{ "Event": { "published": true, "date": "2024-03-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-25", "timestamp": 1711411382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fda56116-32de-4d30-9937-6f7def83801e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d459e0-ea88-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711358371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358371, "uuid": "855ae951-2c9f-454c-a6cb-b8f09ac1f50c", "comment": "Malware payload", "value": "439c543a3fe75b05bd26da68114cc3b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358371, "uuid": "f7c51573-3639-42e5-9353-efe7bbbb98bd", "comment": "Malware payload", "value": "00493519846c8efc72f9c4cd1c419d1562b68903df5a199051279d1780036331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358371, "uuid": "3fe9640c-06b2-4bde-8ab6-55b7645d76b6", "comment": "Malware payload", "value": "ca831ec8bd3107f3e1aee9d7961ee7df79954f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358371, "uuid": "18da01d2-14d5-4fec-a70a-a823e7d660a4", "comment": "Malware payload", "value": "2191ea50f8d46143a0ec2265742a597eda00c4d3c81a949ff7fa00fadbe182e7b121c9604971e3bba74a3225515bb8f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358371, "uuid": "c3072a77-4437-4ec0-bc1c-148d70d31dbd", "value": "T1B0B63372B4452836C2A3613594B7CA375D35F6750B82E80B0CBD603FAEB19F53A66F09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358371, "uuid": "49f70d80-91d6-467a-b6ca-6c1de107dea8", "value": "f72d7260b75875d4cc65750aa7b35d18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358371, "uuid": "5f523a5f-2484-43c2-a25a-9efc82b711a0", "value": "196608:SURoVirYlDIA0DIA0DIA0DIA0DIA0DIAPHisah95dLU6TWHtldPd0dXbXPZoSTy2:qirYlsA0sA0sA0sA0sA0sAPHiMZjd1cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358371, "uuid": "5aae5a76-a015-4633-bb65-08ab0b9ba026", "value": 11285865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358371, "uuid": "0c8dfb00-e8cb-46d5-bcc8-265f03ad1e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358371, "uuid": "4f486da7-5160-489c-bb12-17ca3edb3d3f", "value": "SecuriteInfo.com.Win32.Evo-gen.24318.16217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5584f9e4-ea8a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711359035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359035, "uuid": "c6bb81ac-ac3f-4633-9c48-7566c911bd1b", "comment": "Malware payload (AgentTesla)", "value": "2abdbfd83497c9995cb7042541e4d630", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359035, "uuid": "e351d154-3ae8-4c8b-95dc-772997995cbe", "comment": "Malware payload (AgentTesla)", "value": "00666bf61ffa5fa165f2bea9a18d7e902baae99f456d740b4272e476ecd3cfc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359035, "uuid": "8df020c2-0a3e-449d-b84e-7d9070dc7f0e", "comment": "Malware payload (AgentTesla)", "value": "471b967bd46223387d11e83f1c54dedae2c75179", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359035, "uuid": "e07e35be-f2b7-4561-b465-5a95df8bc562", "comment": "Malware payload (AgentTesla)", "value": "3cf4dc2eeef145badbfb579511a6ed557503406c126be8bb9e0322ca37068918ae9ac7fc06c086141adce7eb16cc44bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359035, "uuid": "97e46601-cb1e-4ddf-9170-26328fce2d44", "value": "T1BAE412AA639803B7D5A547715DBB051AB37A901A6730C2191DD490EE2BB3F008F3ABD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359035, "uuid": "7142319a-9f21-4d83-b479-3849ce0872ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359035, "uuid": "f1bcaa74-b5a1-4b5f-89d5-a1d658fe0c0e", "value": "12288:aBMgC74CMwZq1uv5x5te55nTjm+ZX+pNcMJh02XmrcckObcXQCfJV2bV:aBMFXRv54tjm+ZKNcyxX+/RbcAChU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359035, "uuid": "9535bbaa-2de9-4afc-a5ec-700845ab8395", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359035, "uuid": "317dacd6-d826-44cb-85f0-3797edf50a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359035, "uuid": "3c0f492c-49ba-435d-bdce-1c7e631392b2", "value": "rRCP000004689ScanCopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca7829f-ea91-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711362134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362134, "uuid": "e92f8d01-99a1-4b53-8cf1-3b2ced0522ad", "comment": "Malware payload (Stealc)", "value": "19be923313c497dab7d82847c04cbc7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362134, "uuid": "c84253c1-256a-4ae8-8076-ef81941998cf", "comment": "Malware payload (Stealc)", "value": "0073a30288e51d3adc55fe86dc134e9ace7ea974211729deb1a43d39d1ae4a46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362134, "uuid": "50c11539-d3d6-49ee-bb54-dce49b0f474d", "comment": "Malware payload (Stealc)", "value": "b7c253d383c9c44b12973278f7ae5a16040dacf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362134, "uuid": "f5b92fc5-d49b-43cd-81f8-8b89ed9f9e1a", "comment": "Malware payload (Stealc)", "value": "ed4e5552a9213248ad0facc2272ec515b6cf8040fe8b33cdda168e47de87f1eebb6ac5ef54f0993139f5d7f81ec9162d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362134, "uuid": "cac4ca99-5ce3-4ce2-b665-21a4b9bbea67", "value": "T1945459112AF99125F2F34E30597497A81A3FB8A37A34418E72702ADF99F17D08B617D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362134, "uuid": "9ed74738-4117-444a-8949-c80c37868da1", "value": "86368fa79aa670a69606c89d67200668", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362134, "uuid": "ac4cfcd4-72d2-47d5-b104-268760995205", "value": "6144:km68SBXLj/d2pDpzniEzVV6u6ZxDKzCEXRfy:t68SBXLj/d25ln5LsDKjRfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711362134, "uuid": "0f917f89-f060-45ad-9357-7ca93e4609d1", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711362134, "uuid": "cf292552-a865-46c8-b173-e0c4afb616e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362134, "uuid": "11cf7dc4-9613-467a-882e-9093bbea08af", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9596.22784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c944a35-ea74-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711349571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349571, "uuid": "9a720bc9-534b-4b94-9f43-bc3f5de059de", "comment": "Malware payload (AgentTesla)", "value": "37241a1c4e55aa3638eaece31fe885fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349571, "uuid": "f30ca2ad-ac2d-4923-82f4-4ff44fb63505", "comment": "Malware payload (AgentTesla)", "value": "0153b116e6a412cfd8dbf868de5cae3a8b3303c550eba80a0605ad4acfda6c66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349571, "uuid": "3812d518-5ef3-4f3f-b7bf-a4252d33b7b5", "comment": "Malware payload (AgentTesla)", "value": "e0f21d93d124f5bc0de9a50a1b1d16326654faad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349571, "uuid": "a6997062-b1aa-4f37-b570-cdcb53a770ff", "comment": "Malware payload (AgentTesla)", "value": "ca6f45b65d66018ddaeee8e8211099a6032561cb2385ef5988597d446e4e7935c25c2b4f91627d2b58a1f827f21defac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711349571, "uuid": "da3e1bff-216d-4472-9d74-a0722f9637ed", "value": "T17B54BF5263EE4108F6F33F44A9BA55214A3BBDD99C79C64D018C6A5E0BE3A40DCB1B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711349571, "uuid": "d684916c-0cf9-4f6e-a27e-3f3ba3e7cb90", "value": "3072:XYFEhNe4VTdRnTT8w4TWX7ZIgJdpe+og0S7A:XYFY7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711349571, "uuid": "3f4aefae-ce9d-40cf-9ebb-e6d99a4e79a4", "value": 299698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711349571, "uuid": "8c43a339-3890-4c61-a349-3ee355f68853", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711349571, "uuid": "11e6fb34-7701-481e-a4fa-7d46efbc7c56", "value": "New_Order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759586de-ea95-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1711363813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711363813, "uuid": "7775845e-32b1-418a-9bea-bdec543c26fb", "comment": "Malware payload (njrat)", "value": "256ac8fe73c61f22a1c479606e1508ea", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711363813, "uuid": "cb047dc7-e859-4d13-b87a-9a4d306f565c", "comment": "Malware payload (njrat)", "value": "0231c4a5cd7e1a07cdbaf84df4f635fd6c4acbadf14f817b4004ecbcc3fbd3f2", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711363813, "uuid": "190670d1-1237-4d59-a73a-eb284696be8c", "comment": "Malware payload (njrat)", "value": "33155ce05f51507912b032e608dd68bef8897723", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711363813, "uuid": "33fbddf3-cb71-4bf5-940b-cb938ee455ee", "comment": "Malware payload (njrat)", "value": "2122489d0006cc7a6c119b3926e0fe325d35774d19d9fe558a9a64525619684c3728cb4c79504e3faa6f5be589f3b74b", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711363813, "uuid": "3d0b1a41-630b-4a1d-aed0-e946b55f13a2", "value": "T1ABA3D02DC62D3D97DEADB151382D68544708C2DB48CD08D7A9EECC5DCB6EE8EE4D2806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711363813, "uuid": "808135d0-4a24-4021-b4ca-e4598c60f045", "value": "3072:IwueGbqzhFA9XDPj02Zs9VFRp3zYkHSu5sXO:FtGb+zAdj0KgFjzYeSu5sXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711363813, "uuid": "4246a1a5-9c87-45cb-97f6-36068cd6d523", "value": 101186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711363813, "uuid": "6611f9b9-6e77-4fc2-8412-2dbe7516e3c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711363813, "uuid": "e5f0c5e2-0ccb-4550-87fc-f6396a07dcc4", "value": "Outstanding Payments.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0243fce8-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365338, "uuid": "6b19fbf1-7e99-4552-b6c3-bf71091a8820", "comment": "Malware payload (Gafgyt)", "value": "57576a0baef15a9a87b9883d9987775a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365338, "uuid": "c4529574-f160-4996-80de-3e67e94767c4", "comment": "Malware payload (Gafgyt)", "value": "0302a084d7d3f03d60c1827b965279ca72fa1d294326c25842ec8dd4fe733bb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365338, "uuid": "dd148fc4-cfdd-4cc3-b45a-960755e755cc", "comment": "Malware payload (Gafgyt)", "value": "2ca54b25df3842dbeffea0d12c157d2c9bacb1ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365338, "uuid": "f34cf87c-27ad-49af-b9b1-5686f85aa5e2", "comment": "Malware payload (Gafgyt)", "value": "8979021dbd8d8dc3ae62ef7fdb3d1b7cf4742e168ce16dfe0274989d9d07ee31f50e853290ad911819a6df8569b64100", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365338, "uuid": "f37fa5f8-65e9-484d-ac99-a82d4057339a", "value": "T19E932B81D640C6B3D05F0BB9119B9B112533F6BA266B9D6BF31C2CB4DA07881725AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365338, "uuid": "7967f381-7c0e-43f3-a020-ea862f130ce8", "value": "1536:kiKvk/P//7U8U0Cq9YEjTKH1VPPyfkXeN7GlBqYEkjmy5hGL7brT0O2R9sNBF2Pj:TKGjU8U0p9YEjTKH1VyfyelGlBlb5hGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365338, "uuid": "3e1e4603-417a-4f8d-bba4-c2ff7001519b", "value": 95132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365338, "uuid": "1297b1dc-41f9-4da5-85f5-87171834eaa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365338, "uuid": "20feb241-20d8-45ed-b566-bee307c0d075", "value": "57576a0baef15a9a87b9883d9987775a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0416156d-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383809, "uuid": "b25cf959-d5ed-46fa-800d-75ddc881cd41", "comment": "Malware payload (AgentTesla)", "value": "37401a2f1c14ca7f50a260fb249b4bef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383809, "uuid": "6b113506-fc26-4b97-aca9-41c555df519d", "comment": "Malware payload (AgentTesla)", "value": "04f1a4029ceab0910277c84393147a726a9fd5d3e53e77725a13608d5a883a96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383809, "uuid": "541ac08b-2c18-4144-951c-40765d8de64f", "comment": "Malware payload (AgentTesla)", "value": "d938cbaa977659c91031329dd505d5060babfd73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383809, "uuid": "c99a4ffd-ed3d-4959-9b90-3eacdd6c2bc3", "comment": "Malware payload (AgentTesla)", "value": "391b02630498b8f8b5ee12aaae69d82703a52711ab32e964037e594590e6144cf5c9a750ff618258e279d32a10a4d1a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383809, "uuid": "e61096ee-fab3-4e6d-912b-8a88d894f262", "value": "T17CF42386E5AB15C8D74C83AD99E42D0E5F253B4DDB95C24DBC688B473B304FD30AA90E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383809, "uuid": "c1dfda93-023b-4401-a478-0d25550d0db6", "value": "12288:iWnWGfjFXF9xnjXfRa/yo+7RkH7q3U9X/HyJcRhAp/U4v0N1kWxaRATTlrMutAU1:3HXFf+y5abq3O62RCpUHN7EkVKV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383809, "uuid": "5c491ac9-cc23-410c-ad5d-0bb7ad6152e4", "value": 758321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383809, "uuid": "29d7fa99-634a-4ca1-a774-bbfe00c344bb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383809, "uuid": "8cc32806-2b65-4566-8ee2-3d9b39babf96", "value": "Resqust for Quote.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c39a817-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711385299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385299, "uuid": "5c937c11-f280-4563-8f23-8da517b583f0", "comment": "Malware payload (AgentTesla)", "value": "41685eda86fd0c3580849308a25b4a9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385299, "uuid": "1c141819-60fe-40b5-bdcf-302909eb9862", "comment": "Malware payload (AgentTesla)", "value": "0602f5f777f16e6eceba591204219845b53b8f82b130b0a58b384fa2c06983fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385299, "uuid": "d63a9ce4-5a6c-4e14-a11c-562eec7dd159", "comment": "Malware payload (AgentTesla)", "value": "b497bde46d77522ae99ba0a3b06b0f0c930ee0ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385299, "uuid": "205a66db-08b8-4c17-96ec-adf2181192ce", "comment": "Malware payload (AgentTesla)", "value": "0a25c83bb7a7ce410e250c50667b71e0fe4499999751b5ba641373f8ed04d8d6310f2f1d4fda4a90c4b3c8b0b770b4b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385299, "uuid": "7d2cf555-f292-4d48-9ac4-3727c8cd96fd", "value": "T18635BF027391C062FFAB92334B5AF6515BBC79260123E62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385299, "uuid": "830f611b-a7ee-40ba-92fa-715704bac3a7", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385299, "uuid": "43122072-f293-4ecc-9bf1-0937840e506a", "value": "24576:bqDEvCTbMWu7rQYlBQcBiT6rprG8avlVB:bTvC/MTQYxsWR7av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385299, "uuid": "6c15b3a9-8bbd-4054-b57a-6c8d6bb52d27", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385299, "uuid": "d51abdf4-a7fc-4c07-9c0e-f7222ee58383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385299, "uuid": "1f5e4f2f-ecb5-434a-93ab-a74afdf06ef1", "value": "41685eda86fd0c3580849308a25b4a9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86e8558-ea88-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711358369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358369, "uuid": "54347a7f-e12a-4940-b648-bbd655a67631", "comment": "Malware payload", "value": "6baa663744b63175132e4c4e67aeafbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358369, "uuid": "fc1c9f31-a709-4638-b5af-4df11a2e2e44", "comment": "Malware payload", "value": "06258ba59fc0fce8016facfea4c1ae3227e71efbab604bd4f310cfb064077b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358369, "uuid": "d1773649-299e-4f43-8528-fa8561524ffc", "comment": "Malware payload", "value": "b23fb954516fe0cd2287d1eb656c363cd45764b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358369, "uuid": "74d44ada-fbfa-4680-8197-c9163fd661da", "comment": "Malware payload", "value": "413e479909fcf76ab19a7af61eedd3d818c5953ebb7432ff84562107224bc1e618d8c7cbce62ec01d70cf960e2690f93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358369, "uuid": "8d36743d-cdb5-4078-a7b3-9f5ba8c48515", "value": "T1554633B0ACC714B3C19E193394B0C7720D2FE9369B47A45FC9A056B99E72AD15223F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358369, "uuid": "6ae5f758-9c42-4e5c-8ba8-cb169f5ae4ca", "value": "f72d7260b75875d4cc65750aa7b35d18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358369, "uuid": "608cbeca-96e0-41ff-885f-8082cf21c1af", "value": "98304:Q9tYA00XHirM3WHijx6a/7JN6GGJo95d5BU6TDynHDIxd0df8zqKyqcp0UCIzx:KYR0XirMGHisaR95dLU6TWHyd0dbKysc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358369, "uuid": "60ab8a40-76c7-4652-94b4-d6b9b6cbf11d", "value": 5514635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358369, "uuid": "7dcad7f7-a767-45b8-91c0-9e628e7c202d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358369, "uuid": "2aaf1a11-cb5b-47d3-b2ce-3c1dbf4783f4", "value": "SecuriteInfo.com.Win32.Evo-gen.28489.31883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a72f7a2-ea9e-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711367606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367606, "uuid": "e0bdb9e7-e3f8-422e-8157-ca379ab161e9", "comment": "Malware payload (AgentTesla)", "value": "5beb87bbb91a52e9cacfdc4186a55de2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367606, "uuid": "4374a6b0-4485-4313-999b-5663723285a7", "comment": "Malware payload (AgentTesla)", "value": "06310626cb603e88a438ef3bda2702ea27867e3552ddd7010fe1e55d6ed74839", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367606, "uuid": "8db19154-6577-4493-92f7-82279c042903", "comment": "Malware payload (AgentTesla)", "value": "57e0e26026c5d8233e30dc67b1adc54a0d779d79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367606, "uuid": "7dfffe1f-2cdc-445b-a2dd-56b1b39f3b19", "comment": "Malware payload (AgentTesla)", "value": "a93ef0ed3904ce0bbc7edb53746fd52e87d9d845e68d57c2f32c9d6504402f2eea3f59c9b87a328b7ef2ad01c653a047", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367606, "uuid": "fa63a4e1-f987-40f7-8d28-dd71a9b1139f", "value": "T102F4121133BC5A37E2BE6BF95861140057F2B62B60A5D3EE0CC154DD59E2F00AA93FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367606, "uuid": "5e327e0d-6da6-48d6-8432-ba4d0fefd69c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367606, "uuid": "cf29a929-9704-425c-aee2-204a92024e75", "value": "12288:24CMwz1pCU+NLVEJf2vXFvsTWnyTAs/QBm+30RwFZmlsra31IA:swLSFmVlny8sIk+30y8sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367606, "uuid": "d1aad3be-fe20-4d27-9651-eb737effe65c", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367606, "uuid": "bdcd8441-0e60-4193-9e85-2477ee4d8508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367606, "uuid": "ece67a27-707b-49d4-9eb9-d03aa27cf196", "value": "Pice request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09410c1b-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1711383818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383818, "uuid": "67e84f6d-2632-4621-83f7-55700d96dfd8", "comment": "Malware payload (STRRAT)", "value": "b623c370b427039563d1a12581605ffb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383818, "uuid": "705f6903-7e6c-4228-aa63-48adb99dd091", "comment": "Malware payload (STRRAT)", "value": "069c716db6c53a10f55026d650b7530db1169858836dfbbba95bedb2617c43ac", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383818, "uuid": "3c9ea293-9354-4ba8-8241-7a209740d040", "comment": "Malware payload (STRRAT)", "value": "b3c6c4519955c3f54cec7916ff80c2f1f7e4ee2f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383818, "uuid": "6dc6a987-bad6-4295-b637-78814d67521a", "comment": "Malware payload (STRRAT)", "value": "45e9a929e78744509e882a8c7be550ca7d525051828a379df5549b68d891154664451613f0f5bba3d8c5e59d46d7b24d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383818, "uuid": "b428b8c6-607e-4e10-bcfa-f03b2005659f", "value": "T1A57412BF7ADEE069E41B527221908271AB2C86D5D284941FB5FD1E4D4C37C8C4B92ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383818, "uuid": "a09bf8d1-efe3-416f-aa1b-efb14e2fe9db", "value": "6144:XRQbvXDhQg7g2DpgHBKBRaDnsHOslQqOn2Qyn+Bo7LTjE:BQb/DhrKQeLN5Bo7/jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383818, "uuid": "18e7fb56-f8f8-4823-9fa2-1e09f347c85d", "value": 344540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383818, "uuid": "01ae285f-56f8-4ae1-ab57-2060fd1b88a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383818, "uuid": "d178450b-fdcb-4889-9f4a-e61c0eead019", "value": "Swift copy of payment.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2573c7-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359741, "uuid": "a9d34c38-09fc-49c6-b68d-d0089f6a343a", "comment": "Malware payload (Mirai)", "value": "b0a8e401c574d0b75f95a4d134bbbac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359741, "uuid": "af561ea2-d566-434a-aec2-77e21c2e69bb", "comment": "Malware payload (Mirai)", "value": "07ff0a6d179224d57aad6f733e187dae4b1126627722679aa25274aa5a01cf4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359741, "uuid": "0971214c-d355-433d-8c0e-84f8ad4a135d", "comment": "Malware payload (Mirai)", "value": "21039441a5aaeed9e890345a17b4cbd6bb68f262", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359741, "uuid": "bb4fff63-95b6-45c6-9b09-10e070b7323b", "comment": "Malware payload (Mirai)", "value": "805ef27ebbfe50015e758de02281a98bad88ba88db65cb6217da7418e286eec817c47118563387b5c0e9b248f9c967b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359741, "uuid": "7259ba73-cd1c-412d-9f91-ab23ac04a5c7", "value": "T115B2C0CC61443084C98DBC7C278D4A664F6CA1D0BAEDDB16E364CDD873BAA4B385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359741, "uuid": "abdb4b5b-9a10-415d-ab24-9e384b3175ae", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpx9Zq8Wve:BQlS07FUXqIYSXQKqu5qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359741, "uuid": "f0fe589d-0f0c-49fa-bf62-a49ded3c286f", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359741, "uuid": "d7d68cd6-74af-463c-9db6-4cad2a2f8c5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359741, "uuid": "1123e8fc-d656-4341-ace9-9588b17e9b82", "value": "b0a8e401c574d0b75f95a4d134bbbac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697a09b8-eabc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711380543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380543, "uuid": "2533021c-cafa-455d-a517-e9855708719f", "comment": "Malware payload", "value": "e5fad12b7d3333f7a5e940f8b93c6e7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380543, "uuid": "6bbe3743-7d71-43e0-bef7-79dfea073079", "comment": "Malware payload", "value": "0a02981af9a8948f4dac63cfac6127c7b4b17c1f13da877f4a31a6aa2a9b56c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380543, "uuid": "bb4eee30-7525-4a15-8215-401509652248", "comment": "Malware payload", "value": "5593b7df806780e4f6814e234cfe86ea42369d05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380543, "uuid": "3bb282d0-ca94-4732-be0c-a74f7664b462", "comment": "Malware payload", "value": "faf0f230db0c016a54ae16594b30b6512be579a91b534af3c266daa983bd7a04dbb59ee83e1218bd059f5957ae38ad62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380543, "uuid": "59351933-a052-4adf-9ba5-f51019a4022c", "value": "T1B5F30946F8818B15D5D212BAFE1E128E37271B7CE3DE73029D245F307B8A86B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380543, "uuid": "71804ae5-58df-4b2c-9af9-2c8362a26989", "value": "3072:s9F08cMBepWrAIjUqapfg8a36hQiM6MxeGcWyJir6dc:c08zcktIPflaq6iMQGH1r6dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711380543, "uuid": "f15a7d85-0ce3-413a-9b15-5a886fe04379", "value": 169596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711380543, "uuid": "3a7454db-8b72-467b-98dc-83179096fb9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380543, "uuid": "a99c1b17-f49e-441c-a958-f81fff250419", "value": "SecuriteInfo.com.Linux.Siggen.9999.1198.26098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0e1852-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368389, "uuid": "7cd92d01-be45-4679-8959-a1df19fb7c2f", "comment": "Malware payload (Mirai)", "value": "8745eda703a2e55dac84e0a78d77a107", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368389, "uuid": "8e8201ff-241e-4c5c-b802-9d6ba620a9ae", "comment": "Malware payload (Mirai)", "value": "0c48c50c8007a1e6f9d5d79a95c04963e2d6af4ccb98e830836d62126f1d4259", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368389, "uuid": "7315bf23-d405-4b70-92c2-5cffd8e6485a", "comment": "Malware payload (Mirai)", "value": "f114daa048f30702ff2bd7c2118318552c5d84c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368389, "uuid": "4a7493b1-a4c8-4d1e-a33a-61c52dc11c91", "comment": "Malware payload (Mirai)", "value": "eb1f60a246a9d9ee4b21f8b160a1882d7d8dc7c05f0694697f3ccbac99e75c4cb93f0c268e59c04d7a8439c47e8bcca3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368389, "uuid": "8599c971-6441-4812-afd4-dfb34e99664b", "value": "T1AC73023355F985B5DAF006AFE4259D832AF374F0D33E69B3147042B9BD820872678663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368389, "uuid": "867cb9d5-f0dc-4ae9-a074-687b2e524377", "value": "1536:Y0wYBxm9AHid41oNbLzKbeJctLCGW3xdP9GxN7nh0llA1OKeCNfLS:Y0wYBg/4ALSkGW3j9Gbt0oeqfLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368389, "uuid": "d1a32e81-d626-436f-b555-2b7c8171c68f", "value": 80364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368389, "uuid": "871a9bf8-6a54-4ef6-92eb-2b085371b048", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368389, "uuid": "dd80245b-c61a-477a-8a0a-fc0fc0df78a4", "value": "8745eda703a2e55dac84e0a78d77a107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae0293c-eacc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711387391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387391, "uuid": "ae3bd0d3-8a8f-4d06-b7f7-7a321ef37c27", "comment": "Malware payload", "value": "037b72bd0844cb2ce886cd6442c03694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387391, "uuid": "217e7a7b-fbdc-4324-a199-314742c1171b", "comment": "Malware payload", "value": "0caa772186814dbf84856293f102c7538980bcd31b70c1836be236e9fa05c48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387391, "uuid": "617f3f68-7cdd-4e5a-9ff6-14da34b81f6a", "comment": "Malware payload", "value": "242a11ac80b1370801169997fbf6265a412e61ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387391, "uuid": "bf8fbc3c-3e59-4c60-b137-ef1408ffd25b", "comment": "Malware payload", "value": "e8c9d3796e25e3524a68af328aa7ea42acc2b6cf41a668ad56acdb661c45730e6a732c9026d2a8177c5538e6256b6a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387391, "uuid": "e901d174-37c1-45b6-b95c-2bda0233286a", "value": "T128D64903FA948AEECA559279896246C27771FC442F16A7C36B04F63C6DB37D86EB4304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387391, "uuid": "7b82749f-3c0a-4649-bba6-7a7b8498d831", "value": "8c893e679774af99b3a5f251a00677ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387391, "uuid": "e952a311-3c53-497e-b9e5-561447ea92fc", "value": "98304:lS949otHsw/xmF4EMz5YA8/cwumyz5E/qfOeXtOqmSr2fvYFgaH3e:E2OtHswYxMHzq7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711387391, "uuid": "52ee6199-cf60-4f56-b9e8-344256bb1cc2", "value": 13198274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711387391, "uuid": "8f38ad71-240e-4eb4-aa29-5dc8339a912f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387391, "uuid": "8385d86d-69a9-42da-a66f-3a0510b6b6eb", "value": "PuTTy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212245df-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711367967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367967, "uuid": "eeff9357-e017-41d3-bc1e-ce53268bfcb1", "comment": "Malware payload (Gafgyt)", "value": "7a2e0f11e27d58419511d93f4248f75c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367967, "uuid": "170a41d5-22c7-457e-9ba0-dc9eab87ffe6", "comment": "Malware payload (Gafgyt)", "value": "0d8c04e275d51adb7d645b05595f091409deabde33a09adf36351b0f3a096f58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367967, "uuid": "6bfc9208-aa73-463e-8646-482cd4e83c1c", "comment": "Malware payload (Gafgyt)", "value": "c0d122d09ae70da54717c58a5bc0ed150004cfad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367967, "uuid": "fc065e9f-b3ae-4145-ab90-4dee6068ce1d", "comment": "Malware payload (Gafgyt)", "value": "6d45a6511ca12d50a021d2c4ab5439f6137b580b6aa862caca7399fe5baf674f6a3d7900e2f7eb99c7fa9476b8ea9b68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367967, "uuid": "1ba52fb1-3862-4cb6-83f8-9f941bee227a", "value": "T17EE36B72C8262F58C668D5B1B0B0DE795B53991482872FBF19B7C6B94043DCCFA097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367967, "uuid": "27cef69b-1233-47fe-8287-74690b5acae6", "value": "1536:Jcni25OhZzq3u7zDAHfcKmJh+C/2KqveB8L10oS0CesRWBvZKsJFXp8x5TTS:JcVIz4uMHdcoSJqb10o7FSWBosJ1+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367967, "uuid": "9014591d-8468-4ba5-b082-6aff191945f2", "value": 150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367967, "uuid": "6e3535bb-a659-480b-8e7e-3c38c9e69d4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367967, "uuid": "69df5fcb-2be5-48b0-aec2-0a5c93f8673e", "value": "7a2e0f11e27d58419511d93f4248f75c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1034ee-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711409114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409114, "uuid": "2359e165-c7cc-4cad-a2ab-c9cde9c94c5c", "comment": "Malware payload (Mirai)", "value": "65e9e151c3de7e815dc2602feaea4247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409114, "uuid": "db79655f-de4a-4ff0-a4fa-770477082b8c", "comment": "Malware payload (Mirai)", "value": "0e196ee37b5516112d7ea600f27620d012492d7637fe969f5cdb6b25af5ea8e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409114, "uuid": "402b5bdc-b6af-408e-b1f1-dc088b113721", "comment": "Malware payload (Mirai)", "value": "22e2dfc011e0dd026b8a9b8c1c9808f73f60f09f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409114, "uuid": "8f0ab9f8-db71-4baa-a782-2c29e1f466df", "comment": "Malware payload (Mirai)", "value": "352dddcbac77957d84d5d1be069cf1f0ef5d76c852096b49d28226a3b9856af37b576af072806744b4b3a456ad31263f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409114, "uuid": "4cbac117-ab5d-4a23-8a69-c30a959c2db6", "value": "T112310F9862D05DF8C8D451BE9D56031173649F80E0C732A382087B25BD2AE785C27486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409114, "uuid": "d8f1550b-7f75-4935-9e64-0b5491c40daa", "value": "24:lpKGpa7Urz/jlfR5XK1hUVev3gRGaJ9iM/BBukDsHlxrR+zHGS90t:/KGpa7UrLZRu/+J5BukDGlxrsHGS90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409114, "uuid": "e9fdfb61-08d3-4ff5-bc08-63ebaa31bd79", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409114, "uuid": "d3b11f86-20e7-4855-9606-d2cac832ccf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409114, "uuid": "81b5083f-352d-4a25-8364-e3caf145b967", "value": "SecuriteInfo.com.Linux.DownLoader.523.20043.16420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7156b1bf-ea82-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711355646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355646, "uuid": "c6a6dfa7-062e-41d9-955f-f66db801f954", "comment": "Malware payload (Formbook)", "value": "4bdc4934c5146827cf7109505f54b3e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355646, "uuid": "cb182088-51e4-462e-8bab-f41a4c2de7c4", "comment": "Malware payload (Formbook)", "value": "10a2ba9cfcb7738cbaf5a4a01fe235d437e303c74225f6792536daf532d0e7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355646, "uuid": "bfcc03e3-9fb9-4dfc-8370-1226a0c28931", "comment": "Malware payload (Formbook)", "value": "3eb6553ffa742a727c4f6a2802244b3e631da651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355646, "uuid": "6470072c-ef25-48bd-a1aa-797920fe4f04", "comment": "Malware payload (Formbook)", "value": "0767a5f651ab55bad6a69aad883cd332802f035f2b69a4bd57c682e2e0a0a12cd931996506963e9236d895d2173af2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355646, "uuid": "4771472d-464e-47df-a1cd-ecd0055e09e0", "value": "T1F1E41267B75803B7C5AA03F282AB5A597339642B2371C5682CD050ED27F7F009B76B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355646, "uuid": "309b947a-3326-467f-b834-969c5d6bc61b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355646, "uuid": "03997f09-ba10-4ec5-8d6c-f92b76c3539b", "value": "12288:3OKgC74CMwc/xbgEY8gG4xfe46JiHv9AsAmqukThSQ/AshQSaOxKfE/4FM:3OKFkPJ4xm4TP+HtI5shZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711355646, "uuid": "c52d07f8-f9ed-4c5f-939b-ca53e569b5fb", "value": 715776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711355646, "uuid": "2fec2e14-2695-45d3-9706-8b8fe5301a24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355646, "uuid": "5602c520-9fc0-4577-a832-0dac1f6b9c5d", "value": "SecuriteInfo.com.Win32.PWSX-gen.32672.32442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46d0bfd-ea9e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711367892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367892, "uuid": "b8b40213-067c-4faa-bd09-e524ac6f7962", "comment": "Malware payload", "value": "80e9aa1e7f97d73b5ea8a2649611f46f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367892, "uuid": "2e08f76e-ba5a-4a12-9da5-9e666aea9dca", "comment": "Malware payload", "value": "125dbbbc7f37083e5eab09d6ec2c4802b0391cdcc2c034ad7b4ad374e0f8111a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367892, "uuid": "fd31d1c6-e5c1-4357-aabf-00a7a0965f0f", "comment": "Malware payload", "value": "f68bb6578c7b928854c5ecbd4322d0aeb469416c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367892, "uuid": "1e9deadd-dcfa-4ef7-a71d-deba75abd142", "comment": "Malware payload", "value": "33ee49b4439cd1f57ae1ef06dcf8d8ac0a60a74fe5df9abd28ae185b36fe8550d5c9316824a5820c76b79f5e3ff1d911", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367892, "uuid": "a7565b69-4133-4a72-be6d-e9ecfbdd3786", "value": "T151061295E31C903FC9B740334ABA273642A78D4A49D3AB532958B21C2DBB6C85F5DFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367892, "uuid": "f60d319b-6469-4825-ae8c-8c8113fc78e3", "value": "98304:B+PaKLUHED4rl2LSZ6YZQ1NKTiQ0kU30lWkQVOqTzfrfl5v:cPpFSl2LXiTV0kU30lqVd5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367892, "uuid": "ecde0e0f-895c-41c5-99f7-fb1266ff6f79", "value": 3724499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367892, "uuid": "3e375a17-c35a-4813-8e8a-dd08b21e6558", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367892, "uuid": "7cfacf58-a186-40ff-9841-a4d6b8f7d642", "value": "Lovely Caller Screen Flash_1.5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189228ff-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711383844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383844, "uuid": "6a567cb9-e9d7-425f-bc65-56289e867fc6", "comment": "Malware payload (GuLoader)", "value": "7a34ff061a914ba4b62ecd16d20cd118", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383844, "uuid": "c0928a70-4aaa-42f8-a1dd-afa896a92d94", "comment": "Malware payload (GuLoader)", "value": "13dddd9cebc136afea2553f1b780849f830ce51dd73a7e06eccfe25545911f9d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383844, "uuid": "73ed40ec-1325-4687-a557-2615a95a41da", "comment": "Malware payload (GuLoader)", "value": "5807fd68faa18f57d43e4c0c3139356b7f441809", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383844, "uuid": "629c28f3-87f5-4b81-8e55-cab3a5aab466", "comment": "Malware payload (GuLoader)", "value": "b4dfb485e08828b281acf1f1414452619511fdda59da2c4bb115d8622c19c6ce121fa209201c745b3e90e9c47e1bf37b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383844, "uuid": "81d7403a-380a-4d4f-b6dd-6d31b62c7b7d", "value": "T11804B5E7CAC526688A851AB3ED134B734DA4406D33231F3893BCD65DA04395C8ABFBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383844, "uuid": "6408f688-eab9-4439-b306-30b3f2a2b62d", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyk:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383844, "uuid": "13d96b2d-329f-4b36-b0ae-259e26f872da", "value": 183038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383844, "uuid": "891fda23-008a-4031-aaa6-df493197c46b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383844, "uuid": "1e8724dd-20c2-4310-9d66-71ed603edaca", "value": "??_(NTU)_??_2024100044-05TW.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7717190b-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711385291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385291, "uuid": "115c3ad1-93b0-4ae1-b346-03325e6d40a7", "comment": "Malware payload (Mirai)", "value": "180f70f5dfd4c5e0b9efe3aa96b1fc3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385291, "uuid": "4fa36fd8-7309-4056-95a7-df0ebf322473", "comment": "Malware payload (Mirai)", "value": "140f350abcea12e619e5f3171dcb44a63b04d265c10f2f8020c3a6719c9d7a84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385291, "uuid": "8d796541-a453-45c5-8788-51feec1abc5d", "comment": "Malware payload (Mirai)", "value": "fb98306dccb0ea85c31af2890115715060ed3311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385291, "uuid": "dc46ee3a-caa0-45c1-a61c-c45a742f483a", "comment": "Malware payload (Mirai)", "value": "4b8c5ba1db2e99dbb874773da5a803a4c114be0caf8cb71f229f27bcd5e1a4dcc5c7ef825202836af5da32b3784325a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385291, "uuid": "c0384a6c-1f44-465d-bb62-670ad1851cc9", "value": "T14B63015F74BA3CEBC29C19BF46584262480E4194FA159BFEF3D4504B93C39DAF26E418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385291, "uuid": "b7b7a415-24ce-4809-8b29-10d2db0f20dd", "value": "1536:iLivQvk7yXeynUfy+P5GomJNKopyyAyariqZYF1nx9IFrONV:iaUeynEytomDK6y3LZYFZx9euV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385291, "uuid": "fcff487e-ab39-4fe0-986b-4dcf22b1a9f8", "value": 67824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385291, "uuid": "812198a9-6f6f-4eaf-8b33-125786ef4e6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385291, "uuid": "5e19c3c8-c57f-4450-bc66-e02305683691", "value": "180f70f5dfd4c5e0b9efe3aa96b1fc3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5590c832-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711383946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383946, "uuid": "fdbb8213-730a-4039-8379-ffe3121e8ac1", "comment": "Malware payload (Loki)", "value": "340b7b84b12957dfd45d94014bd42534", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383946, "uuid": "b792fd04-9347-4b5e-ad90-9824a3932aad", "comment": "Malware payload (Loki)", "value": "15603ab70daf04dbde87076530c50bb412ed90e1882489ec46931a4c0de04a22", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383946, "uuid": "893b8e7f-f023-4101-9b27-11b8c9ada1d6", "comment": "Malware payload (Loki)", "value": "5f64f5a508236ac3488775fb5d7af143fbe07898", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383946, "uuid": "a1f122ce-c63d-422b-ad24-126839b834d9", "comment": "Malware payload (Loki)", "value": "c84e45748f6ff164b6560465e3239fab365f76f250be1f0090301f5c4acb9432d40eaa089220b9103d092eeee429a956", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383946, "uuid": "038b8a8c-eba6-4cee-88cf-a138be97e2ac", "value": "T1900490E3DAC626288A851AB3DD174BB34EB0409D73131F3893BCD65D608395896BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383946, "uuid": "4755cd52-005c-4c2a-9bc9-351443870b34", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyE:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383946, "uuid": "82f7045c-e066-44da-9fcc-b49f50fd1165", "value": 182173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383946, "uuid": "f12b6f22-f911-4073-b75c-7f57dd54c939", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383946, "uuid": "40ef9da1-499f-4eaf-9ba4-371681ead97e", "value": "Consulta FEMCO-2410044-05GT\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325d7d62-eab4-11ee-a120-42010a9c002e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1711377015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377015, "uuid": "6bb6729e-4ebb-442b-877e-052e7878929c", "comment": "Malware payload (Gh0stRAT)", "value": "f0dcb37fa43d3e0666e006fc8957dbd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377015, "uuid": "0d965f9d-ffd6-481d-902c-da19f0f604de", "comment": "Malware payload (Gh0stRAT)", "value": "15b037f8dd340ceb319702a38ce3e2afd87123fab72f3859a99b355c050f4f70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377015, "uuid": "7b2921ad-6c41-4b85-8ac4-30118a17d416", "comment": "Malware payload (Gh0stRAT)", "value": "7f0d0c43d9ae55d0b71ae2407d56777d40a61546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377015, "uuid": "c098efb3-e369-4801-9f12-f9b2cee1d7f4", "comment": "Malware payload (Gh0stRAT)", "value": "5084ad275009d372d51b1f4864f6b306e3799799b4b940aadda1524e0d1fd63e681270071d85ead611548e3027aee3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377015, "uuid": "35d2ef5f-32cc-4bc5-b0f7-30f072b9344b", "value": "T148C4CF15FAC24016E09C05B0C1D38BF5ABBC9E73771320DFD7A0B94A1AB51D669329BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377015, "uuid": "83b39f58-4918-4e14-b85d-0728a76c8023", "value": "a0158c18d7c57554131cbbf4101b1cab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377015, "uuid": "3a0d3a48-f3ae-45e2-8976-db22991668a3", "value": "12288:HruM9FNatyT3gNCpOdn/uAcZNJ7QD7HZ5rbx:K+atynpOd/QzJO7HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711377015, "uuid": "38da98d9-b0a7-43e3-90ef-f1635ed2119d", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711377015, "uuid": "3fea38bf-b4df-485e-9537-69ee3dc7c513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377015, "uuid": "7d0951dd-1525-4a02-a5a8-6f42a2867b0a", "value": "F0DCB37FA43D3E0666E006FC8957DBD8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9a9eb2-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409110, "uuid": "9948462b-b477-458f-9de3-1671ff40520f", "comment": "Malware payload", "value": "ceea68f0be78e3b0b95ec2b6e69f7634", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409110, "uuid": "9a7d8ef6-9fd0-4cce-b22c-5261f1bc0c36", "comment": "Malware payload", "value": "198720a409d2d229e3b89470b1229a39a00436f01554ca81df09850ccf8801af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409110, "uuid": "24e70da2-8393-4ebe-81f7-8e4e7d684d0d", "comment": "Malware payload", "value": "130621199a0a6566ecb1bfe46c290a06bf94880b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409110, "uuid": "25afb653-0416-4708-a9af-aa0fade61c79", "comment": "Malware payload", "value": "0044a22072c95ce2dfa1bd26f1bedc005995c9047299c39a8338fb6d08f512498723384753683b4ea19e1db6259ab616", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409110, "uuid": "9a2fcc51-43f1-4d77-ba04-c9feae2cc04b", "value": "T1848302D8591F10C65FBA58B01C3C5050102DFFE0B7DBE9B1ABA98820ABD519236BC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409110, "uuid": "cbc517d6-ffd9-43d7-93d3-67d88cf05f59", "value": "1536:Ed4lLPGOz/12EgnCW09e2ZagfcxUyqudYsyNzaesbuj:Ed4VG0/1LgJAe+fcGyqqYsOX9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409110, "uuid": "7a9820dc-c1ae-42be-bf71-b078795324b6", "value": 81312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409110, "uuid": "0d5ed068-364b-4717-a3bb-cf5cc5c4d53d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409110, "uuid": "54407dbc-4353-477c-a25c-5183ba4e5317", "value": "SecuriteInfo.com.Linux.DownLoader.523.25674.3212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ec6c91-ea98-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365321, "uuid": "37828fc9-7235-488f-9bcc-3ab0ce1d41f2", "comment": "Malware payload (Gafgyt)", "value": "a6d30d2ee0ddd826796fae7f9b0d31a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365321, "uuid": "427c108a-7cb5-4a53-b769-c4d6999b1855", "comment": "Malware payload (Gafgyt)", "value": "1b5c89cdb820f93030e2dd5161cfccdaf7c6be9e92fbf5ff6e0591ae5e3e824e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365321, "uuid": "59f47fe2-7c82-4066-a92b-bb10bad70589", "comment": "Malware payload (Gafgyt)", "value": "c0b4d1839c8afd2b3f10fbeb47fd7508cce94cff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365321, "uuid": "a270c1ff-786e-4a25-87ba-e650fd3c3304", "comment": "Malware payload (Gafgyt)", "value": "694e1b79c481a31f162613078b5525ad2835ba6becef739b6404efc834a244752d39e55938980bd1536da5c7fd3eec5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365321, "uuid": "3d48739d-f6f8-4bd3-9bf0-f8066d157506", "value": "T150C3E805EC408B27C2D267BBEB9E478E7B355A986FD7332256291DB02FC17482E3E550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365321, "uuid": "f2c3c725-2ef9-4da0-9e77-6a4f448be10b", "value": "3072:+Hrp5t53td5KN2bZLEjTBF5Xefn5hZ2yITmj/8TpoQA3lTEKh1:KrEF14n5hZ2y58TpoQA3lTEKh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365321, "uuid": "63709fcf-89f3-479d-b1c8-0d89f3b0ec65", "value": 119972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365321, "uuid": "b9aaeffe-06ee-41ea-b25c-772eaab792e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365321, "uuid": "c62f021c-08b8-4084-a8ba-02620be53fd0", "value": "a6d30d2ee0ddd826796fae7f9b0d31a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d2f337-eab2-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711376375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376375, "uuid": "67e6158d-b289-4662-9b11-8c5987aa951c", "comment": "Malware payload (LummaStealer)", "value": "82e5b2d293bec21f6277a5a6c91999f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376375, "uuid": "60cf4aa4-8978-4167-9626-c73c89c3665e", "comment": "Malware payload (LummaStealer)", "value": "1b76a4c073f5cb3cc6c1f552e042daf0b4ba66965f4b994165adfbf1860db001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376375, "uuid": "b1221123-587b-487a-8139-6fbe776e0511", "comment": "Malware payload (LummaStealer)", "value": "470bb0b87739339806df68da2fb9b59c8baa5fa8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376375, "uuid": "b97b656c-ae87-4d9a-97b0-4f82c4cd4b18", "comment": "Malware payload (LummaStealer)", "value": "b1166a0ee5d0970120d4e7adce5bd5d1ded3d5bcb3d646e06e094da21ee297681f2f6f16fdc35beda7d3172e5cb6b7b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376375, "uuid": "4c8b8994-62be-4411-983c-f6e6c48b3452", "value": "T16446233356271298D1E6C935CD37BDD071F707AA9B80E8B8A5E7B9C626329E0A313543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376375, "uuid": "091a6e98-eb31-4a22-9289-6a8c650cecd0", "value": "89c8abd38fd3ffc06ee06d01f9b3cbbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376375, "uuid": "885221fe-d22c-4339-9f2f-b504bc6f9b55", "value": "98304:+AMEgqpDZeqlCyxg5IrjgHRbPuZHqG6WAqAr7TF7IG0P9LYhHXihUK4TDqOf1pvz:+N1qRjlTxg56kHBPWAqAr7JGFLY4aKey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711376375, "uuid": "918576f2-9422-4bf8-b24a-4a67265a5d08", "value": 5735936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711376375, "uuid": "8d66d295-a60a-48b5-ba9d-9df452689b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376375, "uuid": "8ad54c10-ac53-4c88-9468-002ef2d0ecd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dd2e9a-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711384081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384081, "uuid": "1ad1cef0-4690-4b52-8ca3-43dee281e724", "comment": "Malware payload", "value": "ac5a35c6d1d369ffcbfcefb833a94a49", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384081, "uuid": "b5a6715b-f200-4fc0-bceb-97f577dadec8", "comment": "Malware payload", "value": "1b9d3aa84cb6dc400607604b6e6c189d9735f29fbf6201a487b6054fb2f13e94", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384081, "uuid": "d27eea48-3ef6-451c-b67c-78bffad93682", "comment": "Malware payload", "value": "37635a94c86ae80d3f5bd42d6dd44e4950aad4f9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384081, "uuid": "35a0cfcb-0319-4b65-9195-825c05d73807", "comment": "Malware payload", "value": "7a89b48d14a41e8a6a1b94b76d7949909b6323de0af7ad1a039d5caa15476f4a9011b2bce32b0dcc53f5fd77192d7e4a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384081, "uuid": "932f9017-07e8-47b4-82a3-52c455f6ac4d", "value": "T11F13BF33CBA78485D251A3F893131E4BDA3B983CF5527AC52C97B3E80A121BD4E56D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384081, "uuid": "9feaba19-bb68-49d3-916c-b86c3b333463", "value": "768:D+b/l8G4rZ93bm+LYZwatuNokSZDsYg3nMxmnt/5gbuPK:D+Dluvbm+LYWYuNokkDsYg3UuZ5gcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384081, "uuid": "1e384ba5-976f-45b4-9c06-f5c6cd1a7e59", "value": 43599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384081, "uuid": "630a6396-14a5-4f61-be7a-31e1f3e99793", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384081, "uuid": "6f6e9c49-54a1-42dd-9f5e-6d80e43e3b30", "value": "\u7533\u8bf7\u6d41\u7a0b.