "book04-02.4422136363.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ebee4f-f107-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072697, "uuid": "fa1fa7ef-e33c-49c5-9257-8140237d50d7", "comment": "Malware payload (Mirai)", "value": "20d4a4129bd5b30dbb2be1cf6e80ac52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072697, "uuid": "5730de82-3e98-425f-aaa7-b614a183c44f", "comment": "Malware payload (Mirai)", "value": "c39586ceec33300f6b14bcdc047003b007670ca8f4ddbb0c0a70871c4f5b80ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072697, "uuid": "90293679-4eb0-4e30-bb20-cf9943234d95", "comment": "Malware payload (Mirai)", "value": "867331e6a993da534ed61a17acdf7e573d4f990c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072697, "uuid": "e0bd5a4c-d453-40ee-b951-c88174c5fb3b", "comment": "Malware payload (Mirai)", "value": "658fafe824998ba6ef2e2d633a39edf076dbd8bef1661bceed3e24aa534f5be2df76a68ccef51140935b703dd86de405", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072697, "uuid": "bd222567-8b74-4fe4-837c-27a74e0ffd1f", "value": "T1B6732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072697, "uuid": "b2a28957-a21c-4b41-aa1a-cf14b4c1f2a2", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftcynA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFO4A5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072697, "uuid": "b23057ca-caf3-4288-99a6-ceae3fa1c408", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072697, "uuid": "b76b7b70-d4bd-436c-ad23-7af97fe957fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072697, "uuid": "c342c2d0-8b46-46cd-b1d0-fb3459ab7313", "value": "20d4a4129bd5b30dbb2be1cf6e80ac52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa583a9b-f11b-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712081296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081296, "uuid": "3cd42343-7acb-4e36-9567-4027031f4e1e", "comment": "Malware payload (RiseProStealer)", "value": "e55b01592fb14ad30997807d067f88b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081296, "uuid": "d89d1e88-72bb-42ba-bf99-8f02821dbb4f", "comment": "Malware payload (RiseProStealer)", "value": "c6137468b041020d2a468435b731f738ede3193c2af37179eef2156ecaf6b7a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081296, "uuid": "ae3fd77b-675e-4a73-92ae-d10e69e8dd17", "comment": "Malware payload (RiseProStealer)", "value": "916d863c719ad52295a0ed90210b235e38ff0955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081296, "uuid": "b1fbd735-1b58-46d9-94e6-bd21e1c7ed8a", "comment": "Malware payload (RiseProStealer)", "value": "f140379311a9fcb4d880b87b68d7674151578251ff46288f946710bfced454da3a5302d75a7b2e4d8c7c677bea8dca38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081296, "uuid": "b1810232-8b21-49af-8a66-d9c96960ac14", "value": "T19DB533479C245227CCA88BFE59EC31637E2A3F870532641F18E6ADFBF36355721664A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081296, "uuid": "8aaed077-88b4-4e3a-b72c-4da029445788", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081296, "uuid": "2074dc0e-0150-407b-93fe-af76e36e166b", "value": "49152:qA+oVTESqcd85YQcJnZHe5Sj/pEYE2+Iv6OMkJ+nyl5dQtMjo:EeNqduQc9ZHhVEzHu+a5dJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081296, "uuid": "1be7b658-31f7-48c0-bcb2-f2ed16ae390a", "value": 2332160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081296, "uuid": "cf6eabbf-916d-42d6-8ff2-96e45f03fa12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081296, "uuid": "5a03f06d-e092-43af-8550-bb697300d730", "value": "e55b01592fb14ad30997807d067f88b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ebdd16-f0e5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712057767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057767, "uuid": "5e851ae6-a148-4edf-8aa5-11560b70c1f5", "comment": "Malware payload", "value": "f202a577b912d4f8daa39c869d175944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057767, "uuid": "9beb05b9-c3ff-4e9d-afdb-66408407765f", "comment": "Malware payload", "value": "c61fb508d58830af2d8f2e7fbc18e0e5e7e0f9c24033cada50d42d0fbf343e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057767, "uuid": "1fdbd4c9-1bbf-4bd3-a08a-f107e4559554", "comment": "Malware payload", "value": "496917b19610a957091699ff29ed316f1fa39143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057767, "uuid": "280ffebf-826f-44f1-a1f7-f0a24f7e2616", "comment": "Malware payload", "value": "93e52ea3b5ad221abebdf747441ddf6e0cecbe542d2f0a7d8b33fe0aff9e6e9bf46772f831a9b36ff7e31086f4578c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057767, "uuid": "3d87d051-ee30-4b75-a3ab-de7775a79ea7", "value": "T1CAF58D22B16800EAD977D47C8A8A8523E7F07859137197CF12B1AB6A1F677F41E3E350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057767, "uuid": "df2bd0ab-4cdb-4300-82c3-cfec8cbcd75e", "value": "7b59991952e14875d84193e7789b7311", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057767, "uuid": "03d6b67e-eabc-419e-948c-6410f8b931b8", "value": "49152:KD1wyVu6kLS4U/DiaJ0de0r2AJisyYy20QkTu5dPkLoJjEWU:ewv6kw/eJNHy2z+LoJjEWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057767, "uuid": "3adda039-a8b8-4f1b-a205-372a4b225174", "value": 3407256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057767, "uuid": "cd7dd012-475e-426f-82d7-70c0f71ac048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057767, "uuid": "6a2e6173-89cd-4417-80c4-c79c2de1b3ad", "value": "WeChatPlayer2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc3fab1-f0c8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712045603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045603, "uuid": "3e707795-e183-4f31-9376-7a70896ebd13", "comment": "Malware payload", "value": "0745896812ac59deb92695f1ecdf3225", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045603, "uuid": "b1959e90-4a31-4f87-90ba-ae0944535f5e", "comment": "Malware payload", "value": "c7810f1a7bc06b340f369daf70a71431e98c09abb023c02166af702cf515dbab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045603, "uuid": "91358f73-7c16-49fa-af6f-9301f519fbf2", "comment": "Malware payload", "value": "cdae61bbc0ee6085dd4c85142e12b9954991e9b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712045603, "uuid": "5d52aa5c-a5ff-45b8-b541-0cad2ed3a728", "comment": "Malware payload", "value": "f5c770e7c10c7119d7222024f68bf3890a228118a6616fed0520f40acfea010fd92fca5a59511e271646117ffb2580bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045603, "uuid": "544b342d-325f-4ca6-be1d-af9ff1bf490a", "value": "T19C46CF9653EA80D0DABED135C9178A0FD6B1F8050A35936F5034CA8EEF372515E2A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045603, "uuid": "c87d2f7d-9246-4c07-b4cf-90d4e82563f6", "value": "3ad3a4196640b5ceb959bcbbcf02bf3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045603, "uuid": "de361d0e-c5eb-48e7-bf48-141cf5f1850d", "value": "98304:7yKTMBfBBKULpkJFzL73GKw8+8yBp4cTR+haYrnyU:7yKw7BOJXk8Wuctery", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712045603, "uuid": "aaf39912-19e3-46b2-a402-4860224f823d", "value": 5417472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712045603, "uuid": "c29b5e11-91c2-4560-a4ff-754402695d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712045603, "uuid": "78e1d79d-95b6-4e28-b80b-6cc0fa397791", "value": "9011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980cf82a-f139-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712094016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712094016, "uuid": "f55c9bdd-06c4-49b0-b411-6827091b0b53", "comment": "Malware payload (DCRat)", "value": "77f8f69a2dfe223cca4cf0e5fad714fc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712094016, "uuid": "9cd0b48c-4757-4243-a27b-9f31c61b5d03", "comment": "Malware payload (DCRat)", "value": "c7fd70a6e7e17aebbb8c398e0824d948598bc3558a5016165db3ca7d854c8e33", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712094016, "uuid": "381cb199-feee-4e75-a928-3f6ff945664d", "comment": "Malware payload (DCRat)", "value": "f731448a3b2a14d53cc80f070a270e8514ba8bf1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712094016, "uuid": "ae4f7852-6340-4daf-841f-3165f96263ce", "comment": "Malware payload (DCRat)", "value": "28997db0ecefbd89bd4144814d61388e2330ef3ffb3cab0ca92dd14ae504994192c6d14207c62c4acc5a1fbbb761fc88", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712094016, "uuid": "846c1f8e-4e35-49d7-a0ad-b5d8bfe340dc", "value": "T147F7339E2F34D543E58C3E76CDCBEA164539A7A43C28F7582060F49AABE7B03BC12545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712094016, "uuid": "50627b79-5c79-4471-b7cb-38a7dd0284a2", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712094016, "uuid": "6b3e8696-8088-4aa7-a320-dbee5fe9d658", "value": "1572864:cLBiKk8tvTgmYZMhkVAM8xGZ3/+2JUC7uJp96rh7YNS:4BDBvUmYZZqOm2JU4uH9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712094016, "uuid": "82dc284b-ffc1-48e8-a62c-4a1313a7d209", "value": 70169088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712094016, "uuid": "8aa72f1b-6b07-4e3c-8d34-2b5fbf8f3d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712094016, "uuid": "c2f1bc93-86e6-4bb7-8be3-07d12346968c", "value": "77F8F69A2DFE223CCA4CF0E5FAD714FC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f188da-f0c5-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712044028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044028, "uuid": "a368eb79-215d-485e-9494-2216fd576e64", "comment": "Malware payload (RemcosRAT)", "value": "b637de26aa293e2d88beb31e09febd46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044028, "uuid": "2b15e61f-32f3-4435-9459-2b55627161b7", "comment": "Malware payload (RemcosRAT)", "value": "ca52caeb15fde0f171362e3e7771edecc44f2e582cccaa0fedbd6012669076d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044028, "uuid": "f32804cd-71e7-4b4c-a200-68ceea604c57", "comment": "Malware payload (RemcosRAT)", "value": "a800c3b4defa12246ad3d6b9e70f1aa02e2d7623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044028, "uuid": "d5247404-b188-4a7b-b6d7-bb9ff57af035", "comment": "Malware payload (RemcosRAT)", "value": "c898b76a75b8d6e738f94a1cb41082f58239d9c17f64d9ff3a337e4885756dd75e6e98f7656a8933f279b7aeeb8c167b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044028, "uuid": "b2b547d3-cac9-408e-bff7-a3c66b5b6c23", "value": "T14765D00273C1D062FF9B96334B9AF6115BBC69260123A51F13981DBEBE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044028, "uuid": "5d25a4d8-0a81-4518-aeb1-93f00d97faa8", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044028, "uuid": "414db06d-0f14-45c2-a099-38a892db1268", "value": "24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8a61SU+YLo06JKBqM02XjJxn:tTvC/MTQYxsWR7a6gU+OV6JKcM0uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712044028, "uuid": "f54a5508-aca9-41b5-bcfa-3baa03b439ec", "value": 1472000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712044028, "uuid": "33295538-67ac-488d-93b3-b1306867898d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044028, "uuid": "71c47562-8d7c-4697-8efe-df31fb229412", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4d9230-f115-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712078432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078432, "uuid": "497d4fe6-5585-4737-b3aa-2bc4ec917d33", "comment": "Malware payload (PureLogStealer)", "value": "7ed6ac58a23ab36e89c5516c56af920d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078432, "uuid": "7a79a759-fcd0-4a4a-9528-ac62b3008ae7", "comment": "Malware payload (PureLogStealer)", "value": "cad22ca41d730a37e6c581dc61dce32c1385c80f386ced8e7747cbcf0fc4b347", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078432, "uuid": "21a7bc34-f1ca-4bb2-a9a9-0fa6c5a58178", "comment": "Malware payload (PureLogStealer)", "value": "70899887f2e86b6e4e1d445b66fc9201a416c526", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712078432, "uuid": "5ac3bf77-f314-4767-bf48-524d78b4c3f4", "comment": "Malware payload (PureLogStealer)", "value": "9fffaec5da54fca3179e92b733b208293bfca90d80aa475c07cd92e14d8fddfd4d83c4a428258b53ae7eff3eb647e163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078432, "uuid": "2a70e297-a5b3-4234-a82d-cd516ab24e8d", "value": "T189534B2673CB5710D62585F4C0E7906403F6A7872B73DA4A3B8943A61E533DADF88B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078432, "uuid": "76df22ac-3651-48b2-b049-78bb1ef57615", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078432, "uuid": "9d9e21f8-0dd9-419d-bde4-85dcd376a5e1", "value": "768:VV8/15Ej6pYqYznsRCsivJ8ZoHYB6t9QtS/oopjQBI4rH6Cq2f4UHy2:PKrEuTanHx0o4B6gtS/oMRc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712078432, "uuid": "fc146161-28d3-45c4-9d2f-edb1ef5fabee", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712078432, "uuid": "060883ed-4fce-4809-9b0d-95ba6a663e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712078432, "uuid": "09b10069-c455-4b48-a44d-05d039424845", "value": "7ed6ac58a23ab36e89c5516c56af920d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2d233b-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067204, "uuid": "cc522450-a42e-4aa8-85a9-aefb10a3de4a", "comment": "Malware payload (Mirai)", "value": "08c088faec5cb51257fdf1e3cf49849f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067204, "uuid": "f39869b3-1e3b-4eda-b7fc-0d627aa2a3f3", "comment": "Malware payload (Mirai)", "value": "cc9d4042417902b0c5a37a229720aabdde878e8b13e48c2309cc02a5535ab8a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067204, "uuid": "56d0eef3-7754-47bd-af80-19e600ce1515", "comment": "Malware payload (Mirai)", "value": "819343f35ba069f384ef8560febb7d3794d7c3d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067204, "uuid": "f81ee60b-57bc-4c5b-b33d-01f56f693458", "comment": "Malware payload (Mirai)", "value": "77d24dbf861b2970d7108ccacca57da7f64f2c9172e01512687200286c5f7107bff833406568cc4cbc0b132e2bcabc45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067204, "uuid": "c06f8a53-97fd-4070-86da-ddc790ee3305", "value": "T11A732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067204, "uuid": "75a898fe-01d2-4675-a60c-438ea36057f4", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftcAnA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFO2A5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067204, "uuid": "95cf86e6-6a51-4f18-a431-393c73f6e892", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067204, "uuid": "09a46b57-f8a1-4944-8fec-f9ed8c7eb761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067204, "uuid": "709e5e0d-f594-424e-9dfc-45316ff2a270", "value": "08c088faec5cb51257fdf1e3cf49849f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843065a8-f0f3-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712063918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063918, "uuid": "f621d355-6fc2-4b09-95ab-ebea8d0922ca", "comment": "Malware payload (PureLogStealer)", "value": "ec72181a6241049dfef5b9df3252010e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063918, "uuid": "6ac0741e-45c5-4f5b-9032-1a7110703d83", "comment": "Malware payload (PureLogStealer)", "value": "ccd4e348aa248d1d9153f8960d60c83b57c8f62a2bec7f874c8f39cbaedc5863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063918, "uuid": "9a2d76f6-d37b-4d61-bd35-265381e9f971", "comment": "Malware