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f18665-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359386, "uuid": "a4866795-d9da-4486-a0c3-870469fee7dc", "comment": "Malware payload (Mirai)", "value": "3f6836643a6db24162312ffdb7313033", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359386, "uuid": "acf69a24-d22b-474b-805a-d194192b92e8", "comment": "Malware payload (Mirai)", "value": "1cbfdb421a8aba3f65f0f0767bc2e9e92c34703bc1f4d4174dedd5b60f00d66f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359386, "uuid": "1c107e29-8b07-4e53-baff-7d605172ef0c", "comment": "Malware payload (Mirai)", "value": "4b094a17e3fbbcbd59992baefe36b707f52f19c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359386, "uuid": "3afa66e7-1e54-476b-b185-a0a91c259c80", "comment": "Malware payload (Mirai)", "value": "c4726ed49d0a2631c9ff013232b781ba641b3678306c9efb17bde91f567be802f16f6244931baa444820566c3f677d1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359386, "uuid": "6cdbf68c-e0cb-4f05-a814-5a19986d0c33", "value": "T139330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359386, "uuid": "ae140e08-13fe-4a52-bd73-5bc7f29011d0", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGQ:r/hqaJMcjeqK806MHdMfQXoHuCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359386, "uuid": "8e9edc24-4259-4866-b92b-94a3fe685522", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359386, "uuid": "96f137f1-8b69-419c-bd52-8a628d033982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359386, "uuid": "36fc892f-0425-4bce-a350-eb2b6b339620", "value": "3f6836643a6db24162312ffdb7313033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5c417b-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359748, "uuid": "88fa0c25-e2bc-4132-88d5-5014e63ed12b", "comment": "Malware payload (Gafgyt)", "value": "5a3fcab40776a8e3a6b415332190df31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359748, "uuid": "9174b1fe-e285-4f87-8aa8-8d5c586261e6", "comment": "Malware payload (Gafgyt)", "value": "1e30f0453e2576b7cd6d74ee95ae434d63dae6bbdba5f6873f73dfee42d8ebf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359748, "uuid": "945cc805-8e71-4f44-bad2-6ecc4889a232", "comment": "Malware payload (Gafgyt)", "value": "c009164d68cf2a8d9933c7c5c6e54e1d67ebbdb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359748, "uuid": "d50dfdeb-481b-476b-9727-aedded085d5a", "comment": "Malware payload (Gafgyt)", "value": "d9fa6d584b749cbd4a4510e3e285233c60272eab7859639a2b81ea8b20c12913b00b99889031d45938e583ee4e40f72c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359748, "uuid": "3e48f3ac-1b55-477b-9963-4a1bfb33bd8c", "value": "T129D30977B61C0793C4C706F11D6B3BF28F68A2F312E761C5661ADA908B739B61412F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359748, "uuid": "32ed0bcf-04e8-44b3-b524-bc0f4d48924e", "value": "3072:eVrQyEDCvqBvpnTy3d5hgrJ3JCI/Dmzj0qDJAGyoze:eVrQyEOvqbnT8d5hg6I/Dmzj0qDJAGyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359748, "uuid": "dc66aa54-da7e-4bb4-9edb-d061cac71a2d", "value": 141485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359748, "uuid": "f41df3ea-401f-4e5c-a403-082cb7b7b5ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359748, "uuid": "c0ae487f-1b22-4302-9f10-ff41c3cd36d5", "value": "5a3fcab40776a8e3a6b415332190df31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcc45b3-ea88-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711358378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358378, "uuid": "92e768c6-61fe-41f0-b571-d4560b59ba90", "comment": "Malware payload", "value": "cfc33fa3765605e1b62e05425bbcd50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358378, "uuid": "6f4a8118-b50a-450a-988d-db419f41de00", "comment": "Malware payload", "value": "1f5ad39707cd639981a6cf6ac0379e6325ff89cf8f466e82f53bc426869ad0c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358378, "uuid": "cec56dfd-b491-4c7e-ac17-a80ff3cbe94d", "comment": "Malware payload", "value": "bf187e817f7449329f8e3e635edadd6dbb46b72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358378, "uuid": "6fc66e9b-e480-48b3-b72c-6dd7bb1ecdd5", "comment": "Malware payload", "value": "f88030f6866041f92b4033febcac928b9affc9faf10c01a988e84288c589279066fcc3297b8ed9d7a34a718b62020a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358378, "uuid": "fbcf9c97-dfb4-4a3c-a31c-e3a968f4f321", "value": "T175079E20759EC52AE52B05F05A2C9B6B902C6E7A0B7194C7B3DCBD2F27744C31636E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358378, "uuid": "77429074-451a-4eee-8b52-c5b1b81536f6", "value": "36aca8edddb161c588fcf5afdc1ad9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358378, "uuid": "3c4c6684-1016-4abd-8ecb-0b705bc942ce", "value": "393216:apsPu5Z0z6oGd7+psPu5Z0z6oGd7Z230ftazSGOITO:qsPu5Z0z6d6sPu5Z0z6d83camGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358378, "uuid": "c6cdb0bf-ec8c-4f57-a446-83588f021f9a", "value": 18332928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358378, "uuid": "cfa1dcdc-1e9c-4fd0-a7b4-0cce7877bd4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358378, "uuid": "f14a5ea0-0f32-4bf7-a405-eac3721b2c83", "value": "SecuriteInfo.com.Trojan.Siggen27.51012.29052.9214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1d82a6-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (SLocker)", "timestamp": 1711385405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385405, "uuid": "59296c28-d124-4684-a97f-e1aedab1d331", "comment": "Malware payload (SLocker)", "value": "ba03c39ba851c2cb3ac5851b5f029b9c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385405, "uuid": "50692adc-3027-4be7-883a-42d21aaee2c3", "comment": "Malware payload (SLocker)", "value": "200d8f98c326fc65f3a11dc5ff1951051c12991cc0996273eeb9b71b27bc294d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385405, "uuid": "b68df778-4f74-49ab-b269-0ee91bb9ad1a", "comment": "Malware payload (SLocker)", "value": "d72ca5ca1e7dc6431c041bfc6d7e3f9bfa39959c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385405, "uuid": "bffffe36-a7f5-4d51-9636-a243d285b976", "comment": "Malware payload (SLocker)", "value": "dcf0a36cf60bbe7c1ff15fba4818b65dd7de94b7b1e0573c2d11c070672375a938717848e8772bbc52c27aac781315af", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SLocker", "colour": "#7533E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385405, "uuid": "9bfb9eab-ff09-4eca-9d6a-1f7cdb5bcb41", "value": "T1DB8512D3B7119E6EDD38093A06934B79AB17DD185AA797030885326D3C77AD80F98ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385405, "uuid": "0c360d48-7683-4207-b7a7-f889fdd78dbd", "value": "49152:x7bFcxrjUIWXUZGlilIy0ywxepey0yDR5y0yzUjtP:xbFcVwXU/lOxeFDIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385405, "uuid": "da33bce9-885b-4d2e-a068-50b83e539638", "value": 1842576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385405, "uuid": "378cf4a5-8454-4e7d-9507-b47132a6a9b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385405, "uuid": "2c47a2e0-addc-4f2d-921d-4a826c38bccf", "value": "WannaLocker.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb087c3-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401943, "uuid": "2f29fe85-cd66-426e-a7a1-be3c004eb3a6", "comment": "Malware payload", "value": "f7d9011e3a9809b8e65545f41ecfd5c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401943, "uuid": "edbc0a1d-6233-4bfa-b164-e6e845587a52", "comment": "Malware payload", "value": "20ef4be84abc3cfb87e99238c11c32628a73e92ecbf5bd7cb4b841f7af0dbf24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401943, "uuid": "cfa3bd43-776e-4979-8156-f3fddb9496c9", "comment": "Malware payload", "value": "0c78575af5fe5a1dca8e20c4e5f8829bc44b5605", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401943, "uuid": "a3e56fab-3165-4f75-ba77-ecdf254938ca", "comment": "Malware payload", "value": "7295567ddd9294a25636fc5ea287ce3317b5d297c8e47af000fd6ecf0ce531aba0b8cbe07126ed97c6028e4bcdc839f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401943, "uuid": "dce9875e-dc1f-42ab-a945-2eb25691249f", "value": "T10C63F12ED472BDCCCF5E0639B02C510AAB8EF280282557D8A71DDDC46A9AF45F04B6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401943, "uuid": "cdbf2fee-e3c3-4938-adef-45e69e611793", "value": "1536:UUKFFDFoSEIPknAlyB1OMdxzdfFgt2pOe1BswECOqXhK/+aNw:UUQFshn/YMvpfFgEpOe1SgOq++aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401943, "uuid": "6b6dfd1a-5de1-4ded-acfc-00f8e5c20990", "value": 68340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401943, "uuid": "410d641d-b11b-4ebd-b65c-35abd2bb6270", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401943, "uuid": "e9115f46-9cd7-4a78-bae1-3586113c2c27", "value": "SecuriteInfo.com.Linux.DownLoader.533.14411.31928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181ad34a-eac3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711383413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383413, "uuid": "e6bce9a1-f7cc-4ade-9374-cbd740f83d12", "comment": "Malware payload", "value": "fbb464a7c8faceed46793ba256327171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383413, "uuid": "4fac66bf-2a10-4b00-af19-69c993b8274f", "comment": "Malware payload", "value": "220253ad2cfa8bfa377854053d9b319a142167a6a644f4b52419fa9bde7e3790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383413, "uuid": "1c74aabc-f931-46d7-b9d0-998864d1dbb2", "comment": "Malware payload", "value": "9a4888c594c9a385748d6533fdb63f0d74b915af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383413, "uuid": "2c6e3d32-6518-444b-a19d-684affa6a013", "comment": "Malware payload", "value": "30199e26d966ddb6489d4852857005bd55ed4f9427d108c1085bf45ec1e013e0b3b780c0842cfa0c621029b6cf944fca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383413, "uuid": "53f33f96-76ad-4173-be7b-1d477e823b1b", "value": "T1F783A24BB70C47AEDB9D8BB2B87A03304228DF931546AD59BDD9FD2E057234C29232D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383413, "uuid": "62be08ff-8b5a-4c28-b650-4c7327ca2763", "value": "384:BLfHeMd2p9qYdgh2tpriM+F+VvLApX11Wc84GhQzF5ZzYZMV/v9yO99upNJRvluP:RfHUp9qYWhMgMbMFW4GezZz7qs9uQjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383413, "uuid": "ee5358e3-e61c-47f1-b8d6-47d9e2cf07a9", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383413, "uuid": "e18bccad-f240-42cb-a2bb-daf81ceb530b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383413, "uuid": "7f4bcfbc-23f3-4a63-a688-d5c365d57710", "value": "TERRA TRADE SUPPLIER SAS REQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b87b2f-ea9d-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711367283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367283, "uuid": "a8a3171f-296e-49a7-81b0-6ec8bdd7c0eb", "comment": "Malware payload (Formbook)", "value": "efab7252e79203b247e72fcc30fbe9f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367283, "uuid": "d3eaf06a-c979-4410-b397-3465e2bb432a", "comment": "Malware payload (Formbook)", "value": "226c51d48dc1734480b8e37ea9a4fdf57c5a7e6cb316905b38f9650292d980c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367283, "uuid": "8e6697be-fd4d-44f3-8fe4-a528277dd459", "comment": "Malware payload (Formbook)", "value": "87af83d50fe26dc53b7ffbaf9d8427493b83ea62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367283, "uuid": "2b1f87c2-737c-4c04-833f-90696f4e8a7d", "comment": "Malware payload (Formbook)", "value": "c97a20eaa1838c74d26bb9428ae2c8a451fd42b3a687e00eccc93a187859553d6dab47c2e3d03496338b576899b986db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367283, "uuid": "e3941b4f-c743-44a7-bb81-a8820ac4cbec", "value": "T166F4124133BC6A73E5BB2AF25C76104543B1A72A607AE3DA2CC3A4DD56F1F904B46B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367283, "uuid": "1c3a5567-367e-44c6-b930-811f63781b5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367283, "uuid": "7b116179-7329-4cb0-ad6d-4d90d511e78f", "value": "12288:T4CMwiMp9rYvbZzL9m4tLWc0KY8pcz2S7IWjL9axCEluzAjypQY5t4oi68A:MO9rUzL9NqJ98uqS7Ii9axCAyz4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367283, "uuid": "cb6b2c0a-91ad-4371-832d-ec22955e25a6", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367283, "uuid": "fbf8f029-d12e-49eb-9674-a1e70a8176f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367283, "uuid": "f37b660a-9d7e-47f8-9157-92e7997284ed", "value": "Payment_Advice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f52d37-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383807, "uuid": "5e13761f-83ac-41ec-b0c4-13297156f0c5", "comment": "Malware payload (AgentTesla)", "value": "652366b5c5cf6074c1c68cd88493c78b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383807, "uuid": "75a539d1-7b5d-4326-80a8-907763436254", "comment": "Malware payload (AgentTesla)", "value": "22e6e1256835d2a029001651e40a54cc5628432cfdcf35438c27b39553941840", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383807, "uuid": "55abc779-6caf-488f-ac0f-74b412d635a2", "comment": "Malware payload (AgentTesla)", "value": "e6556bb2f205e9707b59f170d37b8de055fe031a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383807, "uuid": "6977afba-2c3a-4fcd-8bab-bd0ef3a3a7f9", "comment": "Malware payload (AgentTesla)", "value": "7042173e14933de21782a87517580a59be1822cea3f5334b80ac6d170fb34baf221d794363b8e5a55dc57de393962c2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383807, "uuid": "061adc97-5049-44f6-9bec-1d57b82cffbe", "value": "T176D423102D5F8089CD8FF2F5EE375921E142389CEC44672AF96540BE4FDF85ABC98A61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383807, "uuid": "49a9a1e0-454b-4154-9f10-0eb6da0360dc", "value": "12288:QEnWP4jsCJttmMf4jvUO9tUzNNhlmcDB8P0j0i4hh5GHoVLe7OJaLJsmwLdxD/wU:jtjLwq4jvUO9O5Nhoc2sDO5yMRgpwLnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383807, "uuid": "bb557d1f-8dd6-4288-882e-26a5d5894c38", "value": 627820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383807, "uuid": "6e403dac-643f-4677-9635-6c566a8d5534", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383807, "uuid": "589c56ac-44c2-4376-b0cf-8e031f45473d", "value": "Definitive Itinerary.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bcd3c1-ea9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711366305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366305, "uuid": "eddeb586-1a16-431d-bfd3-3a822a026859", "comment": "Malware payload (AgentTesla)", "value": "13e69fea937d3347724b455b184ecb3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366305, "uuid": "a69fc727-ddb1-4416-9338-2d089e49e67e", "comment": "Malware payload (AgentTesla)", "value": "24693b9c5543da4bfabc03421db5fd558c4b528db2e1fefc6252128a07a3993a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366305, "uuid": "d6a417b6-12e2-4108-bed9-2a30d5c07a92", "comment": "Malware payload (AgentTesla)", "value": "113d02268d524a87d3c9e1f4df7c4f569091a826", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366305, "uuid": "263ca380-f935-4873-a878-7e627d3a4d9b", "comment": "Malware payload (AgentTesla)", "value": "3dd61fd63a73bf55ec6be806ed4b33a7f37694dd6b5fd2bfbd1788c1a9c3e15468acc093dff426d41f67b2c21f701292", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366305, "uuid": "1c9dac26-87fa-4056-a74f-08aedc96f54a", "value": "T189D4333EE8D4C73CA8401BCD3C5E790EE79D859D33B4A49F66C449B4219CA5E738D292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366305, "uuid": "1ba80e12-82d7-4499-be6e-c93e2d195455", "value": "12288:wMuqdXMw0wwz9TueYSW4H+aDyG2752ahxNRimVf+Q3+D+d:nuk8kwpTgpS+WP2V2ahxNEmVD+D+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366305, "uuid": "6ea6b987-7677-49a7-b430-82e17bd7d9a8", "value": 642753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366305, "uuid": "ac957caa-2534-4076-b268-04b98bb4d30c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366305, "uuid": "bae3db3b-604f-4f3d-8b42-354725c9d25b", "value": "Quotation 1563058092XXX.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddd8cab-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390832, "uuid": "586d34ae-9bc3-4b03-a642-f8c016aa3c51", "comment": "Malware payload (Mirai)", "value": "3493eac0b6981683e9eece9b27c8ddd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390832, "uuid": "067d1e5d-0327-4ffe-a436-a66749f4b49d", "comment": "Malware payload (Mirai)", "value": "24f457794242e6c0cf54ad90feb0e3e5c997556d12d3a06ca5ab44dc60258e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390832, "uuid": "2c28fbd3-6f8f-46c3-ba44-047820196dd6", "comment": "Malware payload (Mirai)", "value": "d6c24de8921ce3440a23ddadc9227de83715d620", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390832, "uuid": "874f6efc-0b3c-4f49-9227-9ebfd0ba723e", "comment": "Malware payload (Mirai)", "value": "613b68bc99e1c53a8f3f20fa15d98b4a150733c7948f2065b8d6725e1717f09184450dc82cd4443ce1405539da8f924d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390832, "uuid": "7cb0cce0-41a8-4920-b55e-dd46fff0a31e", "value": "T154F319C7F800DDFAF80AE33748530906B230B7E155925A377357796BEC3A1991867E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390832, "uuid": "829ac3ac-3b61-4715-9153-0955c457b481", "value": "3072:dkz3tytRjVZFqKmB1pz9DX8aEWGbVcjbiPLJkSU9VsyGw5bi7:4y9mDppfEWG3LJkSfyGKbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390832, "uuid": "3a1d2760-f88a-43c8-97b7-7ddaf36eed8b", "value": 163488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390832, "uuid": "b93af65d-a408-4697-ae4d-eb452373bf18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390832, "uuid": "15f05cae-ae38-4d66-b216-381270382ce6", "value": "3493eac0b6981683e9eece9b27c8ddd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3863cc8a-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359416, "uuid": "fcc1ce22-ccd7-4b69-8089-d7419fd06a2a", "comment": "Malware payload (Gafgyt)", "value": "22b3d913cdcedd97092ea4869f10e360", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359416, "uuid": "92677306-3039-4b4f-8a84-4faf3271ff39", "comment": "Malware payload (Gafgyt)", "value": "26265c88f305ed004f769964b7ec9d03ef3bbf400751e6c479a3dcfacb08df16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359416, "uuid": "4b343685-d0c4-4ef2-87e5-0e4eeea1ccf7", "comment": "Malware payload (Gafgyt)", "value": "b3a9f1928b29f73a1a31525979c55f8f4ed55649", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359416, "uuid": "e1e79c1f-e0f7-4662-86f5-dd9e2e6ef97c", "comment": "Malware payload (Gafgyt)", "value": "9bab86ba7d616dad0555cb78cb2688ef86fc355c81640740ce08c100d44c5748c7f20d3d5ef883fbb321e6cbf8c9aaa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359416, "uuid": "6b28202f-4beb-48fc-9ed6-03f5946e628b", "value": "T152C32BB5F740C672D18301F2119BDF624D32F2F7169AA54AE3682DB0CE6A1827563F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359416, "uuid": "50abb096-aada-4928-aa14-254f4e614c3a", "value": "3072:SNhAfn3U8UXULUwUbUJ1hYlHRRDsBOnR75hgkE5mJC0OzQaGyPZk:SMf3ts05gehYlxO4R75hgnmJC0OzQaGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359416, "uuid": "54e3eb34-25a8-4954-bde0-01d62aab00e7", "value": 123364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359416, "uuid": "5b5276de-81e1-48d3-8c4f-e58fb487e61a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359416, "uuid": "b187c5b0-f883-42c2-9314-0e3621ca815f", "value": "22b3d913cdcedd97092ea4869f10e360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a62fa18-eab5-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1711377377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377377, "uuid": "384d83f7-95a0-4096-9bdb-41c068556d0f", "comment": "Malware payload (NetSupport)", "value": "fec0fc54e19faa3a08692e09cb2e9863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377377, "uuid": "d4936a6a-848a-4a4a-9ea2-ee11ea0cfd04", "comment": "Malware payload (NetSupport)", "value": "271d519dff8d3a7db53b291c7345fdb05fc7a9d1e3862ea073287976a14fcb74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377377, "uuid": "4f4d5df9-62ef-4113-b8f8-443034fd4b1f", "comment": "Malware payload (NetSupport)", "value": "8b105845550efe89c51d8f7ba269d9d077d3a59d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377377, "uuid": "001e4067-e2a4-41ea-a2e6-3c8cd9f9b844", "comment": "Malware payload (NetSupport)", "value": "7cfbd0c00e8e941d118b248419663e843882f74881707e99ed41b0827b138f91bc48eda0f8e984090b59b44e0171d2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377377, "uuid": "5cd90e03-a1b3-4ea0-87a1-8c871243d30c", "value": "T1EFC501B7344515E2F53D1BF12BC2AA775ADE6E3F0CC5198826DD32F494B222182AD12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377377, "uuid": "345c9973-56c4-4151-91ed-786588a051ad", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377377, "uuid": "f42b8e57-e725-4994-8cd4-a69a53edb17b", "value": "49152:i9xpDbvfxZNEYMEoXhheKEyaIC1yR8fxOdPK2KNdM9s3et6mmj7j:uxl7xYY2oxyynj2KNIwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711377377, "uuid": "910a090b-3a2c-4e12-be3b-3025e078b8d3", "value": 2615808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711377377, "uuid": "1b76804d-3346-4fd2-be8f-51f624c4d703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377377, "uuid": "4389d48f-0289-4bb5-b8bd-88b1208db5f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edda3c7c-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711409112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409112, "uuid": "5ad4a30c-9b50-4a66-8225-e7d216eb3c22", "comment": "Malware payload (Mirai)", "value": "0aa29c5f97e9f620f42673577716a3a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409112, "uuid": "2344f5f5-f639-40e1-b711-da74b52fb054", "comment": "Malware payload (Mirai)", "value": "289220acc96ed451582bce130286eb45eca951fd57e6b273cbe2e419156b1c22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409112, "uuid": "6914fd55-b5bd-4dbc-9b3e-638c6e935569", "comment": "Malware payload (Mirai)", "value": "b292cacb4b1f657fd4df507a7562ca4d4c27d034", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409112, "uuid": "6fa16bc5-bb1b-479b-ad63-281548f898a3", "comment": "Malware payload (Mirai)", "value": "ac2b5c03d1a73e0b125306446416c63eb6c214594ccb6fd1f3fc81fbf69fb2c4ed2b78ad19ae60a7adbed3a6c010de6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409112, "uuid": "7095e3af-6094-481c-a00a-88adf8809fef", "value": "T15641E28E5F725EF9F55AD53887370B3937AE514842C08249E2ACEA006EC530E88DF7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409112, "uuid": "411af347-2d07-4e93-aa34-d403c2e99be7", "value": "48:Oji5E4GYg2Hzxf+1eHHu/9LuEpExn3QNeBl:956WHzs7MEpEV3QEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409112, "uuid": "df6b6ccc-481e-4fdd-9146-69d381fe710a", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409112, "uuid": "6340b466-3e62-4f2e-9c61-845681be0038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409112, "uuid": "1a0be4e0-e94f-431d-84a3-bb7977220577", "value": "SecuriteInfo.com.Linux.DownLoader.598.17007.6191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385f3f5b-ea8a-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711358986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358986, "uuid": "47007d2b-cfe7-411b-a858-6949e4f6c51c", "comment": "Malware payload (Formbook)", "value": "37542e8c1a49dbc9fe65a8df1be8ae48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358986, "uuid": "6451d151-36c7-4c21-96c5-bb277753dc61", "comment": "Malware payload (Formbook)", "value": "29aa45ee8553d1697f4a8cf318fe4b57a6628d3eb6836b1dd9fef6b67741c60d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358986, "uuid": "3bb64270-4f63-42b5-b765-f9824b908e1f", "comment": "Malware payload (Formbook)", "value": "e16bc346a74f71185d7b6b9a6c34b0224e84c596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358986, "uuid": "0b897029-d52d-4f1c-b770-ca5af70319f0", "comment": "Malware payload (Formbook)", "value": "38ccb439990772668d2a1f3c5ac14b5a59e62078c0b320fffd18746659fe8e3030a59bb2fb3b0800a77e7c7e749a68f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358986, "uuid": "f4d1855e-b4c5-44ed-af18-ba5aef9a29ec", "value": "T11DF4128273685963EABF57F60C6A011007B2722B7075E7EA1CC390DE09E6F219B61F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358986, "uuid": "50aa0649-a608-41d0-a21d-ca3f8e7e22b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358986, "uuid": "31612af0-449a-4347-8bd9-da96d710e310", "value": "12288:f4CMwpVZiBlSH+s+NufyqYFi3I2czpy9XSwdSAknfHx9ck2R9WA:TVZR+sYu6qYR8dS7fHTck2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358986, "uuid": "ec7dfa37-8cc2-4151-ba8c-ff2c070d1e41", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358986, "uuid": "5baf16ab-f7e2-410c-9e0b-c24356d99ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358986, "uuid": "990c042e-efdc-49c2-adb4-e17a624ccc30", "value": "rSC_TR11670000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6f6693-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373888, "uuid": "00fc9e33-db34-4669-9e82-094ff7863583", "comment": "Malware payload (Mirai)", "value": "7475fb2adf7f559a6e4ce4666286df19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373888, "uuid": "95b7d54e-d496-4c5f-8032-ca214d546938", "comment": "Malware payload (Mirai)", "value": "29ef4c5d9172b09d6abc08da800a5a09b460b98aaadf1aa29edda81300fcc609", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373888, "uuid": "451ed52b-52e1-479a-8e9b-0b95739d4cdb", "comment": "Malware payload (Mirai)", "value": "5ef7b9b101ad23c02cd37268fbf351616fc7e698", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373888, "uuid": "3f9d4ef7-0e6b-4ae2-a952-c696afa90514", "comment": "Malware payload (Mirai)", "value": "dc7894aef75761ea93161e0fd49e788b5e47479008a828e097178296f71233fec3721b793e0c1e041339ddfd9588b9bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373888, "uuid": "c808a02d-335c-4da8-b0bb-fd53e0cca515", "value": "T1AAD31A06B31C0A47D2632EF03A3F67D093EFAAC121E4F640355F9A8A9171E365586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373888, "uuid": "07007a3e-652a-4b06-af6e-0b84099ad9d9", "value": "1536:FUHQLSW/jHfHAIQqQSpexpHvTkNI8HxY0gYbPM2AvANIWUDj2J/qfcsk5eHC8:SW/jm6pexZ7kpPgYPMWNF5eHC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373888, "uuid": "fd2229fc-18e1-40b7-b825-bc594b51eeb5", "value": 132312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373888, "uuid": "ed89b4d6-3ddd-424f-b0f7-815280d1b33d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373888, "uuid": "eaf9646d-440e-4ab8-bdeb-618546662e02", "value": "7475fb2adf7f559a6e4ce4666286df19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7311d2e5-ea82-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711355649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355649, "uuid": "41c22983-8d0b-4a50-9cf8-99ea294c96bf", "comment": "Malware payload (AgentTesla)", "value": "22c042f6898327a51e91fc7ceea1aec6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355649, "uuid": "2f96ea74-98a8-4e6b-bc3d-b4363a5801b2", "comment": "Malware payload (AgentTesla)", "value": "2a43f1b160cae2b4a8823f8ffa06ec1c64e2bba3622986df05bc309b5caefd50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355649, "uuid": "11e7b628-c525-4ab5-8581-af6f0377f3f7", "comment": "Malware payload (AgentTesla)", "value": "a8dddd65f82fc1a04d44f6f5e59bd0c2ca67e0d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355649, "uuid": "de1894d5-3b57-49a0-a6c4-e58e97558503", "comment": "Malware payload (AgentTesla)", "value": "06c70b69d6f3fb45eba11d039973f016b785bf0de5e7697b013d5be3cb67363f94daa9af0dc2c83bee9c0eb3397559b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355649, "uuid": "cb840fe3-631d-48b3-b346-4031088f2511", "value": "T10A05D0AD764076EFC867C972DA692C64F721A07B430BD203605701EC9A1EA9BCF255F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355649, "uuid": "6bac44bd-ebc1-4933-8361-b2d1cc9f9530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355649, "uuid": "ca85738e-4ea3-4c76-9fbc-332e491566d3", "value": "12288:qh7gC74CMw2cdvrYm5eFeytjU6rSNb5/XfV2OIVpXEnbOvSWaVeedAAwUKzRh078:UFgcdkjq/0Bjp/aV1dAAwhRiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711355649, "uuid": "711d1316-b10e-41ac-b32f-0926b749085a", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711355649, "uuid": "47aff930-06d0-4fd4-bd23-f1f9c7dda4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355649, "uuid": "b3c7d956-8bf8-45f3-900a-91eda58aea24", "value": "SecuriteInfo.com.Win32.PWSX-gen.31913.14500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafe32f2-eae9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711399981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399981, "uuid": "7e78d8e8-b0e2-4b1f-ac6b-f54190f14f78", "comment": "Malware payload", "value": "bbaded0a8091b76257dc4880c9ef59dc", "object_relation": "md5", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399981, "uuid": "37631722-6b6c-480c-b74f-4207a667cf6e", "comment": "Malware payload", "value": "2d960acdda45cd77a0590c6f652d8496eba30e1b2b263f6a083ac5b27512d1c6", "object_relation": "sha256", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399981, "uuid": "5d40e2a2-7df0-4fd2-bac2-865a38a3711d", "comment": "Malware payload", "value": "ecae806439418202758a1011005f726a57399032", "object_relation": "sha1", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399981, "uuid": "42f9fa8a-dc24-4278-a170-4b761c581160", "comment": "Malware payload", "value": "883151ba724651e846f4ba2ea6ec3c4b2e4a8aadc80455d3972d6956834e9ce352dda241c7ed58d8a7de89fbb4fa1029", "object_relation": "sha3-384", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711399981, "uuid": "13f20cc3-f59c-42cf-b6a4-0ffcdbfa0a02", "value": "T1A042A803BE478439E0301517AC23541EEB5001536264ABB57BACD2C79F7E96EE9B2E7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711399981, "uuid": "4332b3f0-3ebe-4ec3-bd83-86e7c0513171", "value": "192:QMg119gkCtL3IqSPN3QzGNzUoNzhLnOdEpeLSHZgNdPR/Dnm9V4nNX:Ly19gR3IquNgzG2oNdOdEpeeqlPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711399981, "uuid": "e7483073-3450-4abc-a4cc-6ddb44c16c49", "value": 12667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711399981, "uuid": "f3422430-5597-4e06-841a-d814aec6bdf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711399981, "uuid": "80f1d7d0-a088-405e-af4a-f63c232c3182", "value": "MICROSOFT_OFFICE_EXCEL_A.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7702dffc-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369829, "uuid": "3ec691a3-8ec2-4efd-963e-c6130ce79ff4", "comment": "Malware payload (AgentTesla)", "value": "9bab9e325ff03efaa2afc7d9f23078c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369829, "uuid": "9f58b608-24c6-40e8-9807-17f518e2df9a", "comment": "Malware payload (AgentTesla)", "value": "2db2ce01cb77bd0981b789c62af358866171a409fdad4bef98c62a302e8348ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369829, "uuid": "17afdc77-f370-4b18-875c-d251f3e9060e", "comment": "Malware payload (AgentTesla)", "value": "908d1029a572bf252da0af3c0b04e87b16b3ba19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369829, "uuid": "871467fa-0bde-42d6-9712-37b37850bc13", "comment": "Malware payload (AgentTesla)", "value": "e873cf570ba183c64d66bd2c060ce8eaa95598c0c8b34cc448c6c45acad07dbf846b4912bae292807c7b95333fd5b4e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369829, "uuid": "88a1aa37-1641-4d13-b740-226cedaaf38e", "value": "T1C0259D0273D2C036FFAB92739B6AE2415ABD7D250133852F13981D79BD701B2263E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369829, "uuid": "5381c8db-f2be-4cf0-b80a-542758e93622", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369829, "uuid": "aa8e91f7-2087-484b-84cc-c15becdfc815", "value": "24576:NAHnh+eWsN3skA4RV1Hom2KXcmtcZf4ylHkD:sh+ZkldoPKsacZfhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369829, "uuid": "18ea66a8-702e-4047-a39a-1e985d484aad", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369829, "uuid": "d6a6156b-29e6-43e8-b714-3e9a20d2ff0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369829, "uuid": "9f974300-f780-4e08-baf4-3fbc90bfd3ab", "value": "LPO-582-AL SAFA FA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5310f7-eace-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711388385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388385, "uuid": "ffec2f34-bb4a-4bd7-b103-c981106648e6", "comment": "Malware payload", "value": "deb9a371b713547898a18a44bf2b2f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388385, "uuid": "e5ef8c2f-b8cc-48a0-b078-741dc19a09ba", "comment": "Malware payload", "value": "2e8b0749a2846d176ba40c52692cb84c772460c38e705214c0758cf8e41f7a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388385, "uuid": "8d5b8ebc-17cb-4198-b356-dba08018f764", "comment": "Malware payload", "value": "1b00d97d1df288bc7f0a0247a381043387d088d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388385, "uuid": "8bd38ea6-417d-4e13-81a6-926dfa5bb6f1", "comment": "Malware payload", "value": "45d6a61f3e510f41006ea5a1f24d98cb6e42f788c068e72b49801e287a4705ccf5a406a5669ee7677f91c8109249bfb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388385, "uuid": "6409a0f4-4163-47bc-ac39-18dcf10ad7a8", "value": "T159A5009220894425FBF0B539F36C80C05B16ED5E52AC03881F86FC5536B1DBDADED6AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388385, "uuid": "450c9ac0-9da2-4e66-829c-f8f6102597f3", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388385, "uuid": "bc85848c-3a7d-4a15-ba6b-9160c9bbbd85", "value": "49152:5GIpewFyJnbJwyyW0h3BRxZ5Sujbz0Dm6Q9Gn8njqlc:5GWiJ70hxRxZvjbz0Drn8n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711388385, "uuid": "b0779f8f-22a0-4619-8f47-a03c7a5cf453", "value": 2064648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711388385, "uuid": "8f02511d-2118-40b6-bee5-300585960c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388385, "uuid": "e9a909db-d571-432e-9959-0692e87e4b12", "value": "SecuriteInfo.com.Trojan.GenericKD.72085463.6969.3560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65e0e69-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384108, "uuid": "196ef71b-1b22-43fe-8ca5-f5f417fa354e", "comment": "Malware payload (AgentTesla)", "value": "6a9b97d6916857f64d90084707de1e00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384108, "uuid": "1c309d84-8cca-4be1-a5ef-5f1bc368f869", "comment": "Malware payload (AgentTesla)", "value": "2f1acdeff407a2ddcc16a30e5524e07cc543d45e0df27cc0d6da3722f0f7c998", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384108, "uuid": "38c8138d-b1c3-47b8-9759-342c524c96a4", "comment": "Malware payload (AgentTesla)", "value": "d28f2fa2bd59bbaff092e752ce755220ed847405", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384108, "uuid": "e6cd5ca2-26ba-4595-a3f4-e41aa95c4b92", "comment": "Malware payload (AgentTesla)", "value": "43f94706dceacf11d02047a32e0369925716878d172120ea5fdf7c342547235d42e93b5a1fc3978a7663bcf47f2c5f23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384108, "uuid": "d7150a96-46a4-4cf6-b9e2-269e147fff92", "value": "T104F4120233A96A63D5BF6FF00875405143B2A56A71B9D3EF2CC2A4D885E2F849F52B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384108, "uuid": "fc7e2a1b-4b05-4eab-99d9-b7ee888bd419", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384108, "uuid": "e808383f-5a50-4b92-aada-e1c5500d9212", "value": "12288:s84CMwpreEndxfpO7jweeZzsuA2XVlmocKZ4gnTGOc3or5d57cMLX9cswmy1/A:dreAdppO7E7HXVXc/gnTGOv/SNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384108, "uuid": "8e3c4bbc-86b8-4dbe-9173-990b0904d080", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384108, "uuid": "c0c5fa1b-ccf8-41aa-9fa9-9fc8757a814b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384108, "uuid": "abc79825-9a2d-4d76-9d11-148fa851a0fb", "value": "fiyat 25.03.2024 ara alim_ unit order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb192933-ea98-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365326, "uuid": "43ed88d6-6560-4da8-bf96-bbf50b501b3c", "comment": "Malware payload (Gafgyt)", "value": "d79e4948bf728a8a4a7daa45392a337b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365326, "uuid": "7ede2eb5-524c-4ea6-9e18-17f145d5014b", "comment": "Malware payload (Gafgyt)", "value": "3042f63761941a681e2e51ac165131ec65e55f5c79446d3585a5c6105b58cc04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365326, "uuid": "e8729dad-10a7-4b1c-a7d5-fb4852bbf190", "comment": "Malware payload (Gafgyt)", "value": "3a85e382061f6592625438b8fb134215be2fbb75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365326, "uuid": "fb23d9ad-5f2b-4d23-a7da-3e5c12161f4b", "comment": "Malware payload (Gafgyt)", "value": "09ad26ab5a637fcf0f4838654643649e86f567ccd86d32e82409d92d4ccf3a1f13901d8d8e0d877cc13ded16b3b49943", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365326, "uuid": "3b0eee5c-6f18-40e3-a457-d76601757595", "value": "T19FA31A0798216EB7D04599B135FB59302732B9610F4F1B9A697C66A047CB8CFF40FAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365326, "uuid": "46316bed-4606-48be-ae1a-000378b61ce0", "value": "3072:ZbNdvEtFbfWJHVpm324gQQIS5hZmfFK7uGiAUif1:ZzvEtFbe5VpmmbIS5hZmfFK7uGiAUif1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365326, "uuid": "197bcf56-5f07-438d-8230-2ccdef8fb3c5", "value": 107435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365326, "uuid": "1e655fe7-e9a5-46a8-94c4-5e08f62c19cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365326, "uuid": "e81b9606-1d94-4431-ab4e-322a98ca274a", "value": "d79e4948bf728a8a4a7daa45392a337b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756a8089-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369826, "uuid": "ef95bf6d-153a-4c16-9a1d-f60616f94fbf", "comment": "Malware payload (AgentTesla)", "value": "920962b95cdb2e49965cb1d366dd95d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369826, "uuid": "fab2afaa-06a4-499c-ba09-1450695b01be", "comment": "Malware payload (AgentTesla)", "value": "30cea92b1d8700749f86c34c95cc8895f9c34bea29b3aca54dd2eea282b995c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369826, "uuid": "b1490760-eada-4632-89dc-afc6682712f0", "comment": "Malware payload (AgentTesla)", "value": "25c1ad3c8c5018c5927b1cea7b8246ab93d889e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369826, "uuid": "c0f96bfc-78b6-4530-9a84-4b6b9a416cac", "comment": "Malware payload (AgentTesla)", "value": "b9c5422d97c995dc6ea5ff75263940a365588996f6dd4806462aa6853682899c15ff22fc30c35a7f109287367ddde0d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369826, "uuid": "3b5d4b50-b471-4223-8f54-a2e348191a26", "value": "T1AE25C05A53E43D88E4BF7BB09A7AA05487B2B8C6CD32C31D148497DF1B736419E9037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369826, "uuid": "ea71440c-e805-4f9e-a0ae-4822c064b8ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369826, "uuid": "0245ab29-84f1-43bc-837d-1f574c4097b8", "value": "12288:GHPrp4OAUWTObULyfW0Vi8wI9dJ7/rF3ZGZg0YerE40w48DcZzKE:GHPl4OAscV0VRwI93X8VG8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369826, "uuid": "613f14f2-5e94-4212-b3d2-8d6cc534af39", "value": 984576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369826, "uuid": "96756361-2f75-40ba-9d8c-cabbd521b50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369826, "uuid": "50764649-6169-494a-bda3-e44c12354114", "value": "faktura-marzec-2024.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c9fb8e-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711383888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383888, "uuid": "25723b22-1f13-4a1d-8412-aac8c0e040f1", "comment": "Malware payload", "value": "71f59053a0be74344a6c0c296af04752", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383888, "uuid": "6d5ed02c-2e4d-4c17-8d04-050cbce4ac38", "comment": "Malware payload", "value": "3116b608c6299a5d2ac2b75820d79c0c96f07c8e3d978ad6d48c9e2ec3ee863e", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383888, "uuid": "1a67cf56-334c-4c06-961d-a681dd6a954b", "comment": "Malware payload", "value": "bd1b633c5b1fb5855fc120136793cc19d544bdfa", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383888, "uuid": "f913f0f1-5442-4b22-b4e8-2315763f4bc9", "comment": "Malware payload", "value": "308f2a2b612afad2e524113b2afe4181f06bbc0099bf15137dcb7aa43e042a1fb80179f1f518fdcacc0457bddea87ba4", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383888, "uuid": "1c5ddd05-b299-487f-be06-bcc4e60a2a28", "value": "T186A35892173C6AD530B3BF004542072DA96BFBE1E578040D9D434E9DE3A1AC919E9FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383888, "uuid": "73f71834-da59-43fd-b498-3061a25432e3", "value": "96:3R9IKHr6XI3vEs7zp03AdN6P6j6XgvKqq52l4/Cj73O:Bvty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383888, "uuid": "b7f446b2-4a18-4e2f-b1b3-7e2e19b7a74e", "value": 99556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383888, "uuid": "4850fd0f-7293-409c-9051-1a4ea1400e90", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383888, "uuid": "8c6b91f6-f51d-4634-aab9-79dce40bdd2c", "value": "Comprobante de pago (PAGOS BBVA).PDF.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf063df-eb02-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711410723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711410723, "uuid": "944a1d33-a397-4314-8a08-a90b7c0f868c", "comment": "Malware payload (Stealc)", "value": "5b8615896e85dd6af58f2d907f1653bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711410723, "uuid": "e72563e4-09e1-4e99-bde6-15ebdb68db98", "comment": "Malware payload (Stealc)", "value": "3161e8351ef07f9062f67505f0a875924269e0098cb95075084a4f59e8c2e988", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711410723, "uuid": "9a7f0f6e-13b1-44e1-ad7b-bee5bbf22097", "comment": "Malware payload (Stealc)", "value": "6ba8e7da63c54173c3f4fbf06c783562eb43d813", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711410723, "uuid": "28623d63-c926-4628-9966-00191bace764", "comment": "Malware payload (Stealc)", "value": "e658071b7882c8e982aa46c2f0cd798ec831c44c2c80b6a13a63a882f86e677118602b1ba4e6f8a0709d5118e4332683", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711410723, "uuid": "59b86163-f96e-45c5-bf5a-768b5233ba84", "value": "T183647C3132F1A555F3F30A306B799AE41ABFF8626930514F2A50B63F1D752C889E1B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711410723, "uuid": "9b34eb7a-e7d2-4608-af9d-77fc1adb5dcb", "value": "cd3a75dc52103dd2aa93487a6b56056d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711410723, "uuid": "729129b4-6eed-45fc-8781-7db21d81eb1f", "value": "6144:Tm6qwi5Uh3UnQagtkTkrIwcdPXhaNTagOPnPfewt5/:a6qwi5Uh3MCePPdXMANne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711410723, "uuid": "74c1eeb1-5e8e-4110-8004-98490343e83c", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711410723, "uuid": "bd98e292-886f-4445-8d46-8ca5d8e019dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711410723, "uuid": "9331e610-a88d-4dcb-93b9-9028b4119abf", "value": "5b8615896e85dd6af58f2d907f1653bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0843a5a8-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368354, "uuid": "6600feb1-eaec-43f1-a1b1-a4ee9f9b436a", "comment": "Malware payload (Mirai)", "value": "332505b646e1a479d9b17f6082222f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368354, "uuid": "e4d31403-58fd-4427-8454-adcb7f810888", "comment": "Malware payload (Mirai)", "value": "31b2a34a37ad0992e38e49d54b8e2e5cd09270dd5731fd83027ce80c05674dd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368354, "uuid": "b3d29787-8f50-4a35-9e1f-4b215cf88377", "comment": "Malware payload (Mirai)", "value": "403caea9d221071d1c5e4b2dd8005dc881bc0610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368354, "uuid": "88ba3c7d-127f-4588-b8bf-2678e3b5d530", "comment": "Malware payload (Mirai)", "value": "ff1070f1d4c713fec2e08e5e466ce8e2a019745fb243337bfd3739818c6f6c0fcf9045904270e609a34d1b2e37dd65ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368354, "uuid": "4b1d6b68-4de7-4c86-ac07-42bb6fbd4684", "value": "T18841A08E1F714EE8F555D53887374B35679F524842C04249E29CD6006EC430D499E7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368354, "uuid": "6f3b1bce-f3c0-4eaf-bf14-100e4fc0792a", "value": "24:3u4dsgph8AmsiRD8AmyT/z2Hz7llPJdEqtWB4u37I8pagDdz3N9l5zBkEp7ilAG0:exgpEuQ2Hzxf+1EgD/9LuEp8nn2yqxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368354, "uuid": "50d081a2-7ad1-4bf4-9f0f-72d3bfdc79ce", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368354, "uuid": "dbe0ec52-a587-4728-ad2d-77267ca8f8ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368354, "uuid": "f2555611-7b26-4ae0-bd3e-c0d59884a608", "value": "332505b646e1a479d9b17f6082222f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c82f61c-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711385246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385246, "uuid": "fc4d9208-4e2f-4bc5-a28f-3043c709d0e2", "comment": "Malware payload (Stealc)", "value": "32da82af183c6de4e3874d5760b65168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385246, "uuid": "0dbe0219-de67-4519-8df1-6a30d6cf95ef", "comment": "Malware payload (Stealc)", "value": "31c6a028ab500d3b8c6d53c5827ffdd773146a55306f3196271dce2f548aa020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385246, "uuid": "5611d597-30e2-4882-8b44-da17bb2d1f3a", "comment": "Malware payload (Stealc)", "value": "7be8f0dc1bfc8f172b407a366f19aec9d30684c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385246, "uuid": "5a7425b4-76a8-47b0-be75-8c4e9fd3f8a4", "comment": "Malware payload (Stealc)", "value": "bbd5f520c060c1b0bc4594c6e33a02dd356f3f066e440049f94c458deb2564205032e0420c5c6d4c645284035c0e3b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385246, "uuid": "d2529ddf-64a7-4306-9de8-f12b17d261cb", "value": "T19494E10176F2D871E5F34B3219B49A145A3BFC726D75868B3784274E2DB0AC15E23BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385246, "uuid": "2ca89869-acb4-4b17-b900-636390d1db6c", "value": "ff23e32a63aac9251bb507fbef91be04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385246, "uuid": "4fa54526-7c05-4146-a27c-925e9abedcf9", "value": "6144:kUBes6jA+uS+YRiXbr41hssVhBM+gOmHs0EE2ovTCsqXd3zCEKV:1j6U+ulYRYv4zx4pMBAvTmFKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385246, "uuid": "846a0f07-b042-4c57-bc7a-f7e80807cb52", "value": 423937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385246, "uuid": "8c60250f-91ba-4950-8d47-27604d608b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385246, "uuid": "4c8230e7-bec0-4acb-b33b-6774034408c3", "value": "32da82af183c6de4e3874d5760b65168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea012a6-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711369842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369842, "uuid": "02347c27-a5c3-49f5-885b-cfb5347b070d", "comment": "Malware payload (GuLoader)", "value": "bd62f17940dfd751c9819c454cc69bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369842, "uuid": "0aeffd35-033f-4c4f-9dd4-6cc99307b7bb", "comment": "Malware payload (GuLoader)", "value": "32f3ca938c2ce5e47648ad52af6d01eb49d3f03d47dd7b45b91f8102aca68482", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369842, "uuid": "70ef17a4-dd93-41d7-bb4e-0ca86945f2f8", "comment": "Malware payload (GuLoader)", "value": "fb98c9cad78cc269181e3eee7f14b89f74e04b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369842, "uuid": "05f22d42-ee51-439f-9c23-119c5cda2e30", "comment": "Malware payload (GuLoader)", "value": "dd40af5f0348eb8217b78045d0e38511990c846eb672dfad2776be230017cbead134a641e9fa38deee9502dffa9f8571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369842, "uuid": "33fc817f-a98f-42f4-8352-f9c99cf0442f", "value": "T1B084224029E8D037FFBB8E305E783E5DBB75AB060165660673947F0A6E63742D60B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369842, "uuid": "ba8e4b07-2a26-467e-b7a9-a36af094708b", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369842, "uuid": "c8ad2768-51be-44b9-9640-3717ce0d4b48", "value": "6144:0GYgXWlQwTiuj8KHwL0+OulsWJyaAt/wVcmBkTv6+CuxUHAKsvJT8wGl8KRLTm9O:tDGvj8KHwLbHdE/wRBSzCuxBKiZGl8LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369842, "uuid": "5464b1ee-af61-496f-96d9-1e85c515fce3", "value": 381412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369842, "uuid": "f6610641-8e43-4643-9116-35d325cedaf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369842, "uuid": "1fb8af61-0bc1-480c-9226-1bd7ecdbd94e", "value": "shipping documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea136dc-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711385223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385223, "uuid": "58e83771-29ea-4e41-8caf-99940907d2e7", "comment": "Malware payload (AgentTesla)", "value": "c4cb7655cafcc20ca7c0a513293605ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385223, "uuid": "4a08c808-260e-4e95-8c66-3d256c103ff8", "comment": "Malware payload (AgentTesla)", "value": "340e702e49081960c6d318774ab212ae3885ab93fe5ad5d26cdf3c64189a7abd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385223, "uuid": "10975633-a866-464a-84f0-c96756b09e87", "comment": "Malware payload (AgentTesla)", "value": "00ac921a5b26a640d002c3c7528a6ae6c88e8900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385223, "uuid": "4153d08e-38e7-4dd6-9b42-4ade909ece98", "comment": "Malware payload (AgentTesla)", "value": "29fff56943036564fbbeec0e6aad7cd29923b457b68f7d96a295e7c3076312dad07ae218227997b43f3df0824b1ea68d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385223, "uuid": "668711a5-55c6-454e-a1f7-3297b079a384", "value": "T128240146EB6A88D0CCD86BF49C779F190F62CDD39A135C4A1354721E986238624BFE4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385223, "uuid": "0370146c-af49-41e4-87fa-040455439a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385223, "uuid": "7e2e65b8-8f47-4aac-978e-c347ddf1d397", "value": "3072:aIc6fEubNTqFxWXtN+vv2fUwFZZGt4UvERdCtOWEbnmrdR5hV6RhnZ7GmCMY7pdL:09w2WXzCw3TGzv5EDmR56Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385223, "uuid": "03b39a23-19a9-494f-a2cd-7577c403bcbb", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385223, "uuid": "f79ed102-b31c-40b5-ab78-aab698bd6859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385223, "uuid": "2c91e331-c11d-4ae0-92ee-8f724aaf0fee", "value": "New Order #5977336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687dfa20-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711369804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369804, "uuid": "1b973c9b-e7bf-44d0-a1dd-2590401822ca", "comment": "Malware payload", "value": "503b943cefa802951df977cfa0bedb43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369804, "uuid": "d0220d77-a1dc-419c-b811-93e8461b9c5c", "comment": "Malware payload", "value": "347795559ecf295360c41b1ee5a47b798f0cdfd8919f60229ba8eb50f1972bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369804, "uuid": "bddf97f1-be75-470e-b01f-04c458900f7e", "comment": "Malware payload", "value": "a7c5c0b9d2a6f9dd5138d139538592706f049a52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369804, "uuid": "17f60bb7-a595-4726-b68d-21009b71df44", "comment": "Malware payload", "value": "111ecd52a16631bda930147c644ce689fda9b47e241b893bad36aa9678daf1b110f738e7b04d3bb0889cb3a1d43654ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369804, "uuid": "c6555fff-9a7f-4abf-9fe9-d1a7d4cd2e3b", "value": "T186D56BC1BBC3A551C0E60830446AB7BDD267FC3139D9661B6253F72F6CB02D2AB2568D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369804, "uuid": "90c3ec92-31b9-40c9-be7a-49defad4396d", "value": "49152:+6tB0n409ugrEeg8vYYYYYYYYYYYRYYYYYYYYYYE3iA7/eFUJN9ojoso2xno1J:1t+4kugk8vYYYYYYYYYYYRYYYYYYYYYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369804, "uuid": "e807635a-b2f8-4edc-9550-f4714a5a450b", "value": 2972672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369804, "uuid": "b3d56eb9-48d1-4da9-8784-6dc30dd8940b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369804, "uuid": "c92f184d-4db9-44b6-9146-0a148b8ebfa0", "value": "347795559ecf295360c41b1ee5a47b798f0cdfd8919f60229ba8eb50f1972bf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693dabf4-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1711369806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369806, "uuid": "29dd01ce-d997-4059-8698-7725e9e5f847", "comment": "Malware payload (SnakeKeylogger)", "value": "233ba091cc5c7b102991d67ac031479b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369806, "uuid": "e1b11ab1-4853-415e-ba18-6b683c92b04c", "comment": "Malware payload (SnakeKeylogger)", "value": "366afad132e168747e82f4aec0e8144cc92bbfbdb988b55d8a8e1a985092b76b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369806, "uuid": "b068ff0a-6ab1-4886-b808-27ed28691aae", "comment": "Malware payload (SnakeKeylogger)", "value": "141943aa769c02f8c1465adae12f352b7edc3cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369806, "uuid": "1e300078-3de9-4ac1-a661-d62ff989bdc5", "comment": "Malware payload (SnakeKeylogger)", "value": "0ad7732f9db4142a894e42cc069f41fd74476f0fd5ac60d71d4d5ddc6f823279b842f3e2caa639cc6a0c944351a4efc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369806, "uuid": "d76e9350-7622-480c-bae7-e4fa7ec261cb", "value": "T19CD3E81937E48818E1FF9A7306316115C775F8430A1ADF0D1AD2B86D2B7DBA18E1AF93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369806, "uuid": "cd2bf14e-1564-4a68-8695-a058055640de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369806, "uuid": "ce30e87a-de18-4d68-8939-5d9c565df1df", "value": "3072:L2ckK2iu2HGJ13HJ4TfCiakblbHaBYmdpwvEXLo7LNgbY:aK2i9HGJuJakbgk7Lub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369806, "uuid": "1b1b94ad-44de-48db-92e3-72ee79824dff", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369806, "uuid": "a8b2c6ad-721b-4020-940d-25cfb8e99317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369806, "uuid": "2ee3d5e1-a9d0-476a-9b38-5775d83978a4", "value": "366afad132e168747e82f4aec0e8144cc92bbfbdb988b55d8a8e1a985092b76b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46b4ce0-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373878, "uuid": "17b4ad4b-a5c6-4aef-921d-ee5a1059c13c", "comment": "Malware payload (Mirai)", "value": "678ecc2470b1040b77bb430334edf566", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373878, "uuid": "c6a3c465-e4a0-42bd-b346-4d24f7211c4c", "comment": "Malware payload (Mirai)", "value": "367bd347a3133bfda0d369916c123ee769caad8044d6efab3dacc74ec89fd80d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373878, "uuid": "725dc31f-bd87-4cc3-92e0-7804729ea73b", "comment": "Malware payload (Mirai)", "value": "0f8976b7226e09dff316a178b7df61469a9e1f5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373878, "uuid": "a7e3d23c-c789-42d5-bff2-c23a34d2d125", "comment": "Malware payload (Mirai)", "value": "49c82f41d13658e2a609db8dc1a11b50b5ceb63e7d78730cde88776977e4e5d21b2d909c0e7efcd9179a132d6de0491e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373878, "uuid": "a0740927-fe3b-43fd-a89f-d206fd434d20", "value": "T1A34301E15105D5328CBC04398A5C3AD3212F584DE63DA429606BCA2A18F90F6F4BF5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373878, "uuid": "82209917-ed41-4648-ac87-857eb1c8c48f", "value": "768:Z9Su2yqfWDBfNApmi1H7fZ0uyP8RMU4QgI0o8Dgzk9F5tNv9QsPmHyB23Uv:Z9eyDgpmwuvIP8IkXpFNPmSBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373878, "uuid": "06dfb131-25a3-44be-80d6-ef6f44bd5938", "value": 60052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373878, "uuid": "8a8b924c-d371-4f14-88b5-2c25b42ec9c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373878, "uuid": "cdd07817-12b6-4aad-9490-a0c04519b0fc", "value": "678ecc2470b1040b77bb430334edf566", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd0e73e-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359831, "uuid": "2a35a384-3196-4e8f-8175-01ea72f4559e", "comment": "Malware payload (Mirai)", "value": "00940a6466ffdd660a5cfceec98a74d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359831, "uuid": "93b66a66-7750-46a4-b6d0-00d1419c3734", "comment": "Malware payload (Mirai)", "value": "37abd9ae1ce97738f9e0b116d887603f5533863cac6b881dd048445b1f96d1d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359831, "uuid": "87fff478-1d1c-4981-b7b1-7641d71119ed", "comment": "Malware payload (Mirai)", "value": "9673c3ab07684916584fdbce3b5dc4e1e5645533", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359831, "uuid": "8a95e0db-079f-4fb1-b985-6ddc416e0440", "comment": "Malware payload (Mirai)", "value": "55b75abd35264644237012ba1019a6771c1f5f07da5b2adea81ff132a07fc4f1101c34941a3677790f539ec8c220db3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359831, "uuid": "662a9db3-8f5d-4f45-9ff4-849b2011db2f", "value": "T1B0A2E019BE1C82CBC832293444E9EAD61356FC71F2EDDC092940D16FF4B33A95874E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359831, "uuid": "3bbbc05f-263b-4282-8e3b-c58f45ece37d", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK5:x98o08kxofBE+ZkXaqGbp2F2TWul0c5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359831, "uuid": "95a2c74a-8e6e-46ed-94ea-9a56672c216d", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359831, "uuid": "375b9b4d-428c-4cd5-834e-f86038aea274", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359831, "uuid": "b2a43548-540d-478b-a3ec-8ba8289a7c99", "value": "00940a6466ffdd660a5cfceec98a74d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9895bf45-ea4e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711333378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333378, "uuid": "6f860370-98b7-466c-8c85-483ac3e69b67", "comment": "Malware payload", "value": "a5609f2c83bd8c49bf3f593889fc0052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333378, "uuid": "974c0af4-c184-4620-aa31-eb7cd9a31e39", "comment": "Malware payload", "value": "38243e4e7eaed73105c2789afa62b5332a91ca79bf569a29ccfe6a2e257b4233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333378, "uuid": "65571764-1acc-460f-9062-003813921115", "comment": "Malware payload", "value": "6d1cd4b3e03484b0ee19dca86563fd2b30cef5e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333378, "uuid": "424adbcc-cfd7-4a0e-84c0-fd7acfea6ee6", "comment": "Malware payload", "value": "b9a8ead7c57ac914cb0f6ff59882bb809ec4a184ea77135214c0551084b165afe9a64d719c8daac6e8d876e3726a4d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333378, "uuid": "06d55b31-ee8e-41c9-8c7f-82654ef682af", "value": "T113F49E1275D1C072C2732130AAB9EB7156ADFC324B354687B3883A696B742F26E34777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333378, "uuid": "e8176a55-fb7d-4cfc-8230-087a1b969b86", "value": "213e0a4928f644955b6c40c3acf835d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333378, "uuid": "6a468293-87e2-4a97-b5a7-c546cb3cb87f", "value": "12288:QNp51L0Z775xs2qnf8PtVXJSLKlK4pKJe5d0nocsxa3k48118t/HY4EErtkTd2h9:WJL0Z/mnet60yocssl8gY4hkTd2hCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711333378, "uuid": "af95cc84-194d-4940-8925-c1a7746fe66d", "value": 790064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711333378, "uuid": "c2a0dd5b-184f-4c12-addd-fbbd74af6f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333378, "uuid": "9da9e796-95f7-4755-902d-39f1622ce015", "value": "SecuriteInfo.com.Trojan.Siggen21.62491.10492.21094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689a08e9-eabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711380542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380542, "uuid": "2cb4b3be-6875-4853-833f-99de928aaef1", "comment": "Malware payload (Gafgyt)", "value": "52d5b3792f8f9ee05e60698feb6bbd63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380542, "uuid": "3491cbb7-7079-4631-81da-c0d8be6c0fee", "comment": "Malware payload (Gafgyt)", "value": "38828da55f631246aeb36e1c92d325075ba6f125fbb6e15a483069ba8521b99e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380542, "uuid": "a036151d-75b2-4ebb-9788-68e8058ffe23", "comment": "Malware payload (Gafgyt)", "value": "fc71bd069e75478375fc9763dd4368e25d2859bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380542, "uuid": "a28acc53-f6f3-45cf-b37f-9d27312358fd", "comment": "Malware payload (Gafgyt)", "value": "120778989e9b500d2ffabf9e7df1b1401e93278b45bf086fcd7054d6da9b88ca2ba3aab8fe162e4c11c51972227299aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380542, "uuid": "2329c909-ef4a-4d80-8a6a-7551f1c0604b", "value": "T138F31A45FC519F22C6D622BBFB4E429D772A0768D3EE7203D9255F20378B85B0E76242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380542, "uuid": "8c3c34ef-9206-421f-9016-4a95ffa6c1ab", "value": "3072:tUTtjOfAW5uwAo7s5AhMJddkHMU4JEgf:uTlOfCwPw5AhiddksH1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711380542, "uuid": "d37877a7-aece-4ae3-92c2-ef1c4ea3822f", "value": 158432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711380542, "uuid": "825404b3-32c2-4a2d-8b8f-f71678e93ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380542, "uuid": "cd048a76-c618-4d02-95ba-3242a8a07c30", "value": "SecuriteInfo.com.Linux.Siggen.9999.14440.28173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f7ec7c-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369807, "uuid": "2abe04d2-91f5-42ab-b644-5bdb089209d9", "comment": "Malware payload (AgentTesla)", "value": "a821e2148700e9b3c3531240c6d03aa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369807, "uuid": "68d040d6-efa5-4fab-9dda-c1b0331bb87c", "comment": "Malware payload (AgentTesla)", "value": "38a34bdb11f1ce758fcaff636f46ebc1fa1dcc786b2825b1fc48bcc5b9082ddb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369807, "uuid": "9a498e4d-8180-4790-8b0f-9e117e42ed06", "comment": "Malware payload (AgentTesla)", "value": "b232b45909804fb29e1007c6000451328171cd54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369807, "uuid": "1165b823-4d16-48a9-9b19-235d0d838c1b", "comment": "Malware payload (AgentTesla)", "value": "5bcea3d12c59632cc48774e5d354f70608e584dcf8210e28cc3988e25b5db29213d4dec6c0a3dcf315f81b9061493eb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369807, "uuid": "be6b5293-f75d-4241-bf87-9a72a0676466", "value": "T16A34FE037E48EB15E5A87E3782EF2D2413B2B4C71733D60B6F49AAA524517426C3E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369807, "uuid": "38f8130f-0208-4737-8a35-530dbb894197", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369807, "uuid": "1ebd9de2-83c1-4e5c-8e27-13347ae17b0c", "value": "6144:HY1Lxpf3nvvsBRVNBbTrRQ1q+4n9vLOGyG:2pf3nvvsHVNB8pI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369807, "uuid": "a92b86cc-b359-4773-beb9-4c58aab18875", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369807, "uuid": "24b16f30-041c-42bb-a356-4316c8ba9b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369807, "uuid": "09ca402d-9191-4fca-87a3-9df94be02d2c", "value": "38a34bdb11f1ce758fcaff636f46ebc1fa1dcc786b2825b1fc48bcc5b9082ddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea2955b-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359373, "uuid": "dd7fc9f0-ac91-4fce-a56b-c7bda5e63b1a", "comment": "Malware payload (Mirai)", "value": "acc9f175f50d10be1199047fe5521234", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359373, "uuid": "e0458678-f1ca-4650-8c10-b6fd7c17b821", "comment": "Malware payload (Mirai)", "value": "396a8c2a40998af86d8ff1aa81222ce3e65a01e9c7b50921e83fb52e450ab694", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359373, "uuid": "2fa46c29-5052-4ee3-9485-192fc92dd5b2", "comment": "Malware payload (Mirai)", "value": "9466ca376dce6024e49a49ba38a790604934387e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359373, "uuid": "819c52be-8af2-4b1d-b450-adb54e0e5b01", "comment": "Malware payload (Mirai)", "value": "2ad1295d92c811c0fab4b45e7cf0868c3c3517687e6153511f6ea54947b3c0dc70eeb4a7a38068ff6d4bca514dcdd107", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359373, "uuid": "2380fe01-c1e7-4ac4-b575-890df3e51fb9", "value": "T18282DF30619B75F4CBE10431FEEECEC6A71A0BB8D1FC369317586B78894610621F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359373, "uuid": "b26f7726-18e8-46db-bc58-6eeaff89a88d", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaxhymdGUop5h5lY:2dV0P6+kom0tVAoNvm+to1xs3UoznlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359373, "uuid": "71483def-779f-4654-8cca-e78476b4bd6a", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359373, "uuid": "7c734eb5-37b2-41b6-b35c-330c4079c0a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359373, "uuid": "303d3071-d417-4ace-9707-288f2781b7fd", "value": "acc9f175f50d10be1199047fe5521234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4d7982-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401944, "uuid": "39802185-36d4-4195-82e7-85813b620d0d", "comment": "Malware payload", "value": "2158ceff1c3a3953946e85ec8ecd70b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401944, "uuid": "7dd965ba-5827-4b00-bff8-1e413c97fbf8", "comment": "Malware payload", "value": "39d5499985b1f8a4a9ff4afe3768c3f10001a13d52faf1ff68bc8750938f10cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401944, "uuid": "7451d8f3-d71e-4601-b744-7211e130900f", "comment": "Malware payload", "value": "23299953fb5ef8aba41bb5ad1f04ee357e8ac41b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401944, "uuid": "f5d114e4-7819-4514-8618-489e1d2daace", "comment": "Malware payload", "value": "002d6ce995261cdb0ba23af6e14724f5eb7bd555e4f7667726a7946e3f113be12d9ddc6900630f7a53a3d0124fb81a2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401944, "uuid": "3f223935-7150-4e11-b281-291b0b00956f", "value": "T1B5330262E1B6E740C529F274585F3ADBFC08FB4AA801916CE5C8A2BC9E766313F14197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401944, "uuid": "40802dfe-3d1d-47a0-a723-2adb3565941b", "value": "768:A9Hn+919VvnHwWR1doiFd7DqMzymOXEHRv0oBUviRKfp0h7VlcaAnbcuyD7U0/29:AB+9C1iT3FzyplGIidpVlcaAnouy8j9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401944, "uuid": "e6e06b85-cf47-48b2-a040-6d7a14b22455", "value": 51872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401944, "uuid": "d89eb155-0f5d-4dd3-83dd-c4827fa8bc73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401944, "uuid": "723e5d2c-fd80-4d3d-85f6-984c8149ef0d", "value": "SecuriteInfo.com.Linux.Siggen.9999.5231.4958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c844f7-ea9c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711366847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366847, "uuid": "c6edb5f6-f5ca-4b5e-bf62-108e824f0478", "comment": "Malware payload", "value": "0cd0b71b219419b688ecd6599223639a", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366847, "uuid": "d3b518ce-f9c2-4575-9684-91307f6868ce", "comment": "Malware payload", "value": "3a23b616a5944735ffa156ebfba3fcf8debec466c00687a52ecdbde03b2bd94a", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366847, "uuid": "8547a477-4a2e-435e-b304-fa806edce73d", "comment": "Malware payload", "value": "fde7e33898b73304755f1cff8578139f34246e23", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366847, "uuid": "23b5626e-d0f2-4371-8fe2-e29e916aa3ff", "comment": "Malware payload", "value": "8735685a9901627a04261f6f98add7c01d5cb3b5f8702c1d5b11dba6ffe8d16f035437c21a28667d439e6eb10cdc9cba", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366847, "uuid": "f224692c-3e09-42ad-8a5c-61a78ad80bd6", "value": "T1EF64E151BE91874AE85607754DFB4A9A6325FC41AF524F0F324CF71D3EB03A44E2BA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366847, "uuid": "fdfb4542-135b-4aaf-9264-edc0903f4cca", "value": "6144:ZyunhXx+oY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVqIMIlSD3Sclx/nTOtB:ZzhXx+l3bVqIMIlSDicj6Is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366847, "uuid": "26162bab-6970-4140-86ad-9b0cc7621029", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366847, "uuid": "41f2ac90-b9b6-4c92-8ea3-cf045cdbed4e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366847, "uuid": "8041608a-4ebc-4463-8d68-dcfb872bc2fd", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6376f2-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711373837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373837, "uuid": "257f719f-6024-4dd1-bc81-f7bf693204b7", "comment": "Malware payload (RemcosRAT)", "value": "cde3695e8c23e9e09db22243c899a215", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373837, "uuid": "56273c90-c89d-4173-a051-b8355d0245a8", "comment": "Malware payload (RemcosRAT)", "value": "3c5444b736af60ee4f23f9f411c0c6c7a266647e0b127500f1e320e4946fb2c9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373837, "uuid": "f7ab6041-7b09-437c-8e6c-fc3a1915e876", "comment": "Malware payload (RemcosRAT)", "value": "82598dfe560b70c5f2c6441bc4c13a58309ce0e8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373837, "uuid": "54cd1a54-b33f-465f-a2fd-ad415009f591", "comment": "Malware payload (RemcosRAT)", "value": "083e50abe880b859bdafa82ae9b4084238732456b39fc0dd9d63cfd34a735b4ff4303ebcb0bb0f8a2a71959584562353", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373837, "uuid": "2589865e-9eb7-49b0-b62b-a15353eefc0a", "value": "T14C73466EE30F0965DF55A6BB430A4B4A09FCB33D738540A179BC9734376D82E46628BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373837, "uuid": "26a3cc84-ffb6-458c-b7f1-75639fa2fc65", "value": "1536:YxfsTw3nHeO1NwvfG08IhcX7Obmpy8wt0O/pARY9BxeRO5Ddc9h:Yxuw9bGfv3a+mpyht0+p2SeRO55c9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373837, "uuid": "9718d00f-e930-412a-9980-992bfeb9829f", "value": 79746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373837, "uuid": "33c98797-cee3-426c-a385-d828aae70591", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373837, "uuid": "fe865bc1-0707-4355-a5f2-49220b5196a7", "value": "SecuriteInfo.com.Exploit.ShellCode.69.11663.9638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013f6efe-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711383805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383805, "uuid": "51bb862e-0f5f-4e2b-95b6-098eeb68a184", "comment": "Malware payload", "value": "084c6880daf0702eebf59d0d187fc410", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383805, "uuid": "7bf2753b-d8e7-4b05-bc5d-0672ec461652", "comment": "Malware payload", "value": "3c7ca50a75889db8a018ad928d3ebb80e0721bc55831a3039c017b5eda4e104d", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383805, "uuid": "691c3027-d42d-4d76-b833-7d59417422ff", "comment": "Malware payload", "value": "2f9c5a9e77731987bfaf9be414a75245c7ada37a", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383805, "uuid": "61ac28ba-dbea-4c3e-a24d-a9d1291da7b1", "comment": "Malware payload", "value": "a2dc2758152dc40a45e0b0587c5a3947768b79445303de1167750926713b7f7478fb5a5d7e05a73d296ac61fe9bdd1f7", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383805, "uuid": "efca4f57-7d60-4ab0-95c3-d28c834c9a61", "value": "T12C33BF1433A5D069D1025E788DDDD2EB6B117C61AE978B0732C17B1F18B53C2AF136AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383805, "uuid": "4716ac81-a1d9-4ab1-ab15-83b1887132ef", "value": "1536:/X68Vm6+r4O89YH1vkQ6wv6Bp4N5xZeaFg3u:/X68c4O7S+6e5jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383805, "uuid": "c0b62f94-5989-49a1-97f3-e70de0aa5c69", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383805, "uuid": "e185b299-c6d3-472e-9450-faac690c6449", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383805, "uuid": "0719df8a-a05c-4f2d-ab69-a0bf6d15e4a2", "value": "orden de compra T7849..xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba78fe3-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711369837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369837, "uuid": "1a586dff-d2b3-4470-a6af-ae81d61ae3ca", "comment": "Malware payload (Formbook)", "value": "ae466afa4292c5c6f3d21ad0e9a9c52b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369837, "uuid": "53f3af5b-1609-471f-9277-dba5aa03d125", "comment": "Malware payload (Formbook)", "value": "407fc451a24a5a7d08b067fc8a1361f57e0f46331c19c4e069ae2d967cd33084", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369837, "uuid": "f1481a3c-d815-4341-9ac2-09953145f848", "comment": "Malware payload (Formbook)", "value": "1d3c5a7c207670935e144608da09b34a2e9bf8ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369837, "uuid": "e7eb1901-d75c-4061-bb24-9d0e250a547d", "comment": "Malware payload (Formbook)", "value": "4055445f5276d4a0714e9638fe612274f99a57ee452f5df2d785e113693ecd03c704278469c8a07d44343bc2e2399ae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369837, "uuid": "b69eb6b2-35a8-4b3f-a583-861b0931d4de", "value": "T1D2B53316DB6851BACAEF77BFD87305064FB1F640205AD3138C457E923A53B0A149BBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369837, "uuid": "6ab9ebb3-b582-431a-859f-be42a523c1bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369837, "uuid": "51e8a5af-d888-4b53-8a95-2523f4144fdb", "value": "49152:20VVh/qMriEHJMtjmvn2cy5bwioFsMgmkYuGV6f0G:zhlrikKtyvn9MbwioyM0V50G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369837, "uuid": "2d014882-1926-483b-a851-9bbe01c8cebc", "value": 2348032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369837, "uuid": "1f9b4e66-572c-4856-81c3-1843aed956c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369837, "uuid": "efcfc545-aa4d-451d-9df3-0547553a5c95", "value": "QUOTATION_MARQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65693a56-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (FalseFont)", "timestamp": 1711359921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359921, "uuid": "ba5e5d68-dffa-4c97-bbf9-30f04985054b", "comment": "Malware payload (FalseFont)", "value": "eec0b8d2c0b1f311214d1b9940a2ecfc", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT33", "colour": "#C4CC0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359921, "uuid": "40c29189-a637-4acd-8883-128ce52d457c", "comment": "Malware payload (FalseFont)", "value": "4145e792c9e9f3c4e80ca0e290bd7568ebcef678affd68d9b505f02c6acaab12", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT33", "colour": "#C4CC0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359921, "uuid": "bad4230c-2141-4f7f-a62e-3c0eaf626710", "comment": "Malware payload (FalseFont)", "value": "968c27f5e13f072e9b0478220f3218e2d1eaf7a6", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT33", "colour": "#C4CC0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359921, "uuid": "aa3d2553-f081-43c4-bee2-13ccc384e46a", "comment": "Malware payload (FalseFont)", "value": "54f1ebe46cbf7addfb74ddd8449824aab186288ddaeaf353f954dc240af69adc3e6a71aee4b485d5ca0cc6c061132b75", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT33", "colour": "#C4CC0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FalseFont", "colour": "#FAA745", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359921, "uuid": "dc042d77-4083-402b-8f43-1fb1b3b57d8c", "value": "T176F4022527A887A7FB5F0B78D5A08254DB3C014BBC1EFB496F6DE8EE6C4175019024EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359921, "uuid": "e532e065-8e98-4879-872c-bd108f0e3e7f", "value": "12288:f5JmKVhqYA5jPxzXmmCVj1kuO5odKdfD6C63o495JT5vPgvuqoYe:R9A5DB0Vj1kuGodKV6CPA3vPPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359921, "uuid": "543404a3-1051-40f1-95d9-d11749288624", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359921, "uuid": "1d5a67c4-2c55-4a50-b225-f8af94c21234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359921, "uuid": "7dec7cf3-182f-44fa-a7f3-038ba65f3344", "value": "Maxar.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16af2ef7-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359789, "uuid": "ab0ea476-1717-43d8-a31e-7937d21f553e", "comment": "Malware payload (Mirai)", "value": "feff2b47b325842902985c3ca6cb2e5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359789, "uuid": "405994b8-9d80-4318-8259-f0cfd1c86701", "comment": "Malware payload (Mirai)", "value": "414f89244a2a7d409d121a8c12f2143534da9b6319f91d089bcdc8c4fc7e5c7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359789, "uuid": "4d9d570e-7352-4c3b-9123-c50f3b5f9c4e", "comment": "Malware payload (Mirai)", "value": "2e4622e66fc60f26c1a7ac4249ed35d79a98a2ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359789, "uuid": "e7730199-5974-46ff-a2c4-1e9ee48d9cba", "comment": "Malware payload (Mirai)", "value": "06f7df90618e936edea0ebc323e7a6c87c5ee2b8dc14655af8a4c44dc493f18eb5c31b0a2af4f4332e94dc3256329d03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359789, "uuid": "fc8c496a-5324-4396-819c-04638a4e73ba", "value": "T156B2DF3C2B151B98EE1AC0BE839D0B613CB41B3591829D4B7207EDD7AF9A4747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359789, "uuid": "c2e62305-a84b-4076-851d-8b4e13ecb6c5", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui3mdzJgGlzDpH7uNj1JA4F:neD8ZSWvZHZbs1row697qohQvg93izJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359789, "uuid": "884fbd65-0013-42b6-b2ff-ce2705781925", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359789, "uuid": "929ee028-63d4-4202-9aa4-79942c0efb3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359789, "uuid": "d4598c92-9c3f-42bf-923e-674903564f2d", "value": "feff2b47b325842902985c3ca6cb2e5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477dfd2f-ea85-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356864, "uuid": "1cd48a8d-44f6-4818-afea-d1bd6f9e6fe6", "comment": "Malware payload (Mirai)", "value": "425a290d733ca9562c3f4f9b1be65667", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356864, "uuid": "a2690a79-2ce7-4aab-bfc2-0cc5d936889b", "comment": "Malware payload (Mirai)", "value": "422e61a16eab7b3cbacbabfa00d7968b91daaa9a9595ab4160104a39ab1d704c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356864, "uuid": "f5ce2fd4-0fc9-4c9c-a615-40da5151e755", "comment": "Malware payload (Mirai)", "value": "f3826cc9087925006b24c510249943e0231f5bd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356864, "uuid": "d06da13e-f202-40fe-b3d8-8fe37fb697f5", "comment": "Malware payload (Mirai)", "value": "64aa461c941fa70a26e974f58ca362e64daec04acc4733cf9c0b76169001722b9826ffc7f662a59e985fb1e2c846cc4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356864, "uuid": "ad16a2d2-5d13-4765-987b-ac1f0c5eb0b7", "value": "T113C32A56F7418B13C0D61779BADF52053722A79093DB33065A286FF43F86BAE4E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356864, "uuid": "f72f373b-ec70-41ad-abb7-e3332c5bac20", "value": "3072:kvWmF/NesFgdQQHlUQGSWCn95X7NtM/9IxGmiwqs33:kvXFDFgdQQHiQ+CzX7XM/9IEmiwqs33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356864, "uuid": "664c66e3-0779-45ed-b6cd-6428dc82d80b", "value": 124735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356864, "uuid": "0629ea8d-449b-4cae-b9f0-8c9f8c52b9fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356864, "uuid": "28e7e8e9-a2fa-436f-a8e4-0f1a7ecb743e", "value": "425a290d733ca9562c3f4f9b1be65667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9aa0f9-ea5e-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1711340419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340419, "uuid": "810e033d-6709-4e9e-9297-d5d27024f029", "comment": "Malware payload (Neshta)", "value": "43a456551f6781563cef69ed172eab19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340419, "uuid": "2a355d5c-1c5e-4c6c-acf3-0c0cd14ec835", "comment": "Malware payload (Neshta)", "value": "425f76eb82d3accf2865ff9f455a49675c2ca3f273ade57fd865c8fec5163f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340419, "uuid": "5f728625-43b6-4afa-b4fa-dc2d1226139c", "comment": "Malware payload (Neshta)", "value": "3ca13937264ebf59b3a76a3fc65782b7ee51d407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340419, "uuid": "916c1f94-1d3f-4851-80b7-3d6f3ddd5452", "comment": "Malware payload (Neshta)", "value": "aa83a6cc8fb3b4d184a4e94d616953eea0a2e1e8b5da92da2d052a2553ca7e4e118af243a2e2504bb1291b0153c814c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340419, "uuid": "40106dfe-c67c-4458-acb5-40675559311d", "value": "T12CF4120133782FA3D6BF5AF694BA104A43B2B52F3064E6DE1CC254CE45F2F518A56B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340419, "uuid": "95147f69-3b8e-4de4-96ab-5199ea5d7eea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340419, "uuid": "5db54adf-0f2c-4a57-9f3d-ae544a50c5e7", "value": "12288:W4CMwwi0ZhvpqAXrKrKMkze/8kd1x/4zRWq04FTOkeSv6O1GLXFTUsLEVufYmPPw:ti0/vpPGWCkkd1jqxlOkes/kdUskufY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711340419, "uuid": "671a749c-bd22-420c-a669-80777e699dd8", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711340419, "uuid": "9e7fa2cf-8d75-4dd9-95a7-3adabbc9cbe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340419, "uuid": "18fef67b-6054-4ff9-a7b3-d53fed5391d8", "value": "SecuriteInfo.com.Heur.22743.1556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339c213c-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359408, "uuid": "1528435a-b667-4e26-8fa8-21b809052e28", "comment": "Malware payload (Mirai)", "value": "911db988ba8e84f96dee8fc8db9456d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359408, "uuid": "7a63e197-cfc2-4465-8c6e-d866f1c4bacb", "comment": "Malware payload (Mirai)", "value": "42fb7565e47d04bcf1264aa76cefe76c5daff00031843bec7cee04d0b690aede", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359408, "uuid": "358d26d6-75dd-4c90-a03b-fdaddb04201d", "comment": "Malware payload (Mirai)", "value": "d944a807bc02722b21e8a16d74e28d315d828f81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359408, "uuid": "5cbbbd61-edab-4f24-a0cb-550fcdb42533", "comment": "Malware payload (Mirai)", "value": "aca690812f22ca21f735e351334eae42ee22cd4d8d921b5ece572c7ec66a41cb98ab36ab4884ce842b22c29d7f47f950", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359408, "uuid": "fcdc06df-fc2e-4411-8a16-6f892999fce7", "value": "T194230271840E9DF124303C76EAD9D793B6A12AB1C6673023D61D0A3C6F757531E1BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359408, "uuid": "767bf2c9-2b04-49ff-92e2-dba9d35d8448", "value": "768:S/TYCoIxdEk+AxoTZAZHFeq8b3z9q3UELbUXfi6nVMQHI4vcGpvZ:SECFd+A6YHAxyLRQZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359408, "uuid": "027e6ef8-d883-45c4-9f11-f0cf8896f30e", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359408, "uuid": "e91c6051-b19b-458b-9b53-81beadda7fcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359408, "uuid": "f92aa57e-5061-4195-ae95-9940b905a9ed", "value": "911db988ba8e84f96dee8fc8db9456d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c93e50-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359782, "uuid": "39e9b127-f55c-445f-81ea-e7b6866e0408", "comment": "Malware payload (Mirai)", "value": "4ad18a8664d00906e7bc117682b4adb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359782, "uuid": "d152085b-0a3c-470f-b2e4-a082583e0d98", "comment": "Malware payload (Mirai)", "value": "44f473fad788f09f28865159d99da9cf52b0f370a79657d2900efdf220a3c2a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359782, "uuid": "0e4aa0bd-0e36-4506-bdd6-9af2a97f0701", "comment": "Malware payload (Mirai)", "value": "03b34f1ed8db936a51a8c29c1c86d24a4c240ee6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359782, "uuid": "ef1ae587-f058-446b-b15e-baa599c6a1a6", "comment": "Malware payload (Mirai)", "value": "c4ecd309004eec7fe8a0389a844fde97a65a83e5542c8f99459ad518f29823f7a32e5ddff820e3522924ea916c49c0d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359782, "uuid": "adb38e64-63ea-438b-b0f4-17fc3844a976", "value": "T171336C36E029DED0C6560234A4E88F751F13F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359782, "uuid": "ffd0f7ac-e185-416d-bd8c-a5475538aa17", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359782, "uuid": "4b01f961-858a-4abd-9569-455113242c36", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359782, "uuid": "406a9afe-a0f2-430c-80de-54694654a2fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359782, "uuid": "6931fc15-e8ef-43bd-a887-ce3398d1b60a", "value": "4ad18a8664d00906e7bc117682b4adb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c28d75e-ea4c-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711332310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711332310, "uuid": "d072f102-f2f5-4541-9201-97cf6feec00a", "comment": "Malware payload (LummaStealer)", "value": "e9a06315725491847033d946ab2a2c0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711332310, "uuid": "8415049e-8799-40d1-904c-9876ec5ec8b4", "comment": "Malware payload (LummaStealer)", "value": "46a8847d9b5339fcadfbaf158c5775c5ab2965f014afa009671573b4d9d1ce2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711332310, "uuid": "a54252fd-d398-428b-8118-9e382b10ff7a", "comment": "Malware payload (LummaStealer)", "value": "33b91c6ec588a746755e63bc3d5d30890dc961ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711332310, "uuid": "d3bb42b1-141c-4ca6-9324-0cdd1f3eb9d1", "comment": "Malware payload (LummaStealer)", "value": "657049fe89bb451f957a4163148b8621d286779d9e3cede3539ac7b4ae8a1a446fc17aee452886c87fafd151d5176b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711332310, "uuid": "77c7ad6c-c704-4dfb-b427-d974ce1a726f", "value": "T14784BF53B2E16C60F57787324D2DC9E8263EF5F38E6A6B6B23586A0F04710A1C673761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711332310, "uuid": "47bd1131-f086-45d3-a28b-53737400625d", "value": "632c0082677b53886d85a93e74f074ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711332310, "uuid": "f9dbf22a-0025-43cc-a22b-b8b2cda8c619", "value": "6144:iDeQ8jU1Oye5m59xWMGfZisIO1sZemEBIVdHd:iCQ8jUo5mbifUYGwmECrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711332310, "uuid": "b4b3c2bd-61f9-433f-820a-77c678142df4", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711332310, "uuid": "0265d4fe-7179-4a27-a15a-840c1528bd5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711332310, "uuid": "bc3a250b-187a-4584-96fe-7aa66393a348", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b29823-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373913, "uuid": "7024cb4b-64d8-45ce-b2d7-0e316e09646d", "comment": "Malware payload (Mirai)", "value": "7e29353af3efc6a749806c3c5c5ca7d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373913, "uuid": "db2b1cdf-b4ce-4770-a285-15b631e0aca1", "comment": "Malware payload (Mirai)", "value": "475487bf7b96fe3da321dac0b5f59231651fc3d71f86bf9580bfa77e59b0f2c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373913, "uuid": "7854fb99-7386-46b6-8063-d74dd5e71e46", "comment": "Malware payload (Mirai)", "value": "36f0a20cf3f1526535bd6eb578ea01cf845a7da9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373913, "uuid": "7b276c16-856e-4481-b018-959d3645c53a", "comment": "Malware payload (Mirai)", "value": "ff50083f3d159b3170315885d42bded2382b572bcd9d052a19095b8d41da299e9e972848baefd3b1054761564e23176a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373913, "uuid": "51b5d80e-6ba3-4b79-93f0-f78fb4544ee1", "value": "T1D1E329D7F800DDBAF80AE33748530909B530BBE245925B372257797BED3A1991873E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373913, "uuid": "6e86495a-d6ca-4895-997e-3747be6680e9", "value": "3072:SQsZaBRDirvG/TPPf9jAcMUlqDVrjbiRLyxV2OyiahTtN:JsQNHfRAolqwLyxDyiQTtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373913, "uuid": "e2cc230f-4001-40bf-8b32-a4988736ed42", "value": 150432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373913, "uuid": "795485f8-03ee-43be-b219-7e42e55ab3e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373913, "uuid": "b07b4940-da4d-44ca-af18-ec2a1fa46eb9", "value": "7e29353af3efc6a749806c3c5c5ca7d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159b17c1-eab5-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711377396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377396, "uuid": "cab94bc8-dda4-4bc6-a4ce-b920598e410a", "comment": "Malware payload (AgentTesla)", "value": "c4f2a19d38347f4548bf020c4a6450a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377396, "uuid": "841f7eb2-797b-4f90-996e-f3d573ab3c29", "comment": "Malware payload (AgentTesla)", "value": "47984a065cde081ccce122463a9f65793cc522513ccb4ce790b6bfce91d7e767", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377396, "uuid": "72dde041-cb1a-4a3b-9163-6fe739bbbf91", "comment": "Malware payload (AgentTesla)", "value": "234966ee3d31ebf9dadf4f605e7198d3ee56b8b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377396, "uuid": "3f358a66-4b47-4eaf-aa83-eb9b8ca247fb", "comment": "Malware payload (AgentTesla)", "value": "8166258be228984886b37bf6808c9879c71ca44ddc36e6c2b042bfa36cd6fb847fec737ad9f284eaa29191e2b884d9c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377396, "uuid": "8ee4c5f0-6aee-4eb9-a589-ea27d098ec4a", "value": "T1CCF4CEDAB0CF0DE6CA1AB5BD4CF16462129F3E9A54E41D2D2F5AB531C5B2482603ED0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377396, "uuid": "d9180cd4-e865-4ad4-95c8-04f6a183b7a0", "value": "12288:rdsXlTyeCGNTiK/jmj+pIA9eI7sII+25+TDidHH6o5gPHWy2OW6ZVT8:rdsxyqNT8A9/h0CHNZ58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711377396, "uuid": "1f085e58-10de-4c7a-9119-3df95069cdfb", "value": 746096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711377396, "uuid": "91c328c2-ecf6-4076-a7dd-566e3739d079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377396, "uuid": "272954fa-2131-436e-ac9f-06061f7030c5", "value": "SecuriteInfo.com.PWSX-gen.17424.6091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea40c68-eaa5-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711370701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370701, "uuid": "21c49654-734d-446b-9372-a615a0050570", "comment": "Malware payload (RemcosRAT)", "value": "d41c910389d9f8ca4b978d028dcb1bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370701, "uuid": "ab955fd6-3f45-42f7-b49f-d7ca1f132f9f", "comment": "Malware payload (RemcosRAT)", "value": "48445bfa9459e7707ebb2abb6a6a5ee097468650df2a4ad1cb279324854a5c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370701, "uuid": "077c2971-69d8-4034-867a-3b609475d1b0", "comment": "Malware payload (RemcosRAT)", "value": "73d1614bb957f466b85501113534b46a14a3d431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370701, "uuid": "51179af1-4b74-45f3-9277-7872e30a3f96", "comment": "Malware payload (RemcosRAT)", "value": "13ce7f4284c2fb4ad48db82f2a4af6bbd6546e67c1bec4fb7b105269ff2c872e66a40908d20835813e7c6b05138e5abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370701, "uuid": "0ffbd03f-1060-4844-98fd-388bf92e224c", "value": "T1C143D91A9D40803DCED0047905ABC9D392BB97B9938E66E39BD416223E535FFFC75424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370701, "uuid": "85e37a7a-7d47-4652-b0dd-4676cc22293b", "value": "96:7DOtKOqtHAusyaGlp9khvXlsyCtxAgVC:7St2JAustGlp9khvXOySxA8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370701, "uuid": "6fbb554f-782f-4b10-a311-c383087802e1", "value": 56228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370701, "uuid": "3fb59e46-1aec-45fe-bc84-967865cc3ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370701, "uuid": "3951c3c2-cc31-4ab6-8f90-36a86c085dfc", "value": "cZaHKaPW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377dccf2-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401934, "uuid": "cbff45c3-1828-43a5-9fea-b1719d5def69", "comment": "Malware payload", "value": "7d1d2a5e1d02bac28ca87c2de5feeed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401934, "uuid": "4b3629de-134f-456a-9518-e6f34c19e8c6", "comment": "Malware payload", "value": "48f7b13fd2173f1fe8a5bbc596a0dbfb9cab84648c4baa05a7d50683c4c59e99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401934, "uuid": "4e0ca9ad-a677-44fd-892c-7b871b82ddaa", "comment": "Malware payload", "value": "cd8757e20469f03430bd571265ce0590680b93dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401934, "uuid": "2b3b812c-28f6-4815-aa5e-6ee0ed20a725", "comment": "Malware payload", "value": "5edcbf55b09c779389cfca1316094f325ec5372fb60c9e14db942d6abc82b670b204d4c573eea2df17994a383992df21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401934, "uuid": "0ee77ae7-785d-4395-80b7-3309a2f352d5", "value": "T15453029880C326C6E6FBE934DF0255886BE17B0877B1CAE1678DEAB05006307B719DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401934, "uuid": "d2054439-a60c-479f-ac2d-14b65882b266", "value": "1536:q+3Thft0AGuTllsdFyMoQqrGvTSSuIjyCNSLjo4u+qgw09C:7D9touDgFytrGGSdjQHo4u+qgwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401934, "uuid": "ac8e4ed0-c0a2-4412-8149-6ecbf00089a9", "value": 61272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401934, "uuid": "971504e6-286e-427d-bce7-3c6af2718c5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401934, "uuid": "9af22b38-cc8b-436e-93f3-eca10aaaf7c6", "value": "SecuriteInfo.com.Linux.Siggen.9999.32009.13850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef69933-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384096, "uuid": "6a3bc18d-3089-4370-b896-27ce35b1f797", "comment": "Malware payload (AgentTesla)", "value": "4cf86422d38e37c1e08c4b3b3128e6b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384096, "uuid": "a680c08e-a42b-480d-986b-292cce5023e3", "comment": "Malware payload (AgentTesla)", "value": "4914d971c34eb5a8af4e83e4d0a9edd358d12b54e87a949420e5e82897452d40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384096, "uuid": "c8a2d207-6359-4121-8cbf-6cc636164f4e", "comment": "Malware payload (AgentTesla)", "value": "88a3cd955c9ffc6b6a20da4e3133ba019faa5985", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384096, "uuid": "8d956a7d-10d1-4bc4-8dbc-c0fe80b24be8", "comment": "Malware payload (AgentTesla)", "value": "1f787f37df256307b52ffd2105bdb5218a03aa92bc6acabfc339adbedc5db8c390ef0a843565534d0567697b1783c421", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384096, "uuid": "38486f4b-18cb-4dc6-b96b-322c1a8f59d6", "value": "T1F5251227AE49D0EFF5CCCABB7D8A8269C5A43E1582C5ECC92E5C73FE0635433A511446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384096, "uuid": "b21d27d4-b8f8-4a0a-adb6-26be3930c458", "value": "12288:R7oRh0OKD4TkZjaEp87Tb5tcxJEpuVbeqoXGEaBbdy3ENd1I5PnNryPHpkB0zZFS:xD4TkZjkX4J0IdgayjfZyvpkB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384096, "uuid": "8d4769a8-5200-472c-bd5e-a14bf5ffd0ee", "value": 979568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384096, "uuid": "6f6d7809-0f31-43eb-8674-025ed7b3249d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384096, "uuid": "243659bb-2943-4fbd-857c-8e883631997c", "value": "TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a01416d-ea4e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711333380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333380, "uuid": "d92bdd3b-38df-43b2-bd76-72f5aa5bfb92", "comment": "Malware payload", "value": "ca040c4480594328d18eb6df47fcdbbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333380, "uuid": "0df0053e-64d3-4306-88d9-751d335b847b", "comment": "Malware payload", "value": "4923fffa4bd7171e09e50c79ff00d3cb7576e18b2bda0adbff289d42b4f5abbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333380, "uuid": "80b86f9e-71e3-4534-b319-15d5f965bdec", "comment": "Malware payload", "value": "5247631b1d415ad4cdca6f5c5c7a63f262acb3ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333380, "uuid": "60a09857-695d-4064-80a1-c8a237daf5de", "comment": "Malware payload", "value": "e12953e466c0a90b4036c223872f9c8b79f0ee85cf1532e4177aa22e4c053723d46c4b4dba5b5f0c080a7d10089e1cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333380, "uuid": "873af370-f99a-4096-b871-ed3487b1c7de", "value": "T190B633890906F44DF56442F2C67FE998162835F92EE26E21E07D5C387FBA8B35312B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333380, "uuid": "34dfa3eb-5ea7-43a9-a92a-aaffcfc6c267", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333380, "uuid": "3e05867f-182b-4e37-a06a-26ed70054471", "value": "196608:B1jk+nFrmSdkZDzXnAWdJXPQ4Z3wZO8I2Hk/QYxl0W8xB:3IuFrmzXAWdJ/x3wZHEVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711333380, "uuid": "1f299f9a-c97f-48e7-8b12-fed58dbc73b7", "value": 11225912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711333380, "uuid": "9ec1e0ea-fc29-48bb-b337-28aacfec532b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333380, "uuid": "300843b0-e688-46ee-930d-0dfa2348ee78", "value": "SecuriteInfo.com.Virus.Win32.Expiro.17415.1834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8932b5-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359768, "uuid": "358541a5-8d7b-430a-8bf4-be9344d8a0f8", "comment": "Malware payload (Gafgyt)", "value": "963154ef6065537e74b1738e5d669e32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359768, "uuid": "8e213c10-b9a8-4249-a6d1-659904d652d1", "comment": "Malware payload (Gafgyt)", "value": "49c9af449f7e8e9c5c702904a872c1bdbf39619064ab5e3ba4f55cdff14f69b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359768, "uuid": "cd29b241-a348-4cad-afe7-ea1c1f0268d3", "comment": "Malware payload (Gafgyt)", "value": "9fbb3ca1688ddaaa2f694575bb0f19ebcaa1ecfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359768, "uuid": "28b45b9c-4d5b-43cd-a192-6dae1a5135a9", "comment": "Malware payload (Gafgyt)", "value": "b55e78c1aaa8eb00557edb29d9255c958481766887308a170e65aab9bee2c7a9b8e9ff1aec6ace4f82307fc45c907e3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359768, "uuid": "cd44f4c6-0935-43bc-8413-bdcd06825ceb", "value": "T12A04717AB7618EB7D80FCE7305DA4912188C968652E93FABB3B4C528E75784F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359768, "uuid": "de5d2ecc-e372-4275-bab3-2f6de81cab73", "value": "3072:aaF7XSy6Cv9RDh5hCs1ZPhmv8uqx1BVnKoe:aICGVFh5hC2hmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359768, "uuid": "8aba1242-8f1d-48de-959f-ceef2795c805", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359768, "uuid": "262ba8f0-a466-47a8-a2fa-ef2473604966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359768, "uuid": "ed5ed4a2-2c09-4c21-ad15-fc2becf24781", "value": "963154ef6065537e74b1738e5d669e32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea62072-ea98-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365332, "uuid": "a38636b8-2a99-404c-93d1-253a1ee0a36b", "comment": "Malware payload (Gafgyt)", "value": "ba40f052d4d636a0d6ce873024f21187", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365332, "uuid": "08f6682f-4497-4b5c-bf20-e6914774a567", "comment": "Malware payload (Gafgyt)", "value": "4babdcc394d5e4ec7ac1292c766918b9e0dc34aac6c9f3515c01dae24ab34343", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365332, "uuid": "3130a1b5-9979-4067-9804-53f6d704a9bd", "comment": "Malware payload (Gafgyt)", "value": "04fbe8a65462de03167799942b493f2ebaa96a71", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365332, "uuid": "0a11df4f-269e-426f-8b0d-c36cdaf2950b", "comment": "Malware payload (Gafgyt)", "value": "aa1c767a17b7f14c3b4de3ceae3b277ddc40691d10d32c591bec5d41a0ce815f696717df7a6fc1eb792305134acb106e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365332, "uuid": "4a72ea24-c32c-44c0-bf5c-6e040f2094ef", "value": "T185B36B276181C6FAC48312B436CFA6D15823F5FE0B66704B77D47EB42F228C95E5AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365332, "uuid": "9497e10f-a211-4ffe-97b6-86e9a0d9a6c0", "value": "3072:tco/mw3jCHuYnoAwI1T4Nrb1AJphaP2W8NDtjoKty8wdO1:zPTCn7T4xMphaPYNDtjoKty8wdO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365332, "uuid": "80f4ef3c-86d2-499e-9ac4-efcaaa3882f6", "value": 110471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365332, "uuid": "75c001d6-97b0-47d2-8582-fc3e7488f57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365332, "uuid": "13bfa521-5b93-4215-b71d-ef72f673573b", "value": "ba40f052d4d636a0d6ce873024f21187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96165415-ea4e-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711333374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333374, "uuid": "7ee3cb4b-876e-434b-8be0-f306ab74c80c", "comment": "Malware payload (RemcosRAT)", "value": "5dc4dfdc43b27b8e1664f4ba3c11cb08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333374, "uuid": "568e8fc6-5488-4f1a-a4ae-842572ef4d35", "comment": "Malware payload (RemcosRAT)", "value": "4d02ef98d7fec3d3e752706c11c9a57130dba4b03022f85e12e7214fc92622bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333374, "uuid": "4281241d-1a89-4ce1-abce-562b8a6cc6e0", "comment": "Malware payload (RemcosRAT)", "value": "b8650b9e3d5d0e054c7decffffaf06cb83b18ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333374, "uuid": "f1f11a32-0c3c-42f1-a44a-6a90b8b6a933", "comment": "Malware payload (RemcosRAT)", "value": "ff85326ccd265e9b73d2930ecc836b1c9aa9e1f060f8c102b7522f50b39bbe97390a781dafcb28960290b1f1c111a473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333374, "uuid": "8a4490e9-50bc-407d-9d53-9bcf9db08b75", "value": "T12E357C6376F1A835D73E79788C4A7664115FBE38EE545802B3E9397C0E391C1AC2A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333374, "uuid": "fd27726d-249d-41fe-93da-59fbd612b01b", "value": "d9e0b0a083e7f2f7198f40fb54e0f914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333374, "uuid": "0b80b39b-df18-4bd3-ae58-87a0dde43e6f", "value": "24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6ezPEM:+PazuAOfh4RaR6URrNph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711333374, "uuid": "2eedb406-6c0f-42a6-97fd-4e1a2d6b3861", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711333374, "uuid": "e1f70955-0d1e-4cd2-a224-af424b6ec550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333374, "uuid": "c61ee565-f96b-4f17-ba95-3723bde03f11", "value": "SecuriteInfo.com.Win32.Evo-gen.7105.24636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac25aec3-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384091, "uuid": "6853b034-8f12-42d0-baf7-80b0fc06550e", "comment": "Malware payload (AgentTesla)", "value": "8ce7fa07609ee715d17d41ebcc2036d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384091, "uuid": "e8fb7ad5-0404-40b5-af23-bb5d4ae33d6d", "comment": "Malware payload (AgentTesla)", "value": "4d907c3d7974732445e036c17d48ffa394628c26a25c5eac76eafd101d4299a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384091, "uuid": "59d95ae2-1b4e-4a16-b4b6-7df729036ea9", "comment": "Malware payload (AgentTesla)", "value": "3d72cbab3a62ae99cc2fe87f9767da426ae1330b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384091, "uuid": "9e1c5179-39b4-4bd4-a900-e991bbf39cae", "comment": "Malware payload (AgentTesla)", "value": "22cbf1ab4cac33635557d15e7c620590e23055e395583c481e56c8d0f211f9535586f29e73d8561643a60ab125506f33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384091, "uuid": "3cd97f08-b577-4653-a2a7-7ad2d9add11c", "value": "T10EE4121AAB940777C1A903F295670159B77BE0276631C61A2DE080AE17F3F005F7ABDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384091, "uuid": "a73e77fe-0d8d-4161-add0-17af1aebf6d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384091, "uuid": "704a7ae2-9968-45f3-8f1c-e71393eb6011", "value": "12288:h8EgC74CMw0CLKcpcxcVOlMU60C6b8sBoigImwvht52PN1:h8EFAcpYcV0MU60XbJ/gPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384091, "uuid": "9bfff87f-939c-49df-a2f1-1ed3aee314a5", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384091, "uuid": "df04d994-aa9b-4f9d-bee4-18cdec2bc18d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384091, "uuid": "f944f0a8-ca87-4aa9-97ca-c890de9296f6", "value": "T.HALK BANKASI A.\u015e. 01.02.2024 - 25.03.2024 Hesap Ekstresi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b16aa11-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369809, "uuid": "fde93b13-f41b-4150-9385-02acac406c1c", "comment": "Malware payload (AgentTesla)", "value": "253518a20dabaace95c9bf3f83790c34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369809, "uuid": "0bf98068-9c7d-41df-9730-0756018403d3", "comment": "Malware payload (AgentTesla)", "value": "4ddfa204bd649f9b26a5def51fbb75752bdb7b9bffe4e9c76c2a5c46ff017fc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369809, "uuid": "6878db3c-d80f-4d71-b8d3-93bfcc98e3df", "comment": "Malware payload (AgentTesla)", "value": "73970ca11d627cb716608e105635efd175adaadc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369809, "uuid": "70d90ef3-e211-4390-84a8-9edfcedea93c", "comment": "Malware payload (AgentTesla)", "value": "62edbdd81763cfbfc851d0cc96ec7977606104f90e6630c4fdbb8bce745226b11dfa50c4a3c0f2f7fe13a29b84b5c69a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369809, "uuid": "66204eb3-a6bb-48d0-9736-04d77f337e3e", "value": "T175342F037E88EB15E5A83E3782EF2C2413B2B4C71633C60B6F49AFA514516466D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369809, "uuid": "bb2b098f-ba4b-4db1-a239-6ec1317a5317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369809, "uuid": "5196d49a-c77a-42a6-bb56-c29a702f6c9c", "value": "3072:znb5lR1ZlvoOGcTGbXfYecIvGsv6EPPu54+ZtvjU:znb5lR1ZlgOGZbXgexJJkt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369809, "uuid": "3aedcd89-ee4c-4e2f-84c6-93dd506e2e25", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369809, "uuid": "c88f2cc5-4c1a-4be6-ae68-4ccda2b20c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369809, "uuid": "6bff9ab1-83dd-46b4-9757-26805c95bc21", "value": "4ddfa204bd649f9b26a5def51fbb75752bdb7b9bffe4e9c76c2a5c46ff017fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a455f003-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384078, "uuid": "d95aee1f-2066-4165-b740-f7fa9bd1f64f", "comment": "Malware payload (AgentTesla)", "value": "bc813828d08b596681681296a9e17eb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384078, "uuid": "6d9c156c-2139-4376-949e-de9fac432a2a", "comment": "Malware payload (AgentTesla)", "value": "4de0c431cb9805cb419d42e5f3630a74393ed10409bf0e6d3d65c7b95e380aa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384078, "uuid": "8d8f726d-b002-478a-bcdb-6e6e3905f7a5", "comment": "Malware payload (AgentTesla)", "value": "245133d9baef52591ff6ec3f310b729eceaf47fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384078, "uuid": "624df3ef-f865-492a-bcfd-648b2311972c", "comment": "Malware payload (AgentTesla)", "value": "2769efead8f5a985ae1d2b6705f9da7801a8c7b18d2f33dee4fc557c63b723f5d2882ecbc6fcde4a58a253865e5b9e1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384078, "uuid": "f77ea317-86cf-47c5-8736-032725864774", "value": "T104F4025237782943EABFABF54972604247F2B26A2071D2ED1CD160EE4DF6F014E11B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384078, "uuid": "a9955729-2eaf-447c-b044-8f5ca8b9521a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384078, "uuid": "0c91f889-a14f-4054-908b-e292dba3d9f9", "value": "12288:/14CMwLXXZLdbHDQThYmKwN8B5vKgVTnuRz+yd3qwabuyHHePcQgoeVMAskR:fXXZGu9vKgVTuRCylqwn7PVgfVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384078, "uuid": "08570b75-b87d-40a9-a2c1-8bc6b65213e1", "value": 744968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384078, "uuid": "597c879d-2294-4374-b50c-bb90663a7f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384078, "uuid": "d9461b64-974c-43ef-a77a-1e29f806a0b0", "value": "FedEx_ 239071091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd6ce2d-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368414, "uuid": "840fe2db-1481-4580-82d8-7bc0a7619ba7", "comment": "Malware payload (Mirai)", "value": "fc526f0e9b1599b918049a6e38b59c04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368414, "uuid": "374743fe-bc5a-481a-a40d-96dd59496dbb", "comment": "Malware payload (Mirai)", "value": "4de920dbc2bb1f89e07066a89b1bee0d9bd788f50af77be5f3663d0088c610da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368414, "uuid": "7f4310da-c48e-4567-bc2c-53d2cc464452", "comment": "Malware payload (Mirai)", "value": "8c598dcf987d35471de5300599d94eb2b89d02dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368414, "uuid": "2dc08fb2-dff0-47bf-aa5b-010f7ec5d866", "comment": "Malware payload (Mirai)", "value": "0fae103c17310c7b921ea9b373f9828bb60ce5100432d898e63ee8a9c808d899f24603ad08ea4c25861a4496038f1d83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368414, "uuid": "28a3644c-8472-4f56-9d4f-4991a48a5b5a", "value": "T161219E9A67D36D17CC540277DCAF5720F362AE84869EF513F32226150C6F20A1F2204A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368414, "uuid": "93d6b1d2-2a64-49f9-87d4-b2db1f465eb2", "value": "24:JColMlgP9qD0at6EocGArUlFSy4PzLCkIddx2HuGIANfc7:JColMOFqDPtDrkFSy4PzLmGIANy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368414, "uuid": "cbaf69df-1c37-4c68-97d4-a9c17db9819a", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368414, "uuid": "48ea5944-c970-4b9e-8cf4-fd3043ce5029", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368414, "uuid": "a7efc767-8766-4e4d-8dbe-07576e00fe3e", "value": "fc526f0e9b1599b918049a6e38b59c04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de4b919-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373572, "uuid": "ab09c408-4607-47c1-9ae1-abfca09ea319", "comment": "Malware payload (Mirai)", "value": "84a7524f28ffccabdcdf8f8c4615fd2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373572, "uuid": "14f9fbdc-e092-4713-b04c-0942b5cd9845", "comment": "Malware payload (Mirai)", "value": "4e1937436febcd73edabd3fee1fad514eb9f57f0dc48a8aa93b81e3f4eb5855d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373572, "uuid": "2c5510a4-fec0-4949-ac76-5ce11a4fca85", "comment": "Malware payload (Mirai)", "value": "b58f9da4d78bc50239b77cdd40f136bc3d56e1c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373572, "uuid": "54723203-e33c-4780-966e-1171399aa20e", "comment": "Malware payload (Mirai)", "value": "2ffded717a2c2f8ae15786514f242c814199cc0d226f3f4285a0edf4ac48417a86ce307d130f0ca655ba801cf1764abd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373572, "uuid": "dcdf949b-5173-4fa9-80a5-1c79fd9f8e89", "value": "T1B6830270C6FD9118D29246738C7F85C22299A7E5DDE6BE632D900F1B190AC2A9B33136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373572, "uuid": "a53e4271-5fc4-4b70-8270-a8a4f6e8629d", "value": "1536:bcUKAVoGZoAXtdW9risYoW6ZgA1ogWjDmZmHAfXdblo/:AUKiP+tYoW6Z1zUOXdblo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373572, "uuid": "554b6e7d-6ee6-43d2-9de6-6dc76a1b5e45", "value": 80724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373572, "uuid": "9c4d3f14-6c22-43d9-a7b4-f42c43860dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373572, "uuid": "c1879f87-76a1-4357-abd0-c4ba178c719c", "value": "84a7524f28ffccabdcdf8f8c4615fd2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1218066-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359726, "uuid": "2cf781eb-11cc-464b-8130-53e3d481780b", "comment": "Malware payload (Mirai)", "value": "d9f3e87946d8ffe13d128b45b244a0ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359726, "uuid": "39ed44d2-3dbc-4521-b75b-5cdac8138b34", "comment": "Malware payload (Mirai)", "value": "4e670c71ce8b41eefd43421743d34a5cd90cca0297bedf78742e8cff8bf91a53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359726, "uuid": "58d6ef44-3501-46d5-9f20-2411cb8d6045", "comment": "Malware payload (Mirai)", "value": "c9523ad9ee743832d8d2791e626db61c42b12558", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359726, "uuid": "8ec69fee-23fa-4181-816d-a410995087e4", "comment": "Malware payload (Mirai)", "value": "bb6045b20212aa79a75ebb1ca51158715335bc2217f12fd824f194bff92c2f46589ee2826effdba3b65069526b977770", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359726, "uuid": "6e71e820-d547-4a8b-8e18-ae11b5d95d0b", "value": "T163431921B53A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359726, "uuid": "24a39d56-23b0-4b1d-b330-acce58b48ee1", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw0:RqtmZPuutfbltZFBSJsBcfDSTFI+BE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359726, "uuid": "88176574-62e2-46d5-b907-bd8ae5f86371", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359726, "uuid": "0ea29f61-4f3a-4a6c-ab8a-9a80c7eccd9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359726, "uuid": "a7764aec-1b01-4e06-bf98-559baa0d429b", "value": "d9f3e87946d8ffe13d128b45b244a0ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6aced77-ead6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711391947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391947, "uuid": "58192cb7-c84a-40d5-8c38-27f4cfc6ef81", "comment": "Malware payload", "value": "d31d27a59cb329e5c7ff914274c41b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391947, "uuid": "495a8dc2-0d83-417a-afeb-25d1e91d3eda", "comment": "Malware payload", "value": "4f2875b41146a2c534df2155dff98ef369d1a92c6c53bcc07783290dce445901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391947, "uuid": "62658de8-4cfd-4e02-95ee-fb14a06f2294", "comment": "Malware payload", "value": "42c4b40067453c46f5e587950e595067f3a8d3c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391947, "uuid": "505b9d09-5af6-4ee0-9c0a-5c44364ed44c", "comment": "Malware payload", "value": "e9321b37108579dae94ef826cb2ae8cd2c94b68e8fa2a0e58a74b2f862a844f391d9bc5c619de0230271dd702f8edd25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391947, "uuid": "c6aaa140-ba36-4bf2-8158-697e9487f45d", "value": "T1067312028729E1F4CEB17570D7AE4AC3F3963304C0ABCEB93594DA6CA6E6407DED5191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391947, "uuid": "01742046-2a49-411c-ab22-ddec520368c4", "value": "1536:zwG/4pseKBC2vY2AzPI1Vg5ueEiTSF932kGzu1FegWjDmZHnFHWzBr+vnsf:dSsdvvYgLFBppZWF+vnsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711391947, "uuid": "3f78ba9e-21f5-4460-9f7d-3dc7c48644f4", "value": 80684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711391947, "uuid": "2a394d07-20fa-426b-b001-cb5b75d07abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391947, "uuid": "4d9486f2-b231-4d83-b0d0-6cce5692e2a7", "value": "SecuriteInfo.com.Linux.Siggen.9999.7957.23356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468e5a2f-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711385209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385209, "uuid": "771f4fcb-4a71-4c13-be5c-98f00342f1d2", "comment": "Malware payload (Smoke Loader)", "value": "cccb10ceec06dcd07535387e28224db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385209, "uuid": "e0611764-fb4c-44cb-84f7-98cef03a0de8", "comment": "Malware payload (Smoke Loader)", "value": "4f6b05e7e7c2c51a1cf5569a47a8bf31f8d452359f5a37bcecd36ef3f852c858", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385209, "uuid": "8294f670-0eb2-427f-a818-bb014e1889bf", "comment": "Malware payload (Smoke Loader)", "value": "9d9e4dccfe75ed49f3b6c89f446654d4d91f63c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385209, "uuid": "75dfdc8f-39f9-40ec-9abd-6e5542e9d1d8", "comment": "Malware payload (Smoke Loader)", "value": "aeae1b1012fcf6fbff1e2fcd7a255bdf234dced76859423e439b9aee74687524114725571ac0e5bf14f6529ed8716cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385209, "uuid": "4a63317c-f08a-4c0a-be57-f672f6deeb49", "value": "T12544BE0236E2D8B5E1B347315D788A94167BFC739A31899B33942F0F6C741C19E76BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385209, "uuid": "86c6e2c8-5273-4eec-9ffa-799c9ac977b4", "value": "e881322220aa0a8ed0d8e38f4f3c660b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385209, "uuid": "0d7acc18-fc2e-460e-9f3f-a5934a9cb98a", "value": "3072:s/ZZBAvpmGkYrX15+VNX2VvXa4WNCqyEuHTP5QrTFWpc1nCKPTsyWj3cDe4:oZBar15FDWNpg72rTcpqCKP433cD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385209, "uuid": "fefc6228-b05f-49dc-ae57-af68f5d043b4", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385209, "uuid": "e9900c2a-77f8-4ddc-875e-0f24b83b75e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385209, "uuid": "c51fc0c9-d338-458e-a2b5-c3541ded1dd3", "value": "cccb10ceec06dcd07535387e28224db5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f1cca2-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390842, "uuid": "1c925003-85dd-4e87-838b-4923ddd2feee", "comment": "Malware payload (Mirai)", "value": "279fdfd5a54da8f0a16463cad450c81b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390842, "uuid": "1a641670-5e53-4cbf-94ac-6b039cc732b5", "comment": "Malware payload (Mirai)", "value": "503434ff2449797ffd228b7fdc79817653ff4ab20a42aed5a8a2a87fbeabda67", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390842, "uuid": "5c62d260-1ebe-4ba3-a6a0-6fcb9227b620", "comment": "Malware payload (Mirai)", "value": "0d49bc0353a892e5219f95ead113b83f16033b99", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390842, "uuid": "f0daff08-8fcb-448c-98cf-a4dee4224e26", "comment": "Malware payload (Mirai)", "value": "13d757dbaf4f9921a146d28c5ab79582ba8d6f822a1cd10310f7f12a1a695239010de8e00e6c3f58ebe836e64e8b83c5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390842, "uuid": "7985458b-ee3a-4fcd-b785-2f806f4e1db2", "value": "T1D3E34B17B5C184FDC8DAC1744BAEE63BDD32F4AD1238B21B27D4AA225E4DE205F5DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390842, "uuid": "12ac60af-4269-4b8b-864a-c1508b655656", "value": "3072:OVBWvnKvPK8owehzmkrjR0EDCVm1Q9/S6ReFxBW+gFc0BWt:OVBWPKa8oF88+UKcrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390842, "uuid": "523944a0-c0a0-4df7-9b77-ad18c1b4c45c", "value": 151848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390842, "uuid": "a644f6ff-4af7-46a6-b575-7a167de1f876", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390842, "uuid": "cf634473-b4a4-4df2-bb9e-cbcb60ad7a68", "value": "279fdfd5a54da8f0a16463cad450c81b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9f5582-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373895, "uuid": "d34a6122-fc79-4ab9-b740-16aefb1af774", "comment": "Malware payload (Mirai)", "value": "6c74e091b0f12fc4a64054139061000e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373895, "uuid": "107c0994-74da-4714-b139-38b0c8f1ce50", "comment": "Malware payload (Mirai)", "value": "51e22531837967bf76da386c59d225cbe14170115f296c9cfd8e71152285de95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373895, "uuid": "63eb2b9a-ef6a-4e98-8d13-bd5eb77178e9", "comment": "Malware payload (Mirai)", "value": "aa1b990d377165c04269624fa4773c6d1ee9229d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373895, "uuid": "f0a480fe-4d5c-4ab9-8c79-ffaa89aab08d", "comment": "Malware payload (Mirai)", "value": "002979f171b3437a0d3b6da5e0352cd82c01fcf761d25b05aa20ca1a061fbd32d85ed3343612157f2d237dc9ddf83c3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373895, "uuid": "e8d74c1d-0587-4884-95a4-4cd50c7ebb5f", "value": "T1875302A08F83B93242795D330D9E920DA81F1AF590E976CB36B2017039C651B11DF99B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373895, "uuid": "9a3c172f-13d5-464a-90c4-e61f541b241b", "value": "1536:O9hTBOWNJs/5UldR/wWe11gRLqea5ciIQgqH:OBOKQlGRL0cifH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373895, "uuid": "b0b624c9-0664-49a7-a1b6-a6688f0c75aa", "value": 64820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373895, "uuid": "061f4868-f67f-4741-93d1-995e07799835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373895, "uuid": "77687ab1-4d2b-4b40-9e63-96d49745a3a1", "value": "6c74e091b0f12fc4a64054139061000e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70350429-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390863, "uuid": "6e070934-7ff0-4a72-a21c-ae09240b3584", "comment": "Malware payload (Mirai)", "value": "3c5218e2a237cbede1722cd09c646ec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390863, "uuid": "13a357b8-2f7c-4096-9656-96d6e7ec0035", "comment": "Malware payload (Mirai)", "value": "522b56eebbd9e3cdef43e7ce67e21ee1d2a7d2e3100528da3ab8b2844adff487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390863, "uuid": "915aef72-6b19-4def-a827-7ee9f3bc0c2a", "comment": "Malware payload (Mirai)", "value": "cf103cea05e6544d5861f612b3b61624c7ad5dff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390863, "uuid": "1461f3b5-e622-49b9-b465-1471f290c05c", "comment": "Malware payload (Mirai)", "value": "e880811a62ecfd2f13878b99366706e8bdead88e2133cb7436d516adcb082a14b0d9f79850dcf2f8b25c02c2c74474f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390863, "uuid": "8ba1700c-6ebe-4ef0-a52a-9b2ec9fa5d13", "value": "T11DA36CC5F743D0F2E89705B1207BAB339B32E079641AEA43C3749932ACA2511DB1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390863, "uuid": "2c2ca64c-d2db-4c31-b8d1-4962b6e06322", "value": "1536:678a6srb/fIC2CDcxgmShRQmA+3MRz5M8WxuXOj2STAOavM:6osrbHtDcW56mA+3AzGNxPjavM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390863, "uuid": "d1efcd4d-3bac-4e7d-911f-23061fdd2f4e", "value": 100044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390863, "uuid": "05da6c20-ec3e-49d2-88b4-5ed5184c9fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390863, "uuid": "d06f13bb-4c62-4f8d-a74c-9b0523236b67", "value": "3c5218e2a237cbede1722cd09c646ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638fa5b4-eae2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711396854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396854, "uuid": "dd2f0ed7-fce5-4d24-814e-c5439c2c76e9", "comment": "Malware payload", "value": "769c8ad3f187882a49cda5d26103730c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396854, "uuid": "75e41bf5-4e9f-46a6-bee2-207f9ff5a56f", "comment": "Malware payload", "value": "5230c370cbdb95a2f4a30e70b7ac6a857af81c9498ef473704778fe86e6dbe1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396854, "uuid": "234cfc38-09b0-43ca-a03e-b8c461d33efc", "comment": "Malware payload", "value": "dae972d44336ffbb28509eabe946e83972166502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396854, "uuid": "756c48c1-006a-4382-8f8d-b1f682682e1d", "comment": "Malware payload", "value": "9fe7831a7f145602b20ec178f0960bdeddae271036ba471ae57180371c93ceaefbf5216e3763c8aeef1706e3ead62c3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396854, "uuid": "5ae5303b-5c4f-4316-921e-9a660e9e1756", "value": "T10F240212775FB594C80E837E98EA494887F2D34C520BC68B388D11C5DD127FBC7AA7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396854, "uuid": "9f7e57da-8e10-4919-8bec-c64c9a03375d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396854, "uuid": "422b4550-d017-459f-a0d0-3e0ab632131e", "value": "3072:Q52Gig7F8wUC1mK2iKkb8YxhX7EQXdeBvR/P4ieqSgvBEn/zcAGqxp6qUDbKSB/:sdF8l9sKqHbYQU/BSg5En/zqq/6qU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711396854, "uuid": "f9d4248b-bfcc-4228-a426-0e39ab79793b", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711396854, "uuid": "d3d17456-cf4d-44a9-ba20-eb77e6c80611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396854, "uuid": "2efc7d7c-b322-47b5-9eaf-3d2072c1495b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40f8c02-eac3-11ee-a120-42010a9c002e", "comment": "Malware payload (PowershellEmpire)", "timestamp": 1711383702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383702, "uuid": "10390751-6bac-45b2-a177-8d57f3cc04f8", "comment": "Malware payload (PowershellEmpire)", "value": "85458e5e0809da89721cf8f78907adba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383702, "uuid": "9fe1487a-bfb1-4248-bf12-c26638e39700", "comment": "Malware payload (PowershellEmpire)", "value": "53b55ab8b1dd2d78709f93399db598c3172ab1c8b9a7a138f1f4a4b3a99b35ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383702, "uuid": "d88348ab-8318-4489-bac1-929156ed73a7", "comment": "Malware payload (PowershellEmpire)", "value": "ae817d295f0aa7a91c4dc059561c3c629f908a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383702, "uuid": "2dab344e-33b6-4897-ba00-c6e03ffb3839", "comment": "Malware payload (PowershellEmpire)", "value": "decedde442c2f48cb9d22ec4681048ad90999ce6605e16c8d04515a17df044f732c3675438e0238cee519852ed55b1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PowershellEmpire", "colour": "#4B5B97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383702, "uuid": "950075b6-c9f5-4c13-8e15-6999a4f7e3b1", "value": "T1F443DB9C326032DFC8ABC4729AA81C68FA71787B531BD207985315ED9A1DA87CF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383702, "uuid": "16d246f0-e245-4577-8ad2-bcebbc0da971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383702, "uuid": "15bd645a-d509-4d24-b447-46ff9c7d7fa6", "value": "768:P/G15xn8/zVfGVy+cRqBMSSayER4+idpSLOoszFVt7UU+BYLBsp:P/GvxnGxfGVQRIYaygDrLsTlbgqB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383702, "uuid": "cc1f8514-c147-4bd5-842d-cde9e47cc104", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383702, "uuid": "09f99c63-30d9-46bc-9e75-7cc781adb7ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383702, "uuid": "4e2d00de-9d31-4e51-b2b0-27ecd597258b", "value": "85458e5e0809da89721cf8f78907adba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240d819f-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368401, "uuid": "0cb63e2b-8d8c-43b2-b5f0-0b7905cabbbe", "comment": "Malware payload (Mirai)", "value": "9902d9e62143c1d0a654891a9442eb8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368401, "uuid": "124780a9-5d63-4628-b1e0-623f8815940b", "comment": "Malware payload (Mirai)", "value": "53cd55d36870f40208918b630d07d6aaf8031950a7368a51f2749b52e3de3d3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368401, "uuid": "7d4e0598-3170-4619-a708-4740c317e6fd", "comment": "Malware payload (Mirai)", "value": "93f1b2728a33790d08a9d2c0e6081dee9fc7790b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368401, "uuid": "91c3e178-9ecf-43f6-9acc-bc86e953a45c", "comment": "Malware payload (Mirai)", "value": "22947e538c62673307cb8a13564408ae59fde90e897f85a89c8502087366908bfa43102bc3af610d493308657a873dcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368401, "uuid": "2d0bdc97-6c6d-46be-980c-24ad16c36646", "value": "T167430289E6C51C22D0D4703AB3855E4D37745B3E72BDE398D3AA0B544AA1892637AFC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368401, "uuid": "e2fe1d76-008c-4586-aca3-ac56f23d7335", "value": "1536:RU66RZWV5dH2RNX38m/1mSBaneNKu5Zpy86TRWx:n6LeWLXMSQKaneNKu9ydTRWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368401, "uuid": "519cb877-612c-4a31-9dca-8d580e445933", "value": 60268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368401, "uuid": "e54cd0a3-a0a3-4c2b-832f-9e54848eceff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368401, "uuid": "a0a41885-65a1-463b-8a5e-5dfa9ac4649e", "value": "9902d9e62143c1d0a654891a9442eb8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3382833-eace-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711388505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388505, "uuid": "394c87cd-43bb-4bac-b89f-5c26e3ffc3e7", "comment": "Malware payload", "value": "301503edfb1ea723b231b416c2a81f0f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388505, "uuid": "ce993924-91f3-4149-93fc-51001b9a7fbd", "comment": "Malware payload", "value": "544887bc3f0dccb610dd7ba35b498a03ea32fca047e133a0639d5bca61cc6f45", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388505, "uuid": "6c695830-e0b8-4137-9bd4-15f8b4ce4a2e", "comment": "Malware payload", "value": "dd41fda85637d2593ef4aad407371ec830fe171d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388505, "uuid": "3d582d96-be32-47f7-a0b7-09fa9d2cecb1", "comment": "Malware payload", "value": "49d1ff5f83cb2ad3d0ccc39716e6f353511de81ef8d5746fcb3b65f0a7fa71e72d9e8ff41add178d284da5911165dde1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388505, "uuid": "d36c093f-2cd1-41c0-8a11-95572947379d", "value": "T1A174AE3111A3BB8E2B561CD996A0F4800C7CF91353D58B49EB8F34568BED964CABCE74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388505, "uuid": "631112d8-1f88-4f92-946d-2a1aea3bca76", "value": "6144:FSxcuKYMvWe+ch9Bi7PoOCSElpHMnOInDOWPZsngSKTj+c42pf:+cRYMv5+ctgEBmODYsw+h2pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711388505, "uuid": "b5b78ae5-7c9c-4a74-8eb2-5f57f8e95522", "value": 354114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711388505, "uuid": "7389ad1e-417b-4047-9461-bc772e82c757", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388505, "uuid": "fa41dcc6-0075-42d9-8726-bf41ce5f8073", "value": "18262829011200.