payload (PureLogStealer)", "value": "cb9102dbb2d29af87e7f878aed83f61a8d474fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712063918, "uuid": "5db3f3ce-c97b-474e-ad1f-536e35d36fee", "comment": "Malware payload (PureLogStealer)", "value": "b05952e93a4bd93e07c79d7608d140046648c06fc1102cb8580851fc5a9d6e51bb7b67733bc0a47747aa9dbdd47482c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063918, "uuid": "07a43f01-b92e-4002-8012-39729e9bf788", "value": "T1C43523915591C86BD87ADDBE62EB8438F7E27D190EC05BC2E30C755B68B108B7A1F381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063918, "uuid": "6ab4670d-c463-49f6-94c1-2863f65c150a", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063918, "uuid": "1391c603-7eca-49af-8590-a0bdd33ded73", "value": "24576:YfLjbmcxC2cSZLUqGg+F0uOPZkA1lBN8TPZHdzBhyKX:SvbVUqLg0uOPtd8TPZHPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712063918, "uuid": "f17d8f18-871a-4e0c-a95d-6a89bf344537", "value": 1063167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712063918, "uuid": "e8755fe9-285f-46d1-877e-a68bc9637baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712063918, "uuid": "8dde36e7-f6af-499b-85d6-b62c55767869", "value": "ec72181a6241049dfef5b9df3252010e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f20a13-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064462, "uuid": "3ef4abc3-e813-4284-a64e-51bad1660035", "comment": "Malware payload (AgentTesla)", "value": "ab8597f92b33fa7da10619ff13360b0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064462, "uuid": "19784092-ded9-4a7c-a2a4-3bd4da62b609", "comment": "Malware payload (AgentTesla)", "value": "ce213fe45b524d85486c2f3956e17a333b2d8ecbf1d73078bf56014cc1c7702c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064462, "uuid": "2dba6883-9434-47c7-bc5f-da71a6271de1", "comment": "Malware payload (AgentTesla)", "value": "6ec623e7be8913a5e5d1aa7ca79784f8167f2e79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064462, "uuid": "7c8daa1d-b7ef-462b-af14-fe5a992c6e29", "comment": "Malware payload (AgentTesla)", "value": "16bb81301beef58db5150afd618eb1ba3fcdf1c480c23dc4c60fa786e8e72142c9aa11376c7e05844e4e0138035866c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064462, "uuid": "14f33fb7-b203-40a2-8a37-a7ce82d63cef", "value": "T1DA05E0993660B6DFC457C8B69A982C74BB2075B7630BD343A42316AC9A0C6DBCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064462, "uuid": "0086f535-bbaa-4b9d-b01a-d057102f0a5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064462, "uuid": "2e538260-86f7-441f-911a-62910c9a5896", "value": "12288:6SZPGmMZciaUF36qoxUC3j/RhaJjWHEksEk6useHw7e2OmRhGNgH/hIFaz+Mf6BX:6eMq6unaJ6kkvkzHw7e2OmRlJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064462, "uuid": "3d496fe1-f1f3-45f9-937c-fffcafa519f3", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064462, "uuid": "4a5201be-487e-4dc0-9e82-547751a01b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064462, "uuid": "00b28d1b-a64f-4b73-84cb-991e9021f630", "value": "April Order202402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3819e8-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039399, "uuid": "fb1e30e9-01ab-441d-bc0f-a4d465e89328", "comment": "Malware payload (Gafgyt)", "value": "905e8456a5c15fb66af128c40c4c5033", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039399, "uuid": "454895b7-5de7-4dcd-a687-6dd93181adec", "comment": "Malware payload (Gafgyt)", "value": "cf478785a0bed843623f5163a6ccb714a0335c611a39ea6274c52cea86b65454", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039399, "uuid": "0c9305ad-43c3-4152-8f04-dea09969ccb1", "comment": "Malware payload (Gafgyt)", "value": "9909888c25aa43db0213a47dee48ea20b1f23ad2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039399, "uuid": "12dfc8c5-22d3-4aeb-9555-278f583f9a6a", "comment": "Malware payload (Gafgyt)", "value": "d4ae814d8bbf4ac192f1a6e6993464e86442a5dca13c2e21fcb64a2307407bf795c38cab92c63d3fca1296086538d63f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039399, "uuid": "d81f806c-2016-4cdc-b01f-165c62933956", "value": "T1B4F3B63BBB160F23C0C500B111E76632ADB5C7DA34F952D76AE06DAC6F2A5883465EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039399, "uuid": "320a330c-49c9-4455-a984-c800dbfd3ca2", "value": "3072:Mqnuwd00SXON8CLphapM7I5n3lNsmzjEq/dNYy2Se:MqD+ephae7Ix3XsmzjEq/dNYy2Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039399, "uuid": "4ec10025-b4a4-4d51-9e03-2919c8b62cf8", "value": 157989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039399, "uuid": "87976901-2479-4d02-a77f-d484322d47eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039399, "uuid": "e3a80c54-e284-4e48-98ad-44e4aa109cc2", "value": "905e8456a5c15fb66af128c40c4c5033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb4e106-f11b-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1712081298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081298, "uuid": "3a4a0e67-687d-4cf0-9a3a-6abb321a858b", "comment": "Malware payload (XWorm)", "value": "e81963d4c5a431f529c7669d3595a943", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081298, "uuid": "c43fbc4d-15a5-4dc8-a950-f58393ca417c", "comment": "Malware payload (XWorm)", "value": "cf6cab6b405f7e849e6585f6f4c1ae3fd155b75d8ceb197bd0cf46a9b4c5f91b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081298, "uuid": "daf39fc6-024e-4bb3-b6bc-82910df05d88", "comment": "Malware payload (XWorm)", "value": "82ac49f24caad73263ae461a2c1c7546b1ba9ded", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081298, "uuid": "afcd6f0e-45b0-42ef-bf6b-c41db80f2ca9", "comment": "Malware payload (XWorm)", "value": "5ecc337620860ba9296d285e14fe8cd2ae8ad74103eb8ec843ed1a87e5b0a19734a2c1d662e3d408cbfdc99220169974", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081298, "uuid": "f1121793-4c20-4e04-b65a-dabde48138bf", "value": "T1B30112A96C9B49487372C7A512E7E2A9E553E28B60804D0CB340219BFE5A30E8693243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081298, "uuid": "51fd0e65-691c-4718-a852-9e53d7e7917d", "value": "24:hMNmMvy4GqptE0ia57Irp8xuY8y+/r88+M8E4olEC:ImMqopO0Jx4d4+/Xt40F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081298, "uuid": "7c72f25b-63ef-4bdd-9141-0c70b55dbed6", "value": 834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081298, "uuid": "df25241f-cec6-4d44-badf-68fd51481d2f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081298, "uuid": "758d09a7-c329-4e19-8110-d2d94a0e053a", "value": "e81963d4c5a431f529c7669d3595a943.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b35a36-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712067172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067172, "uuid": "149e9cee-236b-4941-8d31-91eb94eecc77", "comment": "Malware payload (Gafgyt)", "value": "6efdcf7cca4ec4399b51bee95b277b71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067172, "uuid": "011b6dd4-2b87-40a2-b6eb-87a7bfb1c839", "comment": "Malware payload (Gafgyt)", "value": "cfa360161b9f882640fa6693aa483ce8bc9217151f3f888e84bbf4c6e86d401b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067172, "uuid": "b5d114d8-f837-4799-bbd6-f338e65df0d6", "comment": "Malware payload (Gafgyt)", "value": "574dbd234c2b7aa600b6d13db4b9faf39c6fcbf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067172, "uuid": "f9f0caaa-a3d8-4dd0-95fd-2fac1c8d24c8", "comment": "Malware payload (Gafgyt)", "value": "3942d6e27ee80f9580b8c88d7b098aaacea3a1c358d61588d5b24aa0c6659bcd16e1d0d992a1f86d9e13bfc2824bc9c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067172, "uuid": "56bb3306-ab08-4f2e-8745-360cfa5f8790", "value": "T186A30796F800EFA6F40FD67604D34B257630BBA20F532622735739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067172, "uuid": "f5718ed1-42d6-48ef-953a-702a4f15576a", "value": "3072:rs93zWJ6fz3s6u7FyorA/bSmZpVLoP4Nf2kk:rslzWJ6fzQyoI+mZpVLoP4Nf2kk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067172, "uuid": "da5ddffe-8de4-449d-9ed8-a2bf69348929", "value": 101306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067172, "uuid": "ff309845-ccf8-4939-be57-860a3e81e2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067172, "uuid": "ce1dad21-76d0-440c-b605-481c1fc909f1", "value": "6efdcf7cca4ec4399b51bee95b277b71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f72039-f0ed-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712061375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061375, "uuid": "80fdf207-0bb7-41ed-b04c-ab38c26e5881", "comment": "Malware payload (Mirai)", "value": "db9f0651a98e3ccfbac78393adee7e98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061375, "uuid": "1e60ea1d-02cd-4229-bb11-466eabd3eaef", "comment": "Malware payload (Mirai)", "value": "d28cc69bcace90bc162ef8f5d97e72ee5b4e23597dd571484f86263bc1645e72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061375, "uuid": "d05d1adc-ee42-4c90-8279-8e1766b4ed89", "comment": "Malware payload (Mirai)", "value": "600b2b5d30cf1abdb0fde046e2297511a8bc7604", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712061375, "uuid": "97cba4e3-0463-477c-90e6-c4f209ce064f", "comment": "Malware payload (Mirai)", "value": "ca04e0a96b84049e1974867ec136882a258aa009a995a8a597815eb4eb1040cd4eaa2d7f1befe43dea3316f13592bbc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061375, "uuid": "ebeb01d5-141e-48d9-a25a-46abb85c5af1", "value": "T1CA936CC5F683D4F5EC9705B1113BEB375B33F0B52029EA42C769A932ECA1510EA16B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061375, "uuid": "4aec93c7-5a85-48af-a543-069cfee7f473", "value": "1536:xpG2cWAcCghsZcWU3S8esStqU1gQI68jne8Fs8F2c/dw8SAwHEoSrtAjj0xZ:xpG3WrCEjWUiRLZ98FIcK8SFk1Ij0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712061375, "uuid": "cb7e7f3d-1a1b-43c1-a551-ee2a53a563a6", "value": 89608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712061375, "uuid": "2c3a3e78-688e-4354-a61a-2ee440538c37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712061375, "uuid": "2c3234cf-1357-4ff6-8bd5-207458eccb7f", "value": "db9f0651a98e3ccfbac78393adee7e98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0349a48f-f108-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072721, "uuid": "0c76935a-75af-4e4b-b1ed-873c2895205f", "comment": "Malware payload (Mirai)", "value": "d53c2e9a8e7875f422487834b2fea257", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072721, "uuid": "3538c283-c6e6-4901-b5f5-34ddb95082f6", "comment": "Malware payload (Mirai)", "value": "d2a1d868c169aa82c5029696f513214bdd9f97bc14db6fa5fa58518061c0d313", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072721, "uuid": "8ffb106a-17c4-43a7-8bf8-8430c190389e", "comment": "Malware payload (Mirai)", "value": "7ca2a8063e0e6791a6cdc26578be3522d87a3e2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072721, "uuid": "a9d391de-734e-4ad1-ab54-baf72463cc92", "comment": "Malware payload (Mirai)", "value": "13fcacfdc477897c58f3441ec99e6bf2ea50a430a34275871efbf2039381187402e975ee464cf031e05795408dc80615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072721, "uuid": "3e1cb42e-deff-4fca-a042-49d17cb1cb3d", "value": "T182934B32377A4A23C4E6643881E78737B3F79B851D30411BBA946F887F5AAD031937A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072721, "uuid": "944f4a82-c38d-463d-ab3c-a3f07e454a17", "value": "1536:RMtmq5+UhAgokTSUyAVv9Ks4OL92l5sdxt/+DQnqt+Aecm5jSa:RTmokuUyQvB4fsdXHnqZeDYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072721, "uuid": "49980ee7-5143-40ed-aee5-a73a3f863089", "value": 97283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072721, "uuid": "67a0fcb8-4ec0-4814-8110-74c6a7c554a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072721, "uuid": "c8997168-093e-4c93-8101-2a162fe56767", "value": "d53c2e9a8e7875f422487834b2fea257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd49e05-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712064360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064360, "uuid": "6893c14c-fd5d-4e72-98a5-d618f422aba5", "comment": "Malware payload (RemcosRAT)", "value": "a327225f272fd971b5f4f7aa315813b4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064360, "uuid": "b042b51a-3057-4e70-9fd7-dc9680fecb7d", "comment": "Malware payload (RemcosRAT)", "value": "d2e251a9c99d6547f45cd5242a3df8800b09041ba5637cf2b79c87820f0b121f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064360, "uuid": "9bbbdc30-2246-4cea-994e-6633c8627d24", "comment": "Malware payload (RemcosRAT)", "value": "41038ec753bac2fbbaeda7c8d191e6b83e524559", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064360, "uuid": "536896e9-2065-41bb-9d57-0cdb452b965c", "comment": "Malware payload (RemcosRAT)", "value": "dd34435f3521ba3a93c5ea7b0248eb5477fd09f70f8e542216123a4650d1d6af25c7b8c90d6f5ec1277814fdcdfbce6e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064360, "uuid": "e9897fd9-718a-4824-815c-bbba07e3a726", "value": "T1B7623A9A7A4B13F4DC2729108D8E3489E57D2D23D43205E0BE7E63C459124EAE39DB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064360, "uuid": "b0c00712-1bf8-4bec-be3a-9104bd2c16c6", "value": "384:XTNbD2JZcLchOhKMT+05RNcCQqG4ACXR4WuyTzLU8:jN+h1MT+ENcCW/CXftU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064360, "uuid": "871220ff-e80e-458c-a9f5-1548f14bcd0d", "value": 15373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064360, "uuid": "8737e454-a81d-4157-bea3-1563f3078e7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064360, "uuid": "2e02daaf-42bd-4d29-af96-bd5265344e8a", "value": "awb_shipping_documents_bl_02_04_2024_0000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f93892-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1712046571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046571, "uuid": "eb07097e-3247-47c2-bf72-b03716b27668", "comment": "Malware payload (Stealc)", "value": "3041f5c81c035eea4226ce9665f7f06e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046571, "uuid": "ac2ad83d-64c8-40bb-90d9-9d1605af524e", "comment": "Malware payload (Stealc)", "value": "d307a960d51352067a2b44e7ddc1f4b6efd9821cb9de3512ef70bfe42ca6a726", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046571, "uuid": "3ab28d1c-7afb-434e-b660-1e594ae02cfe", "comment": "Malware payload (Stealc)", "value": "0941a01c89fa6154f68a1b82e0e38ada2db58f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046571, "uuid": "0486e497-1e65-42ca-b81c-134bb373bb6b", "comment": "Malware payload (Stealc)", "value": "8cff8832bf7bd91898258a25ef62d3e8d4ac657edd6db20e79d0f4387fc32963506dff40a1165a7bbec2a001fa0915c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046571, "uuid": "36c7d407-4e2f-452e-84a2-6ea05d8d7a6a", "value": "T18D24AE02F6E1C43ED6A719314874C2E11A3AFD725FBA919B73983B2E5DB1EC05A35342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046571, "uuid": "f15a698b-0341-4fa7-888b-e24a60ad60f4", "value": "37e790ea5156f496ba5ef90577d31fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046571, "uuid": "b94a752e-278a-4c93-a679-a071a448885e", "value": "3072:1y6WJ3/VFudwk5xjmk7bdKBy/DegWDPbYnzMkOBvHhtIUB4LAF:1y/3/VFur5xiHByagSOgrRBiUB4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046571, "uuid": "68f88ead-ed87-4e4c-83f4-a0f383c22f31", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046571, "uuid": "a6a60d04-9ce4-48d3-bb2a-f6ac13651e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046571, "uuid": "87393ce5-a6c3-48db-a0d7-503e4f28fb76", "value": "SecuriteInfo.com.Win32.RansomX-gen.4468.18196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204913ed-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712046570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046570, "uuid": "86874570-a980-40b6-8aac-c51f124560a4", "comment": "Malware payload", "value": "be13c1f3bb7c58b3387450f5d6cae529", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046570, "uuid": "766702c5-4af6-4de5-9b98-06265a3d907c", "comment": "Malware payload", "value": "d442843ba4dd07287f15e7b9bdf5aecb9e688d606a243afd2b1ea3a06533621a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046570, "uuid": "613b63f6-2b6b-4385-87d5-b7e37192d43e", "comment": "Malware payload", "value": "7439b6eba208816d0d5a9742800c41e80939d42a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046570, "uuid": "6e5dabbe-fd14-40bb-bbd1-3af8a93f0578", "comment": "Malware payload", "value": "13b8a3e9059d8c49c8915ff38921bdfd6f9828887feed753162cf6738f07d945b58a3c657efffe05a29212ad0d0563c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046570, "uuid": "e46dfd2e-367b-4bc4-ac25-29a8cc13b3ba", "value": "T1634633C2C0731963C5851C49E20C2E9286C6EEB594CCD163BC6EDAF2DA79EEF075016E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046570, "uuid": "7d2bd9e2-29b1-4bbb-ad4d-fde8443d93dd", "value": "98304:ZRUdrY1DYMqR8ytr2tq/xWOqR97vqOKQNUZ4c3UnxNlpGikYj8g:DY0L+wqpWOqR9DbKZ4rnxNlpGikYj8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046570, "uuid": "cfad31b5-a604-464e-923b-87c727b2e1eb", "value": 5566468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046570, "uuid": "abf5dbc7-94c1-4bd1-b12d-01ddd722036b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046570, "uuid": "0f68714a-b69e-4335-98ba-524568eb14ba", "value": "SecuriteInfo.com.HEUR.Backdoor.Linux.Sshdkit.n.27451.18738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32de56d-f0a3-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1712029717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712029717, "uuid": "86cd3841-fe6a-43d7-a471-a6df52ce8829", "comment": "Malware payload (IRATA)", "value": "85265b678d2f194c75153724dbe62d43", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712029717, "uuid": "7a6a1beb-e8ed-4ffa-af76-0e9da8ab7b06", "comment": "Malware payload (IRATA)", "value": "d4aa85afc4e79e605395fdbb7b8c31b9d31f8bc3912b6419cdeea59084599501", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712029717, "uuid": "fac2581a-547c-4610-82da-40163c79c332", "comment": "Malware payload (IRATA)", "value": "78c9d81a695033e5dbd25b77539f6c8cbd953703", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712029717, "uuid": "0c1ce6d6-979e-46be-89f0-cc34a89f3ee8", "comment": "Malware payload (IRATA)", "value": "3bea7611c7759d4be7ddb82bfda2c4de8e41ecb16bed6af30346ee747266c89021c83934780bb09c262d6c234188c9e6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712029717, "uuid": "ef4f9e34-457d-4487-8fce-8e452621952a", "value": "T16A162357F3666D13C8F5C3722574293A11764E199B07B38A39187BFA2EBBCE80B841D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712029717, "uuid": "8fac7d4a-665a-498d-baff-4d54b7165567", "value": "49152:F/DkMk8fqOTSRZWPwo6yY2kkmX73ZrOHK8o9FNCCN21pR5/5TXSUo1e9KJ+byzcn:dTqYjwZAkkmXN8o1CCipRpX7UP3ltxP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712029717, "uuid": "a40d2efd-418c-4c7f-b323-ec84d1f0cc8b", "value": 4034973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712029717, "uuid": "1c02abd7-d48d-44aa-9cb1-6724e7661321", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712029717, "uuid": "db79abf0-e940-4f05-b2f3-e68ef1a0adf2", "value": "MissGame.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9765b75b-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039468, "uuid": "db37430f-377a-4a91-ad6b-53de52ccd313", "comment": "Malware payload (Mirai)", "value": "9de14d1524dd40982bb14caea6c57b35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039468, "uuid": "e0ceb76c-575a-4f4a-9ed2-ffa6009480cb", "comment": "Malware payload (Mirai)", "value": "d57d95b17aff264e0125c0b773cb62284cccde3739f92611e78494ca35f87d45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039468, "uuid": "7029d858-737e-4923-87b9-11a9214317b2", "comment": "Malware payload (Mirai)", "value": "37ef09867e2136acf56e2e774a458a9dbbf7be01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039468, "uuid": "6535377b-8484-4a0d-8d81-1bbf415949f8", "comment": "Malware payload (Mirai)", "value": "c01b0a639d38dbc4add18f21313196b7bc2ac93e7dc1858175c03b37fad4d8d08e0ee37ef83f479ebfa6d51126e31ab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039468, "uuid": "69059e26-acbe-43e0-9836-d949c9fd6e11", "value": "T1E0735B24A93A2F26C1D4A17E62FBC321F1F6230E25B4961C3CB60F8EFF1465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039468, "uuid": "df1780a8-2d58-48c9-a956-22009a62205b", "value": "1536:ubHmkTSo3BOIqS5aq+Dc03lR9QuEk6vNNicKzfZFx8:kmcjaq+DcclJ+vN4Fzfp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039468, "uuid": "3c54b31a-9bcd-48ca-8a7c-74b8680998d1", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039468, "uuid": "4b77f8be-3bed-4927-90d7-8adcb6659328", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039468, "uuid": "c5b78f98-8147-4331-80f0-6794094a05d8", "value": "9de14d1524dd40982bb14caea6c57b35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65638426-f0ba-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712039385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039385, "uuid": "589bbc89-3a31-4c65-95e4-7217679a35b1", "comment": "Malware payload (Mirai)", "value": "0c0ff536f9d5cb7a77de733ade71db3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039385, "uuid": "3d13bff2-c602-4413-859b-222c2ed4a30d", "comment": "Malware payload (Mirai)", "value": "d645d1485791ebaa963a387884f46099fdfb9ec1e6d520d2f8f154efd799d4e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039385, "uuid": "fbfea799-7b89-480f-b9cf-3a4a85d77c64", "comment": "Malware payload (Mirai)", "value": "7ec33473171fa9832b976c3ae05c985c69791270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039385, "uuid": "f11e3c7c-2ada-4f29-9dd3-5dcfab7b09d5", "comment": "Malware payload (Mirai)", "value": "ed271dd67925bb8230a18b3174ab96fd5287fef1f763730390b5cf8d67d59e3487c051578a173c09d2666aa60e26482c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039385, "uuid": "5608e54d-8837-43ed-83f3-78e73f27c296", "value": "T1F553024FBDFB6C4DD29F9438549D0AE15A052789C7C3CA9A5A124C49F02BAC62FCD87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039385, "uuid": "56b0ec4b-b9b8-4caf-8904-d0fb92b5b043", "value": "1536:A/FL9mmdU2P4df2td6a83oNv4SnU01me0nMLjy7Nvg8Re2:Mf5cejj83oNce0MPSNoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039385, "uuid": "7fc1fc44-ad7b-435f-bf22-9ab68e8bf85a", "value": 65180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039385, "uuid": "5e3026a1-8a5c-45f6-b610-c93f4eae0218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039385, "uuid": "dc49bc80-0830-4c52-8911-4896ae4ebd1e", "value": "0c0ff536f9d5cb7a77de733ade71db3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476f0ad9-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712047065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047065, "uuid": "65496641-ad7d-421a-bd64-0d88ffef8a11", "comment": "Malware payload (Gafgyt)", "value": "24654be7bb525a3634f7d1229e965f62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047065, "uuid": "99bfa6b3-6262-4f57-939f-42369bd21e9c", "comment": "Malware payload (Gafgyt)", "value": "d71b600752b028cb1666c54b600c5fcdaeb74575fdf59094f49923aa1416435f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047065, "uuid": "37a39437-bc74-4b06-b939-cd2c21bfe43e", "comment": "Malware payload (Gafgyt)", "value": "60aa083370cbf38db1d73b0aebf293a0c1ffdf1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047065, "uuid": "2a27cb95-7377-4af1-b983-a34c0c3e2bb7", "comment": "Malware payload (Gafgyt)", "value": "82eeab42255dacb4862c2513e7e0b34de4c62c95a6ca8d9e4b4d0abe209608bd7cd0aa224647c767fb8e81e926986bad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047065, "uuid": "77849423-1079-428c-8003-2f4fe68c315c", "value": "T188C33BB5F740C672D18301F2119BDF624D32F2F7169AA54AE3682DB0CE6A1827563F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047065, "uuid": "8eef89ea-2148-4f4a-a8f4-0b70b44d9aab", "value": "3072:ShhAfn3U8UXULUwUbUJ1hYlHRRDsBOnRt5h0kE5mJC0OzQaGyPZk:SAf3ts05gehYlxO4Rt5h0nmJC0OzQaGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047065, "uuid": "c9f3acf8-0baf-4f33-a839-53840b64704b", "value": 123364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047065, "uuid": "abccdd66-5c53-48d5-a5fa-1928dbf1edbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047065, "uuid": "4beb3b4c-a855-4049-a1f2-cf94d8a55273", "value": "24654be7bb525a3634f7d1229e965f62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e572e6e2-f13e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712096293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712096293, "uuid": "3055b312-df5d-4076-b4f2-d4223b5418b4", "comment": "Malware payload", "value": "8e047f6425b7cea3bcbaa0f78f5f7e14", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712096293, "uuid": "acb52ec2-af3c-4e31-a191-0e21c2ae984b", "comment": "Malware payload", "value": "d8aea7be5efe36eb90538c5f54a02f966e95bc6475c836d94795ae67f7ff15c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712096293, "uuid": "02937b68-13ce-4039-81b5-005f01cbb0d9", "comment": "Malware payload", "value": "815c48877684459d0ef854e868bdd6fcb3e79274", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712096293, "uuid": "957d9538-16b6-40f2-a878-bc70e912ae58", "comment": "Malware payload", "value": "732c28949b12248bbbc5595e9d88bf819f74e8771c047b749573bc5997c23cba16d4307573a7954e7e7563d783199d94", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712096293, "uuid": "b6f0bde3-6a72-4f4b-8b23-165de58e6bcc", "value": "T1A9914B4253FA0210B2B39A0C997666794F77791A687C820C05BC2C1D6FF3E849C267B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712096293, "uuid": "1f897e90-ebc4-4288-bf8b-3f89fa8b8a3c", "value": "48:WTgpFb0AdhwfG6p+IhWJDUTUg5FaAuaaJZGZUoUuUdO9Q/KjBo6RBNamMB9Ug8h8:KMh/76oMG2am4Twj+nxYD8fAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712096293, "uuid": "0d8d7631-e336-4407-896e-2e05d2c6de33", "value": 4230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712096293, "uuid": "f52ad18c-f6b1-4477-b2ae-cde3966ada44", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712096293, "uuid": "1392e656-bbcb-47c7-8441-a417638bcf7e", "value": "R9283762154.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d9cb4e-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067220, "uuid": "c9734c10-30a5-4be9-bce5-236e76ef7677", "comment": "Malware payload (Mirai)", "value": "00909e59eb07d5faa46e2a5a3b58bd5c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067220, "uuid": "d0c101f0-d020-413e-bb85-c1fbe7cc561f", "comment": "Malware payload (Mirai)", "value": "d8de25662a5d43aa34a7c11c01f437df9649d76b69168116b8148f31de6b4fa4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067220, "uuid": "c74fad88-e120-4264-a378-f71573485b8d", "comment": "Malware payload (Mirai)", "value": "4379f3ae24b5f63ab4ff8992bcc0ee779907f040", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067220, "uuid": "bf28d03f-ba76-4d53-9922-f4dc3d501bfc", "comment": "Malware payload (Mirai)", "value": "8cea84d9f9aa7f19691bc6bb0574bbd4ab4db1b45ca6ca81ed6fedb0a848afe5e1c33e9c0463b0741b37f4c7779201df", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067220, "uuid": "dbb6edcf-595d-4ee8-91aa-a5fd0f364edb", "value": "T10A331903B856C0FCD55AC2B199AFD572D632B8AC51307D6F0788FA722F29E31665EB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067220, "uuid": "1e3a4e80-84aa-4e6b-8b5a-1b6ff8fd538d", "value": "768:NgplhD19+0yAuhIlCmWRP0IuYebtkaBLtR40Nj5UEr:ijxyUCmWRzL0JtZNjZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067220, "uuid": "e959c681-edef-45ac-8cc3-78896ba90c08", "value": 52296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067220, "uuid": "ea383ec3-061a-4beb-a513-84ce08ff9376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067220, "uuid": "25a9d595-ed0b-482b-8546-e0853be2f85a", "value": "00909e59eb07d5faa46e2a5a3b58bd5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46f897d-f08d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712020297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020297, "uuid": "8ada02b1-8098-4e17-a678-05f360770117", "comment": "Malware payload", "value": "3f3f172dec6be473761ea22c56d720f8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hakika Loan", "colour": "#FDF5B6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Tanzania", "colour": "#4D230B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020297, "uuid": "43b04707-864d-4c39-a1ae-3b04dab3fe48", "comment": "Malware payload", "value": "d8eca9954be450ee42e68e460fe514bf4a6421f53fe971f0d5a430d48ae22080", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hakika Loan", "colour": "#FDF5B6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Tanzania", "colour": "#4D230B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020297, "uuid": "de555e75-3d13-444f-b37f-bbec62052eef", "comment": "Malware payload", "value": "9134077a16a225dcc06980e5affc70283c2ded5a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hakika Loan", "colour": "#FDF5B6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Tanzania", "colour": "#4D230B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020297, "uuid": "0cf81f3f-92e4-41fd-b99f-5304b95e7547", "comment": "Malware payload", "value": "9c52ee60a0635771e88437a5a908b5814e02b68fb019b861f9fe18cc200d5417ee091343a1e07d5286c25838543f24d0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hakika Loan", "colour": "#FDF5B6", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyLoan", "colour": "#AB320F", "exportable": true, "hide_tag": false }, { "name": "Tanzania", "colour": "#4D230B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020297, "uuid": "4e74a701-ef50-4c0e-8a30-48f8e1aeeb7d", "value": "T1E7A61296F768D91FC4777032096A6335115B4C168E839B8779483F4C38BB6E84F9ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020297, "uuid": "693501fe-2955-45f8-9b80-1988b12f42eb", "value": "196608:xTz8lANd6DiZJhChOhTkVdgkkQyggiUMK5MH9T8fMu:x3sANd3ChOhTkDgkFUf5MH9Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712020297, "uuid": "a31399bf-fe91-43f5-9fcd-9a678c45f20a", "value": 10242346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712020297, "uuid": "b2ebbd9d-e88a-4777-b2e2-4e54411cf2fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020297, "uuid": "2e5e4301-746a-4260-825c-577a9a8c7162", "value": "com_mdqqkj_hakikaloan_v1.1.9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db13f1fa-f110-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712076519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076519, "uuid": "f19e699c-3198-42e2-b828-8df867a8ec87", "comment": "Malware payload", "value": "9cd6bf3c09abbecc45bf9cec6abb3789", "object_relation": "md5", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076519, "uuid": "cbe85bb2-1508-48ed-8750-05e025d74011", "comment": "Malware