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd18982-ea5e-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711340096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340096, "uuid": "e40de279-e14d-4bfe-ac70-89c62643b318", "comment": "Malware payload (AgentTesla)", "value": "43222246288ded51499a28aa77ed3cdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340096, "uuid": "5075cebe-0dc6-4fb7-8df1-f95d713447b2", "comment": "Malware payload (AgentTesla)", "value": "549efc26b767eb73d03d661fc2234dff23a0de9198b84103ef6b20e286af04d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340096, "uuid": "e39cc42b-43b7-48d3-9b69-c45edfd3d557", "comment": "Malware payload (AgentTesla)", "value": "9dea43e48e0f730047586c429235eec77576953d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340096, "uuid": "a905ccfb-59f5-4365-8139-bbc214f5de5f", "comment": "Malware payload (AgentTesla)", "value": "5603379e6b386dee81a25778a3cdd626ba3b6a3036b69c7eeb47d527916c9bad1370f06c1a0ebbc9a2ee2d2d5630dd2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340096, "uuid": "f1014e35-f77d-4134-ac8e-c9ff8253a4ff", "value": "T10CC3156DD34B02698F624376AB570E5442BDBA7EF38152B1306C437933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340096, "uuid": "c591569d-d641-4c83-b5ba-be684f06e92f", "value": "1536:nwAlRkwAlRkwAlRhiZKAXUcqnNHCGCKiH:nwAlawAlawAljiNXUcqnNHCGCDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711340096, "uuid": "942cf65c-5ac2-4c01-ba30-4158f38c1d2a", "value": 126859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711340096, "uuid": "c396b3e9-9114-44c4-9bcc-5f88ed7777ad", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340096, "uuid": "ccf34227-cf66-4230-848c-8d45a0fb22e3", "value": "43222246288ded51499a28aa77ed3cdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187f72ea-eae5-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1711398017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398017, "uuid": "060f6e7d-cb20-4907-a8d3-19424039f093", "comment": "Malware payload (QuasarRAT)", "value": "7905279f9bd20f89fd34b2bffb8dfead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398017, "uuid": "8c13d541-7a06-406d-8589-9bf76653fb3a", "comment": "Malware payload (QuasarRAT)", "value": "5659ddb44daebaa170fc21e45e82412e3d6791cde509df6b545d340cf054f5d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398017, "uuid": "cb31fd16-ce1c-42d7-9f38-ac4865b9e660", "comment": "Malware payload (QuasarRAT)", "value": "4fd0093451265ae18041355f626fbb57c774ae10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398017, "uuid": "c8da4bfc-633d-4c41-a59c-27fc46857f1f", "comment": "Malware payload (QuasarRAT)", "value": "24415a5ecef2682354424b6b5de913089cedd349cdead47f6cb7c791e899cea46ed5dd330e1d1a3f64b94f722ae62638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398017, "uuid": "de63bdc7-71e3-4a1f-958c-db129b9d1ae8", "value": "T15E348D1A72A00CB9EE77823AC9535A0BD7B2B8061760D7DF0374439AAF1B7D1663D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398017, "uuid": "17e30476-4a12-425a-97a8-c5798674495e", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398017, "uuid": "130be254-a523-440f-b8dd-67438c7437ce", "value": "3072:0mkHdE+02qRIGYrP6OUHgz5dHtSyXQTxaxz2lJE2cWUQlaQMpjlaFKcI:0JdDkcP6Oygz5dNVQizgyRjsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711398017, "uuid": "046d56c2-9f1a-4757-993d-63068fafdbba", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711398017, "uuid": "495bfa33-7159-4a53-96c7-b51d62c32883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398017, "uuid": "4d33f102-f08d-42bb-abec-7f5e5df4649a", "value": "7905279F9BD20F89FD34B2BFFB8DFEAD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f4ccd4-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (STRRAT)", "timestamp": 1711383814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383814, "uuid": "c9941c9f-1b8e-4b06-aad6-3ddc5a61058e", "comment": "Malware payload (STRRAT)", "value": "df7be0365b1ed92efa70ea5bc070f19c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383814, "uuid": "dbb8a4b6-f701-410b-ae6d-fadc92ed498a", "comment": "Malware payload (STRRAT)", "value": "56adddced8be369b725c6c4db11ab5579dc88c40cbca16715db7a1e60da2fc3e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383814, "uuid": "a8f9a2ff-c4b5-4f66-a2fe-8c04d9d35b4b", "comment": "Malware payload (STRRAT)", "value": "5c6d506244d85222a25f25a93d7400d71a7b527a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383814, "uuid": "bdfa06b1-faf5-47cf-b008-ff1be3704d29", "comment": "Malware payload (STRRAT)", "value": "e50f76188509fe3f75e939191e504bad36c7524db7a367c1aae08073e4e3e5c7c21c3d0faab7fe9512a707a91f3326aa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383814, "uuid": "46b5b35a-a83e-416a-a032-77e3c029f5ae", "value": "T17BF3E02F68AED5B4E853987D5558E1AAA14CD0E8F309D11F61FD48990938CFE120AFCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383814, "uuid": "6185ad9a-b188-4477-8b5a-08542e0824b3", "value": "3072:T3FFxl3/W/7n3ZaVfK+7dkKwvBMxMI61Bd4+tEveaYARpzUPxOeQfebl2fXqAwWy:T3FFbUVao+S91BdfK2adzAx8eR2fqVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383814, "uuid": "92a44638-96c6-4038-99b8-09770a601d16", "value": 171416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383814, "uuid": "c7ac8c73-8d35-44cb-80c8-cb429755fe35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383814, "uuid": "3b0eca3f-5758-4115-80d3-479d5865ea09", "value": "PO#0015871.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15453b24-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368376, "uuid": "43999c94-89d3-4774-9c77-41ba1203c18e", "comment": "Malware payload (Mirai)", "value": "76829ad9a98714eebb8d23d75faae708", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368376, "uuid": "ae2ce427-35bc-4647-a508-71530002778b", "comment": "Malware payload (Mirai)", "value": "56c169229de12e0d83c76c30c715834d79b3d95be4c59cbd7a20f02b7263a605", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368376, "uuid": "9fb0d0a1-378a-4f29-8510-5c992bd4f01a", "comment": "Malware payload (Mirai)", "value": "4338ffd23bcfe11f043c5e28eeb66e7b5a111b07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368376, "uuid": "b2488078-9498-4d80-a000-3bfb9270dc27", "comment": "Malware payload (Mirai)", "value": "54df7cda365b129721891a1e34491b2f6871f7c41ced7c4f52a6a6753c1cf6f12118ddc436abe078c3c9214dbc32c0b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368376, "uuid": "3665616c-76be-475e-b09c-4877a792a1f2", "value": "T1EE63026CAD62BECADFAD9275B29C52E31C016089F3EEAD0066D08DC8BF67DC619D0454", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368376, "uuid": "3fdd430e-8238-4656-b682-a6c8275a8433", "value": "1536:swUNUMtPwgl85MEfxJ9iZLqXPe+szoIrlVcutUVZ9N3t:slNUMipxZiZLqXWBXc0UHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368376, "uuid": "a3f528eb-fbd7-45cc-8862-a201109f3718", "value": 67544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368376, "uuid": "f9678290-0cd5-492d-92ee-286c562928bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368376, "uuid": "d868a2ae-da0a-4846-89fe-7c4bfa66b49d", "value": "76829ad9a98714eebb8d23d75faae708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501ee193-eadb-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711393815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393815, "uuid": "3a3b905d-5e14-409a-9867-2c0841d92b29", "comment": "Malware payload (RemcosRAT)", "value": "9a942028f55f59560c38677923c7ce6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393815, "uuid": "045277de-e392-48c5-95bc-070cce048bfc", "comment": "Malware payload (RemcosRAT)", "value": "5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393815, "uuid": "850ab514-55c3-4b76-8e70-6ef0f69d6dca", "comment": "Malware payload (RemcosRAT)", "value": "069cf2b7306f61ac65a4598f519a83dd535325c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393815, "uuid": "a43ad3a2-5aee-4cff-9a0e-866695c46953", "comment": "Malware payload (RemcosRAT)", "value": "73e09108c6b56d434b48c0d01db0a3f655fb060854129fff8f7193d3bde7189ce560405e96cda3b8628415cdeeb9cb1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393815, "uuid": "33b1f92c-10e1-4742-859f-26d7ec8c0bba", "value": "T18E250192EAC48685ED695FB911371C241377BE2BBDB8E11C4D48B0E96BB36C34432E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393815, "uuid": "6ca3d78c-cf12-4a01-a7f6-444f82580d16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393815, "uuid": "47a32cca-0a45-4822-bcf8-2f17fb72c165", "value": "24576:yxWTl+NDnZjbBxcxyGFKjL8kFzzjBh3HrYMY:lpknZHEyGw3t3cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711393815, "uuid": "405d0026-a62e-443d-ae16-5bc42be780f5", "value": 1022464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711393815, "uuid": "728213bd-b88b-483d-9853-43ea8d087f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393815, "uuid": "d8efd2be-f250-45a0-9803-2e7115ea34fc", "value": "HUD34EDRFQ253.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229b5d5c-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359379, "uuid": "f906af57-61d2-4f63-8520-864b83bb267c", "comment": "Malware payload (Mirai)", "value": "3b9ab5eb41a9e5bbc4de87c7ee620d89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359379, "uuid": "66c054fd-e807-41f3-ac1d-80cc7b6bc195", "comment": "Malware payload (Mirai)", "value": "588839fc5f65c5bf7e17cdfce5fc8ce371d240924cba03cc8ecb08f5e85ccbc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359379, "uuid": "6f61fbcb-5239-4f85-8fb0-8ae5a9022041", "comment": "Malware payload (Mirai)", "value": "b9d06cb2f8519a47367f75c1a762d0cfe9631fa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359379, "uuid": "b93d0393-e0a6-4382-90bc-0aaa9ce90ff7", "comment": "Malware payload (Mirai)", "value": "e5a732844fa58ca0bc0b3c7b01cb6baef9e2f3338b203acc7dd8c95ff9d89c9e232ea935a41318d6d6a3fda1e02de5c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359379, "uuid": "60e7c010-4e6a-4c5a-aa3a-b449c7c57ad1", "value": "T13CB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359379, "uuid": "a3eee893-33dd-42fa-bbea-ef689cddb2e9", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1P/LWy:c9sSyzz36YaWWgg1Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359379, "uuid": "fd328761-9659-4199-815e-84e2d46f06ab", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359379, "uuid": "35917507-ade5-456e-a534-fe898c25fee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359379, "uuid": "669e2672-4190-4f2b-9139-e4541850171d", "value": "3b9ab5eb41a9e5bbc4de87c7ee620d89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fee840-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390847, "uuid": "69b2bc26-dc66-4e2e-a2e7-f1a5a4eaeae1", "comment": "Malware payload (Mirai)", "value": "735d8017be4ff8e05910dae8e4ab613c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390847, "uuid": "4f801368-939a-4944-88da-a44f018bc444", "comment": "Malware payload (Mirai)", "value": "595a436719c2ac7c441a77af3173629eb7ddfb0e304a27e09dbd19c1a6b4e741", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390847, "uuid": "e333349b-65ef-42a0-a6aa-8f614a0a43ba", "comment": "Malware payload (Mirai)", "value": "476fd7a7ac8f2824d1d7e8b52c5e2151cb856dfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390847, "uuid": "3b9b1b0b-6b69-455c-b67b-c135bb0dda0e", "comment": "Malware payload (Mirai)", "value": "9f6bd79ba5cb9bd4cb761b8cab6968558cb4cadfcd8eef9f72d9847d5a2bb19ec9b952ee4382cb6a5a7307d2a6e2dc8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390847, "uuid": "064ad7fa-93e8-41b4-8386-fa6d84477684", "value": "T109142A45EA414B13C0D72BB9FADF42453333AB9497E773069528AFB43F8279E4E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390847, "uuid": "8601d615-284e-47f0-9b53-88a8321d1c17", "value": "3072:ITfQeB+smIw9GXl3aMjfGEgOSMsS4Y2SPRRiMrZzWZrUwH8:af5mIEE3aMjfGEgfzYrPRcMrZzWZrUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390847, "uuid": "d194eb16-5e0a-41df-90a2-13956b3077b2", "value": 196272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390847, "uuid": "b746124f-8d6d-4fc5-b71b-72479588e4e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390847, "uuid": "7f22bf5b-2fc1-4567-b6cd-3ea476e539e4", "value": "735d8017be4ff8e05910dae8e4ab613c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fab284-eac2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711383269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383269, "uuid": "b50af470-2039-4cc2-ba54-32e0d9d2691e", "comment": "Malware payload", "value": "a2a9823517f77dbed5fa532c9496e846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383269, "uuid": "01c4419b-bf9b-4b22-8193-4d0f9aaa3f66", "comment": "Malware payload", "value": "59d589f27f394530ce2f7441b3366c8dc0423e14ba17b8fe62dd25683397d224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383269, "uuid": "ca1d770e-62b2-4fe9-8a76-3b1b53e51939", "comment": "Malware payload", "value": "cadaaa42b02a026e3be4b90452baacaade0d7023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383269, "uuid": "5cdea062-bfea-4283-8456-8d56ca76d421", "comment": "Malware payload", "value": "73c6b1dc04eb0a138213cf6a026ad192bb2c0efbc9ebee1fe2e052b6e3f18dff3326d7ba85692a4282de7b6d8d7a84ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383269, "uuid": "f10640a4-774a-4b1f-83b3-215626048e01", "value": "T17AA423814C6334F0E3A42B7365A9E3EED20A46FB41AF6548B95DE8344DD94CF74E6630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383269, "uuid": "5a30fbaf-81c0-4df7-831e-f1783ebd3900", "value": "12288:XhNRFm4oD8zMGSiH8R67dDAc0YPsGyXc3V:XRPoaMEHO6pl0BJXcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383269, "uuid": "b4aa2d7c-7013-4759-97c3-b000f71c2b05", "value": 482976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383269, "uuid": "3b0f8427-6d16-4950-b889-11a8956e3a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383269, "uuid": "c6db199b-519b-45d7-a7c9-39ddd5cbbf4a", "value": "a2a9823517f77dbed5fa532c9496e846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10111ec5-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365361, "uuid": "e8766de1-4aff-4c25-b810-2f80a0add2b6", "comment": "Malware payload (Gafgyt)", "value": "e63fedbe67e9a94d04e305ff7e0416d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365361, "uuid": "3ca0cd88-035a-40ba-ab5a-c2f6881e3083", "comment": "Malware payload (Gafgyt)", "value": "5afaee1ec920bf1c508bdcf9e4429cc5d157d4ae1052f83f0334a10374b95994", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365361, "uuid": "099c2822-e78d-49d3-a9e5-a5b8930f4392", "comment": "Malware payload (Gafgyt)", "value": "3b1dde12405658548bbcccbbbb18281a51e42210", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365361, "uuid": "d9d50fbf-cc9e-49cd-925d-720571499cd5", "comment": "Malware payload (Gafgyt)", "value": "141a8963517c2da72af552a92a7818e580402fabe94c6f7cc16c33a5dcae498265cd70dce2b1942167494324faad7a4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365361, "uuid": "3bbe7df4-ad8a-49a6-8e46-df66e526b7bc", "value": "T1F5A34A41D123C3B3C8430AB121CF5A9A1522FA7A0BEB4EA5F7583EB4DB61AD53506FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365361, "uuid": "f348bfa7-2d97-45a8-b6d6-3e83b2120cb4", "value": "3072:X2YUGPbGVjqWfZhNawnMjfpcu3A5hA7bE37K812UrYn:X2bGPbGVjqWfvaau3A5hA7bE37K812Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365361, "uuid": "54f025a1-97bd-4c4f-990f-a9c5899bf030", "value": 99228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365361, "uuid": "8a3c7ed7-f69f-4ec1-8ceb-1e1c64cfa52d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365361, "uuid": "a159a388-5e5b-4802-88c9-9ffcd18ff993", "value": "e63fedbe67e9a94d04e305ff7e0416d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1934e1c3-ea8a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711358934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358934, "uuid": "5d487d96-7510-4645-a4d6-be96dd9d3f10", "comment": "Malware payload (AgentTesla)", "value": "1c1a756218884d532814597afd086ebb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358934, "uuid": "b123ff10-b0f7-4c74-97c6-13cc2525b6e8", "comment": "Malware payload (AgentTesla)", "value": "5b4d196e4aaf77ed9490a404e845d2e44a57cee008cbf01672fa28ba184cf370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358934, "uuid": "10f12a79-f69f-46b4-9159-002d060b4ad9", "comment": "Malware payload (AgentTesla)", "value": "b9dce8867de0d89f8562d59f89f1809b705c0e69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358934, "uuid": "e509d46f-c990-46b1-9b7b-9e3a17dc75b0", "comment": "Malware payload (AgentTesla)", "value": "d98eb7a4fd8af12e69cd59c6fe7750697bafd6f7de0d9ae65956a3ad3ffdffbf6e4eeb12f6c7e805db4bd65e58e7b9ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358934, "uuid": "034621f7-89d6-45b6-b754-c7db753ff5f0", "value": "T1B29401536EAC87E9F2BE8BB408605000C37BA2C25A61E1193EBE7CDDCB537108716797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358934, "uuid": "a01675b0-378d-40bd-9c47-31a8399d2326", "value": "12288:JSTa2iNHYsUlppAYNEECB5mgTUMM7ZPYDo9Lil:821+lpXEEcKJ7J9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358934, "uuid": "9e8caa7d-6663-4f8a-99a6-c0cd16943fa4", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358934, "uuid": "ce82992c-5c2c-401c-aa70-f89be892245d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358934, "uuid": "d79075c9-b3cf-40be-8c86-3fc5a040e623", "value": "nnaredbe_br-_700611_-_C.E.F_doo.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de22a0ad-ea9a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711366136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366136, "uuid": "41442c79-6ac7-42c7-9831-46868c58b866", "comment": "Malware payload", "value": "a7609e0f7ca5481ec2693ab6d779bbf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366136, "uuid": "8e5ae8a7-e0fa-40d4-9b69-3a438b4b7382", "comment": "Malware payload", "value": "5be374c07abb0eaf554e553892894b3adef43aeda7460c12bc18178a546ccd9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366136, "uuid": "8881229c-9405-445d-aaf5-4079bb8a0f75", "comment": "Malware payload", "value": "334c909ef79fbcd74d659ba77e851d24bd556474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366136, "uuid": "a5d80666-4c4b-4c79-a182-50c8cb95a789", "comment": "Malware payload", "value": "88822b44e5d662e0c8dbe96929e43bb231ff1f92610c7b6cd6f0457e971f06da9f3121b6352ad222b35903a23ac44356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366136, "uuid": "a1d63616-7997-445c-bbfa-21fb923e90a7", "value": "T17F060546EF8980A5CEA6B2F3C561853192327C110625D68BE5F0B74DDA72653FF2EE0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366136, "uuid": "592fccb2-c2d7-413c-8268-e4c028716359", "value": "f9309fff2ca1987b729c2da5521e6655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366136, "uuid": "8567f378-1455-441a-a46d-181e87612600", "value": "49152:YlOhBCfLUjME9UI7JJqWun8s3gt9LoHwjvTyXdC8fZOO:YCF9FtgTOvLMCzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366136, "uuid": "13b6908c-9da0-4fd7-ac5f-eb9efd9804c2", "value": 3810816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366136, "uuid": "0bca1976-327f-43f4-ac53-56f5f746011f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366136, "uuid": "e838d01c-cf1e-4146-b742-614cf7fd1574", "value": "SecuriteInfo.com.Trojan.GenericKD.72064331.20544.29306", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e664eb-ea84-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711356323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356323, "uuid": "02fea0eb-08a3-411d-8337-58cde126bab6", "comment": "Malware payload (DCRat)", "value": "a167a0ed8f5565faac55afaa6fedb8fe", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356323, "uuid": "82656a7b-7b38-4609-8805-67bcc3e275b7", "comment": "Malware payload (DCRat)", "value": "5ccafcbb793d4eb05da495019e7eb15c042a0300fcbe68c07c3de7db0cbf64f1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356323, "uuid": "7da8a23f-0d70-42e1-9a85-cd45777247f3", "comment": "Malware payload (DCRat)", "value": "50572048b151f9c64b5469aba7899e62ff4087df", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356323, "uuid": "0260adfd-65c2-468e-a142-e551383d47d3", "comment": "Malware payload (DCRat)", "value": "5e31153f786450ec9481c60021c7af855dfbde2dd59423e8863fafef41d898bfc2cb53caf0612b65ec7ef9cb362d0c8a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356323, "uuid": "fdf5054a-a282-4a7b-9fdf-2925098ddb9d", "value": "T152D5D00665925E3BC26467325457003E92E0D7723962EF0F3A5F14E2A903BB9CB772E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356323, "uuid": "b736659a-7478-4b5a-9edb-943a1bb3abba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356323, "uuid": "b484e03a-1e3c-4aac-95a2-b37886d71dac", "value": "49152:cZpwGx6vfOx6d2ID0sYE083+qh9MA4PBJ9mBVU5npVO0L8pCGgoe8bYnSu:czazio08uqzMRrI4nTOpg3tMYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356323, "uuid": "d9fce574-2478-446d-9fed-c23a8ab6656e", "value": 2944000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356323, "uuid": "0c0b7d2b-dec5-4031-a5f7-5ad5631c4ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356323, "uuid": "4d041cbc-c7ab-422c-9f8a-abda30efb919", "value": "a167a0ed8f5565faac55afaa6fedb8fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f033399f-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711409116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409116, "uuid": "e45dc9c7-262d-4560-871e-0fec8381df42", "comment": "Malware payload (Mirai)", "value": "ddd4759d8ee6e8da23e3a62a7d200b09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409116, "uuid": "c6efadd4-bea2-4bfe-b5c9-c8952311a4b2", "comment": "Malware payload (Mirai)", "value": "5e1e797c39462c00438739aecc520017e179cc98226a27f2dd21ac863206cd8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409116, "uuid": "b528962c-a76f-4fbe-9d50-7a9be6dc7165", "comment": "Malware payload (Mirai)", "value": "20710956c665d4d45a9e726eff2f5e61307e9b33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409116, "uuid": "acef3d0d-8374-482b-a892-a72ac4c77770", "comment": "Malware payload (Mirai)", "value": "50367a69df5f5c91b324ece03ad7eebac0691a4dc265d68012590acf6d962a202390d809892d6ff2cf97f6a52e025a71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409116, "uuid": "b52b87af-f017-4d8d-9e30-e0763934acc6", "value": "T122310FD5A7D04DBDC8E411BE9D6B0314B3799F80E0C63523830C77286C1AF785D26486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409116, "uuid": "bfb33fc2-04ee-4152-819f-80f99a64d22a", "value": "24:uAlKGpa7Urz/jlfR5XK1hUVev3gRGaJ9iVBBuLlfs19gSO:uAlKGpa7UrLZRu/+JGBuV89O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409116, "uuid": "689ad5cd-b9a2-48dd-b66e-0fb6f9bac575", "value": 1492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409116, "uuid": "c348ffdf-53e0-4a31-81ee-9bbeb3bc97b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409116, "uuid": "6ff9c199-fe8c-45aa-9005-d7afb527fb38", "value": "SecuriteInfo.com.Linux.DownLoader.523.16058.8965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9da55a-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359804, "uuid": "cf5c0315-286b-47e4-bde2-d716c34c73ea", "comment": "Malware payload (Gafgyt)", "value": "df490fb07becab7a297c0c5eb71f4c24", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359804, "uuid": "45320eea-78cb-4221-ada4-91cdebb36355", "comment": "Malware payload (Gafgyt)", "value": "5f15af20db9c991cb81469e969f26082310a93eb1c62f6086462fa98794d28b8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359804, "uuid": "b104e8ac-ea3f-4a88-a3b1-37d2ee0c3d15", "comment": "Malware payload (Gafgyt)", "value": "7e0440c363a0ba6e17d92073954dfed6d62cc9a6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359804, "uuid": "9e5e97b7-59ab-4124-8e5d-170e29787afb", "comment": "Malware payload (Gafgyt)", "value": "dcf810a172e9b1057af3b9e03564f4e48f15fbcc83da0f5c3311569c4a317b9c5a97c54e3e82d0e7600f89e7afca4d48", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359804, "uuid": "c6575464-c3dd-4ca8-aa93-416c9acf0a55", "value": "T1BDE3D733B2E18DFAC14652B026EFDEB29C31F1FE0672312B23A41D605F2D9D61D99A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359804, "uuid": "0b7e1335-ec61-4eb6-9e46-c6faf334d4ab", "value": "3072:syUyaJ3LUQEWuZI3zKZPhJOphahZtwkt3m+QVOXFNqOPPe:+3OI3mophaDtwqm+QVOXFNqOPPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359804, "uuid": "8255b65d-eff2-4668-bd81-25e6a51b70ba", "value": 144121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359804, "uuid": "13da8436-49cf-4336-8e0e-d151ecf581c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359804, "uuid": "0196c64d-1da3-455c-aca4-b793a78b1246", "value": "df490fb07becab7a297c0c5eb71f4c24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728a57b7-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711385283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385283, "uuid": "ea1937cc-e49e-4c59-93a5-bdccff1a4ef8", "comment": "Malware payload (Mirai)", "value": "a5f4c875931ab350828bbc696f85cf79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385283, "uuid": "1f6a507d-19e0-42d6-a9e0-1a5c029b688e", "comment": "Malware payload (Mirai)", "value": "5f6fb37ce34ca77a1682f03ff8543a7ae0bbbc9028cce834938daaa0ccd7eba7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385283, "uuid": "9afd8a17-38bd-48aa-999e-88075ce3d876", "comment": "Malware payload (Mirai)", "value": "8f129f4c25e148fd23c439380e119b0439ac2e2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385283, "uuid": "d358d887-d69e-44c0-a9d7-883b6735b84b", "comment": "Malware payload (Mirai)", "value": "8d338077acea3ec114b9708f9e10285b2089a9548e7a37e8c4d9c048a94df5fe274706174d0cc32256f78ac7f25c9fff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385283, "uuid": "7bd0d203-30ed-4ef7-93f5-a5c785421412", "value": "T1AF0439C7F800DEBEF80EE73B48530519B130BBA655825B333217797AED3A19505A7E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385283, "uuid": "3ee5e9fb-08c3-4eb9-bc94-9a78cbd7469d", "value": "3072:7fNkhQrC9yOoDSjdPevEJg+7QHuBbyPXOQTB1yql7F0cjhq3oVwjbiRLS4BEd6O2:bNkh/9T2IdGlOhyP+QTBEq06q3sLS4BN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385283, "uuid": "ebba32e0-7315-4078-a52f-28573fc6823d", "value": 179904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385283, "uuid": "4a5393e9-52f2-4029-89f5-59da8cd0d552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385283, "uuid": "409122d6-09aa-40e7-b1da-9ab0570e7f33", "value": "a5f4c875931ab350828bbc696f85cf79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfc5e18-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359824, "uuid": "215c2967-41dd-4cac-a578-96ced6879a42", "comment": "Malware payload (Gafgyt)", "value": "5b3a3d4a9fe87bb379e651188e27340f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359824, "uuid": "6dfac2e5-ebef-4cd3-b6cd-c5fcadcd783b", "comment": "Malware payload (Gafgyt)", "value": "5f86ab87e8f3336371bf80a7a47bf8abfd5f2e0434023832b56a1ca96d1ca1ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359824, "uuid": "73ce8b51-22c7-47bc-9a4c-4f7b753fe738", "comment": "Malware payload (Gafgyt)", "value": "6fe7d942be6618d1d9af5851aa4e3ab87c93bb0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359824, "uuid": "bde305e4-a394-4c03-ad5c-bcf002b9cd44", "comment": "Malware payload (Gafgyt)", "value": "cc7c4ffc3b3a927636ad4d506d21d040571cbe59ef2c667d0396959c749761feacb312e3d766c87feb0b752d908b5840", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359824, "uuid": "fcc854d1-aa61-4f84-860d-032967bc7f3e", "value": "T1C6F3B63BBB160F23C0C500B111E76632ADB5C7DA34F952D76AE06DAC6F2A5883465EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359824, "uuid": "a70ade42-373d-42fa-92f4-ffa7bd9c8ae5", "value": "3072:Mqnuwd00SXON8CQphapM7I5n3ANsmzjEq/dNYy2Se:MqD+hphae7Ix3gsmzjEq/dNYy2Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359824, "uuid": "2e63adc7-09e5-4604-be01-a66a1e374f56", "value": 157989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359824, "uuid": "c47723e2-d462-492a-b6a4-8866465ca941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359824, "uuid": "33355007-af6a-4ce8-b64e-15775837719d", "value": "5b3a3d4a9fe87bb379e651188e27340f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa1eb6c-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711409115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409115, "uuid": "98e803ee-a599-4ad5-9dfe-74a43cebbe43", "comment": "Malware payload (Mirai)", "value": "1fc6f69134ba03d1358b1f24231bb44e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409115, "uuid": "94625139-a2ef-443a-9360-f704a3d0928f", "comment": "Malware payload (Mirai)", "value": "5fa2db242f4061748a6b5553061c5bcbc2276bb131e1888bd3f78c3b8e3aa630", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409115, "uuid": "fa17d6a9-3ccb-48d3-a967-91cf5ffd5ceb", "comment": "Malware payload (Mirai)", "value": "472564200997bfcc4755044bf55a0704e5ddb534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409115, "uuid": "dc987c61-f50e-4b78-8839-146150b48d82", "comment": "Malware payload (Mirai)", "value": "f9f9921d3595eef1e7de67065d5c816c273b963d1e5c85fcdebaacc7ad2a651049f79eee2375b74d5e324a39627207a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409115, "uuid": "660910a6-f289-40fd-853a-fec3d813f583", "value": "T12A41F21A2F901F22DDA6CC36424A2B5139CC842B616A23565374ED64BD3EA05E7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409115, "uuid": "7ddbbb41-18e6-4c8d-a970-620da6e87879", "value": "48:EQ22nuDS3/o6df9r+SMTLWPkeTz3FWXp:EQDnuuTf9CSoLW7TzA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409115, "uuid": "2a3bfc7f-fc1d-4182-b468-c502310c664a", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409115, "uuid": "2f8faf31-e95d-47e6-9cd7-9fb94fef367d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409115, "uuid": "2c7612d1-33cb-4281-a526-a9a8d4b67192", "value": "SecuriteInfo.com.Linux.DownLoader.533.3647.12878", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a3f91d-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409120, "uuid": "15994b41-2c80-4279-b22a-505dac0c20a3", "comment": "Malware payload", "value": "b6dec74035a2e74f3c832b42c0ad6087", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409120, "uuid": "083ec924-9f62-4b30-a83c-98e1eb2c1e00", "comment": "Malware payload", "value": "610c95298ba92defe4679f84ee3791bf35d78bab4580cada533685818f36fc63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409120, "uuid": "eadd017c-e582-44ac-938e-72002eda531e", "comment": "Malware payload", "value": "d9e089d9aab9071a321aa9fef592e0d7c37181b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409120, "uuid": "851f91da-b41a-4530-994c-cb1cb768c777", "comment": "Malware payload", "value": "c658bfbc8eb528b9c792d0e5afde2e21fc51443db7d6b0865a58581e1e8d2894d78c33ea991201e3758eec5497f59e19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409120, "uuid": "22df97cd-ba16-497d-9cbc-fd544e37f118", "value": "T11963F1BEF99DAE86D3DE04BDD70403C550DD70EC2098AB9863324580D7EB906EE790B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409120, "uuid": "743d5127-05dc-4882-a4fe-a3814d75ba0b", "value": "1536:V7QqkoJxqev8tq6qDc+vXeE2gaBdvUmyWNrE7uN3:eoP8Ejo+GthUdSE7O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409120, "uuid": "3c96344e-5fa0-4799-8156-cd4498daba35", "value": 68348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409120, "uuid": "8c46cedd-8ac0-4fbb-b0db-b67e06a71b9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409120, "uuid": "924f5583-4138-46c8-a5c0-ed235bcb5166", "value": "SecuriteInfo.com.Linux.DownLoader.533.24672.4914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdaf531-ea77-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711350914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350914, "uuid": "b5534f64-b749-4f48-9cd0-cc54bb5b290d", "comment": "Malware payload (DCRat)", "value": "4b18ba302ac3b732c059bc9349dc5b1d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350914, "uuid": "d76e1633-fcfc-4061-af6e-c7951902f26e", "comment": "Malware payload (DCRat)", "value": "6120c9db8e0c5d714fd87dcb35954c460439498928bc85978aef0fb377e43e1d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350914, "uuid": "548b4cd7-494f-4da0-b0d2-04e2ec68b43d", "comment": "Malware payload (DCRat)", "value": "cdf1b87ab98bc1dbd6ec33426090df881d5500b1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350914, "uuid": "df6a4d86-8e1b-41c1-886a-82133418281e", "comment": "Malware payload (DCRat)", "value": "761088ef3eef97884408cb6ac18da781e5a69638fa3ce9d68452d47a8fa1c1c0aadf901b5cac747a9fa125d10640e4a0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350914, "uuid": "d8665e90-2afd-4137-8ddc-a6b64492e1d4", "value": "T18406F1027E84CA12F0191633C2EF854447F4EC91A6A6E72B7EB9376D55123A33D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350914, "uuid": "f2333400-f6aa-4759-889e-cde80cd4bdf6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350914, "uuid": "2d07db86-a198-42b2-a8b6-19d81b96f8d3", "value": "49152:UbA30qT+k5eUUNB4Pi8viz3aMauYHBuzmQZ1vIF85qZlczSoPNhBpbfXWYwEqGaf:UbWq0LF6DJVmQZ2FXcfhBPHdaII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711350914, "uuid": "ac5115eb-84b5-4d8e-80e7-39b30dc66714", "value": 3866274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711350914, "uuid": "80446ecf-12a6-4719-9993-c15edf60624f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350914, "uuid": "aab91e7e-dbf7-4ffe-8137-246830257e37", "value": "4b18ba302ac3b732c059bc9349dc5b1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdca25a-ea85-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356878, "uuid": "72672789-07a3-44bf-8f99-8c9683f5f2ab", "comment": "Malware payload (Mirai)", "value": "c135f913db127f5d31d127e78b4d0787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356878, "uuid": "8433e4ba-732f-4469-a6e3-c34a55410f1a", "comment": "Malware payload (Mirai)", "value": "627839506cf16aa9ecc7e0522ea0cc3dc9937aff637c6db6aef72812b0eccd40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356878, "uuid": "119683af-9338-44fa-be68-9e42f989426d", "comment": "Malware payload (Mirai)", "value": "4266c392e01aa5d4f2daa580c81742382ab4b785", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356878, "uuid": "921c4619-7af8-43c6-8819-da4656e3ac1f", "comment": "Malware payload (Mirai)", "value": "05931ac6339a2a05190b9a612230c5f98254e73f7d49641302fc7dcd5aa95af590bc0a01851e25214efe38437af1465b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356878, "uuid": "9c482b6e-da04-4c6e-bcf1-4db95b17cc5a", "value": "T1A2531956F8829B21C4D50279F91E158E372717E8E3DE7213AE605F6077CA52B0E3BD0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356878, "uuid": "0e39158f-5614-4af3-a8e1-95d3a6755afc", "value": "1536:ibnBjNQkJm89bvlgsfpQbM+ii1Fv0hCVK+Aa10CB:iNQkE89eXFv0hCVKeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356878, "uuid": "f05ea490-65e3-4e06-8878-0759e0ea9aba", "value": 64144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356878, "uuid": "a584a3f2-97a1-4df5-b25f-21b374ffe697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356878, "uuid": "e7120d70-a462-4a19-9f21-089fced498c9", "value": "c135f913db127f5d31d127e78b4d0787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4c3894-eacd-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711387828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387828, "uuid": "2687f4bb-abee-40ed-821c-6b3b4679acfb", "comment": "Malware payload (Mirai)", "value": "04c6f6da13dd8bb472cbece2156cfead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387828, "uuid": "8bb483ee-db4c-4eca-ae7c-051218505f5e", "comment": "Malware payload (Mirai)", "value": "6386e44de48d89e3f9f2cb3680f7b194007aa43e02ead3993677a2a29659c341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387828, "uuid": "111feac4-d4aa-4c7f-8f9a-119ea1ca15d5", "comment": "Malware payload (Mirai)", "value": "fb1e5ab8b3d8444e7c25f9492cc0649be2043d9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387828, "uuid": "775e64cd-cc73-4554-9295-85f6f52b7b62", "comment": "Malware payload (Mirai)", "value": "7757b164413bc5195b88d808d92f67faa971e600ba4bc1a83993c6be1440278d641e60f11566ca6d8d49f4917377fa3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387828, "uuid": "8e6f5377-449e-4433-9eaa-eec4d2308bd5", "value": "T17943F2D1B33AE874DB542D33822AD531374959B46AB7F1B9F23ACB1912C105137BAC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387828, "uuid": "c9771e79-b3b4-4521-abe1-e539869bd77d", "value": "1536:iQ7zp6SFzhUHkU5H06fwHyO9gC+OHvOuzCghw:i6pNkU6YSOScHmfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711387828, "uuid": "1f5ec062-04e7-4112-a107-be095c7bbc59", "value": 60076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711387828, "uuid": "66614ae2-25b9-46b3-9e30-e5e658f03487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387828, "uuid": "12849059-037b-4d5e-9988-4e9b1e5ae436", "value": "04c6f6da13dd8bb472cbece2156cfead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16296d25-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365371, "uuid": "7a7bc17c-9064-406e-b030-8ac5399dacb3", "comment": "Malware payload (Gafgyt)", "value": "aa781e63189a13918b78134747273b93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365371, "uuid": "2bd39b7d-2491-42ef-ae3c-6983dca37e9d", "comment": "Malware payload (Gafgyt)", "value": "63b923e770d615a55eef3e624436ffcddb4b074ad37eb0673649d6485192f9b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365371, "uuid": "2b52bd46-f7c9-4d27-b31d-cc425e292ce2", "comment": "Malware payload (Gafgyt)", "value": "91b24003149967a74324dbc523127c5d4efb8447", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365371, "uuid": "c9e9f875-9cf9-40f5-abed-36f6317345bb", "comment": "Malware payload (Gafgyt)", "value": "6a3ca13901ad475de95a3f6069fbfe5d4f51082cd55a3f01832fffcf338ba53a5cc58de06b386aaa44111f3b46977f87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365371, "uuid": "39252a72-0e68-4151-bab5-0024a051e9bc", "value": "T1A8C3F805E8404B27C2D267BAFB9A438E7B315BD86BD7332256296DB02FC17582E3E550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365371, "uuid": "d296acd5-102e-44cc-bec9-fb6d4dcd41ae", "value": "3072:fHrd5t53td5KN2HZIE/05UXLEjpF5hZtyY7888E5QInMsEc/1:Pr4UWpF5hZtyN88E5QInMsEc/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365371, "uuid": "3f58f061-c2b6-4ef2-97cd-23781ee67207", "value": 127518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365371, "uuid": "81894dfe-0390-4c2d-af85-5210e56a0f29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365371, "uuid": "dd58476e-09d1-4387-b972-91c82c73991f", "value": "aa781e63189a13918b78134747273b93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4a0112-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359394, "uuid": "08f69f51-56a7-48f2-8201-f8fbc35d976f", "comment": "Malware payload (Gafgyt)", "value": "267c526632dabb67d1393219a1d9a1f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359394, "uuid": "8149344e-3b81-4948-b09f-05652e3fbe92", "comment": "Malware payload (Gafgyt)", "value": "643f08ad224269aed8e7895c0191bb72518e8624a8669b6302ca3d92ac5c3368", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359394, "uuid": "6ff4c2b2-f329-4dea-8571-969178ba7f39", "comment": "Malware payload (Gafgyt)", "value": "d7f379fac0837b1e3730ad270f56095ff33ae95a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359394, "uuid": "675a9769-1b41-48f3-9186-577a7db45cae", "comment": "Malware payload (Gafgyt)", "value": "41cf48405a8f14118499e44f68ae2e8de391373543aaffbe831e73cdac069f6bc08ce28a68b047b9f452f430b7a37647", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359394, "uuid": "7f3b1e6a-b0de-4230-b7e4-273f12187279", "value": "T101D3E876F401DFA6F00B96B104D78F256D30ABE30B9321266366356B9EB31D63C63E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359394, "uuid": "7fce9624-5074-476c-ab60-971a6a10bc10", "value": "3072:9nmwABC9snnXR2KbukNXrUE9Q/4yWzoJ3BDqCmzj0qDJNYyoPe:9onjbukNXrFyWEJ3BDqCmzj0qDJNYyoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359394, "uuid": "2d13e3b6-02fd-4714-82d4-7b7dd8c7e139", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359394, "uuid": "cb5c3eba-3814-4d96-be03-3fa9750e58fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359394, "uuid": "975a4e85-2e9e-4fb6-a2ad-ff0ef328d20a", "value": "267c526632dabb67d1393219a1d9a1f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020e89c4-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383806, "uuid": "e5b68847-b55f-4ac0-ba6e-3ac394a3f30d", "comment": "Malware payload (AgentTesla)", "value": "f8798b71a4fbd1465cdff6564bae7ee8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383806, "uuid": "694b6f12-9fc8-488f-8486-9a0fde19d26c", "comment": "Malware payload (AgentTesla)", "value": "66939cad8ad6ea772c4f93509fb43a63635024fcaf22605af3f6016a9bbc429b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383806, "uuid": "c6fa5faf-9a0b-4ba8-9758-37b59f9e8aa0", "comment": "Malware payload (AgentTesla)", "value": "fafb4ef1565a1b70c7b716924815ef4ca24c2892", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383806, "uuid": "71a0265d-0085-47e6-9eb3-b71463c0aa95", "comment": "Malware payload (AgentTesla)", "value": "51691ad1f8df46be516e3600215522c09ed87057e02a8cf5be06faa6276d3e939637322a47b11bd6e9a9e09dc8a70bd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383806, "uuid": "0d8a8f77-ddab-438e-81d1-af29c4564cf3", "value": "T145E4235C14ADC8CAED7352F80009698EDAF5E939860919D47F3C861B2E7967F2B0D623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383806, "uuid": "f910776a-0d8b-421d-9d32-787a0cfbaf99", "value": "12288:QjxdXgLho7M8ONl4/pUPhVa45JM3hdh4pxrlIrN4Y8guHHH8aVzVtuIHzdA0bH1:kxJgV8XRUZVxkdgBqrN854IHOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383806, "uuid": "8cb101f7-4b5a-439c-8252-6a21d3426fe4", "value": 717718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383806, "uuid": "6059bfd4-84fb-4bb7-9696-4851c7e941ec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383806, "uuid": "89ad816a-7cb4-44d3-b927-59d4d32d1f6b", "value": "PO# 4501820652- PO001008 XNE-2024-0124.