payload", "value": "dc2fc4c40093403de407508175ad7dcd74996827bc6c6748ef3b83b0a65d4148", "object_relation": "sha256", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076519, "uuid": "ea51e507-1de8-416f-b2c7-732ee6de052c", "comment": "Malware payload", "value": "2c5d92a627bf760331130ec12eb566931ba492c0", "object_relation": "sha1", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076519, "uuid": "c2514c43-9ef0-4e66-bf4b-ec3e101d1d4d", "comment": "Malware payload", "value": "fc9661dfd4945c82a0dd03cc1fe503b5653b1097f31ae7abaa597fb34dfc960bada78fd40f19b12acf32598a9ebd711a", "object_relation": "sha3-384", "Tag": [ { "name": "40.66.40.211", "colour": "#DB737E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sky-beta.com", "colour": "#2AF68F", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076519, "uuid": "ba6a0d16-8a34-4252-a539-3077975b4a1f", "value": "T13F08335DE35A7621E815FCFBABB47124D991B5C336F5D0B37FA02E806468603FA684C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076519, "uuid": "9d6a38a6-2813-40a1-a85e-0a56198c8c24", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076519, "uuid": "05466bb1-bba0-4b1b-861d-133a1ffafced", "value": "1572864:hxJ39KOtDnuvx/9MXI5B8ceyIS7nqYdd6hIEhSmnJZxRByuoXFPD:hIODnu99Mw/vP7nMhJnzxRB5oXdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712076519, "uuid": "0ded3b44-c818-4c89-9d32-846ca70697ba", "value": 84176653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712076519, "uuid": "2e5dc05e-5df2-437d-a70b-a79c99eb4d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076519, "uuid": "f1dae77b-bee0-4c27-8c3b-2eaee0e75c8c", "value": "Sky-Beta-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4969a7-f090-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712021515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021515, "uuid": "44f3f713-65e2-4e6e-b82b-541208658560", "comment": "Malware payload", "value": "4d2a2a6737af7c7984ec89d37e75aa48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021515, "uuid": "da1b336b-25c8-4d8e-b777-5861fc1583f4", "comment": "Malware payload", "value": "dc406dbe3c30c9308bc0def4cee4071c35e6e8af6b619f63108e48744069b2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021515, "uuid": "866832a9-7464-4384-9af7-c35f79882586", "comment": "Malware payload", "value": "11e216712b562212e73ce8d366aa635d3daafa76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021515, "uuid": "9c3ff9a9-27e1-483a-89be-f9d43b1bc0a0", "comment": "Malware payload", "value": "f0fb7d44f609d015ddfabeaecf5e096d07b56c6e49fa83a931eb1a27f558fd109889858198829056ee07f543ef6cb230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021515, "uuid": "6a20fb22-10db-49f4-826d-0eb9deb0387c", "value": "T118D533027BC69AB2C07315379E11AB50A73E3D704F36CC8B9394561EAE722D19A36737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021515, "uuid": "7562a5d1-967b-4c21-be00-47e8c2d817da", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021515, "uuid": "b14334b1-b480-4442-84b8-576d6c5f50d7", "value": "49152:9ILcYrh32udV72vSX+emxOg4H5yDCqGeymbZsssHvvLrMD14iRVQ:9JYrh3JXKvfggK0DOm9L0vvLaFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712021515, "uuid": "504c2a42-6d4c-4187-b86d-35ea2a218833", "value": 2991648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712021515, "uuid": "5587c8af-5ff6-49d7-be4d-a081a864e9e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021515, "uuid": "ede9f19f-e249-4fba-bdaa-eacb4a100c39", "value": "SecuriteInfo.com.Trojan.MulDrop26.43748.22516.12564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b7d1bc-f0fd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712068136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712068136, "uuid": "7ae929ab-d2aa-45ae-8e1b-3dace1fd9143", "comment": "Malware payload", "value": "4a9cfff3e3291632882c4c74696f984e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712068136, "uuid": "44dcb483-5a1d-448c-bb98-944b7300b0b0", "comment": "Malware payload", "value": "ddc63974ae0d40f205c9260cb191e54fec3804659427a7f8184543495e66946c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712068136, "uuid": "c062d093-cd4e-47ef-87cd-3ee7129c8c3a", "comment": "Malware payload", "value": "c35bcd9c752b4a9d03f31162f4499aa9d00c5d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712068136, "uuid": "04437691-24ce-4560-8176-4be0cca26b0b", "comment": "Malware payload", "value": "6eb5afefc1d857cfd04e5fa6d0aed06e3517ee4bc4fc6f3304ae562ff0691d4aa5637820b0d5afa9fa11184d7e5a3ca3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712068136, "uuid": "a8c6993c-c969-491f-ae69-c48d040c90ab", "value": "T1B5473347F9929AECD1AEC174426627B2B732FC6C45306B7787D08B323F4AB105A8C759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712068136, "uuid": "0172f1bf-55e8-4caf-9fbd-1c96e95463ce", "value": "4968a00e8017740306d0d35ab4f23b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712068136, "uuid": "8cc08e53-10f2-4d26-84e7-9f041a27fcb6", "value": "393216:gRkAHpSlMdyiQhJE4wS/JVywizWb+sCLvSkI7Wb3k7+FAWdwzf5NpckWWh:gDHpciCJhxPiz2+xKktbJFzdqFck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712068136, "uuid": "0c980299-130d-4756-810f-4efb7813b1d5", "value": 26442680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712068136, "uuid": "c4187025-0ded-44b5-99dd-53f74e2d13d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712068136, "uuid": "59e03670-dfee-450f-a815-eafb57a4de6d", "value": "final-windows-sign (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f997e8e4-f0f5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064974, "uuid": "33041aae-e386-441f-95a4-bdbe3b1ca133", "comment": "Malware payload (AgentTesla)", "value": "ca2251224ad1a6bacca9194491655acd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064974, "uuid": "0798b1c4-431f-428a-a491-1b433ce3b991", "comment": "Malware payload (AgentTesla)", "value": "de46dee41975e8d0df4a6ae2572b5ebe94e343aa3871b2358c1856e347654d76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064974, "uuid": "fed6431e-6283-48fc-9308-140b8646d177", "comment": "Malware payload (AgentTesla)", "value": "44cfea1b56dc882c1c23764b2c5e2dcba6655662", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064974, "uuid": "ef7ee103-92c1-47fb-9ad5-a74e0ad4cf26", "comment": "Malware payload (AgentTesla)", "value": "8cd23f13ce0771a7656661d2531e71d78f6a9a1caad736a2a45596e5afe71e8179fd13d8e0ee1bbccf3d72cab74268ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064974, "uuid": "7e923013-ebc7-4d7c-b4d7-38cfe23692d3", "value": "T124D4238077BCAF3AE63223FE14F5392113B9665F5A56C74C1E8E52C10872F945762E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064974, "uuid": "8252a32a-4f90-4c97-bed0-a3862543324b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064974, "uuid": "aedd0358-842a-42f8-91a4-be34e37dc8b6", "value": "12288:a073Mln7HJjkYlWn64B5fMWpYmjBvl+b1WedCIYjUSA0Vls8nYgjHQjA:r3Mt7Htnl34BpI69cUIYY+lNFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064974, "uuid": "452dbaad-c994-421b-b771-777930ee9c6e", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064974, "uuid": "a40a6afd-8d0c-488d-8aca-86be68f586dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064974, "uuid": "4380fb40-fcbf-4230-9439-baa66fb1ea7e", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b093d4b3-f0bc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712040370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040370, "uuid": "44223436-9ca0-4be8-b32f-49bb66381d53", "comment": "Malware payload", "value": "906b3611f5349bfb096e74188bdc8994", "object_relation": "md5", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040370, "uuid": "1951a4ec-9a77-4dc9-a4f2-ef8e6faae580", "comment": "Malware payload", "value": "df0c2424b48b3e388fe31b469ac95076bd82d5222efe9dc0ef3fffbaedef047d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040370, "uuid": "e59a3dbe-51e0-4685-8b59-01896f10f610", "comment": "Malware payload", "value": "38bc1c5287183497970d3bacab7c86edb7640cdc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712040370, "uuid": "7651658b-1dd8-4151-a751-952274e6eb68", "comment": "Malware payload", "value": "8b381eb7af00b82ca1c192964346e4aa14572e5b12cce84e6c3db088a352c571281058ff67352b1738fa22b48217d809", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2024-3094", "colour": "#B95743", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712040370, "uuid": "0fa68db8-5e7f-49c8-9a67-29bfdd2c3c95", "value": "T133345C59A5A1F4F8E15EC830C65B8B2322F1B0A52620753736CC9B7D2E6BF70665C723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712040370, "uuid": "ceb7b2bc-1146-4ca5-9ab5-eb1d0dbd8514", "value": "6144:6HnENsaYiiUoVfpfLmOp+FQ836k6tp9YOqo:6HEKiiUKRipX3Kbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712040370, "uuid": "b6744a80-2c1a-4b2a-888e-9eb700f79cfc", "value": 249216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712040370, "uuid": "9543e8d2-959a-4a80-8c61-143ff0c66e60", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712040370, "uuid": "92eddb00-bc40-4b2d-b302-6a7938f4a111", "value": "liblzma.so.5.6.0_fc40_build1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efebc72-f108-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072740, "uuid": "45d714d0-09b8-46b6-b0f2-604f1ad6ac0a", "comment": "Malware payload (Mirai)", "value": "3006393ef36dd8b1f985da671ef2aa03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072740, "uuid": "44ff1946-c5b7-46ad-ab70-ff78f739b026", "comment": "Malware payload (Mirai)", "value": "df54aa7b41f71ce4605b834586485d21713f10b70de0f180a941cd68a6b8bd18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072740, "uuid": "80c72305-a22f-403f-8a21-bbef0e034cf6", "comment": "Malware payload (Mirai)", "value": "39a40451966b0bfb44e438a8ccfd553c55d54016", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072740, "uuid": "0443cc00-dded-4080-ac1f-a1bb8cb13874", "comment": "Malware payload (Mirai)", "value": "986c933c33070e5f626b0628fd5419b96485a8b6e07f5df5145a147baa8df9ab4f8c18022bb3a23a0d9614405687febe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072740, "uuid": "4f2c3f85-25ff-4c49-9b29-7e9cfcb56149", "value": "T174C3405B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072740, "uuid": "42d40ebd-5f97-4399-9503-a0ff290498dc", "value": "3072:QISPhPh28cVCSudCve0uPgrUiyeVKfj/GPIBWhFb1lqQl:QIyhPh28cVliPgrUnas/GPIBWhFb1ltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072740, "uuid": "be100732-fe6b-4c35-a303-26a152464da8", "value": 127632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072740, "uuid": "6886a256-0889-4da2-8d36-1ef545d7094a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072740, "uuid": "13050791-7107-4084-b3dc-44668e7ee8e5", "value": "3006393ef36dd8b1f985da671ef2aa03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd56cb36-f143-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1712098373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712098373, "uuid": "dc4d6f4b-0500-4dac-830d-cc33d243f692", "comment": "Malware payload (CoinMiner)", "value": "b14b3b1da5e2b04f3ddf04f55a090bd8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712098373, "uuid": "97289cd1-b4fc-463c-ba51-e5272162bee1", "comment": "Malware payload (CoinMiner)", "value": "dfa2a1ac549c911af8183707ba1fed1e8c401f8e448ea36bb7825d03df0f4c5a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712098373, "uuid": "732b8458-ec10-411d-95ee-9511d6acb2c9", "comment": "Malware payload (CoinMiner)", "value": "33a84f949ddae2d47c2c18ab299cf602e6cac1da", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712098373, "uuid": "14acbdd1-c55e-4a54-8b91-35e5322a8512", "comment": "Malware payload (CoinMiner)", "value": "a0e8c278270e34cbb86f9a31edcc8d52719a628d8ecd6e8e10c609a7b89a105c0f9ce7b5a897ae37a412a0aed68144be", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712098373, "uuid": "4b25137a-bf63-4992-a32f-4cb1efc96f18", "value": "T12F6633C51E4FD029FA6B4A7A3776D63203721567ED50A4BDB30968C792ED4CCD008BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712098373, "uuid": "3415fd9b-da27-4b5e-ae8f-2198a9021c28", "value": "196608:9IY6GWuTSSzZINAk+hfz97Kn4R/BXMXCu3fS2k:dWuLK+19TR5XqK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712098373, "uuid": "ff5ab4b6-581e-4dec-8134-154cded6a336", "value": 7023104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712098373, "uuid": "b04406a1-cc8b-4577-88b9-c60e34701b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712098373, "uuid": "c4d16159-7b81-46a4-aa64-228fff3325a6", "value": "b14b3b1da5e2b04f3ddf04f55a090bd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfeab774-f0f0-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712062783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062783, "uuid": "b884e44c-ef58-41c9-ba41-29b3a6a5e1d5", "comment": "Malware payload (Formbook)", "value": "98b47b714262793f885ed37d13a24bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062783, "uuid": "bec633ce-08f2-4246-b74a-b62db89d0e76", "comment": "Malware payload (Formbook)", "value": "e09a94300d0d920a995471c0831f191466c9fad9bca1240656f166e0a12eaea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062783, "uuid": "7277ee78-0449-4394-9f65-9799784cde64", "comment": "Malware payload (Formbook)", "value": "2fd3840a4ad3eb35db1c16a694820d22ba62d5ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062783, "uuid": "dbf6530e-e18b-4f40-83d6-6e3e43434e98", "comment": "Malware payload (Formbook)", "value": "ab60a85ac54fe03a9bfe507303f7bb8cff185c39fd4f8d86652b34af9fcd469ddbb56d6a6218f9934eda2f4c0bb13944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062783, "uuid": "bc01b111-91ed-466e-958f-11800b7f2c76", "value": "T186F4129427FC8A1BE2B727B63830165067BAB9537535E7CE0DC450CB6AB1B8189B0773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062783, "uuid": "175b07ce-55b7-429a-ab47-07808fe599f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062783, "uuid": "52f12128-b5cb-49a5-afa1-e90affff9d2d", "value": "12288:1PGmMZcIFa5NyUZ4skVx1ly9vOXavWtbIUrJ0sEd6ug+Dllw7jmB4vLV0kBm:1M9My+45lSwavWtlOdXm7jy4vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712062783, "uuid": "b571a963-c0db-4406-85f4-3a3462ccef1f", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712062783, "uuid": "3f330c66-a9db-4930-a1f3-33da53cda6be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062783, "uuid": "778290f3-e656-4146-bc8f-cdbe2529168a", "value": "Scan001-929999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2bb05e7-f0f0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712062734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062734, "uuid": "469a28d4-494a-4e92-948c-a53103d3d946", "comment": "Malware payload (AgentTesla)", "value": "4c3d33c8c7d1e811aa93fd9d624cb202", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062734, "uuid": "9404f92f-4cf0-447d-9f94-a7e598d64ce9", "comment": "Malware payload (AgentTesla)", "value": "e145314d3ee28df8575d1aa7f2128db4e74271198737c556def2c738331ee327", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062734, "uuid": "94c86a01-0d5c-4695-804d-1e54ed637a91", "comment": "Malware payload (AgentTesla)", "value": "25d6abe1bc3a84d3f011765216182d60b9b6c9eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712062734, "uuid": "f56e2319-4573-4b5b-8a93-5e263f8e5264", "comment": "Malware payload (AgentTesla)", "value": "d683fcf87df39e22e1ab09f230a9d985ebc921a1b9bd13e53e3267bc02991f2e17b423d914c88f3024e2aa70ef2e7042", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062734, "uuid": "9cf720b6-66df-4b8e-b057-31d3155b7ea1", "value": "T18905E09C3220B2DFC957C9B29A586C64F72174B7630BD643A46311EDAA0C6ABCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062734, "uuid": "d6736206-6c7f-4ccb-97c8-fe428c9651e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062734, "uuid": "6b94207d-a820-4ef5-b64b-e46daacd7f04", "value": "12288:AiOPGmMZcwFaCQMXxNP6AIvGjuQU3xWirtbZ/Y2+LUh03gB5ZHj0lbEbMTqanGTz:AiOM9AMBNP6AsGajBbZSO03gLFjtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712062734, "uuid": "50c14580-6735-44af-bb24-0ef7e5c4a02e", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712062734, "uuid": "1d7d45dd-d36d-4bb1-addb-411385a60544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712062734, "uuid": "2c789405-873c-4545-99c9-4586077b40be", "value": "Order Nr. 5012300233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8b6f3c-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712038808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038808, "uuid": "a878e295-baf8-4db4-b4a4-48c6a2cbb9f0", "comment": "Malware payload", "value": "35b4fbe52724a306c8e53cd22118c534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038808, "uuid": "6f32b5b7-b173-4cbc-a792-fbe63aabd95d", "comment": "Malware payload", "value": "e4d96e9e47bbc2d6971e8f7355a8c1ca280cd746c85bb50d2468dff237ea0359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038808, "uuid": "09a05a57-04a1-4564-b876-d726db20f925", "comment": "Malware payload", "value": "9f2b5794027393d3d9376fe97abf4e2f898b8fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038808, "uuid": "b773597d-d0dc-44af-b682-01a07378e19a", "comment": "Malware payload", "value": "6eed97cab0a2e6c2dc8074580a0f11e0a121b8c012ff139dbf9c4c489453fb69b281e3bb4fecae8c6d7ed63fd0fcdb2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038808, "uuid": "f34c99c5-f2ff-4205-b7ac-e94ef7918483", "value": "T1AC35F141F3D68872E42255798C36D460AD5BBA7849F8441E3CB8F60D29F338358BBE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038808, "uuid": "2cee26cc-2ed4-469b-88b4-9eaf08139b30", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038808, "uuid": "ff2621a0-8257-4c3f-859b-31067333e53a", "value": "24576:+86PUxA9kqKn+3OFDjFeKCCVgsZ+Jz8LDrrF:MPUxAy5+36DjFmCVgHzoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038808, "uuid": "44b451e2-86e3-4b41-867b-8cf434bd2154", "value": 1075272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038808, "uuid": "91397b0b-36fc-4ff0-8a51-ed27db95434b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038808, "uuid": "1882354c-f038-45c5-98e3-a8d3a910e687", "value": "SecuriteInfo.com.Win32.AdwareX-gen.18052.20026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c97b66-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712064457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064457, "uuid": "8aa0c796-dcbe-496b-aaa4-e2fb5c17d64b", "comment": "Malware payload (AgentTesla)", "value": "4d60aebe30f3b48126ad2d105fd664d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064457, "uuid": "f9c026e0-feb7-49d0-95f4-5e08b4242407", "comment": "Malware payload (AgentTesla)", "value": "e577338548e7de96284ffaf1621fd282b0074fe04b638c0410faa7c2edf126e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064457, "uuid": "93f5170b-d652-4c45-a47c-32feea306efa", "comment": "Malware payload (AgentTesla)", "value": "490f8041ca80a5da9a79565fbe1d4cb2454a2664", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064457, "uuid": "76db0b09-e860-42c7-a0d4-ec3507d7df2b", "comment": "Malware payload (AgentTesla)", "value": "a86ca12dfab33326689aa259c3220a9b47d750c310164b4c97026ab60ca7726389806e202dc8341cdfd1e8a1465ec6bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064457, "uuid": "d89727a5-92bf-4af9-a23b-bf6a5a8587b6", "value": "T1CA35BF0273C1D062FF9B92334B5AF6515BBC69260123E61F13981DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064457, "uuid": "237917ac-53a6-418d-8582-d17c07a49772", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064457, "uuid": "a724a2a6-b73a-4810-ad85-f8c17b0e0523", "value": "24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8aYZS3Jb:dTvC/MTQYxsWR7aYZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064457, "uuid": "39d54c22-0bc1-4f2f-920f-7174e15dff1e", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064457, "uuid": "7a09b481-f2eb-4387-9c21-158aec101f41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064457, "uuid": "081d6237-8e49-4138-b352-abc9a9bd13b8", "value": "DHL Overdue Account Notice - 1606622076.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e54144-f0b9-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1712039030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039030, "uuid": "13ccd0a9-6733-4c4e-a46f-9fa7f9b3d67b", "comment": "Malware payload (Gafgyt)", "value": "b973ef187773fd34587085aba6d26b78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039030, "uuid": "cc208aef-3ff2-4389-994e-7bffbf24f4cd", "comment": "Malware payload (Gafgyt)", "value": "e75edca14f5b7fdac324704eca669d32b55037fbec14b82754db70532c0436a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039030, "uuid": "9fbbd3af-3540-4301-966e-9b7349cc110f", "comment": "Malware payload (Gafgyt)", "value": "801b635eadf8785c72b2b0398614b9a0c72d3b80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712039030, "uuid": "879602a5-cdf1-4469-8504-47139d5817ca", "comment": "Malware payload (Gafgyt)", "value": "04611b4abaa0d54db526acb64525cb2bb371beaefefb7ccbb69b6a8381ba9c9f5c3577594b2615d53fccf6ffc9ec29b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039030, "uuid": "67bf60eb-57a6-4a7d-bd4c-11d7870ec0e6", "value": "T126D3E876F801DFA6F00796B104D78F216E30ABE30B9221567366356B9EB31D63C63E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039030, "uuid": "7f945beb-0ad3-4008-b2ad-a6ba3596ab06", "value": "3072:uaMQpoffseneg2aLyfuEJ/r4Aiik0gwyK3eJ3U9Dzmzj0qDJNYyoPe:ucenGfuEJ/rRyKuJ3U9Dzmzj0qDJNYyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712039030, "uuid": "40d31f4d-8b42-4b8c-9416-7cf5bfe6df22", "value": 140736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712039030, "uuid": "1f8eaed2-bbcb-4b35-b245-bc2a52200cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712039030, "uuid": "94ec3bbf-2b52-4d69-ba74-b9dfa8767569", "value": "b973ef187773fd34587085aba6d26b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f54c7bd-f0b8-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712038623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038623, "uuid": "082465f0-e64e-4530-a024-a241b3529804", "comment": "Malware payload (Mirai)", "value": "704fc35e812e23322506b542d02f4469", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038623, "uuid": "38a57b67-d975-4622-942f-b3952c9aa09c", "comment": "Malware payload (Mirai)", "value": "e81b79d6369d34d63bfc818f19075a8e282a0907b1f0b0b9b66120b32abdb67b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038623, "uuid": "8907fe4c-f668-4337-9b8d-52a55490d0e8", "comment": "Malware payload (Mirai)", "value": "17f1d9538b3151f110be7737cf2deeb1ccfe25b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712038623, "uuid": "e56006ff-e0e3-493b-bcb6-3da0842944fa", "comment": "Malware payload (Mirai)", "value": "ae974da21e7354e920b2159db5192d44e767df751ffb8d610179e445c943ab2e060c74e16a5cf887aa826fa5cfe2d12e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038623, "uuid": "dba4e18e-d370-45ae-915a-f3275ace9a0f", "value": "T1DC63840ABF650FBBEC1BDD3745E91B09208C641A12AA7F367934C918F65B64F09E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038623, "uuid": "5f8c2023-fcaa-4344-9a73-d6ccdb673296", "value": "1536:iOi4So5bOx7Tvp0DH6k85kMmQDARIkNjs+:iho5CZLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712038623, "uuid": "6491dc85-bb54-4271-bf21-43cddd9d56b5", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712038623, "uuid": "7838fbbb-e265-43b5-b4c6-d3c28589e587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712038623, "uuid": "19c58445-2158-4bce-a6a8-85c4c46108a1", "value": "704fc35e812e23322506b542d02f4469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d0d80b-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067195, "uuid": "f681e0f7-a875-40b1-98f0-3f7590933466", "comment": "Malware payload (Mirai)", "value": "d387bda3485fce493e51a1d61b276926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067195, "uuid": "d40f38ed-2fb7-4074-a3c4-433dfd90a0e4", "comment": "Malware payload (Mirai)", "value": "e8935ef32fc60ad9d9e49080c5b13e5c9488fd52bb55ae0a15c7f7ffa7a43b84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067195, "uuid": "24850ff6-1457-4166-b260-a31292cf6529", "comment": "Malware payload (Mirai)", "value": "9c0c834c3f2cfc42e8a0c55880936413953a6b78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067195, "uuid": "98b11b6f-d669-4f14-8777-6063a5779ddf", "comment": "Malware payload (Mirai)", "value": "7123b2ff80ce4c12e65ff4e20d775df930ba52883e2383a9dea165339d8d9b4d311efca4b18735275c9d451faa98430a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067195, "uuid": "efefbefa-98cb-4de5-ab76-731b8ffdcdda", "value": "T1CFC32086BFA03FBFD81ECD324198CA06129C4A5953A4AF7B5E74D404B69B14E5AD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067195, "uuid": "14705f07-a178-43d1-88e4-6f7cd88cb560", "value": "768:GNNT1Nc12cVJ4vTYAc02GeJy3B2LGF2ahPur8zhkbDrjeQ6BN8YJq6J9yx9Ly7YW:GJ2Gr4cubDr6HBN8DCoyEElqXyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067195, "uuid": "e0511a74-5a62-453d-9791-4a81c6786ee8", "value": 120016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067195, "uuid": "fdc968b9-87b5-4c3c-8baf-729ee47f4088", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067195, "uuid": "0e896d6f-83de-41e8-9caa-8e08c2c31ba7", "value": "d387bda3485fce493e51a1d61b276926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5b62a9-f12a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712087612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087612, "uuid": "1e38fcd4-3022-4455-93f8-7d79e4a0ed4d", "comment": "Malware payload", "value": "9195f32b03ff544879942907ead92f93", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087612, "uuid": "ce89eefc-6ac7-475e-8274-6f12a61923f0", "comment": "Malware payload", "value": "e8e5898e27ece32ed62a05b6e7b582d31cd41c41a26ec8ef6915787712f1a7db", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087612, "uuid": "b1eec519-a62c-40e3-968f-09eabd245a58", "comment": "Malware payload", "value": "6c69d134f6abde5934bcdc8c759db3e1074a9a45", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712087612, "uuid": "ff0b5fa9-48d7-4f83-9f6e-2a865934ef7d", "comment": "Malware payload", "value": "8b115d9eabbe9d97c9014850f068aa8a1b360af678d680932bce4d78bd84f73e352ee7e3b9f417d809055a0099438399", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087612, "uuid": "a410d2ce-3a6b-4b73-b138-e6cb82773081", "value": "T12F43600BBA7BDA24D04CD1B01A5682D310697F065F6A95C7729F7E38B8F92306B4478E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087612, "uuid": "9664d6da-0a76-4a29-8220-2bf962516ebb", "value": "768:bWNQ278rkibGBlwPHqRwotEjuGiPpmb9tLiDUxz99:mCRqvpmb9t+DU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712087612, "uuid": "09b906ec-e1c3-411a-9ef8-a5fe63d74733", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712087612, "uuid": "78eacc9a-e199-4fbd-ab19-62cc407daa07", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712087612, "uuid": "85947dd7-a886-4a47-b59c-4a4de48df307", "value": "faithful.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a00ab4-f0cb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712046572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046572, "uuid": "0d96d908-07c6-49f8-925e-c48a3ab7e457", "comment": "Malware payload (Mirai)", "value": "bd8a4c80df6f39ef1e45abd21f10db42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046572, "uuid": "41266bd7-3952-49c4-852d-0873e175ffc8", "comment": "Malware payload (Mirai)", "value": "eb8bb8668f6c00f9ca1fb7873ba67fbd194f8a453db5b3786636c66aa6610d85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046572, "uuid": "e5e766bb-0f79-454a-bf3b-30e29cde10a8", "comment": "Malware payload (Mirai)", "value": "53ce06901807797df159901cef75c349d46d2023", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712046572, "uuid": "913640af-eb6f-4720-b67a-5a63495129e9", "comment": "Malware payload (Mirai)", "value": "b11ae60df9cf8d067289bdab6a7cc47239d0ee1c75b70bc26995d6791a7fdd6a362cb0b0bf8828f42ae7a203a571ae73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046572, "uuid": "1e9d19ee-024a-4423-8969-d2d60b2f11ce", "value": "T1D95302797BCEC161C4203431AC188E4778984A7D99FE7117259E53ED2FB26C8AC6CF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046572, "uuid": "bd067a08-cdf7-4c23-85e9-f34021133d6a", "value": "1536:zYF2EJhKdOyuJOF8oW1+67ZG/x3vT6CCFtXxbbLC:EF2u4IR1+67ZG/56dFhxLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712046572, "uuid": "15651474-3afc-420d-b642-d500e641acbb", "value": 62608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712046572, "uuid": "6dbf3201-de25-416a-bf8f-db6ca46a83cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712046572, "uuid": "70e421e6-d541-4dfd-a141-c2738787a84a", "value": "SecuriteInfo.com.ELF.Mirai-GH.11725.30265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d89a7c6-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1712064363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064363, "uuid": "59ba2731-05ef-4cd2-9c10-e8eb2287e17d", "comment": "Malware payload (GuLoader)", "value": "8f6784a11b0fee19d472f1df569eb154", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064363, "uuid": "20c81a8d-e0cf-4d3a-8b17-dfeb0f779e43", "comment": "Malware payload (GuLoader)", "value": "edb5e837b28745dbd7456038eb11866906ba66f2114342c906e1024323055c70", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064363, "uuid": "831d98f5-1cad-4afd-9e8d-f3f5866c22ef", "comment": "Malware payload (GuLoader)", "value": "34d8314f00fd2161768d2760c501fa9c8cf96b70", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064363, "uuid": "1395f1a5-5caf-4b75-b633-9e59011bfb1e", "comment": "Malware payload (GuLoader)", "value": "c4ff41ecc266b374854b647cc892604c842dc046b7f130ccd8ba626350354b3c6418490d2040058d5d8d339c1b44facd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064363, "uuid": "1a22f631-9128-4883-8686-2d8670ba7495", "value": "T13903F0DAE5853BA859463A7BDC8716F24E78000C73332E38937D91CD718BA58697FAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064363, "uuid": "04b84e97-941d-427f-8eea-b826cbc51389", "value": "768:u0BgBuJ2WAZGc8NnKwiQVBibfFPWHHUSTHNeC7:agQqNnKwwP0HbHNew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064363, "uuid": "3750a3d2-d2fb-4763-95fb-2eed82d94a24", "value": 40140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064363, "uuid": "9c924bfa-cf88-493d-8441-fcb71da359ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064363, "uuid": "29cf4ae5-b9c8-4afc-872e-570456a09a1d", "value": "QUOTATION XS-2024-02-04.