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6d9c32-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359401, "uuid": "4c9b9134-4f77-4c91-a6fe-eb04e45170ca", "comment": "Malware payload (Mirai)", "value": "8c31c17fc49e1980133565ca3f73bae6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359401, "uuid": "887a9efa-a57c-48dc-ab60-91de0ed5c8fa", "comment": "Malware payload (Mirai)", "value": "66f69eb0e036c62e16695826f77b35f46cd21ef6147398c6fed885130ef2fbd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359401, "uuid": "b19c6f45-f009-4791-be07-cf3fac1d1e19", "comment": "Malware payload (Mirai)", "value": "ca80fdea40a75f6d91a31f62eaa2734dc11bc8ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359401, "uuid": "093cad90-2260-4f0c-8a9d-dc18dd97649b", "comment": "Malware payload (Mirai)", "value": "5afb4d2a5ff037882444ed31a5c6d72b6f1d8a7e4607230876ac5feac3bc82581fa2fd94fb6f488078a85b8fc18449ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359401, "uuid": "6bac2495-402d-4129-af51-21da0437f4ec", "value": "T1E9A2E11472632D56F3EC1C3DC96A8357F9A70BFC90F6327579411620C94D24E2E29A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359401, "uuid": "be0f1ac4-e8ca-4eee-986c-249ceedd9a9d", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjJLhymdGUop5hi:vvQn4j+ZO5fKAlx9s3Uozk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359401, "uuid": "289735df-ab60-4384-bc1c-d3bcb79a6e2e", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359401, "uuid": "a4341d4f-9ac1-467e-805f-35796431afb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359401, "uuid": "c5c7ca7a-4e13-4a4b-b2dc-073ecb9da07c", "value": "8c31c17fc49e1980133565ca3f73bae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e95dda-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711385200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385200, "uuid": "e66fa772-27a8-4225-82bc-ca4af67259ec", "comment": "Malware payload", "value": "21cd7586b33a785b66ecded76d05c238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385200, "uuid": "7f5620ad-9238-495a-a355-5d892893bdda", "comment": "Malware payload", "value": "682e5a143bf1041ee0d8cf47c9d8c0aad22cb9fa2cd353dbe367a80011e9a158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385200, "uuid": "dd6df5ab-9ddf-42ee-bc95-15f39bfc6609", "comment": "Malware payload", "value": "d2a004ee0d3355acd845acc8b5a02d78be29884c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385200, "uuid": "c677aa93-33af-4376-b664-5cba93f56b6f", "comment": "Malware payload", "value": "a7b02fb1126e781049e8d9ea22d0cf2bc51f3f38b6e68ccdc1af1ba8bef50c7ba2289840d4909ebe5603e9ff4cf99067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385200, "uuid": "2e38471a-2383-4979-84fa-62d08f070db7", "value": "T1B99533CAAF33616DE45A1ABF6649160675A0C10E30EE6C3D65E703B4E2375188FADCF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385200, "uuid": "88e58643-249c-4e69-86e7-982c22fc193b", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385200, "uuid": "3f1d718c-2c59-4b5d-8358-2afca89040c2", "value": "24576:Foo0BavrjK/btvFFdVLNZCNSrlBfc0b3LAoI+RF4YOXfQkYzPi1w4EWUz0T9Z0/4:50D7f9CqK0b3NYdYzs9EkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385200, "uuid": "c7c6bb20-d0b0-4dcb-8ffb-4d2fcb98bfc6", "value": 1899520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385200, "uuid": "f25c0545-940e-4558-b157-d9337bb29538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385200, "uuid": "1b6b7194-9f71-41e8-855b-684dfe1cb3f5", "value": "21cd7586b33a785b66ecded76d05c238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c991916-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365355, "uuid": "96f67753-e191-4fbd-8e4d-6fce7ba01e65", "comment": "Malware payload (Gafgyt)", "value": "ad470223b26d420c890886ed236637c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365355, "uuid": "f14bbfec-1ec3-42d8-9ab8-6a6255615ec5", "comment": "Malware payload (Gafgyt)", "value": "6996224136d32045b5a44ae686d1d90c089f6c11f89306f1121112f285b88405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365355, "uuid": "49c77c59-03c4-45b8-88c8-b34932833b1f", "comment": "Malware payload (Gafgyt)", "value": "68ea3c38139321d5ccad38ac75ce98a623834c28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365355, "uuid": "36b1d0da-ad23-42cd-bdaa-c72470c25685", "comment": "Malware payload (Gafgyt)", "value": "2e9416dca181f21687793ac1ca172404becf4a60a837cae3f23ef1887e7d13038413191797ee3883a4621da3edb748c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365355, "uuid": "2396cec2-e548-443e-87ab-b5dd71398149", "value": "T1CA042A09DA409B17C1E2277AFB9B434B33239B94ABD7331655285FB03FC27995E3A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365355, "uuid": "d51e062f-c711-4c6c-9068-2cba31bb7d7d", "value": "3072:plx2mxpI1TzhmYineVafX2bCL1gx9pV2OnZW5hUv2JjhM/9QSw2mowhbRWz3e:pNeVafX2bwgx0Ong5hUv2JlM/9QN2mo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365355, "uuid": "41ff7390-b0ff-4075-b315-bf4bdc2658dd", "value": 180410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365355, "uuid": "ce4b2343-8357-4040-ab53-88c97f528ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365355, "uuid": "a4f8892e-9ab6-44f6-90bb-b4ca43ae8b4a", "value": "ad470223b26d420c890886ed236637c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b50cc60-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384063, "uuid": "240d052b-2ce8-4e8a-806c-bef25d30ba95", "comment": "Malware payload (AgentTesla)", "value": "f5ee306a68cfe7ae72c6a6be43546ac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384063, "uuid": "7ec5b7a9-d876-48e9-a4ba-100d8cef2469", "comment": "Malware payload (AgentTesla)", "value": "69aae743926fcf585511c62b5499296003ae896e0c25bc435981edf30bec678f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384063, "uuid": "25f0d047-9f85-4e29-a52e-ba3e335ea70d", "comment": "Malware payload (AgentTesla)", "value": "27b1291325e76fdec2eb1eae717e00c6dd30faaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384063, "uuid": "c52271b6-0384-4014-9f31-63ac2e1242b1", "comment": "Malware payload (AgentTesla)", "value": "8294e4c02658ea549de764daa77121d99dc1bef3e63417ed0894dd4a93e6f58386e07233e7ba281688ce6de0bcddf160", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384063, "uuid": "b19baf01-20a1-4ba3-97ab-c0b409f84d7b", "value": "T1DDF4120233AC2F73E5BE6BF6862A104503F6662F64A6DAEE4CC214DD24F2F505A45F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384063, "uuid": "96e85ca2-df07-4ca7-bb0c-690f21f1316f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384063, "uuid": "48f6fedd-3c86-4a94-9f47-c4139cabd5da", "value": "12288:D4CMwWt+BJa6dWJyHEODJ1Eqa+Gp9Ec9vrDmhb1WaGDqeN+tHKCgCgZxU+/uMLNT:Q0JaZJOEODJ+qa7t9+saGDlgMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384063, "uuid": "00240719-bd65-450f-87ca-679e0d725232", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384063, "uuid": "a6ac6c4c-ea56-46b4-9ac5-87585db8e193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384063, "uuid": "4a1084a8-f528-495a-9c4c-395b95fc142c", "value": "\u00f6deme onaylama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd31cf87-ea66-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711343855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711343855, "uuid": "dcae4b3d-793c-461f-8fb1-e70bef840ace", "comment": "Malware payload (Formbook)", "value": "5aa4f4c55b4cff17728d6ed02716bb83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711343855, "uuid": "63dc1220-2caa-4ed8-b481-3a8ed0907054", "comment": "Malware payload (Formbook)", "value": "6ea6f267651edf5a261e20c68eccb8881e0aaeb0d96189980d18aa39b15b8848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711343855, "uuid": "9d7ff7bd-4b52-4f82-a969-7aa30da4d21a", "comment": "Malware payload (Formbook)", "value": "66532c1923a6ce1a4f006d919f76a5d6b0f8b198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711343855, "uuid": "d2dee9a3-1488-4255-bc28-4bc77113c08a", "comment": "Malware payload (Formbook)", "value": "7fa4ce398a720df32febd014d4cc97ae71c6ade61047962f170229157805e8cbc4a455d643b4d2671534bd917f4ae427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711343855, "uuid": "c70cca59-8170-4048-bb72-56d19d75d3d6", "value": "T13DF41215337C2E73D5BB09F688A6101503F6663B61B2EAEE1CC351ED84E2F508B81B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711343855, "uuid": "2120d4d7-b309-4d70-89f4-b9e82a4bd48f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711343855, "uuid": "0bac7c57-7d5d-4a4a-be4f-493887e985e6", "value": "12288:n4CMwf9q9USj8XM8gbNJ26Ky/xuMj6WjHnAG7dKjhKqyJrGA:989CXWL26Ky/xu0DkMdshM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711343855, "uuid": "bede75bb-897d-42e8-9c30-26e5e4422f45", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711343855, "uuid": "a51ae793-960c-4658-b1fe-895049ebf9b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711343855, "uuid": "5d437b66-232e-4cfc-95ba-580ec6d9a4c8", "value": "SecuriteInfo.com.Win32.PWSX-gen.30511.17410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0129ae52-ea92-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711362330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362330, "uuid": "09e03982-7b84-4c2c-9545-bd2213a58e55", "comment": "Malware payload", "value": "f4e56fb75ab5fde2a92193e142263750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362330, "uuid": "f920d850-6f1c-4bae-9c68-c4ac080fd4cc", "comment": "Malware payload", "value": "6eb58861a0fc2665eccb438084868dbbeb02ce4bea483a6ccb683978bc105b84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362330, "uuid": "551b1abc-a975-460f-9a1c-161879bcfa6d", "comment": "Malware payload", "value": "2b387ed21b91383130548460c39abb1be7d0c860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362330, "uuid": "d642366e-5b90-4e20-b217-63a096d40d14", "comment": "Malware payload", "value": "42e80240132850cecee84f10c203482ce3a31fb1c0e13211d4854d33a292e53688d2535d587a089ee0170b5e24eefc42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362330, "uuid": "207570d4-5445-4456-83e4-77fafaa5c9ec", "value": "T10E832905BBA3C133E496553243904BFF8BBDA8333183202BFB549CF56EB41969546DAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362330, "uuid": "ef3281bf-fcd4-48a0-95ae-0ad85f3f7bd7", "value": "c29ab370ed500debe05d495f2d8c12c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362330, "uuid": "b5d92e2a-3133-47b9-94cf-e0bbb05e312b", "value": "1536:p2Y0VNblnigen1FQGpaika1PASjg/oORPM:p23rbZi/8GprF3jg/oYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711362330, "uuid": "4ad3e688-3be3-4426-b4c6-b5fdc7c3437b", "value": 82406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711362330, "uuid": "f68a0770-e667-4db2-8ea6-8637fb04f3ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362330, "uuid": "946c2228-1026-4c55-9c6d-77610ecf6d1f", "value": "ss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc0ba8d-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711367988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367988, "uuid": "793fcff4-2e99-471f-bc28-62a369503ed7", "comment": "Malware payload (Mirai)", "value": "5213f7e3e1387adb208b47a032341db4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367988, "uuid": "79d416e9-5a38-47bc-9331-8ec1e0ef4161", "comment": "Malware payload (Mirai)", "value": "72f942efbf10b9d0b8a1efc18f666528f390bf9d3b0e81cadac7811c8180dbae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367988, "uuid": "49f8252e-18ed-41f2-97d8-158e81463e05", "comment": "Malware payload (Mirai)", "value": "1a599d2b44ddb28cb891b7f5a1f401594f0aec47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367988, "uuid": "04a4f1a3-5248-4101-b8f1-e6880ff298ba", "comment": "Malware payload (Mirai)", "value": "a6626421288d095677156de05711a193bcf5191b6983524c6676a0cb2b2f92d67a6d6c3f1967c0e80991401d8cdf46e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367988, "uuid": "3c03e3a7-4851-44d2-abea-0422e2df43e2", "value": "T12331FE9163D05EBCCCE491BEAD56432873789F80E0C77263D218B754BD2AEBC9D27046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367988, "uuid": "bdacd9f6-88b5-4a22-94f4-171bb3ebacb4", "value": "24:CCKGpa7Urz/jlfR5XK1hUVev3gRGaJ9iMjBBu0lxrR+zDS+ZA:vKGpa7UrLZRu/+JdBu0lxrsDS+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367988, "uuid": "ff0e891b-b97b-480f-959c-f82ccd5d1025", "value": 1444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367988, "uuid": "687f743b-abae-44df-a9db-bf0b4c23d1f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367988, "uuid": "0db0a335-4fb3-4a3c-8c06-a7194c93d9f5", "value": "5213f7e3e1387adb208b47a032341db4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582750b6-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711383950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383950, "uuid": "2f5837f3-f609-4888-a6b9-71196f0237ad", "comment": "Malware payload (Loki)", "value": "d2082e5d591d1cc6fc92ece94eb9a3a6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383950, "uuid": "3363ed17-5be2-490a-bdba-46b5d7b1c51a", "comment": "Malware payload (Loki)", "value": "73ac6551e788ba3eb82054032f192789502dc52963bd1e49ed745d16a312bb46", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383950, "uuid": "9721ae31-87e9-4615-8495-b261b2f4f01b", "comment": "Malware payload (Loki)", "value": "598b72e3b6c076abf09843642068e81bb7b1bfc4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383950, "uuid": "a708797f-d040-4b19-9466-446497b4f94d", "comment": "Malware payload (Loki)", "value": "e33f4b04ac6e2f76df7b798b56e6520ea7c481a8c29cc301c6b77ea4c4ede14a162cf7b5a135966a5a0c23aef3a8da83", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383950, "uuid": "2ca1799d-afea-4588-9234-a9a67e59023f", "value": "T1ED04B4E3DAC926298A451AB7DD234B734DA400AC77131F3993BCD66D604395C8ABFBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383950, "uuid": "d455f8ba-caae-4fa6-9015-f2426b4036de", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyp:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383950, "uuid": "183cc81c-3aca-4ff9-bc01-e0f36501864d", "value": 183733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383950, "uuid": "ff1a34d7-b33c-4db5-abe0-55d1efa940e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383950, "uuid": "ea98021f-cefb-401e-8bc4-d8bb2ae8b662", "value": "New Inquiry GDXL-L24-433-50\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b47a6a-ead6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711391946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391946, "uuid": "78a23203-4449-4752-8d85-d9845c22dfb4", "comment": "Malware payload", "value": "a990812f1b4c1b3f452058a375aa3689", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391946, "uuid": "d9843de2-4f0c-4d88-9b2d-e9249e140f38", "comment": "Malware payload", "value": "741095beecea7cb983c72b0a0ebd3f5bfbe0b4699b3779325ece444f10060cd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391946, "uuid": "762f0b6d-003d-441e-840b-6761368ec3cd", "comment": "Malware payload", "value": "2871ebc0d272f63984ccacdac3bf4bdfabaea8e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391946, "uuid": "6f9cd008-cf77-4ccb-9977-4db2b6d1de04", "comment": "Malware payload", "value": "4e7fc462fb9124879d082b9fa400d03372dca7259434c05e8ca925c925b2c6ef57b413f97264c3f6d6b7d1af2b1e6b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391946, "uuid": "3917de82-5de7-4e21-a42e-2e2c3e092191", "value": "T1D853023E0B5F7026E44BC971155207DE9CF099DA1AE3390BE988A3B27C670C6B14AF47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391946, "uuid": "943d6130-f507-4aeb-b8a9-50a0dc360dfe", "value": "1536:GM4CohE3azNO/HGZf9+jAe1zuFewOkRMM3DXVEWD:FLoqf/HZ8e1zrbozVEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711391946, "uuid": "4cde296e-94f0-41d2-bc14-8d4915f56e50", "value": 66432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711391946, "uuid": "2e934a5b-bdef-413b-8bd3-c5923bf9b5f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391946, "uuid": "5fbdd729-7c0a-4ded-b343-c212b677bc4f", "value": "SecuriteInfo.com.Linux.Siggen.9999.12778.14245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cba65c8-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711383958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383958, "uuid": "d15b7957-6022-4602-8f63-f1ff8c6f15de", "comment": "Malware payload (GuLoader)", "value": "167f6046d186ff6fcb3f6620063a0de2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383958, "uuid": "35192c0f-b7b6-42c6-b3ff-763d0cf4efbc", "comment": "Malware payload (GuLoader)", "value": "743a36af1075b2ed3a96048db1db5584273ec49029add4fdd00070650aca67a1", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383958, "uuid": "9f4b4601-be45-4f2a-ba61-cf1847a8f066", "comment": "Malware payload (GuLoader)", "value": "f2b98e37d076177d793b7933aaad6b1184ee58d5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383958, "uuid": "51a9c31d-ac93-46ab-ac94-7065241adaea", "comment": "Malware payload (GuLoader)", "value": "b231413b7012795d04278b6f3ae96f4a893f53c079c678b6bf45fed03e191303ebb95c9eb32bb2c440f3e2c57b3f0333", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383958, "uuid": "a191434d-aac3-4598-a064-e2c14ffab128", "value": "T184F319D7DAC52A844A861ABBDC530B734DA4405D37271F359BBCC65EA04399C82BFBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383958, "uuid": "7d6e556f-59d9-40c4-bda6-ba1274a7a653", "value": "3072:sT4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNR2DOFN0m4VGEvyM+gZM6MEMy2Im:sT4yENVOY0NpVXpK68kH3DPbkhZi3eNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383958, "uuid": "89ac5202-cfde-4861-bfe1-be265fdbdb9c", "value": 171898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383958, "uuid": "7543a868-5ef4-49f1-9655-a5c1f74b96e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383958, "uuid": "eb764eaf-bf7e-4aa5-8338-4d678573b5f1", "value": "QUOTE0001113456250324.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3f2461-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409111, "uuid": "0faf04d1-b4dd-4090-b96a-8bf8ced769d5", "comment": "Malware payload", "value": "d3c322bacb11f903a0ac30b07af3a273", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409111, "uuid": "2280948c-7e78-4dd5-b1b2-4ef1d314a2d7", "comment": "Malware payload", "value": "74c56d8d185fbb346deb70d09740963e1aef8de449285ed60d9f1c412f23e51c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409111, "uuid": "fdc63982-95dc-4ef5-9b95-1c35d4623c47", "comment": "Malware payload", "value": "591dbe8268d8bb4fdef9184ae08b20dfeb0f2baa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409111, "uuid": "349dceb2-7e30-4146-b025-20f0eeec2d6c", "comment": "Malware payload", "value": "e3e2f4955a6ee15119e59e79eddafa740f22207bf5fa34a00ce9372f759aced7041076345aa7c052ab3d4aebf79a808a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409111, "uuid": "57b5a35a-d309-496b-ac72-738f84bcde8e", "value": "T16E5302A5F5434CD6D81BB8B46BD4D7C123F14284B2F15EC8D2A3DF60612A97BE3E52A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409111, "uuid": "3c9a5951-2df0-43a6-a2e4-2a43163d489c", "value": "1536:y/sdfHoZ6nq1/naF/S5SUqXhH7TIF4u+qgw090:y/seonqdGK5wRHXQ4u+qgwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409111, "uuid": "f24fa680-5d08-4273-9fa3-ba6dac5c4c2b", "value": 61276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409111, "uuid": "356d61a2-4af0-486e-9be8-3b26b5a91fa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409111, "uuid": "19444564-202e-45a6-ac7b-dea35a0468c3", "value": "SecuriteInfo.com.Linux.Siggen.9999.29659.26627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f4aa92-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390837, "uuid": "0b97b7e1-3f7f-4134-9913-f65eaba67cc1", "comment": "Malware payload (Mirai)", "value": "6da7d5df617ebbb6b8f8942dd6da7451", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390837, "uuid": "26a34f97-0d3e-489b-8be6-da59d516ab55", "comment": "Malware payload (Mirai)", "value": "759997c816ea36a1d4bbe81466b849b5776f47f3c1c7821031a263e5578f9e5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390837, "uuid": "01a016e0-21f0-4f13-a8f4-77242df09bba", "comment": "Malware payload (Mirai)", "value": "054ec8c90f221d45f2aed4a5509efef30d58217e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390837, "uuid": "0aebaae6-887c-436f-b2a1-455824d652e2", "comment": "Malware payload (Mirai)", "value": "13ceb9f8f8cba8f1c8025ab857f3fd491d3d617810458c6ebed99913d0b057d42c7628713d79732ab665ee7935c912d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390837, "uuid": "7e6bccc3-bcd6-4efa-9326-ddd2d0ac4b89", "value": "T193D30945F8418B23C6D212BBFB5E428D7B2A17A8D3EE72039D256F20379785B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390837, "uuid": "7c1cf6e0-d982-4cc8-bb78-769923632c76", "value": "3072:yR0mgoFT3/F7T4cmss5W/IV9Xn6ZDhvG:yRnTxT4cPs5Wa6ZDpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390837, "uuid": "113ac2a1-d4de-466c-9931-fe8e62f2abf6", "value": 142144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390837, "uuid": "e93126f4-5d83-48a8-b3ef-0e1021a2405c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390837, "uuid": "750d4b35-632b-46b4-88a4-a9cc80f77a70", "value": "6da7d5df617ebbb6b8f8942dd6da7451", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30df9b5f-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711367993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367993, "uuid": "93e7e8df-05ee-40df-b3ef-a0938d42aca4", "comment": "Malware payload (Mirai)", "value": "c52d1f6d9942c0037b9d54211aeb4a92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367993, "uuid": "5c82018e-ff3e-4ae4-9366-c98d9b53edb8", "comment": "Malware payload (Mirai)", "value": "7662d17abbed34e67c8e2f70258bb1242b53484442ed9b43acb87e638639181d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367993, "uuid": "46778166-9884-487a-a0c4-0c72b76b6c9b", "comment": "Malware payload (Mirai)", "value": "e75bfa32bbfe7cb90e66388c08fa96ef3d9419c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367993, "uuid": "7f52142d-bc41-4ecf-b4b4-892161e541c7", "comment": "Malware payload (Mirai)", "value": "0de96039a3e7f2c81e0f8a9878fa5fbd8bfa73c8373fd459a98a97d21153f529468c3b9b1517985626e954cab7cc2890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367993, "uuid": "b4bdfb2b-20bf-4361-82fb-a217100097b2", "value": "T1EC0429C7F800DEBEF80EF33A48570509B130B7A648524B773257797AED3A1951927E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367993, "uuid": "793f2514-034c-4d08-87f7-85c8d41f3c63", "value": "3072:q/4xrjUOTkoPA9Ps+Nrzy0sljwrqy2tBzUelDERrKQEa5cmGz8VTjbiaL+snCxzm:o4xrQmkqIPhOy2TzUelD6rVvGzSL+smy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367993, "uuid": "fd285fcb-b2b2-4f1f-9020-99aa830771d5", "value": 184640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367993, "uuid": "8ac179f7-a88e-4011-a9da-f03b2099ea62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367993, "uuid": "9e2d622d-da65-41dc-bf40-dcb88e82dd80", "value": "c52d1f6d9942c0037b9d54211aeb4a92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ee74c7-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711383846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383846, "uuid": "a0036008-4ca6-4aa9-8433-8050ab445fce", "comment": "Malware payload (GuLoader)", "value": "5abfcbce1f90501808379e179feb51c8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383846, "uuid": "732cc832-1101-495b-86c5-023c56c7941f", "comment": "Malware payload (GuLoader)", "value": "7698fb4c720a5c5810a8b80ae25ef1e6f5185e49cb151ef21937f0788276354e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383846, "uuid": "c47c9eb2-4a5d-41a2-9328-b3199d4868fd", "comment": "Malware payload (GuLoader)", "value": "e305ee8202f579517fe0634e22346584aaf4c148", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383846, "uuid": "2724450c-9999-43dd-8e5c-319ceeae616f", "comment": "Malware payload (GuLoader)", "value": "7c395636474bc2ae2059de9b7cb8bef50ec12e077e13c67579a44f2c48bd3b0de4d84cfae112aac6acd20d6c29719a15", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383846, "uuid": "e2b2c5db-6704-400a-930b-78b060afc35b", "value": "T15404B3D3DAC526688A8A5AB7DE134B734DB5405C33131F7893BED25DA043A4886BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383846, "uuid": "d1b32497-7193-4a43-8bc2-490073202aa8", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyC:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383846, "uuid": "048bb7ed-d4e7-4a7a-bf01-e62642d4a6df", "value": 185643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383846, "uuid": "7c9a0d4f-7034-4c49-a60f-1cd5c6c3f126", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383846, "uuid": "18458012-c7b3-4eb5-a3be-0caabcf16f8b", "value": "\u898b\u7a4d\u4f9d\u983c\u5148_(OU)_OSAKA-2024100044-05JP\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b79d8c-ea40-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1711327420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327420, "uuid": "7e051139-4b6b-41d5-96ed-e5b5152fada3", "comment": "Malware payload (Amadey)", "value": "8b176c80a6ff69b7beb12254dfaac8ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327420, "uuid": "a6ffc5e8-897c-419c-9c2f-a9da5b8e7fad", "comment": "Malware payload (Amadey)", "value": "773070e1373913ea1709dde27c293ceca45fa966a83cba6a0483954b94253f78", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327420, "uuid": "597fd7ac-deb2-404c-a310-26c2ab1cce55", "comment": "Malware payload (Amadey)", "value": "a51457eb62364526addd00b610cb1e16c7d3918d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327420, "uuid": "504119cc-d422-4081-9ec9-4ddfc3634397", "comment": "Malware payload (Amadey)", "value": "e60ab30b705b67745c513d5ef06bec090643eec729a9870637c77c49ede5cb01f37127b296b2f8eb12a58adfad538822", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327420, "uuid": "7beaf83f-8f93-40a6-9c0e-a76cea2e5258", "value": "T10F9533A67BFABF96CC6E50782CC3FC087F39D144B913ED16A9D8C1A707667234426588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327420, "uuid": "466fe27c-76b0-4dcb-b42c-f696b49db43f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327420, "uuid": "709869dd-0869-4843-8384-dc351598006c", "value": "49152:2Tqur9h3ToEg0fCmS2tmjTNvlHSbF6X88nDQz90b5OrPsxQTrnaG:233ToEg0fFmjBvxSu88DQ90b5ODs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711327420, "uuid": "e3c448ad-c513-44d0-bd5b-fec72ed80a26", "value": 1948160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711327420, "uuid": "bf1fcebf-d430-413c-8f46-507372b9a37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327420, "uuid": "7f5dca67-dfd6-4d80-a860-da466907dc82", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1033.1898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38649292-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401936, "uuid": "5597479e-d0ed-4b2a-9dce-d91ca7244e41", "comment": "Malware payload", "value": "ca9cafd736611befc35052f102e10f84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401936, "uuid": "550a6bfa-4117-4a6e-a799-265f3147f018", "comment": "Malware payload", "value": "77e6eb1e5234d6264db9d1afa0b1a869e9c3fa1d5c6c460a839c6f5715c755bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401936, "uuid": "72b42e64-b907-4026-9136-5f8872a7d7aa", "comment": "Malware payload", "value": "794157a663faf68fc9130394cfd9f20bf22bcd65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401936, "uuid": "20354fc5-ea42-4fae-9b8a-80299a513363", "comment": "Malware payload", "value": "a1b4095c30ff2fdb42180f6d4b850911e703f7c6e6a2ab1e4528e5869311da6cd8f7339fd89a4476fb7be0f5b045e6c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401936, "uuid": "a31f0e42-5b7f-41e7-9d60-43e19a888a61", "value": "T13363027C86010566CD13F13503891F54AFB70B88ECABD8854F5B25068FB13EAB9369DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401936, "uuid": "577a9eea-6f6d-4c14-a9cf-988f544e5d3a", "value": "1536:7TCPdV05nfL9ZtKiBdV7Xf5A2p2QpKL1nGfcXUqRyb4VEWm:iPdV0NLF3jXRA20QpKL1nGUkqRycVEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401936, "uuid": "f098a008-0155-4171-ab2e-c9e1f67b03ce", "value": 66988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401936, "uuid": "dbe19dbf-b2ce-422a-8e18-4e2271988e54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401936, "uuid": "31261be9-2322-41c1-873b-4db8cf29e612", "value": "SecuriteInfo.com.Linux.Siggen.9999.20393.30808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c491b9-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711383940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383940, "uuid": "4bf3afcc-4f7f-4782-a751-ee35036dbc1a", "comment": "Malware payload (GuLoader)", "value": "434d31ae787eaa00581d957487abe814", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383940, "uuid": "b05e059a-da2d-4027-946c-90c2ab730592", "comment": "Malware payload (GuLoader)", "value": "7c50209f50ce49960450dec8780918a112576c2034ac10d70e569693434bc23a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383940, "uuid": "e5bf20a7-f2fa-429d-8a49-b694ebfa1d27", "comment": "Malware payload (GuLoader)", "value": "85abbe0d2e47a3128a9c94c77395cc33cc7a4da8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383940, "uuid": "f03dae31-f80f-4764-8280-6035f97125f8", "comment": "Malware payload (GuLoader)", "value": "d6f04e9adc02e6c146186c62e61f26c8bae2483aae8c6004c22ea332b120780fd3cd0fc62711d2751559152234fcf62b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383940, "uuid": "2ddfa910-82ad-4824-95ba-56b0baaad45e", "value": "T193F3C5E3CAC526188A896AB7ED274B734DA4409D73031F3497BDD69D908395C82BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383940, "uuid": "fb406af2-6b96-413a-b870-ef4dff629103", "value": "3072:VpK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DTIK/BXH:VpKyPeadLaz+k0zn1j7rZeqGbHfNcckI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383940, "uuid": "0199b9b9-46f8-4f9a-a818-457de6396804", "value": 171314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383940, "uuid": "31acd8b4-bd2e-46c9-9dbc-cd3e2a26c1b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383940, "uuid": "5e70faed-efa8-4341-9bbb-6b529b96067d", "value": "Factura379292.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3403d605-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373582, "uuid": "ae72d6c9-ddd2-4530-bb2e-faf7a980ab15", "comment": "Malware payload (Mirai)", "value": "6d6c267cf328f375f4bdac78d363cfff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373582, "uuid": "9359768b-d0fb-4451-a54c-f2046b7a4d5f", "comment": "Malware payload (Mirai)", "value": "7e9d111d12a1096c40eff76f07da50b8046badcfd0871818724eb480c901d250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373582, "uuid": "d57e1b0d-cd6d-4a41-986c-9b0fb5d49c36", "comment": "Malware payload (Mirai)", "value": "b3b22545102d0e904a05d1265b9fc4e574403542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373582, "uuid": "d86d808d-fef0-4e38-b0b0-febb49ede125", "comment": "Malware payload (Mirai)", "value": "79b1c1ee4367d88633b2148995fd124260c29fc5827591c10bc4f96bc584ce75a7fad7acefe1490cc4f4aba6374357b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373582, "uuid": "0beaed12-2ac5-4edc-a879-1f63873d97f0", "value": "T14963F149D5A56FE3CAAC883DB40D1A1216885AC0A45F4BD82335ED4C13B77FABC9DC58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373582, "uuid": "51931535-4fe0-434e-b244-712d6ecfc9b1", "value": "1536:CrivQvZGk5L3n4r+/49PeXKFascC38ncP/lklG75SuqMcNF:C7T4AseAascC38nWkG75qF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373582, "uuid": "bab43415-26dc-4e98-8e1f-941be788a971", "value": 67792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373582, "uuid": "3cec8aa9-67f9-440a-93bc-d2b46222211a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373582, "uuid": "5f5a9010-c553-4751-bf69-7f206d61834c", "value": "6d6c267cf328f375f4bdac78d363cfff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7bbbc6-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383961, "uuid": "d4387fd0-3e61-43b5-9fa6-6bbde7f346a4", "comment": "Malware payload (AgentTesla)", "value": "b724752855a6406ad4925cb41112aecf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383961, "uuid": "d8a7de47-271f-4ad7-afbc-2fd25c199ca5", "comment": "Malware payload (AgentTesla)", "value": "7f7230e7228c5ddd4e0536f6401123cc6eb5f3a6b1fb05abdce2d664870b590b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383961, "uuid": "5f0f9b57-3642-45fc-850e-fca7ed01ee6b", "comment": "Malware payload (AgentTesla)", "value": "7c9f7f93ffa91b8adb8d5b9d54d5273d249ab0b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383961, "uuid": "67526964-fda6-4fa4-b593-b1576f62e847", "comment": "Malware payload (AgentTesla)", "value": "0e27f180db3bc68555e1022750f324cc50a8021ede319bdbf1868ad27a4dbb913ca1ff68cdeb026933afeddca27b4c87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383961, "uuid": "3ce0d7ef-4182-4ae4-ac25-50ec6edaa50b", "value": "T108F4120532B87BA3D9BE9EF55876005143B6BD2DA172F7EA0CC251CD60E2F005A26F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383961, "uuid": "0c5bf073-2cc7-46df-bba8-562dd0783572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383961, "uuid": "a914df25-5569-48af-b622-4c1f20c999df", "value": "12288:O4CMwLEQunS2vBq4CaS3yaBE235eicOFXbOrkC73QavZ3MKPjvKsIuGllA:mEz8DaS/xbOgWJvNMZsI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383961, "uuid": "d69961f4-8587-42bc-bada-09b79d2b690d", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383961, "uuid": "8c2ada0d-4ddf-48d8-8976-8133c3cad75f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383961, "uuid": "44f907d7-7f00-45db-a83a-ac88a4061598", "value": "Statement of Accounts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fb4ed1-ea7e-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1711353969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711353969, "uuid": "cb19dcf5-96b1-4637-b74a-e6d8c00e1a3e", "comment": "Malware payload (Glupteba)", "value": "03a2b97bda83a05214b75adb54fc7617", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711353969, "uuid": "43a0c7e8-0d21-410d-bf63-d9a7050bdfd5", "comment": "Malware payload (Glupteba)", "value": "7f8662074f283378c7da08b747daf967a050fe2caa1f9f761845475ab2e8a501", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711353969, "uuid": "7baca1e8-9b00-46c9-b520-24a627652088", "comment": "Malware payload (Glupteba)", "value": "cd797ff1edc9f97fbe8f032095c27496fb48425b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711353969, "uuid": "f51a6abe-9606-4f59-9636-2020dd505000", "comment": "Malware payload (Glupteba)", "value": "70d0ff431b49468b47e957629201e509f6ac50620429a46f5c14efc44ba2ed3d97f6ce9587577087cea7c92e666acf60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711353969, "uuid": "63e98933-45e7-4253-aa9c-0d9dbf6a78f1", "value": "T12116231118FE81A5F7F71A38697097A8097FB5B3A9A0808F79B01E0F1DB5390AF61717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711353969, "uuid": "ab11d950-b3cc-428c-8c0e-37fb46944e4e", "value": "86368fa79aa670a69606c89d67200668", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711353969, "uuid": "80406c3a-7633-403c-b953-5cdd29dbf37c", "value": "98304:mzt4Cfs88ZNDRtct68jR4w1kE6V3zyaYiykupS:WOzZNVtE6GR4UN6VGaYizuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711353969, "uuid": "382faa64-889d-4242-8dc6-48d78135df81", "value": 4385672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711353969, "uuid": "fbf5f636-ddb2-44c7-bb78-4f8ddbc572f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711353969, "uuid": "c6969d92-ac94-4e93-bab5-0fae9d797e16", "value": "03a2b97bda83a05214b75adb54fc7617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d427a9-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359817, "uuid": "7c302c5e-dc2e-4bec-9e16-315cad3ebb45", "comment": "Malware payload (Gafgyt)", "value": "ab407ae94ba11102a6cb237caffdfe9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359817, "uuid": "6a205d90-76db-4dbe-9747-ad162797546c", "comment": "Malware payload (Gafgyt)", "value": "8024226804547c1acf8da768253fda56dc3204807e35d8fb1f5d67c957d0afbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359817, "uuid": "7cb4500a-af82-4624-916f-d804314cc702", "comment": "Malware payload (Gafgyt)", "value": "274167fa4cae515bcda1430c7d8e336edce15af0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359817, "uuid": "97dfb937-a507-450a-b1cc-38c901a0913c", "comment": "Malware payload (Gafgyt)", "value": "ca75ae01752b7989853924da79ad00ab8c1fd25f8440d44fd1fb8b9e11fa22df22f6e4167fcad4a19d10d3fe53dfa7c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359817, "uuid": "a5c24571-ffa4-4db8-982f-17bb2c689db6", "value": "T13DC319F9E30BC6F3C40316F2125BEAA70D21B1B7166AA985E7282D70EF734C62555F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359817, "uuid": "cfc49cef-8a6b-4a85-8873-94481af46711", "value": "3072:EWpbc37+Qp2nrkGJc/O5h1Y7rpmJC0OzQaGyPZk:E9Lyc/O5h1kmJC0OzQaGyPZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359817, "uuid": "a72adf33-054f-4c70-8dcf-4a25a09b9fec", "value": 127460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359817, "uuid": "13102221-9402-4d8f-a646-f0093350f541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359817, "uuid": "814d6595-ae37-4a84-a426-cb5cfdcf2d98", "value": "ab407ae94ba11102a6cb237caffdfe9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f45e67-ea79-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711351657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711351657, "uuid": "bcd75c72-09ad-443f-969f-215b057e4f1b", "comment": "Malware payload (AgentTesla)", "value": "7806be4f71ce1b0fc27c40974ecb5041", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711351657, "uuid": "2e8d7d21-d12f-4978-9e94-c7737b3fdf82", "comment": "Malware payload (AgentTesla)", "value": "81ace4c307c53dcb5aa5e1d7a971d373a734c747408be3a9158bb00b5b11f8a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711351657, "uuid": "fb1626b1-401e-42bf-9086-7ee9f0dd4a65", "comment": "Malware payload (AgentTesla)", "value": "bb38809901742d73eccbce01f4576aa6301d35fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711351657, "uuid": "8e3e70ca-f970-4cc2-a055-e5b1082d9f88", "comment": "Malware payload (AgentTesla)", "value": "36d284f44a94f7d33ed0d8a2c430cf05f50cf00ba72531f4b0585871adb9d59ece4eeec97bd7f7fafe86ab05a112aa95", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711351657, "uuid": "7f9a094c-5c6a-468c-a6ec-f870499b73c1", "value": "T158F4120033AC2A73EABF9AF64829006143B2F57B3035D6EB1CC265DE59E6F045B65B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711351657, "uuid": "ddfebdaa-9c98-49aa-8521-bbee2b844f0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711351657, "uuid": "9d5e85a5-f461-454f-a53e-7562fa12ce1b", "value": "12288:J4CMwhctpl1p1TvwjnPWr8Av6cRnjW3YqHaB+QczbA:clXBvwjnPWPv6UqHaoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711351657, "uuid": "2f259b47-7a58-4d31-b9ad-7a84464722fa", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711351657, "uuid": "d3d94d43-bb8d-4c21-8fd3-89b7fddba770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711351657, "uuid": "9f7bae02-aad9-422b-80f5-524110c27382", "value": "SecuriteInfo.com.Win32.PWSX-gen.23449.29887", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c302285-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711369811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369811, "uuid": "5fb8cf07-a043-4d9d-a24e-ed63e71ba7c2", "comment": "Malware payload (Formbook)", "value": "9551b36adc14b4a83679dc640abcf203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369811, "uuid": "ca0d2efb-195d-4237-b77c-56e928771e55", "comment": "Malware payload (Formbook)", "value": "82c1419745039317e766c286be49ff600cf0e98c24545a2e62fc0cf57dabc255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369811, "uuid": "ed7ce77d-cb76-4af3-a58f-52fc07f0b1a1", "comment": "Malware payload (Formbook)", "value": "741945fba64ae3d4cc7729be0a56cb75a0a5744b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369811, "uuid": "b10d16d5-cd16-4e2c-8e05-793bd9b89420", "comment": "Malware payload (Formbook)", "value": "c1e7b7557d2a24a4e5e7401bc2a4dcc55c1e663182ba8b08b516282695c6cadef8bcf9570fea8ae72a54635572b4c3df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369811, "uuid": "ae2b0881-a859-4b90-b535-59fde66794e2", "value": "T1FD04AE36E642C071F2B252B5F67D0B7B883D0D347254A4AAE3F11AE12EA44E5B53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369811, "uuid": "bfb7a000-60ab-4e7a-81b2-2468e41a32f4", "value": "3072:vyywkMnWhzmc3GX6qiqj9llXQ9MEzyhMObKXKbfNdIjzpPZOj49swN:yXSGq/qj9llXQ9O2ObxbfNd0zpPZOj4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369811, "uuid": "81227e31-4b49-4c6e-9f3b-079c8dba0494", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369811, "uuid": "7665b8aa-7924-4d8a-8260-12b84d532943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369811, "uuid": "8c90f12e-6dad-4605-a905-cffe68977fd8", "value": "82c1419745039317e766c286be49ff600cf0e98c24545a2e62fc0cf57dabc255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d8672f-ead9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711393229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393229, "uuid": "6b15cf98-6e25-4624-8b4e-b63e6e62759d", "comment": "Malware payload", "value": "5410f91807493fafa6c2dda136a324e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393229, "uuid": "983c3ab2-ae76-4040-976b-589671fd2259", "comment": "Malware payload", "value": "82f68d736231e7fc24d9746f7046e79bd92d0af7fca8066c87d458061b39bb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393229, "uuid": "2b5b34e4-bd5c-4af4-8f34-1208a2976551", "comment": "Malware payload", "value": "c5176925141652e8c417deece348527a851eb88b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393229, "uuid": "abd0f0fb-88de-40c1-a7ec-2c75ee7712d1", "comment": "Malware payload", "value": "bb9a2d0ebd0a30825891407bdd97e37be040bdc2dff9eab556f8911530b3a2f3b4965e850f1aa8d71171e9c239f3770e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393229, "uuid": "74bb6268-e081-4131-adc8-c5b26608d086", "value": "T1F2A512693E8DCC03E2A166FCDDA6D2F59174EC802C6ADA03ADE33D5F79787856C04246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393229, "uuid": "dfda1286-8bd1-4a03-aec4-0102ead1959d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393229, "uuid": "acf06a02-cf3b-4850-8222-304db5d9f7bd", "value": "49152:qI8+2Xsn5krwwxVeZbryXJzY3VbtL3+zX:qI8+Wsn5kr1BB0BtL3+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711393229, "uuid": "b254f876-42fb-4174-a832-886c3d0b05ce", "value": 2110976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711393229, "uuid": "f39193c2-261a-4657-95ac-0d573e6eff67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393229, "uuid": "deb22c48-d243-4c8a-bd57-3db766f26cda", "value": "AnomalyLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16cb5c2-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409118, "uuid": "6c47a225-8cbd-4810-ae4c-b5a7f8c37ebd", "comment": "Malware payload", "value": "712740fbab721aba6d49e7e079e32633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409118, "uuid": "cf54adf5-858f-4ac4-93dc-617d853e0d44", "comment": "Malware payload", "value": "8349b3e93fad752e593e4381d3b845c94ecb1ce029fb2323b02aa785053195f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409118, "uuid": "10a1cac0-27bf-48e1-bf5c-2fea78dbe4a4", "comment": "Malware payload", "value": "1369433576274f5a47cafe638d4abcb77a840717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409118, "uuid": "b82937b0-178e-44ce-8349-82536d9155ab", "comment": "Malware payload", "value": "9d5fe2a7f464103670cae1856c9e3f8ae04bae5f8247faec2cf815701ddd9979cf6384c40a98a034619441675c899340", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409118, "uuid": "970dfedd-4032-40c1-8745-4ba919f3d3d6", "value": "T1C733F18646248783E8AFA0B6245F2DAE0504D58F17618D57BFBC90368070FBE3F7C986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409118, "uuid": "2e8ba693-8d8f-4da9-9981-e9e12e6fa781", "value": "1536:j4evuGOmh4AmMKJl4DP/4h5sM1QsIvnouy8jd:ehAmZl4z/44M1Woutjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409118, "uuid": "8d75be17-4b6d-4c74-a61a-bafae4adfee5", "value": 51856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409118, "uuid": "da74bd24-2a34-4e3b-868a-f4655f5dae29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409118, "uuid": "391910d7-d647-406e-b0b1-3bafe3360a58", "value": "SecuriteInfo.com.Linux.Siggen.9999.20413.482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4204f6e2-ea85-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356855, "uuid": "3ac4bc63-9852-4f60-81a9-ee0b9b15cf85", "comment": "Malware payload (Mirai)", "value": "3f34325b5ed57777050d68e3561858d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356855, "uuid": "3915663c-594c-47a4-bd2b-16ad663a97bb", "comment": "Malware payload (Mirai)", "value": "84012416cb251e3149f3c47271fd88e820a896a3255726b649955dd2beab744f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356855, "uuid": "6244d674-35f0-45e0-afaa-ee38ec39af1c", "comment": "Malware payload (Mirai)", "value": "523e9d2a814eeca1bfe520a6578777304efba71e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356855, "uuid": "8efcbc01-00f0-4c7b-a86a-2e5d77d25680", "comment": "Malware payload (Mirai)", "value": "77e8bc1416802d8b5aa09849bd6e04b308d0ddf4bc6e23a2aadc7d883a004eba19a84b54736cb84c502efb5a74263dea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356855, "uuid": "a80a5b15-36a7-42a8-99b8-498e7d7920aa", "value": "T150333A21FB751E23C0D5947661F74B19BAF907DA11B4862F3DB20F8ABF116802612EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356855, "uuid": "a608888f-af95-4ff1-965b-d7dda139961e", "value": "768:GrFo1UpgT7eXz4zk6Z9bWgod0hIEj2pCO+7BMgCwAJh+lV0Uuu:YFBp47ej4zk6bW9d0hmgvAfiV00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356855, "uuid": "4d8df97c-1ca2-4e78-b3f0-003f0a2f7d04", "value": 54896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356855, "uuid": "164a316e-a098-4cb4-b297-7bae4fc21991", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356855, "uuid": "2bac9e51-15be-4656-b8a1-132101cbb4b4", "value": "3f34325b5ed57777050d68e3561858d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf3ffea-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711369812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369812, "uuid": "eaddc7fc-e31d-4c33-9229-c2d83084bb32", "comment": "Malware payload", "value": "4aa4c98215348025aec94b39cf3677d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369812, "uuid": "f841215d-a4ac-4ed3-bae4-f5332cf50485", "comment": "Malware payload", "value": "842398a7c64ad88b97bf1d2cf85bcbcc585acceb9fd1972beea2b54b69cfb0fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369812, "uuid": "6abc685f-d1a0-4f80-a8cf-074828d16139", "comment": "Malware payload", "value": "1b17f7c06b8a746bc843f13c73ec22b3089a8675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369812, "uuid": "b4a47866-395f-454a-b185-872c7640f7a4", "comment": "Malware payload", "value": "5f46f86781463c08e2bb3e6dae5edf662552d17583dfc51b02d8c1b0199a45a5a8f398b61a3729490eada65c67e10e29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369812, "uuid": "49641c4b-b907-4c53-82df-d557e20c981e", "value": "T1C0849213B9D82414FC2CA33E546B8E3A42777F7289BA542F75A8742345F37427A6312E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369812, "uuid": "6318567a-be4e-4a31-b4bf-cd229c01f538", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369812, "uuid": "8d355cfa-262b-4311-a41c-d878f2123e8f", "value": "3072:CRSasbGzCs/Rt5uG4lXXJwK/iwA6b1UGhFueMAceXVUDipkO2YpXgJ+b8CB5gto7:W5lzpDUXgbCDKMceDqZ9RTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369812, "uuid": "465caa59-b4c2-41d7-a568-99b1e53fcde3", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369812, "uuid": "b56e4783-f75c-4bcd-b9a3-6595849a3f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369812, "uuid": "082ef7cd-7874-4d02-953a-661b5fd1a28a", "value": "842398a7c64ad88b97bf1d2cf85bcbcc585acceb9fd1972beea2b54b69cfb0fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfbc880-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383957, "uuid": "dff75d1a-8ae1-4f55-8974-5f1416cfc16b", "comment": "Malware payload (AgentTesla)", "value": "023e73a33c40349e529d5484217b864c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383957, "uuid": "4458bf48-9826-4264-8fcb-9b459f2bf6e2", "comment": "Malware payload (AgentTesla)", "value": "857ae746a9d7ce6eb687f8b8a98192902a22311d50f957ca12b0744a2b37db18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383957, "uuid": "e4b6190c-4be6-4894-93ed-ee56102a8c7d", "comment": "Malware payload (AgentTesla)", "value": "5c419a6cda906ecbb7a5cfd346400f67202afee9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383957, "uuid": "8595e7d6-168c-4763-a613-30786ebf8dcf", "comment": "Malware payload (AgentTesla)", "value": "5d3e6998f69e5a3f3940bcb590f4b0417e66096f0332ea0c46807997134c66f188e0f59fd90767751ba76d9651551da6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383957, "uuid": "15f5d87c-5d02-4516-ad8b-e02f9e2252de", "value": "T11DF33BD3CAC926088A861AB7DC174B734DA4419D33271F349BBDCA8D6043A5C86BFBD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383957, "uuid": "e9613166-71c5-4a94-99a1-1a32c5eabfbb", "value": "3072:sd4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNRr8O/nGzpwh2RigSavTjbe9K0XQ:sd4yENVOY0NpVXpK68kH3DPbkhZi3eN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383957, "uuid": "715bbbcb-ccd4-4f7c-95b1-e788c30e44df", "value": 172123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383957, "uuid": "57389de8-d67a-41de-b644-2195d605979d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383957, "uuid": "8cadd656-998c-403a-9260-d6ca7f860406", "value": "Payment_Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb90bec-ea72-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711348610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711348610, "uuid": "d19ae78a-7a21-4f3c-8bef-b4bd28f78ee9", "comment": "Malware payload", "value": "f0c2bcc63376572c1ee741505e8ac11b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711348610, "uuid": "86cdd79e-592d-4cc5-ae67-f39921cab640", "comment": "Malware payload", "value": "8624e09793361dd3a022021a93a17e3b755c256e0a10928b505257bb04f4d5a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711348610, "uuid": "1867e1bf-1d0c-4bc3-bc31-c10d6d48b669", "comment": "Malware payload", "value": "fefff0f17aaa8ab5905e43a1ff47db685776bfa6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711348610, "uuid": "acf6edb9-b5fe-486d-95d1-b38f79649d49", "comment": "Malware payload", "value": "a21d746dc71bc8e77abe890fad6ebcc93cd4f6a8887e4127dc1b298212892ec68f9b93e865fac14f66ee2c8e50722062", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711348610, "uuid": "510f4cfe-cf72-494a-8106-9c6f827f9a6e", "value": "T120958E1177D0CC75E2B22631857DE37CA5BAFA704B7646CB15A10ABD2E3C982953833B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711348610, "uuid": "cfcc07f5-b7f9-4f64-a83f-d17e46b2a529", "value": "9c8b5496fad96a46f235eafa943f7b45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711348610, "uuid": "6a2b5898-ac56-4c48-b4ab-25d1f8cb1547", "value": "49152:GFRbq3P4BanfH1LkuvhgQd8dsXnDjHxKoZX9uNf5/gIHYtQTS30:Aq/4BanfJk2WQ2dsXnDTxSNR/gIHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711348610, "uuid": "99bece8e-e04e-472a-bf6f-778ac222de89", "value": 2042584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711348610, "uuid": "342b5e08-9d3c-4496-b644-a37f28bb5489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711348610, "uuid": "72ad6d0e-246b-40fe-ada1-28bbb3af8744", "value": "TPSvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dddba6e-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711369840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369840, "uuid": "9ef31f45-7994-407a-9755-e31a501d8402", "comment": "Malware payload (GuLoader)", "value": "63431a90363414f88d575f70f27762ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369840, "uuid": "b22a8b2b-07e3-4baa-b8fd-7a46aed936c9", "comment": "Malware payload (GuLoader)", "value": "865306d0b13516f7f33fbd707d0d92c8706e4bfb1a99153c1361559f710bd45e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369840, "uuid": "2d6dc78e-ea8e-4a32-8b7d-8a9918203003", "comment": "Malware payload (GuLoader)", "value": "fd0268e6b54a60f2c04a577b1f0001a4176138c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369840, "uuid": "9b951ade-3f43-4a7a-9981-0e04a5aaa390", "comment": "Malware payload (GuLoader)", "value": "1935aeaa659d75e016758c3b319ca7c42b17a3bf181b6048053650d1e26d2c1de2ad7d0fed42d1af6979fd6a4748c8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369840, "uuid": "954e15b7-96e6-45ff-bc88-d1d5c2af72a5", "value": "T1E0B4E07EBD43CC44CA5A09B2A1B5E67699E87E525F9C9107F3C61EDB7B62C0C710A032", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369840, "uuid": "15ff22bc-9b2e-4e66-b278-2d27106397f5", "value": "93dfc16ed07ebeb5b405221f10d12c0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369840, "uuid": "3163353d-7dc3-4e31-a663-c871eaf91aa1", "value": "12288:oS2dnErpbwb05qldvfvcf7Ac4kj3WdmrJheUuuUjvQ9B:L2dE1b405qldncMc4kjWSJUuUjvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369840, "uuid": "88ad059e-1d48-45c5-bbf4-68f7f7b01779", "value": 538739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369840, "uuid": "a0e71375-771e-4466-994e-4878188c5619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369840, "uuid": "5be35429-4d29-4ef9-bd25-bccfb3d4f46e", "value": "Shipment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2784860c-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711367977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367977, "uuid": "01ca66ef-d35b-414d-bc1a-9458631d4929", "comment": "Malware payload (Mirai)", "value": "ea75ec7729fb129386d6bf4fb6739771", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367977, "uuid": "0742d67a-dd15-478b-b93f-5ffa12d491d8", "comment": "Malware payload (Mirai)", "value": "8659ffddbf25bb5cf821a0b2a045f29f9345c410525d316528ab74d1f22d0835", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367977, "uuid": "76d41a96-11df-4367-8568-93a017e76e5a", "comment": "Malware payload (Mirai)", "value": "b892f9dfe00422a1dffbd126d7ee7cfa561fa859", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367977, "uuid": "0b1d9a05-5393-4671-813f-bba1543e7890", "comment": "Malware payload (Mirai)", "value": "ea50361d63e938befe202c2afec5fa6a9340805acffd286cf42acebe904dfc0d84ccce9b5c147787a7d278dfd0e5391c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367977, "uuid": "c9997742-5f93-4553-a180-a6fdd06cfed1", "value": "T1CE5302261DE1A454C89104B754BDC591F9CF2FE87A77B3032D10929AB2E17F216E31DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367977, "uuid": "79c6a91c-f92e-4ccb-a859-3ef202040413", "value": "1536:7owJB+YZ3Cr+GmolR9zH39S0nRekWeH4ogUlJOMV:7XJ4YZSrXmER5X9SsfWXAlJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367977, "uuid": "22d2ed13-3222-4ce7-9365-d70ed7351e21", "value": 65168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367977, "uuid": "f83ea2f1-70ba-4464-9400-2dcc122683e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367977, "uuid": "26284e7e-bfa2-44f2-921d-e98ba2f4db01", "value": "ea75ec7729fb129386d6bf4fb6739771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7309926b-eaa5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711370681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370681, "uuid": "e8c461b6-9a5b-4cb3-b540-c94189cad371", "comment": "Malware payload", "value": "5f7d5463c0dd8996b6f2d709c4586453", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370681, "uuid": "f1648d42-ef91-4c2a-b2c1-9e1a773c8e97", "comment": "Malware payload", "value": "86ef49fc68ab98fc500c6fbaab3e8ce2fb8987b3fd046849c14cb56d71d03ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370681, "uuid": "d32b9b56-dab3-41ec-8c66-0c00d29091d5", "comment": "Malware payload", "value": "e638a2efbbcafbec704178a5a92a77b787d45002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370681, "uuid": "16a74b14-11d3-455e-aa4e-f2c94a3b1fcc", "comment": "Malware payload", "value": "3728b54f380b7a30b16f8db92f1b11df67d75647c2c8a4870976a11ca996f1c12dc567fd1853e35294ad408330844842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370681, "uuid": "7b51c09c-d6d2-4960-9385-4ee872724d26", "value": "T13E436B474001D06EED90013106E7CA89D3F71A38934697A7EFB10A16EEB19FAF831998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370681, "uuid": "ca22b9b7-e054-43fa-a831-8524bb4693fd", "value": "96:7DVrtKOqtHAusyaG0hTjsdEJoI0UCb9SQhL2iIacK56bi2OLMBK:7prt2JAustGsTjyooJppSQsDaM/OyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370681, "uuid": "8b8f7f68-346c-47df-be6b-803915efc66b", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370681, "uuid": "9a38d76e-c9ce-4f81-b70b-cc3a278e2460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370681, "uuid": "f537c0b0-3134-45cb-9387-538d014d23ef", "value": "bXqFYUkX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c13cf8c-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401942, "uuid": "97d36ef2-fac4-4d45-b1d7-7fd700cffda7", "comment": "Malware payload", "value": "3672a81eab6f275ee4c1c295095d72a2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401942, "uuid": "ee4dc698-21bd-48c5-a90b-6e7f172ebf80", "comment": "Malware payload", "value": "887108d44324470a539b12365948acbe3efa68c042b2ff0abf6d1bc56b350a59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401942, "uuid": "f946d83c-29c1-43dc-8aca-96f4513a1296", "comment": "Malware payload", "value": "b446e0ec702147e7abb3072e4b8bb96c48f8ad3c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401942, "uuid": "3d9dc542-e866-4717-88e4-50bb09dcdde7", "comment": "Malware payload", "value": "2c0c1c7ce7d6f017df2f2455043f2133b00b10211d0220979d96e21cfa92a3c6fddc5aec3d684b4b53b85e503c3564a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401942, "uuid": "635e41b1-17d3-4db9-8d0d-05482c511ea6", "value": "T171050151669B91F6C09F03316976CA1EE7747572CAA4CCABB7C426499C333E42E2D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401942, "uuid": "61879b3d-8a57-4b9f-bcbd-0da63152dd64", "value": "0a63182905d4cb67d3f1698721e3b052", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401942, "uuid": "187bd45f-1e69-48ef-adc1-402b6204bcd9", "value": "24576:eMNvnutxQoksa1t0fQqcdfmGbck5WpOknFby:eMB0xZksaKcdf9bfWJRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401942, "uuid": "beacdd66-4d7d-4592-815a-7fb95b9d73c1", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401942, "uuid": "b172a360-ba07-4f39-8990-6737f76d5060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401942, "uuid": "74988452-62ff-41c9-84d2-9bb731d19c59", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23053.5025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727c27a6-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711369821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369821, "uuid": "f0b15f77-d93c-406b-ad3b-9414b0996670", "comment": "Malware payload (RemcosRAT)", "value": "e652224389478e9294591e8bf638f9a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369821, "uuid": "ca6a5458-2a95-4ec3-b87d-a812cea33726", "comment": "Malware payload (RemcosRAT)", "value": "88c21447120abe15f0da3d0ce1dfa63e1c5e4ef52415ed177728cd229507eb83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369821, "uuid": "4c586669-3468-44d1-bb32-51318110f861", "comment": "Malware payload (RemcosRAT)", "value": "33126d714dbcba65b9006472be89092cb54fa826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369821, "uuid": "ff5ea79d-7486-4635-bc51-de9f37302eb3", "comment": "Malware payload (RemcosRAT)", "value": "d6d07f67b09fa043b5cc6f6c91e5d9da80e114b1cb3624ed65019f859e2ab557a3097310e5b907b65b3237bb22149307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369821, "uuid": "0cc3e8fa-f0d3-4c6f-a888-7a57f34d2529", "value": "T1D5459E12B1604B36C6A211B75C096FDA4627BE312E3835065AD3394FCE313BEE79635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369821, "uuid": "722bbf6d-e245-408c-b335-6b2eb0890785", "value": "f619e9ae0cbb486932cfe13194b1d423", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369821, "uuid": "14c5059f-5d99-4f96-bfeb-26972261066b", "value": "24576:LI7PgJ/Of9JIIB1jf2kH2E4NGGtPlq09Vb2aBPqK5WDpiCEKfF2V2CKKKKKKKKK5:LdJPK2kH2h3t0qVb2aBPqK5WDpifAlC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369821, "uuid": "3b454fe4-c029-4416-bb8e-db9b5739c721", "value": 1251840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369821, "uuid": "98257d7b-a43c-4e56-acdb-c0e4d90fd54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369821, "uuid": "c93ef5c9-8249-4534-ba9b-77da669579cd", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f35c99-eaaf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711374875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374875, "uuid": "ce3d7791-03a6-436a-813f-70d439f7fdeb", "comment": "Malware payload", "value": "fc829b9eefb5d0c650dba41f3824e8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374875, "uuid": "d347e721-60eb-4c9d-aee5-86cb7649481e", "comment": "Malware payload", "value": "8beb3bda63e9a969e510c441cd600062a0d4b64414450c95e30fa139ec70b790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374875, "uuid": "6f4db579-f219-4837-9cbc-e5e9a39c4887", "comment": "Malware payload", "value": "dc5503af3ef023d1d045ded3f21f5d5b48d52cf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374875, "uuid": "f80e3f95-f8f2-4457-a40c-5b6dc6e84868", "comment": "Malware payload", "value": "67887e30d16a41a015bd0fe7ef9edd65be3e36cb93b5c153b9b19d9a3971589ec13781e5453ab3a45276993861e117e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374875, "uuid": "e24574e5-fdb6-43c5-9aac-5d7c6dbe14c9", "value": "T1CA473343F9A39EECE1AEC07542666272F632BC6C4520AB7B47D087313F597101ACDB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374875, "uuid": "e050767f-e2a3-44c3-803c-2f3d3011f67e", "value": "1307ded3508f6060d6b8a1b2224237d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374875, "uuid": "30f1bccf-b370-48d9-8af2-0118a72fb363", "value": "393216:K3J8pXAqs0wnLdHvz+frm+x+05kVHHZndDVQG9PZMlbweBpbvTMP4XTHQ:Kp10GJLGrmWkVZndPZQnvYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711374875, "uuid": "88562b13-97b5-49ce-bac4-74e17e48ad17", "value": 26443776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711374875, "uuid": "a4c947e3-fbb5-4628-bdc9-f799c3da9685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374875, "uuid": "60b1c041-b896-4749-806a-d0f35c6b6856", "value": "FirefoxUpdate.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970a9ef5-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384056, "uuid": "0438aa98-9166-4331-9e49-a458f4f6103d", "comment": "Malware payload (AgentTesla)", "value": "66e196c15ec46d1e7526b1c48da1b72a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384056, "uuid": "96328d91-4f8d-4262-b0eb-27cfc715a634", "comment": "Malware payload (AgentTesla)", "value": "8c5c6b99a06119e1064bfcf3f53cc66150751c0969dc37dc3603eef5535a8af9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384056, "uuid": "ac06fe81-8350-4d00-9968-e11ac373204b", "comment": "Malware payload (AgentTesla)", "value": "f9b2dc950a21c296aaf57a013c3f4e93f8ebbad2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384056, "uuid": "eae6803b-e814-4826-bc15-8ad7aa3c15d2", "comment": "Malware payload (AgentTesla)", "value": "c4aff0274882eba2f5c05f6b858165551fe875188363bf5425a697f4efe82493cfdbbcf44873862cc5b06d9d85d47d40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384056, "uuid": "4d2068cd-8838-4013-a43f-2945f7d4f462", "value": "T1AAD423ADFA5D0F35D59ECB35764256E0743297138BDAC72BE42F00235E022812AE7F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384056, "uuid": "ff1ddf81-fba5-451c-908e-a4041a3c863d", "value": "12288:yRfHhxVzsP5wzyNwv5gs3MjeNPq0wKrCHrT3GQzRVPUYvV3L2dXEg:yXxU5wzaktc4PEWCHfGQzbPfvFydXEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384056, "uuid": "b5c38d1a-c9d0-43e2-92e3-8a4ce411042f", "value": 625236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384056, "uuid": "087a7740-deb6-45f4-b6c1-a35c4c8ebe19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384056, "uuid": "ac117715-d853-447c-81dc-58b4f24b7b50", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cc9da7-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359811, "uuid": "86c67f24-28a5-43f0-9ba2-d59ddf025bb7", "comment": "Malware payload (Gafgyt)", "value": "40056bad0beb6f3bc6becc6bcd838389", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359811, "uuid": "f0b595de-bcd0-4729-b12a-f699b4dcafca", "comment": "Malware payload (Gafgyt)", "value": "8cab98d426860fdb38a77e074bf3a313aa6fca0422077a00cf9668d8a7120e6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359811, "uuid": "b700706b-e94a-4ad1-a3cb-0f6d104c3908", "comment": "Malware payload (Gafgyt)", "value": "03ace24db47826f4c0bce62b2fb0fb42d1f19530", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359811, "uuid": "2477e6e8-00c8-486f-80b5-be8703ef00dd", "comment": "Malware payload (Gafgyt)", "value": "806873abb72a6e33fd6e1ff3d4a48b9d5c374510e60d53b0c7fde86214d8fb6da305cacef9963d4969aab964f672bc9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359811, "uuid": "ac6e0d5c-a72d-4adf-8fd9-8dbe3875e66f", "value": "T182E31814F801476BC2D323F6A65D879D3F3517E623DB33115A38ADB02FC2B992D299A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359811, "uuid": "ff06f117-0ef4-448a-bfbb-af4ddc4cf33f", "value": "3072:Oh8pDxLxO0PXW8/2lMq9B5hBke+84+mzZQQAhtRq6AAe:lm8/2l9B5hBkeW+mzZQQAhtRq6AAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359811, "uuid": "f90c46ef-1248-49f0-941b-037c8fc4f90e", "value": 156077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359811, "uuid": "8067b1bc-610a-4a46-849d-4944cf4a544a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359811, "uuid": "a62b2a38-1f21-44e3-ac97-3383549930bd", "value": "40056bad0beb6f3bc6becc6bcd838389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1464ac0-eaae-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711374758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374758, "uuid": "abf2b7e2-8d23-4e37-8160-a9bd8b2b72a9", "comment": "Malware payload (RedLineStealer)", "value": "27fbd137a423484ad08a92248ccc5849", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374758, "uuid": "509a65b8-6b7e-439e-bd60-c7511877f7a6", "comment": "Malware payload (RedLineStealer)", "value": "8d762b7f886c8d024c39b5c9eee3f09d1d355d6c99073f2676ccba2c536e37b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374758, "uuid": "628bcb88-3321-4b92-9fb0-51425705958a", "comment": "Malware payload (RedLineStealer)", "value": "7ebafc1773af1a58b1b155857a8560e443010807", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711374758, "uuid": "1a5b5035-29e7-4270-b17c-a3ce15c64771", "comment": "Malware payload (RedLineStealer)", "value": "50a1d42ef296e58c4380407eb3cd8869f8dedd054cc7c91b1048f8c60bd86df09c7d238d9bd68e28cf182f851973650b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374758, "uuid": "58e08684-8eeb-4982-aebb-e5665aef1dd9", "value": "T18C7412727B1F5AE5E554B736A846530807E5E388998BDD37B88C32AF5C237CAC4D0B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374758, "uuid": "47b1cf10-dff7-40ed-af78-ee784aa3ab70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374758, "uuid": "922e3508-4a6d-47ee-b1bb-e9285734a7e6", "value": "6144:hEOAwgZLrjLJQcXSye06NLrUTdXNLBg6Y7FVxGaH:mOWZLrZQcXSyIlrUbq6YZbGaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711374758, "uuid": "d0af09bd-5efb-40ab-8ddf-fbb27f324e6d", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711374758, "uuid": "909cc346-de7c-47a5-8ba4-1a92f185e514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711374758, "uuid": "3450f8c1-5401-4e86-b951-05923d068d24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2760b51e-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368407, "uuid": "9c4f0525-fb67-4671-ae59-6484f381809a", "comment": "Malware payload (Mirai)", "value": "7471fb6f5033dd62ea4f3284f9ce0eb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368407, "uuid": "b43c6a90-661e-42bd-ac11-ad3968a02b2b", "comment": "Malware payload (Mirai)", "value": "8e3594454af3c4a862347ca7baee51d936f8eda31e0ff9937f76534a5eb5796d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368407, "uuid": "0da28a35-ddfa-40e0-9a57-994aefee3fc4", "comment": "Malware payload (Mirai)", "value": "a3d8fe0f007228045b77e31fea0c76c38b3d172c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368407, "uuid": "fff88cb4-7df5-4313-9947-f69eff745ada", "comment": "Malware payload (Mirai)", "value": "a8252fa2b01782aa7941788ab41c7f26d690259240ba1745c7896c54f3da2b0b7fd34f15f238d1ec2f23cde9f601262b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368407, "uuid": "eb90dbdb-41a2-4a9b-9213-0c02a9b6884a", "value": "T1C0219BAA67D39D17CC940337DCAF6714F322AE84899EF513E35116250D2F20A1F22159", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368407, "uuid": "9e45bbb1-8143-4cc2-8f19-d34e69c99aff", "value": "24:J6KFpV0gP9qD0at6EocGArUlFSy4PzLCkIddgH9Ik8nSNfm:J6KjFqDPtDrkFSy4PzLT9IkgSNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368407, "uuid": "aeedcbac-5dca-4376-af63-42d69daf97da", "value": 1152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368407, "uuid": "551a1387-7860-403e-a251-d34fa4814c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368407, "uuid": "8c4199d3-48f3-4d97-8b9a-4e6c6f14595e", "value": "7471fb6f5033dd62ea4f3284f9ce0eb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c93359d-ea4a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711331640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711331640, "uuid": "48059c4b-2e41-49a8-87dd-4097aab11236", "comment": "Malware payload", "value": "7c6b12242714098a69ff0bb162daabc2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711331640, "uuid": "05dbfc29-8617-4321-9954-b65b34d392ec", "comment": "Malware payload", "value": "8ec38a3020547c68f8dc598b6277523a4df817bfdd3e3ff7bea846053f4ab4d3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711331640, "uuid": "8ec1b7ff-053f-4582-9dac-aab80d808ec3", "comment": "Malware payload", "value": "221ec09ea9bee9bcce2c51ff7444f47caf3f2994", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711331640, "uuid": "302125dc-0d55-4ea0-9665-6bd92f10f586", "comment": "Malware payload", "value": "e0e353cb9e38a50064a43469b623cb225ee5c85279b14d599c2645a7b596e7afe1f47badc4136622fa6ed4d37383ac11", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711331640, "uuid": "d6e98f4b-6c75-41db-88bb-d34be3d5a628", "value": "T1D0E51203F96295ABD5FAD3361A712129613A4C14038BA361391C3BFF67BF4D91F86AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711331640, "uuid": "f1cd168d-a8a3-4575-a62f-3822d529853e", "value": "98304:hXxbAnClPTg9tBEWbflAlPOshxiO2OWj7DLj+w:JSClLg9tS8A56OJQ7DLj+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711331640, "uuid": "35637d84-6f4e-4c25-b48b-b094a1fbbeae", "value": 3226551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711331640, "uuid": "5d0b9d78-1d93-430b-8763-5bff023ecd03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711331640, "uuid": "0f1d9e4c-073e-41a6-811e-49259a4c068e", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d15949c-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390857, "uuid": "59406ca4-3c49-41ca-bde7-e14b8faa96f1", "comment": "Malware payload (Mirai)", "value": "13939140da0cbe4b2326df24484fbc42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390857, "uuid": "70fa96c2-35d2-4e81-98a1-2b11609bd173", "comment": "Malware payload (Mirai)", "value": "9108d21d77fdf8a9a37675d69aca6cedcbc63c296318071a666687ffab5f40a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390857, "uuid": "7f831666-632d-4ef6-b7b5-fcf272ce3155", "comment": "Malware payload (Mirai)", "value": "b2e46fe0639a5ba6cbc602d9809f58683631268b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390857, "uuid": "76d3a21c-6338-4ead-b320-0a076b746189", "comment": "Malware payload (Mirai)", "value": "6628938cb6a0928b33355323411a102553679fd9dbabb0c6019bb63dfe77bc429fcb782f92cd7acc2bc01d7dd8da9ddb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390857, "uuid": "fcdc5def-ea19-48a2-ac2a-78edc8c92a27", "value": "T12B03E596B8839A6FC5E01276BB7E5B8D776533E8C2CF3723C9200714768A11F5D22E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390857, "uuid": "b307f62b-e3c0-4072-a215-29360f603088", "value": "768:nROBcSkIPv8yDoR8G5x67SFQu4PkfotojIGmgPwvl:nnIPv8yxG5xl4Mfo8Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390857, "uuid": "cf1d7351-e447-4dc6-a092-b1f0767447a5", "value": 38384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390857, "uuid": "624c3802-fcff-448c-afb3-2282f0aa0ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390857, "uuid": "0f204251-45bc-44db-9491-4e7520152ec9", "value": "13939140da0cbe4b2326df24484fbc42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f503a902-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373906, "uuid": "5b7aaded-9cc1-4995-9c9d-9368b27664f2", "comment": "Malware payload (Mirai)", "value": "0d4ee32a76477ec0b049442060c00208", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373906, "uuid": "c95e36f9-8000-4b17-8aa0-1f6914df5da6", "comment": "Malware payload (Mirai)", "value": "910c0b8bf6bab50482daac80df1a0e165a4321d0732e9be0b6def93991802414", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373906, "uuid": "ebf9f605-adc4-47c5-9fa2-6b52ebf32517", "comment": "Malware payload (Mirai)", "value": "08703acb7bcc20f2685e779df59459a39235d2c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373906, "uuid": "9b8c1a6c-ec40-406f-8289-802a77ce5845", "comment": "Malware payload (Mirai)", "value": "e09f1d2da4376c09161b5a92b95007d9e52ce1099e5bca326661b75afeaa5e3fc15824e2e46ec0488feeeb4bda626254", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373906, "uuid": "c1a506ea-52e2-4d8a-98c0-e00877b17bd8", "value": "T1AB43F1F0D662FF27F81669B9C4E15A01550F31BC91B278E0D2A5BA5CF7A64C18A8D0F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373906, "uuid": "83241d55-9f8f-47cd-a618-d722b05b8b44", "value": "1536:PEWmvuGPZm9yafjHNFVHdSZM/EPZaORdpRHbi:PEFv6tFV9Sa6ZaOXHHbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373906, "uuid": "078930c8-4d62-4a69-98cb-1d8d578d4f35", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373906, "uuid": "d4b353a3-bd0b-434b-a58d-dd344dfb89f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373906, "uuid": "520046a7-d2e4-45c7-b135-374876dff534", "value": "0d4ee32a76477ec0b049442060c00208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ba933f-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711401930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401930, "uuid": "1a5b2e34-a7d1-4370-bcd7-4bc95081929f", "comment": "Malware payload (Mirai)", "value": "e088364764232241c3fc75cafc1d91b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401930, "uuid": "b0c545d5-31a8-49d6-9e93-9b83a861e6b6", "comment": "Malware payload (Mirai)", "value": "913b15f34925ecff129a283944ec1a65010f3bc7fa255f5631189c309f83028f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401930, "uuid": "9727b4cc-a58e-4585-8b45-f6b054ec74ef", "comment": "Malware payload (Mirai)", "value": "9cdc4becb1d8482abd7fdb128c92fa056dd59750", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401930, "uuid": "080d3fcf-da9c-45a6-b964-c256a28b353f", "comment": "Malware payload (Mirai)", "value": "790c7a8359f6e00f6703a0f14dbac2ed0e358ef9372a46eb40868040c52f032c94948efde72933af5473d54310ba7961", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401930, "uuid": "3caa9d06-2f0e-4d36-8b13-e63ee1965c66", "value": "T19E41028A1F725EF9F45AD53847370B3937AE514842C08249E2ACEA006EC530E89DF7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401930, "uuid": "5318bbaa-ee14-47c6-a478-cebafcd6830d", "value": "48:Oji5E4GYg2Hzxf+1eHHu/9LuEpExn3CseBl:956WHzs7MEpEV3CPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401930, "uuid": "6f464522-846c-4de0-bc55-8a846204a038", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401930, "uuid": "81127737-6b75-4842-9e8b-d0e5764d2ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401930, "uuid": "1456e159-dd14-47ae-925c-b47ae1265d19", "value": "SecuriteInfo.com.Linux.DownLoader.598.25397.27974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a136f18-eab5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711377404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377404, "uuid": "2dbfc2f6-eaa6-4a83-80b0-ff41c361a5e6", "comment": "Malware payload", "value": "6184df6a944f01ab1024cedd54e5a7d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377404, "uuid": "588a1aa5-77a5-4402-996d-f481f3ece7ff", "comment": "Malware payload", "value": "92db8ea9ca280218a047d49fe329c10254d42f01f7c342b463faac9d7e8d7720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377404, "uuid": "0e430e09-e573-41a5-99c2-ea950bebedea", "comment": "Malware payload", "value": "b166fd8310233e12759ea826b74cdab70382d3c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377404, "uuid": "e918a8a2-a897-4680-af6b-af0e860ce3e6", "comment": "Malware payload", "value": "b757d0c77cbaae7e1ee1f3c41b211e21fc1ccf71b1466300efb9383c175b030c9a92e4d2e0dae17f50f3d0773bfea843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377404, "uuid": "d5b79158-732f-4d33-a1e0-b3ff74d5e250", "value": "T195530238816069FFDE31847611430F024CD60FD9A85F9B41396D60E2DF6163FA99BEAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377404, "uuid": "7e8958e6-5620-4d45-af04-4b19999650f2", "value": "1536:M4E3TPsG520ixkmKOsuAt/QOPPxJw0UNaWeVEWa:gzsGAmOls/nnx20saZVEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711377404, "uuid": "0c2b7247-3776-4a57-86c7-1f306b444c71", "value": 66172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711377404, "uuid": "ce5c8ecf-fe8a-4540-aa75-36bbbe413e8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377404, "uuid": "c7dd2ad7-567d-4d6b-a9c2-e4ae5f43f97c", "value": "SecuriteInfo.com.Linux.Siggen.9999.10377.16488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6ad384-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711401941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401941, "uuid": "1b4f5335-cb61-4b5e-b522-daf640f1f8c3", "comment": "Malware payload (Mirai)", "value": "c7c30a7a5c89fc925dda7c4f3ce91297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401941, "uuid": "6be99651-354a-471e-8508-6c30cec155b8", "comment": "Malware payload (Mirai)", "value": "9459bf214b6c82c64678ad590e2808f992cb1a2febbac31bda288ccffec8d3ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401941, "uuid": "89ebd4a6-5335-45d1-b4d7-6d2877763fca", "comment": "Malware payload (Mirai)", "value": "36dbf9ab43713efee6468ad9bb3cab0426f44641", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401941, "uuid": "a093a158-3e80-4281-99a3-2893f7ce692b", "comment": "Malware payload (Mirai)", "value": "82b6da569d2557ca9720e23fdcb6179263e99b231739ef492ffcd84716efe0fc0c750f3a30a1e5677e3bb9dbaeb5c631", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401941, "uuid": "7bd1e0f2-3fa5-483f-a8a3-a2b9f74e5059", "value": "T15E31DCD5A3D04DBDC8E451BEAE6B0314B3789F84E0C67523820CB7286D2AF795D26486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401941, "uuid": "aa1493c4-4aba-4513-8ab8-9f2abeb52b40", "value": "24:uAlKGpa7Urz/jlfR5XK1hUVev3gRGaJ9iVBBuLlbJ9gSO:uAlKGpa7UrLZRu/+JGBulJ9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401941, "uuid": "f4679e15-a001-42e8-b1fb-462f87c00905", "value": 1492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401941, "uuid": "04fd47d2-706e-4b71-8ffe-2a45d4b70412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401941, "uuid": "3a39baef-2969-43f0-82b7-6b33cf1fcaea", "value": "SecuriteInfo.com.Linux.DownLoader.523.13218.26205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad2122c-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401940, "uuid": "c334b78e-bbc6-4f99-b09e-d97c4f43e4bb", "comment": "Malware payload", "value": "4bd0c09f3c5d07d4f98f1319cce09590", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401940, "uuid": "3258c92c-5555-42e5-875c-3bacd3de846f", "comment": "Malware payload", "value": "955cda664b10dee6d2bb8ca36d16c3688930084e5faaa5785079bd9d6237e8ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401940, "uuid": "d9754c9c-cda0-47be-8b6f-705cfdba5b23", "comment": "Malware payload", "value": "0d8f438434fc1906e081af58986181c1204b963c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401940, "uuid": "fda23771-e32e-4afa-89e3-9e319a5687d0", "comment": "Malware payload", "value": "b567fa973fd26480378fa236d180c98f73d433eafb464e6543e77b07b4bd32d585669a9fb9facf2f6f3089745c95f686", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401940, "uuid": "8298fdff-9de4-47cb-b9bf-29be010c7b7c", "value": "T1B521B19A67D36D17CC540277DCEF5710F362AE84859EF503E32217250C3F21A1F2214A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401940, "uuid": "5db59b0d-3e43-4cdc-b426-7fd837bbf757", "value": "24:JYolMlgP9qD0at6EocGArUlFSy4PzLCkIddgCGIvn4fNfc7:JYolMOFqDPtDrkFSy4PzLmGI/4fNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401940, "uuid": "35e25056-736f-4997-bfe3-9fc9c713a659", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401940, "uuid": "7f63a513-a027-453d-8f8d-e53cd50fb85e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401940, "uuid": "d02bb0b2-f41c-4dd8-a6ba-0994017d59d5", "value": "SecuriteInfo.com.Linux.DownLoader.523.15452.16535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db7c343-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711369813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369813, "uuid": "6b35a597-c20d-4039-9e82-8bda46022814", "comment": "Malware payload (Formbook)", "value": "d12929cda63ca3f7fc4f0e4fc67a8635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369813, "uuid": "6cf4a14b-2fca-4b3f-83a5-6c1b7c01fafe", "comment": "Malware payload (Formbook)", "value": "958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369813, "uuid": "cf7c83a3-c72d-4501-b512-b54093bc67e6", "comment": "Malware payload (Formbook)", "value": "069971095c90d307343bacb403ca249dfb00c02b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369813, "uuid": "2f5e7ef8-b556-41df-a444-0147692dd095", "comment": "Malware payload (Formbook)", "value": "2251e2e71bba130808981f3b92674c84224142e0bbe30233cd5bb554067453cf3aa3e8645ae7ff06ecd519cbd8246ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369813, "uuid": "33c555da-a83e-4f4e-b470-ec5fa58357a4", "value": "T17504AF32D641C435F2B202B4B6BD1BBB483E0D353694A0AAA3F116E06EB45E5F53970F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369813, "uuid": "a9cbf97e-994d-4497-a17b-7c6157363293", "value": "3072:aPlfxikQCGvR5XR3If1+WN6W5qLicYgq/V9lOK1OEHKTAVeZsKGOSUh:jCENIthN6W5qerXd9NOgKxqJOSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369813, "uuid": "d3e96e09-dbf0-460d-8488-adc2cde4998a", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369813, "uuid": "b8cf7bfb-0387-4ac3-8d55-f508b4e51c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369813, "uuid": "c27690da-45b0-440c-a07d-6c1fee6c422a", "value": "958d107ae823cd619fa042dcbaaa97155b1cecc092863f998f2ee4dca893beed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401ae9a3-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711383910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383910, "uuid": "75b5a7ea-1637-4118-975b-22d3679e6e05", "comment": "Malware payload (Loki)", "value": "c310f16989ab3da1c9701c1cf8d31ecd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383910, "uuid": "9c5798d9-8762-4594-99be-89a6899bc46e", "comment": "Malware payload (Loki)", "value": "959ec9d9287432e3234cf35de1ad899ad4ae44d06e2bbf4fd0fe806b58ee6e21", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383910, "uuid": "90073bfc-abea-465e-8385-2f4580c8e125", "comment": "Malware payload (Loki)", "value": "b2aca8e415cfca454a889b1ad089f67c679b3df8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383910, "uuid": "20645526-69dc-4c6c-80eb-1102b66dd676", "comment": "Malware payload (Loki)", "value": "d804c4af2c4b08ed8133b0b91f9b59659ccb1342f73264eca16e85839159c953caa93632990ad44ce8cb1f7bbf7f0c65", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383910, "uuid": "e690035e-3ee3-4b41-91a7-946437ce0f0b", "value": "T10104D5D3CAC526288A955AB3DD134B734DA040AD37271F3893BDE65D6043A5C86BFBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383910, "uuid": "bc6a216e-6d88-4510-b922-2b4ab8c44f89", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyZ:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383910, "uuid": "4c467a56-8ff6-4df4-8e7b-4e40d080f14b", "value": 183967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383910, "uuid": "ffe1f723-09d1-4c8f-8181-d303beafb5f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383910, "uuid": "2f81f3f2-46dd-4764-925d-0139a70c909c", "value": "Solicitud de presupuesto Urgente 554PE\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ff9ca0-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369845, "uuid": "80a0500b-c70a-49dd-9625-8082cb11a01a", "comment": "Malware payload (AgentTesla)", "value": "fe92eb10f855272ceb138f1763b3e3fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369845, "uuid": "717e70ab-ded1-4883-bb7e-d3c531d469cc", "comment": "Malware payload (AgentTesla)", "value": "95b00f75b811e33b79725a40c2dde196dc8c95fc1591d36fee341181d2e7a167", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369845, "uuid": "24f3e935-d6c9-4a17-95ee-eeb187f6106b", "comment": "Malware payload (AgentTesla)", "value": "af35e32fa776123ed46cacebd055e108db25ba8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369845, "uuid": "a0b7171b-87b7-4645-88a2-71332b6fb368", "comment": "Malware payload (AgentTesla)", "value": "e8d603396481a1586158b14a346bb53e8b9528bf58f32c1bba5afa2c31d9a75cd9a0241f62cf1e6b01d3d0dc08a33f33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369845, "uuid": "22d537c4-020d-44ec-ab3f-2c78c6bc2fcb", "value": "T13645BE027392D03AFFBB92B35B69B2015AB97D250123852F13D82D79BE701B1673D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369845, "uuid": "15138629-314b-49d7-aade-2379b8bef820", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369845, "uuid": "d348392c-8bbd-425e-8bc0-aa58b8845430", "value": "24576:BAHnh+eWsN3skA4RV1Hom2KXcmtc14evtJ2DVEg340H2F/etI:Yh+ZkldoPKsac6QJ0Kgm/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369845, "uuid": "7ee09e08-b50c-40f2-8044-a46773611e26", "value": 1193472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369845, "uuid": "316b1bfb-cf15-4938-b9ce-0ab2898078bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369845, "uuid": "ac10bba0-e715-4115-b1d5-24aabc14c752", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9189f159-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384047, "uuid": "62a971a9-22bb-41e0-ac3c-9b57d7aa7bb1", "comment": "Malware payload (AgentTesla)", "value": "17f500de2cd71c52cdaae07f2a290c8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384047, "uuid": "c23557a4-cd9d-4bf2-b59a-89bf547f9bd7", "comment": "Malware payload (AgentTesla)", "value": "95e526a19a39942ee7073e28adddb685bb5bb41f889858c91bea644c657acb36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384047, "uuid": "ee90162e-fdd6-443c-8f16-e7165aea671e", "comment": "Malware payload (AgentTesla)", "value": "e88cfdfb4f9c30671d03fcdb2e9b85d6318bbc3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384047, "uuid": "c0483e7f-fbd5-4127-9c56-c4f85dd0d146", "comment": "Malware payload (AgentTesla)", "value": "8ef7b44a3111a4094f3767762f98e05b092dae2cb48c0cdac8a1c248f49ff3da9f0f2814bb743eee27adf141f819d387", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384047, "uuid": "a943495d-73ac-4ca0-8e24-c702242d5275", "value": "T114F41262337C6A8BDABB8BB2986544024BF3F63E6036C6ED1CC160CD58E7F411B51A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384047, "uuid": "2a5e1cc8-ab7d-4d2e-8b93-6e62a9390eaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384047, "uuid": "4a1c541e-8cf9-4982-8413-ee01c5bf7906", "value": "12288:0g4CMwp1SZUfek6vcaB5PXpPdJFyGn7xlfmE4RA36XbiiVWAmkR:LSkeklaB/1/jdlfmQQFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384047, "uuid": "11fed4bd-576a-466c-80fb-f44ce66e6f86", "value": 749064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384047, "uuid": "6bbe4733-5b1a-4806-8a16-07424ce1efb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384047, "uuid": "c7754b2c-3b9b-46ff-967e-f3dffb5484b3", "value": "Maersk Bill of Lading.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974eee73-ea4e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711333376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333376, "uuid": "baebf92c-4e84-4822-ab12-bc8ccebdfeaa", "comment": "Malware payload", "value": "fa34de0a683eaac577465805b9c608f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333376, "uuid": "81432701-5dd5-4590-ba17-64dc765d463d", "comment": "Malware payload", "value": "966a9be6f6235887c533e14093673d7a7fd857536cd243a3f1193be1ab42c99a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333376, "uuid": "0978d0e5-0a9e-49a9-920f-8fb80a190b22", "comment": "Malware payload", "value": "97e8aac39f57e1cc072ed5e1917453e659f7b375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333376, "uuid": "edc671d5-e160-4334-888d-56d930821be7", "comment": "Malware payload", "value": "ed288a1adfd90d6b5adecd1955997fcfc9d2b9866abf814bbaa9828cec2974b1e8bb21214ea1a13d4206b03c8601024b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333376, "uuid": "9b251c19-43da-4e66-94f9-1e0184b1550b", "value": "T1E1C38C53235ACE89CC96593F5901C3EE9256AF490132C3A830F8FD6BBF167475EA61E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333376, "uuid": "d32b2063-c5bf-4a4e-b4aa-6f350fb9eefc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333376, "uuid": "9879deb8-f960-4766-981f-4954285dc143", "value": "1536:VYANyhkQzNnQeKkhB30aqjS2CTQoqAcx3WkPzNnieAkhB30aqjS2CSBmVcl:VYGDENVfj31qjcjcnbNLFj31qjcSB8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711333376, "uuid": "dd854114-f5f0-44d2-bfe8-edc3a26ed26e", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711333376, "uuid": "52ad9b5d-eeb0-4f34-b63c-ae5291bf9b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333376, "uuid": "38146284-fc03-4655-b0f1-57c797c12e03", "value": "SecuriteInfo.com.Trojan.GenericKD.65442484.8526.7724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e7ae3c9-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711369814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369814, "uuid": "d9d91351-871f-4a69-a1a8-b7cefc903ae8", "comment": "Malware payload (Formbook)", "value": "e7da3b39d61565fb641804fb60beb7a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369814, "uuid": "a894259f-3606-4595-9f15-84202b1507d0", "comment": "Malware payload (Formbook)", "value": "96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369814, "uuid": "f5ea5027-7927-4f92-9c63-02807b1816b1", "comment": "Malware payload (Formbook)", "value": "f8af3b94fc7a5d3eb896cce88eb94d135c05cd40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369814, "uuid": "abab8245-0488-4933-8ae9-6afa9f82c71f", "comment": "Malware payload (Formbook)", "value": "31793b6057549ea3c730b4eb4cd98bd64888aaf34661c5ed2c6e6f5f35325745bf2066e9ff94fce2aeb15484d63ea77c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369814, "uuid": "debe0349-e1b4-414c-9d52-7f1e871c740a", "value": "T1694423514C8C522DE07DAAF11AE43652A0CE57365702AF91B8C03EEB6A753E913F335B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369814, "uuid": "6919db58-2a21-4960-9e19-233303164914", "value": "6144:dsTwoC2FJPr3v4jk1D/+R6a2KJVu71R4U7MI:dscoC27P0jKT+oTKJVk1R4U7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369814, "uuid": "96a380af-4609-4404-a1b1-ebd47e852c94", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369814, "uuid": "173ba39a-5ec5-49b4-8a1e-008a4f8f49b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369814, "uuid": "fb1702c9-02c9-454a-838b-54c32edc0fd0", "value": "96b2160da785abf50af26520f1bc1743e962f24bf983b5ddee8591bdedd0f035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c35bed-eae6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711398437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398437, "uuid": "8164cd40-8009-4571-91c1-e511c9091f1e", "comment": "Malware payload", "value": "43d0038cbeedc5a57f52f0bea45d99b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398437, "uuid": "7ba983e1-7861-4571-a004-225f1e6bc72e", "comment": "Malware payload", "value": "9732d4482e2cf4d1685ac60e8ec19a13b24de4851106917fb0c8d8c1b73920da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398437, "uuid": "994f50d8-be90-455c-bd41-774be64bd264", "comment": "Malware payload", "value": "64d98866b0e6afd1d99dfe717278dd87d94aa098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398437, "uuid": "5cd9ce2a-ec92-4047-9da3-083c9c20dfe0", "comment": "Malware payload", "value": "4cc69b5012a4ba1e24cac4b2367b26a040d3ff83c4c0dd0bead5e15f883d071cbd25cb484830637aeba05b18d01a8565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398437, "uuid": "83a827e0-2f63-4f37-8ef6-fbc7a58ff329", "value": "T17F848D4C384D6416D0D5AD71757521EEC3286DAC0AC674BBFAB092BF17EAFC107A0A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398437, "uuid": "b56c71e0-5447-4b3b-9db0-69ed42a0182a", "value": "c6d783a7f7fc84f3acf5616a958121e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398437, "uuid": "771d9320-49e6-48aa-83dd-6e99bd1d3916", "value": "6144:+naaTH28oVpMr7mHirmj+Tun3gseL//lv1tMV6l:+naaTHYVp6mGmjcuH6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711398437, "uuid": "f824018e-6624-45a8-a4e3-48d97d170e7c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711398437, "uuid": "f9c93d05-01d7-4b8d-8e78-8917169d8c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398437, "uuid": "e8a828a4-f031-422e-a98f-b3b585123db6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db9ec60-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711367961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367961, "uuid": "8d06ec18-1cb8-42f8-9398-4647114ff171", "comment": "Malware payload (Mirai)", "value": "13dcd6a9110365c7f592840ba80efe17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367961, "uuid": "3c6c86b2-5338-4211-a721-ad5f9dbab605", "comment": "Malware payload (Mirai)", "value": "98a2ad93d6b96ee38f6892faff0eb71cb927f80f82820ab03e292e0161995f66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367961, "uuid": "6b896c85-ac11-49b2-a16d-b684394f76b0", "comment": "Malware payload (Mirai)", "value": "af037d6f1e681e1204c07283d3664155bdd9525b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367961, "uuid": "800ceb48-456b-40a2-bb7c-1531220eba57", "comment": "Malware payload (Mirai)", "value": "be58bbc16a4009709dab4c302a083689a548a846daa88598769723b47fcdaadf402207a35e0071fa7c42643ee91fb91d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367961, "uuid": "a0b32d7d-bbde-4957-a6b7-f8e15e0146f9", "value": "T1C541121E2F801F33DD66CC32454B27613ACC842B606A63926334ED60BD3E605A7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367961, "uuid": "26dac968-944a-4c82-a388-5df480e383be", "value": "24:uY23H/ki9mpHHzixZuDa9mCt5UJL4mmlZ9GpeIgO/qM+UTK8mKUlu/OTPwFLCdXa:kff22nuDW3U6df9HOScTLmPkOTYFSXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367961, "uuid": "537fb55c-d324-4807-b0e4-aebea1a32b4a", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367961, "uuid": "16b2b459-4746-4b9f-9ae9-d252cdff4358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367961, "uuid": "aef8b991-cabb-4a06-9c2c-534175d3ba76", "value": "13dcd6a9110365c7f592840ba80efe17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e5a54a-ea7b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711352565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352565, "uuid": "1c6abb70-0fa7-4211-835b-5449b42bad2f", "comment": "Malware payload", "value": "87f8ee61047055bdef03cfd7126595b3", "object_relation": "md5", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352565, "uuid": "be56e096-1f12-4b83-a9c9-1a7a450df2c4", "comment": "Malware payload", "value": "997111c5541b47d7fc94d4e9ea587a19fa29225103964297b1995128607890bf", "object_relation": "sha256", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352565, "uuid": "330662df-81b2-4334-b875-a640a8008664", "comment": "Malware payload", "value": "5fd88e6931e2ac86fc34b37c41c9767f36ddc668", "object_relation": "sha1", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352565, "uuid": "1c294776-e498-45f3-9803-5ff249c4c409", "comment": "Malware payload", "value": "3ea784bcebb3f1d1544373796874373887e92cacb4eade422cdac2e9ddc01ead9ab6d5694d85bc5fb59adf7dcf812b72", "object_relation": "sha3-384", "Tag": [ { "name": "password", "colour": "#5F5042", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711352565, "uuid": "88927e24-73ac-4dfe-be4b-2535a1dc45cb", "value": "T1FF11C4407A4B36B0DE09C5B26217B7DE7E3160C9F321B4C7366C12CB9D349E08300A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711352565, "uuid": "b206a0bb-cbaf-4d81-8e8c-79f728ab1b34", "value": "24:9Oh688+CubylkK/oYEtnS2Ayrao1+Yl2tDNseoX:9O688+IkHnPv7BZfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711352565, "uuid": "0b12115a-bec2-4820-a91a-067e4a1349b6", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711352565, "uuid": "1d2fa4c4-1e22-48bf-875e-2adfcfaa7d64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711352565, "uuid": "4e97e49d-c763-438f-8b9c-792efe54ae9d", "value": "Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10649d0-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711385388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385388, "uuid": "b6a02104-bccb-468f-b0a3-84c1bc50c6be", "comment": "Malware payload (Formbook)", "value": "2f9e1385a9c419ad70bb121e4250ae0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385388, "uuid": "aa30e0bf-76fe-48f2-8f64-ab81c20bb814", "comment": "Malware payload (Formbook)", "value": "9a565700a3d3c7a802780c0e4ba717b082175fd33b5afc7dcfeb95905b6db784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385388, "uuid": "def5316a-4805-4b91-bd0c-1f7c4df07d0f", "comment": "Malware payload (Formbook)", "value": "ee2018b7427e3eccd78683018864043a72d841a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385388, "uuid": "a635ef35-d118-45ae-847f-4ea6c051a493", "comment": "Malware payload (Formbook)", "value": "c0b38b7b34ac27a809112a31d7a1a9851debd6bbdac7ad71413acb8f683f725d33b45402431591eb82c7abb42c2760a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385388, "uuid": "49ed09f2-58ca-430e-b7ff-498e7f93364f", "value": "T1A3D41242B7F86758D2A68BF60AB629411330BF1AA971EB1D2DC5B0DD1D32F02D912F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385388, "uuid": "1cc0bd61-ce6d-4eb9-b82c-554db7d1871a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385388, "uuid": "d3085445-033c-4215-beff-f6e5fb236ccc", "value": "12288:IS4CMwNNFJyvdgH7RPTwerlTuzRjynjSGqaJt2m8:IMFggH7RbweRTuzJsjSGqaJsm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385388, "uuid": "664e028b-a48e-4a91-b05e-022d690960ae", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385388, "uuid": "9c60c098-1e80-4e63-98fc-2cf19884a7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385388, "uuid": "16867244-66fa-4ba7-b1ea-4a08da473038", "value": "Confirma\u00e7\u00e3o do pedido.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355c4ee7-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711401931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401931, "uuid": "d9479121-1b81-4460-939e-985cc63be099", "comment": "Malware payload (Mirai)", "value": "4fbf92a6a378daa19e8773a0a40638f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401931, "uuid": "f11efe90-43a9-471e-867c-89a04099c10b", "comment": "Malware payload (Mirai)", "value": "9aa7bd8f43cd022fd06b1c1e7cf901a8593e4b4509a956ecb9b0cc4955187b98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401931, "uuid": "4866aa83-7f93-403e-b070-2e3ce2d4cb20", "comment": "Malware payload (Mirai)", "value": "d5370fc5d7206a695ecfd96e67dab4516d93a178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401931, "uuid": "d4ff223a-fc27-4e5f-824a-b34a40a06d46", "comment": "Malware payload (Mirai)", "value": "a538505e04e871003c60a5ebf3438ee0e98e7d26b7c200960df367544b404ac1c71a60185a5fd091177f7f0046eaf0cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401931, "uuid": "70c12afd-d8a9-4cea-8e77-a8011aaeb17e", "value": "T1CB41141A2FD01F33DD66CC36424A2B5139CC842F616A23566374ED60BD3EA05E7D38E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401931, "uuid": "21e7e8cd-62e9-4347-8990-b6dbc4d0ffcd", "value": "48:EQ22nuDS3/o6df9r+SMTLWPkeTHaFWXp:EQDnuuTf9CSoLW7THZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401931, "uuid": "8e945c5f-70c4-4355-b0d9-b4823692b22f", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401931, "uuid": "65a5a3b0-4ac6-469c-8a65-f3a64d4f120e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401931, "uuid": "a5b18f2d-fc6d-42a8-b00a-75e0bbd7c61c", "value": "SecuriteInfo.com.Linux.DownLoader.533.22023.19966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba63b90-ea75-11ee-a120-42010a9c002e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1711350107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350107, "uuid": "7eb41eae-d972-4dca-81e1-b4ca553d27a0", "comment": "Malware payload (CobaltStrike)", "value": "979639f1e47964447e34034f98c4a6df", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350107, "uuid": "2004ddf6-ed2e-4a96-94aa-39e7cc77c0c5", "comment": "Malware payload (CobaltStrike)", "value": "9b390b83e833628d68ef4120c7586896a76abe5da52f4b2417541d9f8302ab23", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350107, "uuid": "7a97ab9e-dbfc-4ade-8a29-c473eb610f3a", "comment": "Malware payload (CobaltStrike)", "value": "b541e1d39a9b00c4b55fe0ab70212561b913a564", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350107, "uuid": "84b9ca86-81a8-46d5-95bc-3e44af116497", "comment": "Malware payload (CobaltStrike)", "value": "9f4a1a17e5c931675fdfd76ae078879b16353cf2c2240e7fd9b6f604b8595a34510d48164911ce293f02cdbdb4e86b1a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350107, "uuid": "46ee7aa6-2183-4d11-aeb9-5d7c503a1c4e", "value": "T1F8C67E0AB3875DEACCC26BB4F95F23385720EC315E694A2F658D92395C531EC9D0EB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350107, "uuid": "8af2a4b2-458a-482e-af0c-3f8f2bba7b7a", "value": "2da58318282e0140ff7acb716eecf53d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350107, "uuid": "0d635dd2-79c8-4fb1-aac2-1bd61fa46cb9", "value": "98304:/iGXAhOKdRJOVx0QcBKVFUj7SSckSjmAfLLy531PEcbv:qGXAhOKdRJOtcBKVFUj7SS9xAjLy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711350107, "uuid": "095d34b0-25c3-484a-ad30-68ae937f3b1b", "value": 11906784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711350107, "uuid": "bfa644c7-9c12-4a0f-9eea-77acc863129d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350107, "uuid": "9a4f70b6-d9e0-4a59-83e7-e33b08d22e01", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f357edf-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711369816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369816, "uuid": "85a20d03-8700-4e04-8f32-e70c9236d2f5", "comment": "Malware payload (RemcosRAT)", "value": "3049c48983d277bf2acbbbecabda9f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369816, "uuid": "3ae01dea-b49a-46cd-9c7b-f7b2b881d1a4", "comment": "Malware payload (RemcosRAT)", "value": "9bcacc9d076f50eb4e78d05d5a9910cd9be476dd6c2a50f5419f60079dbb1bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369816, "uuid": "a20c3108-c7ee-48ae-adc5-2aaa036cab67", "comment": "Malware payload (RemcosRAT)", "value": "2a6fba63574a449037036287e98f35ce33b174c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369816, "uuid": "88b72c6f-9a67-4de0-8534-28613ac4cd4e", "comment": "Malware payload (RemcosRAT)", "value": "0787ebb20851326515c1ea207964f8ac8198f60b3b441d7f1d95ae951f471bb1a49af01697a304a892a1dbdcafdc1eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369816, "uuid": "b5eba037-2593-4bc6-948d-7f43f37ba8f2", "value": "T128A4AE02BAD2C072D57161344D2AE735DABDBC212835997BB3E61D5BFD30180A73A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369816, "uuid": "32f38fda-9743-4327-a716-acdbd9ece726", "value": "5d354883fe6f15fcf48045037a99fb7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369816, "uuid": "a6234408-e04a-4b51-b143-c0fdd7d2fd97", "value": "12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSDn9:uiLJbpI7I2WhQqZ7D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369816, "uuid": "c9499f1b-7bd7-4210-b0ed-00abd33c6076", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369816, "uuid": "dca90392-04ba-4684-95c9-906c71d06f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369816, "uuid": "46f62c79-895c-4032-9b91-518e4627c6a8", "value": "9bcacc9d076f50eb4e78d05d5a9910cd9be476dd6c2a50f5419f60079dbb1bb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b7bcc0-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368347, "uuid": "091133b0-e977-4622-bd3d-f7f37393b910", "comment": "Malware payload (Mirai)", "value": "f3ea3514c22015cba2f4f47f6a77d09d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368347, "uuid": "7ee12802-7ea7-46aa-9617-4ef1e2551a4b", "comment": "Malware payload (Mirai)", "value": "9d36324b2c20b177cba07b928523f530850da9ce35d79814c574bda3c510b50f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368347, "uuid": "0d4e1c4b-8602-4f2b-8be4-9b9aef180514", "comment": "Malware payload (Mirai)", "value": "c20f3fa3a65d76f2b3370eaeb1c15ada917835e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368347, "uuid": "1bb55d2a-5640-47a0-94d3-8f30681ffa33", "comment": "Malware payload (Mirai)", "value": "159c8b55ae437841d80d6a710cd3997468fc68bc8e1e3bea372598e93ca6857069855018245e39e53e0f6037c6b9478a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368347, "uuid": "40a305d9-cad8-4b43-ab0d-26e0a9acc41c", "value": "T10943F168861535C2C6750DB2E32E851722BFA4BCC27272E15171E119E9D088FBD3AE97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368347, "uuid": "19a73cd4-0ad7-433c-b18e-dd4f9d463ee3", "value": "768:UB1RN6Tgah86MAlYgdjrPkCsgZhnYPez4HO7hZCD6zMm/HywyKy2oeG2BC23bzQa:svN6786pYurn5P7hqgiwyKy2s2gkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368347, "uuid": "5215a079-031d-4395-a436-51d2390d2eef", "value": 59784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368347, "uuid": "d31efb06-be92-41db-acd9-2cca8a6591a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368347, "uuid": "0b124fcb-212a-453f-a868-dd0e5c8e61f5", "value": "f3ea3514c22015cba2f4f47f6a77d09d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0997c3f0-eaa1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368786, "uuid": "e92b4a30-3465-41fb-9382-cf06acb3d6e8", "comment": "Malware payload (Mirai)", "value": "f53e31af726d3d135963d7f74f0bd11c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368786, "uuid": "9945f282-4295-4876-8bf4-7354fd15e9d2", "comment": "Malware payload (Mirai)", "value": "9d40da7df0b84579fb9c7f1c2bf5f507e09ad3ee05f0a4e4eb64666d8c518c79", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368786, "uuid": "0c72d1a2-922d-42f1-a06b-837d10115dcc", "comment": "Malware payload (Mirai)", "value": "7eb9704f90bdf3fcf8347bb3ab422c5441f78e6b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368786, "uuid": "dc47c9bc-9dec-4193-875d-ec773afafd06", "comment": "Malware payload (Mirai)", "value": "e14deac3645f051f62939f6491e696e50f5304e789bc0fddf810a300c8f21810f5d2ea34472fd6a000840d76f4495f92", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368786, "uuid": "c61af0f9-b768-42d2-8708-2cb533ed330a", "value": "T19B5302FF5383C57ACBC4FFB5362C1725F8B2A4029235039AA28881FFDD7655969A4344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368786, "uuid": "6a548ff0-b42b-4538-ac1b-a282759bced1", "value": "1536:9bRpO3ZbTREkuKm6bz5kYgl1p3DwNwLfvisRdq:jpOpXPdfCp7p3ywLfvPRdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368786, "uuid": "530a97a2-bcfd-4db1-bdae-8176fc6156c6", "value": 62380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368786, "uuid": "520b3474-1f95-449a-811b-ba7fe90e067c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368786, "uuid": "468ad1fc-9e5e-4734-85c6-028757c10c41", "value": "f53e31af726d3d135963d7f74f0bd11c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b70200-ea4e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711333375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333375, "uuid": "4ec9113f-a7c8-4864-9f35-a2d962a460d1", "comment": "Malware payload", "value": "fc9e8599cefc09aa316843c734b7d44e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333375, "uuid": "1f8bf94c-ed62-4a56-9050-38cef6c3edf6", "comment": "Malware payload", "value": "9ea199b86d32a30b6ac06270544f90a124f7335285d37c3eefa5f735722df781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333375, "uuid": "7943dd25-2041-464c-b7e0-1f5793f3ede4", "comment": "Malware payload", "value": "39dad680f2b727dbb052d24b2dc5bef7235f2132", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333375, "uuid": "ad3f8230-e4b7-4bc3-8d34-bd028c75703d", "comment": "Malware payload", "value": "fe6ae1da01d8514918feebca8696aeeb73fc49e5fca3e6cfecef688351844e83bdf49325106afc04eba3eba7f0f44636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333375, "uuid": "f47ffd27-be56-4319-b904-976f265ff2d8", "value": "T12634E6536FDD81ECF89CE5748C95F282C2A0EEC04C1A4966A6BD7F1ED9B34180E07792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333375, "uuid": "b4de51fd-d19a-4c0c-949d-f49ba5ab1bfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333375, "uuid": "6f1292b4-9e20-44e3-a810-83cd5a245be8", "value": "768:Is8ZxGFfw7xgIHMHuEVpkWEKfbB+bBKF/8ncpROz3SeN/nB+bBKF/8nCpRpzhSP4:IrxGFY7vgk9uHWncSzSs/HWnC9FS88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711333375, "uuid": "982c8cad-b2d2-4bb3-93b7-9d8d960bbf3a", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711333375, "uuid": "7a5d6d29-a474-496c-9830-d47287b31065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333375, "uuid": "81bd2ee8-1304-4b24-b690-cd445f45586d", "value": "SecuriteInfo.com.Trojan.GenericKD.72085553.895.5559", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f9a88e-ead0-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711389013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389013, "uuid": "d9d19316-f764-4be3-8f31-24decf6095d5", "comment": "Malware payload (Stealc)", "value": "143797eba04af67ba729b2eb67f824a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389013, "uuid": "0c0ac348-6452-4655-92e9-9b8341b47f9c", "comment": "Malware payload (Stealc)", "value": "a001a71205b22e3bb39a9e586bb587b95f459c04eb1ef43d08e4420d1760b878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389013, "uuid": "384faa04-03b3-4a9a-9ef6-fdceb8b25659", "comment": "Malware payload (Stealc)", "value": "8393dcfdd57ae3ae21a79c2f5b56ecd3c06f1df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389013, "uuid": "edbd3b3a-e4df-4f38-81a5-34b085c8a5fb", "comment": "Malware payload (Stealc)", "value": "4e81f98b69f2ac70cf0504620ecf55e5dd4e1ffa7cd76efa865bd1125d6373a5f01ba95e941798237ebe86c60eb1b2a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389013, "uuid": "7ba6ce85-d33b-4f0b-8227-175028b4edcb", "value": "T16AF33B10E103502EE4E204FF6ABE5F66E59979A21365C1C7E3D06B9826F01F1ED74B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389013, "uuid": "181c9783-5cbb-4188-9226-63d87720bd1c", "value": "1ef0d6e4c3554a91026b47d9a27bf6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389013, "uuid": "6225c91a-7d6e-432d-86f3-8e9b952b9018", "value": "3072:YvtlGc6fgpJSG61doHN4N4QSUukO/yIifJMKoBJuOQP:YvLJryZoI4RvkOKSVnurP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711389013, "uuid": "1ebbf7d6-365c-426b-b644-4632652358d5", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711389013, "uuid": "2d00c1bb-55e0-4cde-8def-6616a79e6bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389013, "uuid": "c3a842d6-f884-485e-9332-da3506ef07d3", "value": "143797EBA04AF67BA729B2EB67F824A8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a682d46-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711367982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367982, "uuid": "548c76a3-d431-4633-bb4a-e870695d215b", "comment": "Malware payload", "value": "584ae70f602f1a1b7de6375979f799ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367982, "uuid": "93e5071d-3754-495a-bb95-7a00b7a84c05", "comment": "Malware payload", "value": "a024d09b5ec5fcee0fb633b1134be79553fa4858964543e078d26d1944fda8e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367982, "uuid": "607e00e6-68d1-420c-bc47-112be937e855", "comment": "Malware payload", "value": "5f277e31b9a534f1ead96614078d073091f5949a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367982, "uuid": "ddbfacf8-d9d5-4ba4-820d-7a3caf6feaef", "comment": "Malware payload", "value": "f335cb64a9f1958109afcd860fea9b98250cc4395434ae8596ca2081e03c7a7a9fe7d868e3fb93d9e3d3216103212861", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367982, "uuid": "263dd3f4-b232-4a28-a369-c80a16afd3c5", "value": "T1B6530276FB436EF0F869F5AB3F2DA9D97FE24B5A7EC0480914140D05080AB236865B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367982, "uuid": "53d10cef-e250-4b12-a9b8-424620c5dc6c", "value": "1536:TAL/i29wzfiyKBXqjVmgQwadpMPz/QEUGo4u+qgw09d:APzaBJQ9uPzx64u+qgwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367982, "uuid": "820ff71e-2490-4fc1-8944-4b0007cca127", "value": 61136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367982, "uuid": "6f1cbf0d-9b51-4d2e-9be0-885ef33c9218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367982, "uuid": "40973240-aa21-4b2b-af3d-1d3298ece0e6", "value": "584ae70f602f1a1b7de6375979f799ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ea5a51-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711369832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369832, "uuid": "fe491db7-2812-4138-8ceb-4be8d9b3308c", "comment": "Malware payload (RemcosRAT)", "value": "9364a597cf9a137519ba3d3b011d0b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369832, "uuid": "d06df8bd-64ed-47aa-9435-ca51cccf460c", "comment": "Malware payload (RemcosRAT)", "value": "a13294a6154bab3c3b03ad32b9752197ff24c1bf5ddefd4f50e01c2709f26f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369832, "uuid": "b07d1c02-f87d-458c-8bcf-96cbc849f89f", "comment": "Malware payload (RemcosRAT)", "value": "59ba8948d0f6435da4fcce19fe13c701b90a0db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369832, "uuid": "343981e3-d924-47d0-9436-d2d8de2763d3", "comment": "Malware payload (RemcosRAT)", "value": "8c0ca42d3aba75feb68753da54070ffb1036aceef976b01797e3a156d5f7d018cf4ee8f5522ee62833d169e759ecd879", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369832, "uuid": "06df728a-ec92-4e89-8c62-4afa5f32dde0", "value": "T16855BE0273D2D036FFAB92739B6AF20556BD79290133852F13982DB9B9701B1273D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369832, "uuid": "d3c49824-6260-4406-89a1-b7d017bafa2c", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369832, "uuid": "ec79e3f0-8255-445e-9cdf-a11348503735", "value": "24576:yAHnh+eWsN3skA4RV1Hom2KXMmHasYOU/lUZGH0BpvqX/4HjnK+EDRm8o5:1h+ZkldoPK8YasYpGG0yX/uK+EDo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369832, "uuid": "558e9c5e-ada6-4af2-ab38-116c5b08a2f8", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369832, "uuid": "04495ca7-1388-4703-b5ee-a4302ed77e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369832, "uuid": "9fa5152b-6bba-40b6-9f80-d75eba1d4e4d", "value": "Orden de compra 0001-0025545T.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0db8ca-ea9a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711366057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366057, "uuid": "d2b16b6a-2beb-49e2-a3a3-5ca4f1b200df", "comment": "Malware payload (RemcosRAT)", "value": "1b32b9ee5fb0b5f2f125ce554edb01d6", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366057, "uuid": "4574c9c7-d25f-495f-9e24-4075215c67c1", "comment": "Malware payload (RemcosRAT)", "value": "a290f02daf43d3eafae24dc1a79f213e666f03cca7433da5a8172ed1d76ab38d", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366057, "uuid": "b4a24379-68c2-408b-8f41-fcef80f14b0e", "comment": "Malware payload (RemcosRAT)", "value": "8254cef962e908b92561b7f22490aa9ace8c9041", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366057, "uuid": "b65e496d-f67f-4ed2-9006-17944b1b4672", "comment": "Malware payload (RemcosRAT)", "value": "5ada72c86368c8277c966b7b8930cdd094f3e1dd27c9f3a999c74dc7341a316977c519998e1e7c34b8af5193b71713ce", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366057, "uuid": "d0c02a4b-1fed-4b5e-8948-2d0fa8ee7276", "value": "T14CE4237F1D6179F1BAD9928AB1D05484383DA0835A89BC42CE3E3FE05484BB7DF066D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366057, "uuid": "dd20eab4-4716-47cb-a4c9-8f382a0990e5", "value": "12288:cZZXgKx/7W78xzlMuUndIuAyu/d5WbA1zvrI4O4izzHChNEn7ibPxJseJtI56Fxh:cZZD678EzIuAyKybAi4WzzPeN2eJtaWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366057, "uuid": "24ab3a7b-9b8f-48f2-b9e9-211026c864e8", "value": 711504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366057, "uuid": "27481ad9-9773-4640-9666-36c8118ba81c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366057, "uuid": "6a79d50b-b05d-49a3-a66b-9b1754145f2b", "value": "Statement Of Account - Overdue Payments #94839540823489.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67d9d19-ea7b-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1711352755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352755, "uuid": "2271ae25-ec38-4b05-9b82-9ed5cebb9140", "comment": "Malware payload (DBatLoader)", "value": "bef5602089e49d7df0c2544b887d1e04", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352755, "uuid": "e4c67516-5c14-4693-a9dc-248ab516826a", "comment": "Malware payload (DBatLoader)", "value": "a2c1b716d20b61bc4c57748e1ec195fbac2c5b143cf960d0ffee895160d4b0db", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352755, "uuid": "749b5c72-1bc0-43b5-9995-282a21dbf9b3", "comment": "Malware payload (DBatLoader)", "value": "cfa99519b6fa66ce8952c205361cf8e2b53b415a", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711352755, "uuid": "788a71dc-a145-4ba9-b802-061fbe47e59a", "comment": "Malware payload (DBatLoader)", "value": "39937956d62d3b9611798b103596cb3aae6d383030d3fa4a96b526d64d531824846de127f55b1392e5724f7d8266ca8a", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711352755, "uuid": "0808161f-63a6-4e60-9d7d-8c8e7e858d5b", "value": "T1D3356B3362E06839D73E79388F4A72E4156FBE38EE54490377E539780E791D1AC3A252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711352755, "uuid": "d1bf971d-4fe6-45ba-870a-191df851e482", "value": "d9e0b0a083e7f2f7198f40fb54e0f914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711352755, "uuid": "560d9431-62d7-462f-b425-b788697a31e8", "value": "24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6erPEM:+PazuAOfh4RaR6URrNpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711352755, "uuid": "541ad569-2857-464b-b267-7f0d78a9434c", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711352755, "uuid": "9d896e3d-3216-4517-95d2-deaf11459bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711352755, "uuid": "303d1d1e-cdb1-47c0-98df-2588f7094113", "value": "BBRAUN VIETNAM - RFQ-QT240422703-01 - 3-29-2024-20-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304bd4f4-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373576, "uuid": "66e0e543-0859-4f7c-bc69-f2ccc18633ca", "comment": "Malware payload (Mirai)", "value": "b2c733cf31836529ba94a9cc55bc590b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373576, "uuid": "ef08cdd4-71cc-4249-92be-0dbf37699b2c", "comment": "Malware payload (Mirai)", "value": "a308729f523a3f45d489042da4f2dbdc979f70150bc23b752ad1168ce794c6af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373576, "uuid": "0c89124e-edb9-4f46-a4e4-ad0499a3e041", "comment": "Malware payload (Mirai)", "value": "79b0d55c4cf5825dfe4eaccdf5413576f342e7c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373576, "uuid": "004c69f4-5fd7-4646-a5d5-910897813655", "comment": "Malware payload (Mirai)", "value": "bf470b0bc5b6bf20aa19ae531bbe39dacd5b8f942b3c6cbd018fd2d28699d2df3b670e4e57c124b8632601b7087f7c8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373576, "uuid": "4b89a20c-e3b0-4b77-ab42-3d741e81448e", "value": "T1730429C7F800DEBEF80EE73B44530919B130BBA615425B733257793AED3A1950967E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373576, "uuid": "2b898275-38f2-4734-a2c1-adb2358dca19", "value": "3072:NqIxIP5nwoDmpJkvWXSp2O2LgXdoKby/HOITR1yqV7lUsDB6H4VwjbihLjBsSGtY:NxIBw2uJkTNo8y/uITREqkK6HsLjBaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373576, "uuid": "d6e29138-5cc3-4ce9-a043-ab2e9a4edf69", "value": 179872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373576, "uuid": "8f5fe357-6adc-49ca-b3ac-215225f1db8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373576, "uuid": "9c920c3f-1aba-42fc-b404-d646e93e9df7", "value": "b2c733cf31836529ba94a9cc55bc590b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632d1273-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383969, "uuid": "19ff048b-53d5-4509-bb56-5ebbd3fc8179", "comment": "Malware payload (AgentTesla)", "value": "a31afb50a1464eb8ecf68411679c2f96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383969, "uuid": "60137e38-7eed-4d22-952e-43b51c37e5f9", "comment": "Malware payload (AgentTesla)", "value": "a325a9a1c6a1c0d8df497b180021ae7a5860103f8ed859956679a5a0f608afae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383969, "uuid": "c1796987-c405-4e5b-b07c-77769d4da7f6", "comment": "Malware payload (AgentTesla)", "value": "084eedf9d926bdee11413a5a7e2a42ebbd82bd4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383969, "uuid": "114953c5-2851-4531-84d0-2106f3d8340d", "comment": "Malware payload (AgentTesla)", "value": "3e3aeeeaddb12212f9dd296c5b1c8788f65cb61015588d7d832f0127405311b8d01c4b8780fa7bb733af5b2ff2cda527", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383969, "uuid": "34b1391f-8efb-4e27-bc5c-7d00e6215f96", "value": "T1A8F4220172B82E27E6BF2AF6A8B6504163F2723B5076DBDE0CC214DE61E2F515712B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383969, "uuid": "2de42fb4-1032-4417-a945-da493851327b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383969, "uuid": "e8aa0e55-efd1-4f18-9dea-b16cb7a10fff", "value": "12288:hM4CMwyrGxPJIU8P2vBKYDiWEeW6kYdN5goTwps5JsGD0sKpZMxT+dA:FSNJo+1DcePPqoT3Ds/ZMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383969, "uuid": "a0c5b316-06fb-44e7-a67f-c6909e84f320", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383969, "uuid": "790239ab-2329-49a4-bdec-58c6cf553316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383969, "uuid": "d9cc7ae3-cd5a-4add-916d-9ced847d9e55", "value": "PO No._10948058268.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36df2f38-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401933, "uuid": "9b69b98f-5efc-4800-a9aa-da2a9212f5c9", "comment": "Malware payload", "value": "b11856b2a18ece2f2a4cffbdecac05de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401933, "uuid": "bfa144c2-bc8f-44de-ae33-6755cff824d0", "comment": "Malware payload", "value": "a32e912bff92c2c482a129304633cfa55576b801868e90c0d9846fd49b2e3d4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401933, "uuid": "78203e02-d3fb-4fab-be58-d0c7d5df18f1", "comment": "Malware payload", "value": "943a8ac9122942f16365323fe7b2955c2e30dc78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401933, "uuid": "e3651ae2-263c-42b8-bc2a-48d78319ce5b", "comment": "Malware payload", "value": "06fa19ce751c8d6771366fdd9735255ce88f2c522d1343ca99ab06ea4f6255c9eb7a5a454caba82e6891db70a2c52ac9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401933, "uuid": "b4b555ba-b4f0-4b72-b1a1-35dc62b32bc4", "value": "T1808302B468677E61C6708EF4CF1E83086B83F564497FA2E74E449B943748C079B6CAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401933, "uuid": "89af9592-d2f1-419c-9fdc-77c1e31ea30b", "value": "1536:pGVhhJkUqcEJiexWbsEmIx1E03VIYByxUa4XrclkDx3IjYQZ3yQ2K1Y:poktiznx1E03VjwxV4+kDpSZbD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401933, "uuid": "c88927ae-bdcb-4fd5-9547-368aa431bced", "value": 81316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401933, "uuid": "75402c64-0bd3-4fbb-ad8a-94e367d9d510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401933, "uuid": "b2ab0f96-ce08-475f-87be-ae61195a7375", "value": "SecuriteInfo.com.Linux.Siggen.9999.30838.7947", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dfbc41-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711385228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385228, "uuid": "9f8b28e1-d713-4994-bdb2-419fbc8f2c08", "comment": "Malware payload (LummaStealer)", "value": "0f780d722c6fbe963d72061a6d8744de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385228, "uuid": "08f48bc8-17dc-4c1d-88de-c2aa986a3cb1", "comment": "Malware payload (LummaStealer)", "value": "a4371736bfd32aa3e398af167348438cfbc72b484f12fc03d4cded8f9490b2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385228, "uuid": "f814720d-0f46-4e0b-bb62-375ce1458c48", "comment": "Malware payload (LummaStealer)", "value": "e19173ce5f4adc33e7ac170fd2ee2a60d6ece4b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385228, "uuid": "c9341543-e736-42c3-9930-3e9c0844a124", "comment": "Malware payload (LummaStealer)", "value": "6c311b0b84a2b30b3b2061721e89cf92cf33d65e799cf04114e4de2b7fa65d07070a8a7531adaf1c2befa4255ef932e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385228, "uuid": "3d7bdf2b-d821-4b43-b4ff-b014825b1428", "value": "T1CB74D00235D2C4B1E5F74A314974DA94563FFC725A368BAB33982A0F3D706C05A76BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385228, "uuid": "463ff2cb-da9a-48a2-b2b4-d3f63b42e399", "value": "ff23e32a63aac9251bb507fbef91be04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385228, "uuid": "9f390fee-6bea-455a-a4a8-00bef92fc81f", "value": "6144:W9B/Zr+SEjNuq8PZsNU9BZI4Xq5bgLWbI43k:avr+SywbZrgMWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385228, "uuid": "c564504e-4476-4aac-813e-2f6cfc52e7e1", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385228, "uuid": "20584c19-a806-400d-9926-ec47c25cbd7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385228, "uuid": "4502c4c6-fb84-4e0b-bf3f-9a870ed59f3c", "value": "0f780d722c6fbe963d72061a6d8744de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd725df-ea88-11ee-a120-42010a9c002e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1711358375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358375, "uuid": "33d58a49-1dda-4f6a-9d1e-760e5962e14e", "comment": "Malware payload (RaccoonStealer)", "value": "9274692906e615dbea2ed86918165645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358375, "uuid": "7d03b562-a50c-429b-a4ae-0749cfcbf6ac", "comment": "Malware payload (RaccoonStealer)", "value": "a5303eb50bb06e06494c163c4fc31d844fcb3e37a39e0acc99ad6420439c7443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358375, "uuid": "cf89c51a-02f0-4812-9e7e-98d7c2401777", "comment": "Malware payload (RaccoonStealer)", "value": "fabc3035c3a87a2895fcf81c805f009aa46121b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358375, "uuid": "01abc701-e1b9-47df-b88d-e2a8fd91cf2e", "comment": "Malware payload (RaccoonStealer)", "value": "2fd1a6628ed133e793c2b9b1302b2f76220a9740ac23146088886f7a98b04c5b4bb523ce447ae598c671a205018b2118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358375, "uuid": "a83d6ad7-4fdd-4999-ae6d-3f0ef76f1d0f", "value": "T148173372539A5082E2FDC5388F27FEE131F60B2FC221113AE5997AC934F5AB4D602657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358375, "uuid": "753d24ba-4382-4ffb-9102-6f2cfb6348c7", "value": "781a4edf48c10028f7616ce95ddae51c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358375, "uuid": "49991f80-0c02-4415-a016-905d297434b0", "value": "393216:uKrRuZ7c9eoXQvvrXa/a6OCRlNbvDlYYLl:uQRulUAnrq/JNZtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358375, "uuid": "e7f5c42a-0550-428b-b35a-565240c3682c", "value": 18522624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358375, "uuid": "94db6530-3e7c-4a35-accf-2ba200a81d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358375, "uuid": "41a4c010-dc3c-4af3-87f2-f1f2c1bb8d80", "value": "SecuriteInfo.com.Heur.26294.11120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7783776-ea88-11ee-a120-42010a9c002e", "comment": "Malware payload (Neshta)", "timestamp": 1711358367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358367, "uuid": "b32fda9e-6f1c-4207-a3aa-4f259f31c8a7", "comment": "Malware payload (Neshta)", "value": "3a09a9bbdb1de0da060aa01676d39f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358367, "uuid": "113218ef-452f-4c01-94ef-707188d83d16", "comment": "Malware payload (Neshta)", "value": "a5c3adbc3170961645549d41320184a231c0eef43e2c5eea71f235bb4e273d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358367, "uuid": "01e66009-3acd-49ce-9716-1e10375adf9d", "comment": "Malware payload (Neshta)", "value": "89aa1e951c689e58321661bf2cfbca3ab46467fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358367, "uuid": "2c0ada1e-3260-4dc4-b108-b1abbab2f654", "comment": "Malware payload (Neshta)", "value": "05b47622cc0448e04cbc03ffdf4dd1d6e5b928e2989851671b62397e137095d79f155036e665b6af3edbbfbfc064ada5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358367, "uuid": "d930c26c-1c41-4207-8ee2-522e2d606140", "value": "T138F4130133AC1A67E67BABF18AA7044143F2D61B3162D6EA1CC394DF11F3F115A46B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358367, "uuid": "198f08c4-ef9c-4128-82d4-a7d81be84e84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358367, "uuid": "3b43ae8b-e223-492f-9301-3cf0bbfdb3f7", "value": "12288:O4CMwyM9kgU+ay+xfn4fNqWTpT4mdDC62CW1Qud3cgttUzzpajA:A+gU7zx/4DTRZ2CWCu3cp/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358367, "uuid": "a641b8ef-44f5-4594-8468-d410036dab69", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358367, "uuid": "59c8e602-ca2b-446d-b9df-38067926729c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358367, "uuid": "a0944672-94b1-4091-aab2-b7d15e8c7dc2", "value": "SecuriteInfo.com.Win32.PWSX-gen.13572.4437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca879ba-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359718, "uuid": "0fd1b7dc-aa7e-452a-afef-2cdc2cb0ffe0", "comment": "Malware payload (Mirai)", "value": "ff0a5df3b5a620d6f1b32871b064ab40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359718, "uuid": "a8bb3655-2c7d-435c-9fe3-7c13f40f3a39", "comment": "Malware payload (Mirai)", "value": "a5ee6bd2710c047277b2e311560cd6b76e6f2354c220b0a125c57bfc4e86eb44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359718, "uuid": "c2fcd427-8fb5-4e75-845d-0bd3620e2f9d", "comment": "Malware payload (Mirai)", "value": "f92f24592fb953c38c9fe249f609991816b0a3f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359718, "uuid": "e6b056bf-fdd3-4b70-8240-127a2630c388", "comment": "Malware payload (Mirai)", "value": "b3f71d9ea519150d2315a8634d04bbeaf0ca57749192b01dd3d8d4f296bd31b832ba77e6eaa8a57c812126ece46ccf18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359718, "uuid": "3fefcd9d-a131-427b-8fb0-f49014df521c", "value": "T1D9A2D015E345AEF4DFEF9D905281C3C276E986C62786C8E340EEBF017506046BB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359718, "uuid": "eae5543c-a7a4-452e-a309-0948ed66c71f", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C50DM4uVcqgw05VxJy:9RxsSVsMD6xiJJE5zRWNL4uVcqgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359718, "uuid": "63b31df4-2d49-4ebf-87e8-a4e4fbd9fdb1", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359718, "uuid": "77ca22af-0f83-4b66-a80e-aac6696f9f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359718, "uuid": "e7baddef-dd52-4f49-9701-53a0ed6a3666", "value": "ff0a5df3b5a620d6f1b32871b064ab40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a77dc5-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368342, "uuid": "c9ec3cf8-9209-46c8-96f8-b262c63cba33", "comment": "Malware payload (Mirai)", "value": "5fd2c88c667dc6a4e659e9b1393da74e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368342, "uuid": "02b32217-85ae-44d2-ad65-cd601385b0a7", "comment": "Malware payload (Mirai)", "value": "a6e7d7c35745c13cac8eb98d035933c291ecbfd44553b1145c9e11b013f51c1f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368342, "uuid": "e3651743-1a59-405a-a5a2-5942cbe0140e", "comment": "Malware payload (Mirai)", "value": "9aea7cb94586b60bbac7e1e1a84e0e7526ad4c15", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368342, "uuid": "c7ee0c16-1120-40d9-a46a-d422cff453bd", "comment": "Malware payload (Mirai)", "value": "8669cb088280f2799d2858a164e3ee8e41c951e858e440d20d2ca3bf03749b948288c4a0c930822de3292887dfcf926c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368342, "uuid": "e32bcad6-4373-47fc-af85-6eca14a4b441", "value": "T1DA53021F4278E2F1F4455039BEFE7B81F0A8DC245125E6978B4AA2BA78873121F02FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368342, "uuid": "88815b04-95d0-4e97-9b39-82414cabc203", "value": "1536:HutSWZeKsCRrhv2kpSDTPNj8Wee/GHoK8al+S5j:OtSlMhuSSvN8WdeH788p5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368342, "uuid": "38421a78-bbef-4f59-868d-a2f31ff22682", "value": 63208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368342, "uuid": "306d571e-2365-4d60-b0c1-cd71d46df8db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368342, "uuid": "3a6054aa-bfe2-455d-bd45-7d21da3dfcef", "value": "5fd2c88c667dc6a4e659e9b1393da74e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b697f04-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1711385164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385164, "uuid": "bb75786f-638c-4573-a06f-d388fc193f82", "comment": "Malware payload (RiseProStealer)", "value": "d5a654fb53d2bd2d39840e81f7725bf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385164, "uuid": "df150cc4-1822-43a5-8e92-d8a376e8b628", "comment": "Malware payload (RiseProStealer)", "value": "a84bfb4e378224cce70975bcfc0e3dd82ee09fc107d8e1f697ec99bf4e778858", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385164, "uuid": "0abbd593-0e05-429c-b884-769ac0acf8d9", "comment": "Malware payload (RiseProStealer)", "value": "49e0cceac03cf02564ae0100c0b5b98e36555f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385164, "uuid": "303bab48-ddae-404a-ba8e-4c42476799db", "comment": "Malware payload (RiseProStealer)", "value": "ec9427407091b7d98800f40f06193ee01094c4be8a4ab9e705a95d66a1425930350dd3c5514e516195e30577fc8d8d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385164, "uuid": "8e0226be-0f7b-43c7-b79b-2c2f54fa01f4", "value": "T10AF5112779E3E95ECFF2B631D805B6294BE8193FCD522132B13A1648393256CBF8B454", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385164, "uuid": "9ca59408-c7ca-4d98-baa4-c182f06ea847", "value": "a21d450c6ebc519c43c3140940327537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385164, "uuid": "c3b77754-2630-44f7-b278-fc2b7642f359", "value": "98304:FvRJedU3DGLDZUEi/pQoTFYYoPRmxxWmPH:FvIgDGHvUbTfoYOmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385164, "uuid": "3a8dd2d0-a304-47c1-a301-2e27da09c8ac", "value": 3485480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385164, "uuid": "e1749ad3-5207-4878-8392-dee9bdc2eb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385164, "uuid": "078df32e-26d2-43d1-9bf9-2d6462a535b9", "value": "d5a654fb53d2bd2d39840e81f7725bf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a8b046-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384111, "uuid": "8408819a-2276-4375-8ecc-3132759eee99", "comment": "Malware payload (AgentTesla)", "value": "91a4e682ebc54e8fd63edf2d6622b216", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384111, "uuid": "eac6bfbb-c895-4b15-9c18-c70d939625a6", "comment": "Malware payload (AgentTesla)", "value": "a87e27a64d0e52356582fb694d7466f79118ae9f2efd15884eb772fda468774b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384111, "uuid": "061a7eb4-a787-4715-994a-674c0f755fad", "comment": "Malware payload (AgentTesla)", "value": "8e69dfb01beccbb6dd7b6b3a3cd58cd750c823ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384111, "uuid": "3f271d74-7c54-4799-a19d-d99962c25184", "comment": "Malware payload (AgentTesla)", "value": "b1d17b5c672b562f446118bd50c45051c77c9ca4fa2d2efcd4890f7b43d59f19fa8892055db07f1afac5a9f416ddc4d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384111, "uuid": "c6603330-ba52-4f03-96a3-9ec5b3fa0a9a", "value": "T1F6F412013B7C1A73DABA56F54866106453B2F62FB024E3EE1CC254ED58E2F049B66F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384111, "uuid": "4a108f92-dc0a-41aa-96c4-b967fdad60ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384111, "uuid": "dba1abed-a3d3-4e79-b9f0-da4904edd7b2", "value": "12288:s4CMwRX2hu6MiFBGT/t05fUulNpGMg1VaFVvNw8GlJ2KpmjFGH8A:3ai6t051/pBxKpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384111, "uuid": "e4f4e49b-3805-4cad-bebd-fa3f95062de5", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384111, "uuid": "a8fdafbd-a782-4a85-a704-e64e9f8d25d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384111, "uuid": "d6e8e03c-602d-4f05-9fa6-ee9d589ecf62", "value": "Enelelektromarket YEN\u0130 S\u0130PAR\u0130\u015e 0191621#25032024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200a531a-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368394, "uuid": "77d0b287-0b4a-4cf4-ac34-55e95ed50b4a", "comment": "Malware payload (Mirai)", "value": "45b5a3df1262e2f0c8c325a4eb4caee0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368394, "uuid": "07ba6f8e-d5e8-49d7-bcb4-a42b5d71235c", "comment": "Malware payload (Mirai)", "value": "a8c92b3b4491108fdc6c7cf29ce1a988dce800d874b139fec4be2a0969ce1d75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368394, "uuid": "c990899d-1ab4-4833-b3de-0da2eee24cfa", "comment": "Malware payload (Mirai)", "value": "df27f4dbdd6801dc489959b4609691fa4311206a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368394, "uuid": "dbc5ee28-305d-4354-b6b1-4215f5ff3942", "comment": "Malware payload (Mirai)", "value": "6b0fbbc447d30ab36ca8fee1788fcf0de81126ad77197bd54efbad1bd8669b957afaf3be311b41c9ab