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77ab574-f0f3-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712064084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064084, "uuid": "5a2b6046-e914-469b-b973-3159777f442c", "comment": "Malware payload (PureLogStealer)", "value": "1d7c7d062a72a414aaac6628b6604080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064084, "uuid": "bf84eee3-97bd-4854-ace1-4ca634f2def6", "comment": "Malware payload (PureLogStealer)", "value": "edbe9bd59fda6c433f7956bf800cf35d4394305a8632ecc127abca4763f15d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064084, "uuid": "773b67aa-b5fd-4a9e-af0a-5e8e6e585948", "comment": "Malware payload (PureLogStealer)", "value": "9864f57703830749865ee91bfbe005bf757ff7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064084, "uuid": "a6ee378e-0474-44eb-be31-cf40c93fd6c5", "comment": "Malware payload (PureLogStealer)", "value": "d3a58ed0a5c5febfb674bdc76d4775fddfc8a3dee56928182e0b65bd52a4eb6cccd3d1c1717db35383c35dc94d23ea5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064084, "uuid": "877f1f6a-2763-46af-be3a-953d49f89258", "value": "T1CB350232A3486205ED89C57819E8556B06053EB7C630C286F3BD7F7F77B2E85826E10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064084, "uuid": "195c36a6-4bc5-4bff-a4d7-dd95cdc22d6a", "value": "8c724739c14ef031c6f1e440b8d5edd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064084, "uuid": "3ebf12ec-3601-4fd7-bde1-e779ddd0f9c0", "value": "24576:jL3AfeDL3AfeThKUUOG1xVa3OCiuzAji:H3Ac3AsyVqiqAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064084, "uuid": "b9aff282-766f-4f43-a2dc-d89174c0c923", "value": 1109040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064084, "uuid": "25926a3e-a5f4-4e75-abe0-6b1cec36e119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064084, "uuid": "bba9f66a-ffed-4087-a0ca-855a933d1466", "value": "1d7c7d062a72a414aaac6628b6604080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac11657b-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712041651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041651, "uuid": "e640b635-e3ed-4415-8860-55599cb4856e", "comment": "Malware payload", "value": "57b000311abd8ae037743c516ac55703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041651, "uuid": "24417ce3-7a38-4bf8-b172-b936e84eec4d", "comment": "Malware payload", "value": "ef747050a4051c37d62ae73fa61ca63028181bae6192c0ca0cd538e516300c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041651, "uuid": "23a03ba5-db84-477c-831b-5353e176fed6", "comment": "Malware payload", "value": "a0830c255c57706653dd02de197c358758339b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041651, "uuid": "33e55fe7-0e7f-4ff1-83dd-c8ca69dc5822", "comment": "Malware payload", "value": "8e17925b5394b094ccadde49df909de7263da10018432d9841e84802256d8cec9a50fa9d04987244b0db85ab8c940650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041651, "uuid": "bdb55e4c-4477-4bf3-9a5e-9d99b2288a5e", "value": "T19CE43203BA978DA5FB8A17B6CBAB04141B7CE9C16623D71F394E23596803777AC64703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041651, "uuid": "ee677742-0b3c-46eb-bf35-c81cda4c11df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041651, "uuid": "57dd1064-2ea4-489b-8779-6bae9f44d0db", "value": "12288:Xh3wmMrrm0vElvVWfYwNT5r+bYqvSqS/+ZFH8:Xh3wdjv3fTll+Eqzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041651, "uuid": "af096092-e6ac-4877-88f6-b64cd6f1aaed", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041651, "uuid": "4b9acb02-28b9-4517-9037-6a9131b45e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041651, "uuid": "ce85d8e5-e3e7-4771-b365-d197ad2edb55", "value": "Tkkbu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873cc4ed-f109-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1712073372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073372, "uuid": "f12b5c4f-e35a-4c2e-a199-002baa74bd47", "comment": "Malware payload (AgentTesla)", "value": "6077c155adbd0dfc96308b9bb61d7923", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073372, "uuid": "64264eba-bd5e-4915-b5d7-1a8a4e999092", "comment": "Malware payload (AgentTesla)", "value": "ef77ad07ee8b36ca0270d922b24d2c4bf9e488edf896ee0801c0e4e270c32c6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073372, "uuid": "6425d857-1ce2-458d-8e5b-603e0d0552bb", "comment": "Malware payload (AgentTesla)", "value": "3344b6f8b9bbd69c4525936f29b3aad82ade112c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712073372, "uuid": "db8b93ba-25a4-4bf0-8a2b-c1adfbcbd216", "comment": "Malware payload (AgentTesla)", "value": "82c49672f835260066da367f87bacc9205fd8e8eedf0d5c2945a1f747e6feb828ee323de2f07b8072c3a81bc337c28b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073372, "uuid": "bd7e23c4-1064-4cbb-8857-36b32231a524", "value": "T1BDE4124033F85B52D8BB8BF462B5A16213313617A971E75C8CD2A0EE2D72BC14D26F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073372, "uuid": "9b23f927-9b08-4d8f-a0e3-828c3f2b45d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073372, "uuid": "2a16cf46-c534-447d-98fb-79090268e0ee", "value": "12288:QOSZcH0fDEfV5lB11JaQcj82kTA7m3s8/KNXrIIdGQHyx/my0xFfTonpZBkR:Ao4w7JjcjgE7m3s8CNXlFyx/O7obc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712073372, "uuid": "4293ee3e-9eb5-4c63-a67d-4063c86485ac", "value": 717320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712073372, "uuid": "6c07438c-7f2a-4f0f-810c-320c0d976f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712073372, "uuid": "3535c599-7f44-441a-9d98-33c7a98d2e67", "value": "DHL PACEL SOFT COPIES_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5682c3e8-f0cc-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712047091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047091, "uuid": "ce4f544c-7751-46fc-b725-d73deca3ebec", "comment": "Malware payload (Mirai)", "value": "726677e32bfec4ca0285ff41196690c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047091, "uuid": "0d0e60d9-2182-4460-a4b7-6d05e44f0b57", "comment": "Malware payload (Mirai)", "value": "efc6dc630b072dd9c8c8b92045e65c731cf358dee591fdea4ae019d0ea13d53c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047091, "uuid": "5a414ae1-0673-4c97-8320-6616e6583b66", "comment": "Malware payload (Mirai)", "value": "b5db75bac21634f99748466f81a76db97c486377", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712047091, "uuid": "8a095cc6-a7ae-4fd7-960a-d87fa00711c2", "comment": "Malware payload (Mirai)", "value": "9d8e02b024ba1a0c2b2360bedb27c4d2658ac44ec28cb7f1705599bcf4d95149bba41834d7080a19589c5693eebf3322", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047091, "uuid": "98abdeab-d6a2-485d-b236-a132c87cf2f9", "value": "T15E539FB5C5A8BD99CF698278B61488389723900565E33DFAE741C7A6D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047091, "uuid": "1bb641e4-fecc-44f3-adf4-364135f8de22", "value": "1536:B/bivQhunGauwt4Iduhosj91RYeycfs3QtLok1cY3CJla:BjiBGFOdO91Rhf+Kn1cY3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712047091, "uuid": "dea9d7d5-55ce-4537-a2c9-1050d483d0f9", "value": 64348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712047091, "uuid": "86b07d89-300f-4988-9128-702e9f5c9766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712047091, "uuid": "a95f7a03-8fce-444f-95b8-31013609c71f", "value": "726677e32bfec4ca0285ff41196690c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2692c162-f11a-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1712080511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712080511, "uuid": "bee611ce-089c-46b3-bdb8-80eb60a76e17", "comment": "Malware payload (DCRat)", "value": "086e9c796fd84f38bc5a9532941fde95", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712080511, "uuid": "beb68ece-2760-4019-b31a-5675a91c32f7", "comment": "Malware payload (DCRat)", "value": "f0914853e353cc878e56b7d3446f25b9edbac3e863952afd63cd185aca97daaf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712080511, "uuid": "a99107df-143e-488a-92ec-918730efe6c0", "comment": "Malware payload (DCRat)", "value": "f1c2752438a495978f3014efbd725450f6490e65", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712080511, "uuid": "5dc48d86-0552-4157-807f-ef5f5d8136b3", "comment": "Malware payload (DCRat)", "value": "acf8b046021dacfd7557fc5880a24c8807f531f2ab77c0c053687ceaad0f9fb5db7fdcb3206779f3bac8e1d268941a02", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712080511, "uuid": "d55ba3ac-158c-4e9b-b4f3-1052bee09c82", "value": "T19B4539017E448A11F0195633C2AF856447B4AD542AB6E31B7EF93B7E66723933C1CACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712080511, "uuid": "74960613-f6ae-4aa9-9c52-18c05acc7e00", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712080511, "uuid": "0670c189-b6a0-4f09-8bc1-0106c9613ecc", "value": "24576:P2G/nvxW3Wl0SxAfBcOrG64OUqWxsv/TADKCAWY54ftYcq:PbA3zMApc1nCY+z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712080511, "uuid": "97024baf-1c66-40b9-9b6c-0749d2c2a19c", "value": 1194152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712080511, "uuid": "dda4ad75-0a40-43af-bd55-2f4006960a1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712080511, "uuid": "4f5430ea-9af9-4ea6-a44a-14c14b0e457a", "value": "086E9C796FD84F38BC5A9532941FDE95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd4caed-f128-11ee-a120-42010a9c002e", "comment": "Malware payload (GCleaner)", "timestamp": 1712086801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086801, "uuid": "473e51d5-8ff6-428d-984e-c7b802511a31", "comment": "Malware payload (GCleaner)", "value": "c095c87e67b0964a91603f3af00dcd97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086801, "uuid": "ae3b2820-6239-485e-a7d0-1b710ee286d9", "comment": "Malware payload (GCleaner)", "value": "f0a6f13b482273d029a6a8613664c33a8f6381dcf98d2cdc7954bbf161c93f49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086801, "uuid": "797cba00-ec23-4589-816e-85c047690cca", "comment": "Malware payload (GCleaner)", "value": "d99699c361864fe49ce29c50f9421ef4813c74a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712086801, "uuid": "7a83dc6f-1ca9-4656-a3a7-f46191e8db1d", "comment": "Malware payload (GCleaner)", "value": "a171c02d847293f998acde5b9b9abef58d4b0ae8b13f2cc707693d6576ece70c97b4d6c53f65e3edd383ff3e46657d90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086801, "uuid": "35a9c51b-fae8-4441-97d7-02436f2ffece", "value": "T11F54BE01FFD1D872D5622534CD65CBA51B7EBC329E34428B7B902A2F6EB02D04A36776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086801, "uuid": "68e281e9-6036-4073-801a-802547e88dc2", "value": "84fe06240982f1bd102fcac07fa31539", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086801, "uuid": "1e8f9c89-9944-401c-9146-d8fc410f1cf8", "value": "6144:D8qrKd3vhpFsfpmG/1DjHyYmT2t+34XVe:Br03vhbc1DGC+oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712086801, "uuid": "b0562e02-6071-40fc-933e-b7dce5f86400", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712086801, "uuid": "b31fcb38-560a-461c-89e9-41ccfc227e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712086801, "uuid": "31cfc9fb-7a15-4f0f-991e-a2b3eddf42de", "value": "c095c87e67b0964a91603f3af00dcd97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b69592f-f108-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072734, "uuid": "ef37e8c3-7756-4bd2-81e9-7df9ae8a4c51", "comment": "Malware payload (Mirai)", "value": "9820d7c2ce46d7aa8e80fd5fcc90ecb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072734, "uuid": "ad67d72c-72d2-482b-866e-9fe309d3c647", "comment": "Malware payload (Mirai)", "value": "f15397f886ab011a5f355bb55b26b8a125f5ba3069c92887401c56182b808cd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072734, "uuid": "56966abd-958a-4d53-b74b-0736055d7219", "comment": "Malware payload (Mirai)", "value": "7d034dc3cf2a95b4af6c6cb9b415912b70cd2ecb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072734, "uuid": "8049b0d4-ea5b-4b65-aed5-4780fee52deb", "comment": "Malware payload (Mirai)", "value": "7255b06405c7d9121a12245e63a5df54aabc704ec453a843b2ec5a8377a7860c50c520a9bc3e2a1549fea2b674b6a0e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072734, "uuid": "613e5b5c-e24c-4947-a303-247d3364a135", "value": "T1B6632BC3F410DBBEF418D73B0C6749157271F2604E870A266BA77B5BE96A198092BFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072734, "uuid": "2a7fddb7-1daf-4ab1-800f-c7447607fbaf", "value": "1536:LC7eqetlZ8IqFfzQekacWVcW0JcWcBuVbgRAgLTcytLxGwLc9Iis/0:LieXNqtzQekacWVcW0JcWcBmbgRNXd8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072734, "uuid": "8dbb5c94-54a9-445c-ada3-ac37ff47d787", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072734, "uuid": "f53b7928-fa9d-4b08-b7cc-05e63dd5b66b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072734, "uuid": "0a025c2a-4245-41e3-a9ba-046a74e64626", "value": "9820d7c2ce46d7aa8e80fd5fcc90ecb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d25d42-f096-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712023838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712023838, "uuid": "d9417605-4137-462b-acaf-f7fcd6766364", "comment": "Malware payload", "value": "0ec679c84dfab2cc2d14efe37398e06e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712023838, "uuid": "865b51ac-d368-4c21-9032-927981a10abd", "comment": "Malware payload", "value": "f1f817a01fa4101876423bdefec632f218a1ca5ee1222f8625b67f03f0168bc2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712023838, "uuid": "6535e195-6fe5-45fa-b332-1ee4c1008f48", "comment": "Malware payload", "value": "93fd04228b1b409bbcae069a57dee1173c36618f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712023838, "uuid": "1e8033fc-33f8-41da-baeb-37e1630b6085", "comment": "Malware payload", "value": "38a47150cb6ec5515ad622b5268f2f0c8de8709dd6caafbfd160cd2a7363284c4c7670f42dbe82727e678add34217630", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712023838, "uuid": "bb9a9add-d799-4065-8943-97a8e94a2129", "value": "T11FE51203EA56A567D4FED3311A75212A603A0C1847839356391C3BFF76BF4DA1F86AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712023838, "uuid": "0eb650ea-cac0-4103-be33-0b91d1c2b1d0", "value": "49152:RlB7phAnAU+Pm2lfjTvud4HtzkQUZujusKXzHDQrY3wIxoTG7Lf5IrxY:zB7p2nl+PJNudotY5NsQzjQrca+oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712023838, "uuid": "d092cc0c-5e9b-404d-8acf-82b23aaa1e22", "value": 3226551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712023838, "uuid": "8c72898a-3c46-4f03-a309-d0c3b576230d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712023838, "uuid": "43168c39-bb82-433a-9dd5-5a1da9d8def0", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adf0181-f0fb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712067177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067177, "uuid": "613f2d66-465d-432a-98c2-80e4e0e6077b", "comment": "Malware payload (Mirai)", "value": "99905e5f6972445738d10c2571900769", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067177, "uuid": "70e9e1bd-1c70-4e4a-8407-83b0e83ecc66", "comment": "Malware payload (Mirai)", "value": "f593291c3b261d4a030fe400cc1f072ad734e3d5e37c3ef4a6f4cdb8f9c4ed01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067177, "uuid": "c032dbbd-6c71-488c-ab10-192aaf607273", "comment": "Malware payload (Mirai)", "value": "9199b20b45295ca3b1397340b7e3fba95ec48faa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712067177, "uuid": "2d518009-64d6-4f97-99db-58f5cec7dfac", "comment": "Malware payload (Mirai)", "value": "6f42e5e054697fc047b01166e5b521bdc1f8bcf70512a601071a201a27d252c41d5338c6527c9a1457a39ffd719063b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067177, "uuid": "21cef108-a709-455f-b403-bd3fa52b5913", "value": "T101F31A45FD509F26C6D212BBFB4E428D372A17A8D3EE720389255F21379B85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067177, "uuid": "962ddfd3-3036-48cb-b0e7-6d3b76814109", "value": "1536:gg+UzRKfgfkiWTn8mrKZjailMAhfngADG2YETMP2Om7SAXOQwES8kOcONilSobwa:XzGgfkXotlM5A7YE4uOmGLJVOlMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712067177, "uuid": "7d576a82-de35-4520-b811-299001576586", "value": 158368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712067177, "uuid": "122632e6-5bb7-4b31-af76-c1fa546f0c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712067177, "uuid": "28ee8b4e-a4db-4516-9834-97fdabe75cd4", "value": "99905e5f6972445738d10c2571900769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a324f1e6-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712041636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041636, "uuid": "34f39434-18f3-4c1a-9620-8fa8cae2690e", "comment": "Malware payload", "value": "a027c955d0d74a120934723524d7225b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041636, "uuid": "32ce0ac0-bfcf-49a1-b78a-107fce9beca1", "comment": "Malware payload", "value": "f6bd90427e0c4afe3295d4f9e3d27eb1146f83322ca955ca91178012753e16ac", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041636, "uuid": "bf19b070-719e-4f30-a18d-8e0b1379c282", "comment": "Malware payload", "value": "2c62f19b0de274e97c2e475d03be7aed45d5cdc1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041636, "uuid": "c8ba3b3c-d8e4-4d78-a241-2d6eff75557b", "comment": "Malware payload", "value": "ecea780771849fd76bca12d86c8cec9526d5c398355a52b9e392aa3ab91d004a6b6eaf86d3a544cb73a46f9de9d02137", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041636, "uuid": "82aa4c69-a17f-4690-b7fa-deb50830e233", "value": "T1614422CDF90620E9C54CD52C8F3072E2E5CE4EC616D01FF6566ED9D9C9AC96EF821228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041636, "uuid": "60e543eb-5a65-46a5-9709-df8a9cdee04f", "value": "6144:2/XyFjk+punB1yyVw1UgB85CGMEqQsV8W:sKjk+AEwk7CFsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041636, "uuid": "b1ab1dbc-b65a-47d8-bb95-6dfabf44cc4c", "value": 253363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041636, "uuid": "dfc26457-747f-4dbb-8e7f-d9c6478a5942", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041636, "uuid": "819e7001-2d2c-42fc-b3b9-09a55dd36b64", "value": "Newpo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fec985-f0e5-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1712057805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057805, "uuid": "a62c8d34-e989-4073-a3a2-73d58e4caa2e", "comment": "Malware payload (RedLineStealer)", "value": "c813ab1235cc9880b05c865da8f0ebae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057805, "uuid": "b32a56e7-10ca-4cd6-9b14-2c6c572878c6", "comment": "Malware payload (RedLineStealer)", "value": "f73a31c7e19e74128d45775a82f8df09150bcaef5bf3c98e2c29a2b90c275a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057805, "uuid": "a92a8c93-4880-498c-be63-5d66ae9acb05", "comment": "Malware payload (RedLineStealer)", "value": "8cde3afb841711bb299066d8e8d1ff750de5de41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712057805, "uuid": "e0bb8aa2-e32c-4332-9d50-8b18390ef432", "comment": "Malware payload (RedLineStealer)", "value": "77cab88c93b03162515184c2d588ee6ce141292e272db818f085b75099d4befe71061fcc2035267bee2d2b876f0ea1bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057805, "uuid": "9c0aceec-43c9-4797-a5a7-ff212a3f3eb3", "value": "T1BA74232297335916FC173D3054FEE766AE78538528039BA3104AB609CF71B8677F62B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057805, "uuid": "0520db15-2b8d-43ee-b39e-be9b492c1099", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057805, "uuid": "a049f2c3-c58d-4817-8436-cd5f9c77af0c", "value": "6144:Hh90JBso1v0l3PEAHRq6MfYKzx8iq3UcmRq1Dt1j5RzSLs:XgRd09E5tx23UcUqlj3uLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712057805, "uuid": "1e6f8046-98a4-4cad-bc5d-318ac167e474", "value": 350344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712057805, "uuid": "e774e513-b7fa-4b42-a07a-892e2dc1e4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712057805, "uuid": "ddc5a01a-544e-4d16-9ca6-4a5754d948ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a8138-f0a8-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1712031667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031667, "uuid": "e8fa97ae-7a0e-4a79-a6dd-77a317c48fd9", "comment": "Malware payload (PureLogStealer)", "value": "29191d2d374a31472195d8e80b4f2860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031667, "uuid": "9447a888-fe54-4d76-864f-7b2da97e8bb8", "comment": "Malware payload (PureLogStealer)", "value": "f786d300e911c09396715900b66e26e1666570bb9483477f76040db3eaae15de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031667, "uuid": "76ad3929-ba85-4d50-8b06-0688ec869da8", "comment": "Malware payload (PureLogStealer)", "value": "674d26515b07d7c8aa1ec3b1916d96eaebbeaf53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712031667, "uuid": "31cfc7a0-151f-46bf-a164-ef022f4eaddc", "comment": "Malware payload (PureLogStealer)", "value": "6f7c9d751576bc8dab32b344fb925e6ea7aebd8c321733a48658f1317105893b17c07769c21bce9d28d273b4a71f0b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031667, "uuid": "552ee98d-a2ab-4bcf-92dc-2d39152cc380", "value": "T195E52227B6178AB1E7845736CAAA252443A0F984E3A7FF1E788F53D90C4B3B2DC15117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031667, "uuid": "78fd4221-76ef-498e-b218-fe8339097a50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031667, "uuid": "6da183de-fe17-411e-984a-b4370cd35f86", "value": "49152:nd0+uGMdBSeMbsxrmmI3ZRocRk9sp+e7XEXxfYwU0cwMSyxsdoyD:ixeImV38Vsp+KXGlYN2oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712031667, "uuid": "8e9074b5-5c9f-4a4c-9062-fc2c872df17e", "value": 3024384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712031667, "uuid": "4642ebb1-8363-4c91-aa88-dd3d2a4e53f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712031667, "uuid": "1f169854-1c3b-40ee-97c4-4030d22426f4", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.11003.8104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1098d4-f0eb-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712060527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060527, "uuid": "0fee2a6b-e600-4b2f-b0d2-e4ac983fc8a9", "comment": "Malware payload (Mirai)", "value": "c655a4bae775d520ced72ab50e69f49a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060527, "uuid": "44642648-31d3-4b9f-9b0a-2b1324f2098e", "comment": "Malware payload (Mirai)", "value": "f7f36cd0fb6ab09a2ac2a8b47bc3ae3c27dead3b344d2fbc83a611631f85d8c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060527, "uuid": "225883f5-4138-42aa-aa10-cf1d6801c888", "comment": "Malware payload (Mirai)", "value": "a3dc14633ef2bf828c812c4a0c6a31d3f5aa9181", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712060527, "uuid": "c56cf31d-fc4a-4ad9-99e1-3220ddcce85f", "comment": "Malware payload (Mirai)", "value": "2510c8186d3941b8da397a03bc2bdc208a1b38b79e945de0d0000985b961756929f375833c74247f88141e887e30bd36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060527, "uuid": "ece17f4c-be52-42f0-8da4-ea7d6a244b65", "value": "T183B35A77C8292F68C259D1B4B0B49F792F63A58182472FBE54A6C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060527, "uuid": "c0f185a5-8611-49ff-a0f1-bf206f482699", "value": "1536:+aVTHW/qIAmLqpMHFGEWCRrK5KFvLTlvKiLzMJWdkTxeo4f/zJ:+qWLGpMlDWMO5mNvKC0WaTxkfbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712060527, "uuid": "a3a72fe7-ab14-45c5-94c3-0fdb01f4ea6e", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712060527, "uuid": "d5dfde57-f8c9-4fde-b39c-9bc30b1d62d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712060527, "uuid": "ed647896-e57c-4156-85e1-55fa70425a1e", "value": "bot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbe2c24-f0a4-11ee-a120-42010a9c002e", "comment": "Malware payload (VenomRAT)", "timestamp": 1712030003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712030003, "uuid": "cae94de9-bf62-4caa-9718-ae77be17ca6e", "comment": "Malware payload (VenomRAT)", "value": "878e1f1d472b786f4676c37e7c054616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712030003, "uuid": "7a37b17a-bde5-45f8-a572-63db08bb7e19", "comment": "Malware payload (VenomRAT)", "value": "f8ab374317daa6e6e08543fd78da36560b2e0a01eb666757678fc4b0d153c78e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712030003, "uuid": "effd5632-2036-48e8-9801-cdbf942d836d", "comment": "Malware payload (VenomRAT)", "value": "541533ab23e24f212e0e3bbaf24abf43409d74c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712030003, "uuid": "584a5740-1485-46e0-a41f-8579e8489f35", "comment": "Malware payload (VenomRAT)", "value": "6032fb8a3f671a3cc6c45aea09a92f6b846e352f22210b0bca648cd8599067adb16f008752b5b00bd323dbc4ce37bc04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712030003, "uuid": "22965246-4169-436d-881c-2bc6457e0d61", "value": "T1CA55123D21C816EAC7958772BA749DDD32FB021A47B6B34F85E939D11E3E22D8B34814", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712030003, "uuid": "d263f350-6622-4a6c-8c01-445a65f56e95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712030003, "uuid": "f38e177a-4e41-4cda-86de-3cda840a568d", "value": "24576:h03laoFFzC9GPje2UjeHA6KvwWnNUbsAy6xYhaHKO3JM/Cm21f5jvs1i65HV:h03ZU9GbGj6HKVN4YhwvZMKm25gBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712030003, "uuid": "edba9fee-01f7-4b9d-8204-7a83ece121d9", "value": 1380352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712030003, "uuid": "0725f815-0433-49ff-b8a6-8522b406d140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712030003, "uuid": "6ada0e28-113b-4eb0-971d-1a60bcc6d4b6", "value": "878e1f1d472b786f4676c37e7c054616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2cd157-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1712064491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064491, "uuid": "5e27309c-f1c9-49f8-9c3a-4342ff3cc08e", "comment": "Malware payload (STRRAT)", "value": "df2db9304574c773b6ce08fad6d441ea", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064491, "uuid": "553e4128-2a1d-43d7-88ab-8c5c945d3a49", "comment": "Malware payload (STRRAT)", "value": "fab834c9ed7fee78318fc356487c47a816967aa242f7844788091d4e32fcc245", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064491, "uuid": "8f8dc6c2-a948-4d02-b4a0-8d5d6aa73fb6", "comment": "Malware payload (STRRAT)", "value": "a0a446c3ebf35ddde405e77f9035f63003d35b2f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064491, "uuid": "3d895de5-4359-4e1c-b3ec-0f5fb3289476", "comment": "Malware payload (STRRAT)", "value": "dcdfb58f7fb323db0237f58e379b7fd2978ac4cc55a76819a9d819374b76a748f2569c284e226263dc8abcb78d54c2ca", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064491, "uuid": "bf6b1459-70d5-4816-991f-e3b8f565fa49", "value": "T1AA7402DF7BDEE069E01352B321110770AB2E46E5D284942FA5ED1A498C37D88CB53ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064491, "uuid": "c58b7dc3-54cd-4738-bf57-8f23cf87870f", "value": "6144:nBQjv/DRIw7Q2jpYnZChRaTnsvOslAqOnGQy3exITrDjp:BQjnDRziYub95xITPjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064491, "uuid": "76f0afb2-123e-495d-b77c-627918335fb2", "value": 344540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064491, "uuid": "e71f31e2-cae0-47f9-a3bb-971f4d8106e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064491, "uuid": "4dbe0de0-dfa9-4a34-9f31-af3b63ae6578", "value": "Swift copy of payment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595ee652-f0bf-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1712041512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041512, "uuid": "149e527d-fe99-42b9-819f-99a00149f77e", "comment": "Malware payload (AsyncRAT)", "value": "ead981cd98146fabe078992943b0329d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041512, "uuid": "5290caaa-a516-47c0-a0bb-ae4270632de2", "comment": "Malware payload (AsyncRAT)", "value": "fafaaff6d67dd5702bf67e82ea12605ddc03797213ee5aaaed48fe6194cfe87e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041512, "uuid": "0f0001e3-150b-445f-bf36-6d8acfff175b", "comment": "Malware payload (AsyncRAT)", "value": "a20ba9450187e13e3ed62e6beab4d2bec788df01", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712041512, "uuid": "491d28b6-8975-43ad-9c44-6489f962dec9", "comment": "Malware payload (AsyncRAT)", "value": "c2fb270ba4815dfc97e032b75f0656aa2251987d584fbf503e1d78ba4e342cce16c60083af76837e8ac63b15a475d7fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041512, "uuid": "b55169e4-c27f-4aff-9ed2-48dc760e1d99", "value": "T11FA412C033A8DF45D27007F2C944A0F5A3357D27E921DA5F2CE23D9CB5B279281A169B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041512, "uuid": "7deb1f1f-cbdf-4a90-92ac-8f5a262ef952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041512, "uuid": "79dcd3ec-65a7-4cc3-9828-2b97fd2dd289", "value": "12288:FZcdIu1fgsDbqonwXKI9SrWLcsz8tEaay4MF3kR:FHumsct9SaLcPtaEFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712041512, "uuid": "7af914d4-c96e-4e9e-88fd-9e5a2cf78b14", "value": 460808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712041512, "uuid": "87862bf6-ed43-42f2-a859-3d43b085b0a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712041512, "uuid": "7f25cc50-0b85-42a4-8524-4701f07329e7", "value": "Scanned-Document.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f15de25-f0c5-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712044072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044072, "uuid": "06cbef0b-e3d2-4a77-b165-ef46e8d0db59", "comment": "Malware payload (RiseProStealer)", "value": "e040df6b67bd73e33ca770104d4addc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044072, "uuid": "0bac87d0-ba9a-4e64-80e9-961f37c956f2", "comment": "Malware payload (RiseProStealer)", "value": "fb0e74083dfd59d78460696bfbefc7ca9c66c741c45dbbd36495badafedf6540", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044072, "uuid": "e3d031cd-82d8-4575-ba55-4ec8fd462fc0", "comment": "Malware payload (RiseProStealer)", "value": "f9b60a82fac79ef004af126242e320fbf68885ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712044072, "uuid": "56c504c0-d3c1-48ae-9b47-bdc9962f6d7a", "comment": "Malware payload (RiseProStealer)", "value": "26b45eab7ae7e68eb66a3735282ca9fbebcdd1fa512905878bb0231e3e3941705aa76b165394f07024aa3b7ec8d49fa7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044072, "uuid": "ecd5d3c9-d6e3-49f4-b59b-4f9cba9af595", "value": "T144A533BC5E71171EDAA983380CB7DF1AADE13252A436AC4E17903EB7764F25E6B04344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044072, "uuid": "9c2c0ebd-2990-4e73-8221-6503ea6a3813", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044072, "uuid": "07fe89e2-82f0-4693-a238-565d75d9dbaa", "value": "49152:saR2wtFNbcdc16ukZbStEAJigrOfTydaoPY4lCFKQZBsd1T:saRjO+XkAbigruTydNz0KQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712044072, "uuid": "6825fe35-50be-4344-8a65-81b5e7883399", "value": 2062848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712044072, "uuid": "e0fd4e04-4fec-448b-a7c8-718be201e231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712044072, "uuid": "77fb2d91-d7e1-44d0-bcfd-b723e5689bdc", "value": "e040df6b67bd73e33ca770104d4addc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9f0caf-f08e-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1712020522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020522, "uuid": "44e95a31-3b8b-4624-8e11-69b6ce3e83da", "comment": "Malware payload (LummaStealer)", "value": "ad9a63ecf8a8e47a18a42b57d96fcbf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020522, "uuid": "e14d0b7c-188a-4e6f-b1dd-67153b47ed55", "comment": "Malware payload (LummaStealer)", "value": "fccf89e443190f196c2fd04920c168fc72ed5f22612491d08dc01cedd68622d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020522, "uuid": "f3a41929-34ce-4afb-bf25-95c78a881613", "comment": "Malware payload (LummaStealer)", "value": "81cc1f7862669b4445b58a83b812ad280745b00d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712020522, "uuid": "c1fd83f0-b30c-4cea-8cdf-913f7b383492", "comment": "Malware payload (LummaStealer)", "value": "a6379e1cbb116f429ba84c2e93ec1455e906716e08a4cc5aaeb75f66a06be6507f778a104209792f7f5d4f9711b13917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020522, "uuid": "368324bc-7a16-487f-9882-379881091304", "value": "T138848C0371E1BC64E92247B24F2E85EC371EF8628E646B7B26586E0F1472171D2537BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020522, "uuid": "5a157f6f-3052-41d6-9f19-87aa859221fa", "value": "133a23a1d0034a9efe3edc434358c397", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020522, "uuid": "6c5ec65a-ce0a-4f30-8d6e-01404a418774", "value": "6144:PPll8eAzM9JKIgLw0GFWQXTLDDZLhQ7tnzBDONFT:PPH8DzM98LE/5h8tntDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712020522, "uuid": "f1d9e0fe-09fc-46ac-9d7d-cdff3e477f77", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712020522, "uuid": "f7168e7e-8e52-44a5-9a4a-28a174a64cf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712020522, "uuid": "f95f6a7f-49fa-4cab-bd29-2a44e4edc332", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3a6260-f110-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712076175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076175, "uuid": "4cee9ca7-6557-4324-b2a8-131b0a4b7804", "comment": "Malware payload", "value": "3eed3fe106759faa124503d888563416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076175, "uuid": "28248b32-6764-4d4e-a432-e0bb76699f8f", "comment": "Malware payload", "value": "fd109a5d9e7f049321b1e3f8e39905953c800ecd62564af6bb72f0cd6b60fbff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076175, "uuid": "adbdca22-bf15-4d65-88d7-7e4c7dbf33e4", "comment": "Malware payload", "value": "8e965f1c69a11bf472c5b792e53f0f54726f6db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712076175, "uuid": "40091f44-c98d-408b-a847-cae1e3f6ecb2", "comment": "Malware payload", "value": "69149ee809f9af9592ec9409e844449ed85ff3fe5d500f38eea2c5bbdc81e0497b9997447d4ec0c2e25fb29378a932c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "healitytherapy.xyz", "colour": "#A20A7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076175, "uuid": "d5e43d88-8277-4607-b97a-1b413850f0f2", "value": "T11008339C1FC0BC46E4AC7FBA5A2779BBE77394581EC05C1231B869C25C26C571E0F26A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076175, "uuid": "911072ef-f99a-4b26-bf68-57043a494744", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076175, "uuid": "cae961cb-0469-4ca5-8c0b-1a24e7ca9d87", "value": "1572864:nr6LBYQ8ujojYQi2NAgJnsI0SNcucgzxTMWIyqi/rydyQ:nyufuQRjJnsqN0QMWMMrEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712076175, "uuid": "76becc54-4921-4658-a866-a23b1f54264c", "value": 78056160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712076175, "uuid": "e51d19c4-be2f-4d0a-a480-5ed57f81d3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712076175, "uuid": "0d8ba077-37fa-4539-8a51-68c2c65d90ab", "value": "HealityTherapy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e875dd21-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1712064515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064515, "uuid": "dbd438e0-f302-4f76-872c-c134218a891b", "comment": "Malware payload (Loki)", "value": "651fde2931d5c4a1622770d8377f5508", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064515, "uuid": "0476c13c-a271-4e84-81a4-3e806ffc6d44", "comment": "Malware payload (Loki)", "value": "fd508374d3ea81ce373c42099890947f65c24d1ffaa281f56c32cb38528bb2f5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064515, "uuid": "dfdf885c-96b8-4db7-92d2-5c9e0efc6817", "comment": "Malware payload (Loki)", "value": "8351c8c661ce8b0a9cf3a0c06d0531617e7c6f6c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064515, "uuid": "935d33cf-c97f-47e1-978e-2b019ae00502", "comment": "Malware payload (Loki)", "value": "cab3dacbdacce81a832b0dd033447aa7e92b54f63ad408c2e04208b24ec6726a77fc540163f4fd1efe2a39f9b6b80eff", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064515, "uuid": "6f134aad-2b77-415b-ae3f-a6f5cfffec2e", "value": "T1A1A222F8C9A10BE9A987FF774B89B43AC230BC954E331A11351772996401B50BF1BADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064515, "uuid": "3283b438-99c1-41b8-9049-cc3339d2e307", "value": "384:eVenfmLgDnXstAPdK450EPpaDX/DRCaL+bSA4MfG:eVoueODrEPpaDXtCaL+bSABfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064515, "uuid": "5c7ac2a1-96af-4ac5-bc74-1546a1ef406f", "value": 22496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064515, "uuid": "47fb7c89-1752-4629-ae52-c7dad1af509c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064515, "uuid": "6e37b25e-f528-4fa3-ada7-860bfc3f7e09", "value": "UM-2400911-Ponudba\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082e2d68-f108-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1712072729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072729, "uuid": "04b7bc5f-c172-46e5-a420-c920eba17106", "comment": "Malware payload (Mirai)", "value": "313ba895d109b9c587e567c505985cc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072729, "uuid": "7d799113-3d4e-455f-9405-2481a2ec6c9a", "comment": "Malware payload (Mirai)", "value": "fe6c916945c0b722fb367bf6e5d5d5c8ca54f503ff61c7ae25c8e94d8627dac5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072729, "uuid": "66720d62-35ba-43a4-b175-087174fc7649", "comment": "Malware payload (Mirai)", "value": "0fd5ac7de8068a96dcc139758f78644fa67727ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712072729, "uuid": "840d6151-40b0-44bc-9988-379cdce5e766", "comment": "Malware payload (Mirai)", "value": "76fad9dd0680d096537445ec84e12680ecad2f45dfea72f67e0c3fc0164ee24e72d9c6c7184c7a036291b47ca02ef850", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072729, "uuid": "ad62a669-78f1-4105-93b0-113e3d446148", "value": "T135631A52B8809B66D5E056BAFE0E018D33531FF4E2DE72068D15BB3077ABD4A0EBB541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072729, "uuid": "810d18bf-edb7-450c-83e5-1dd66944a897", "value": "1536:iMn8fR3fkcuQNuIqtYTJjxOQrs5dsVw/W/YIBQkNKRr:eVDukMFuVw/W/h1KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712072729, "uuid": "44c8c6de-3ab7-47f5-9603-bdd58a18e184", "value": 66904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712072729, "uuid": "be3373a4-7bbd-46ce-aa0d-ba8cd4c75a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712072729, "uuid": "0156be03-26e0-4130-9787-7cb74722565f", "value": "313ba895d109b9c587e567c505985cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870a1333-f0f4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1712064352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064352, "uuid": "ec37a1a9-f791-44fd-ab77-2cd14f51732f", "comment": "Malware payload (RemcosRAT)", "value": "c9db37c76aee446f6df17e38469cc5f5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064352, "uuid": "a4ef148a-3a0b-4dc4-b965-ad3795e88ae1", "comment": "Malware payload (RemcosRAT)", "value": "fe7ff83680ff3855e060227bddf560db0fe75b141db516320674dace99202224", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064352, "uuid": "64740576-396c-429b-a827-301ea0416363", "comment": "Malware payload (RemcosRAT)", "value": "d59d6620ceb71f5bf629c3837340d30a000dc098", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712064352, "uuid": "8dc77ec5-bff6-49fa-8824-2679bd806bae", "comment": "Malware payload (RemcosRAT)", "value": "cec8f68c1c9cbcf3a68ceaeefab5179a727ab988bd37f4f8702013eaebca34bf283e07737fbff0721f557ef50d8fc203", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064352, "uuid": "98ec9427-a6fe-4c08-9e61-4ef42a6cc779", "value": "T11A92911C4A813F8D0D0737F2C66B35BA85A274B64C3328616B1BE024E905796ED2DDEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064352, "uuid": "8d531e60-bb57-42a5-a741-32eefdbc83aa", "value": "192:luOrrF5DUyLdYC/ShXcwyoXvWM24RUQr9OFmZOSxn57UYDb/AT/2PszfEciA6aT8:YgF52Muv/OEV7JDQ/2PszfEBhc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712064352, "uuid": "32961079-d348-4c6b-ac6c-504c07d2b49b", "value": 20467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712064352, "uuid": "0d6cce24-533a-4142-8a5a-77d5989e31a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712064352, "uuid": "7b7eba3d-5cbb-4062-b3f2-1a6107268924", "value": "numer faktury_505603890324\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dea0d3f-f11f-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1712082644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082644, "uuid": "89ceb798-083f-4dfa-9f95-6fec0f966e2d", "comment": "Malware payload (Formbook)", "value": "280a2ddeee3f2023810a59c621806105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082644, "uuid": "e24acb95-c5fc-4e56-ada7-56937611bc8c", "comment": "Malware payload (Formbook)", "value": "fea4dd76fdaa4ce2a97ac7e163c87da2fba16949296e8efd97037b7ed329e0e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082644, "uuid": "68fd9d0f-d851-420f-b7b5-66f87bb8a322", "comment": "Malware payload (Formbook)", "value": "985f9044a49a5e064a0f7fb7aab01f4bcbac687f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712082644, "uuid": "ea914b4e-f662-406b-98d5-7a3afd669827", "comment": "Malware payload (Formbook)", "value": "bb120bb5bd35aa2adfb0127dcfa5e836e27742f264b61a3a997b9ec07614bd7cce134ea27988f598773d941050f1c6b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082644, "uuid": "128e3dfb-0b9c-49d3-a459-6c905b19772f", "value": "T164C51247B65789F2C2885737C88705140774DE9A758AEB06399E37E50873FBB8E1322B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082644, "uuid": "ca68d928-9143-40f0-ac35-69e692bc928b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082644, "uuid": "df67bc95-b449-412f-8262-ea2f3a66d541", "value": "49152:OvOBafaOX4nGl1hKQg70Zcij0CCOLxk4PW:vIL4J0ZBj0DOlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712082644, "uuid": "c1003c7a-f22b-4a28-9f5e-4aa04e805591", "value": 2512896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712082644, "uuid": "04d35938-c1d3-4a58-bbcb-2b3078320cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712082644, "uuid": "c9e57c55-3c94-4eca-8838-3ed6c58ed8f7", "value": "QUOTATION_APRQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd978b57-f11b-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1712081301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081301, "uuid": "da7b39f3-8c59-49c6-b54d-ce7934f2eecd", "comment": "Malware payload (RiseProStealer)", "value": "711209d59b36ab682d71aa22158ca81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081301, "uuid": "cc495b06-3a22-41d7-b47f-219b0c68a209", "comment": "Malware payload (RiseProStealer)", "value": "fea9c2233a76a0382f96b339da3049a58daf262894d9f26bb5dd3eec646ff80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081301, "uuid": "6b7c2966-f70b-4350-b0d1-8ffe78470fdd", "comment": "Malware payload (RiseProStealer)", "value": "817212f9cbffadd9fcd295222cb6494b0f2f1a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712081301, "uuid": "31e89d9f-fd42-418d-8506-144d5cc7c5ea", "comment": "Malware payload (RiseProStealer)", "value": "be93665f2d48f7a760babd59a58255930453a3a55350bf2af0fbd1dc6dbab2bcd870c146fbd10ff15f778e668b438999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081301, "uuid": "8c05b915-75d1-40f5-8b7c-bb7976fc987e", "value": "T133B533028A356784CAD51BB248D192FF93B6BE0BCA35BA586D597C3733773B12F01482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081301, "uuid": "4db6bec0-9020-4995-8ad7-02650489c076", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081301, "uuid": "81517667-90d6-4ae1-92cd-b1bd9bb18102", "value": "49152:MS25DzeK23x8rdBxyNAaZ9t8wzrKzxS/pVKPx4Bvx:925Ix8rdHyNX9iYoxoDa4tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712081301, "uuid": "d2760984-a9cd-460b-84d8-e624d2d55f13", "value": 2369536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712081301, "uuid": "2f70e55c-7da7-42ce-a161-2ff6da27cd59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712081301, "uuid": "b7428420-0cfa-43a7-ab16-99bc276c7dd2", "value": "711209d59b36ab682d71aa22158ca81c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96cded1-f090-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1712021514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021514, "uuid": "7e4919bd-4bb7-4942-9c77-b5dcaeee3ecd", "comment": "Malware payload", "value": "100393911252b450c767bc8cef6ebd78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021514, "uuid": "f3d0ca55-59df-4504-9152-8615bded9875", "comment": "Malware payload", "value": "feecffaa3d7996be5ccad7ce76e7dc12e0a98f62fe48aa171c83f2e2aa01deb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021514, "uuid": "753743aa-778d-4439-a559-33ad6641bdbb", "comment": "Malware payload", "value": "3cc9a8862d4f58300efacafcfb7d390e2639eae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1712021514, "uuid": "09e7016f-5194-41d7-9ce9-1eab5bfbfb78", "comment": "Malware payload", "value": "209c2d595850ce823fcaa180995d3538c3b78e08041d361fdbcf4941c7254475c3050dedae98d7f6a148c37dce5ba15e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021514, "uuid": "576f8ca8-7493-4dca-bc48-25da90029800", "value": "T13455233B53661172E917EC706D3AE1268562F4162DB48C4F328D49CEAF72300D7AB7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021514, "uuid": "0f0cd90a-83eb-4bad-84a4-a56913706a23", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021514, "uuid": "fe673d99-96dd-4921-85fd-c6f5e3c8a4bd", "value": "24576:oyIFFHq76qrRrj4Gk3Sn/RrLVnETkm50R1qkydUMfYCq:oy26xjrKS5fdqkGI1PydUMwCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1712021514, "uuid": "1b5687dd-1664-470a-a3b5-19d4b916d466", "value": 1396368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1712021514, "uuid": "193297d6-58a3-4496-a7aa-9cb0e165b8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1712021514, "uuid": "75b99ef3-e10a-4398-8b27-e7c0524ab4d8", "value": "SecuriteInfo.com.Program.Unwanted.4064.4981.30925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }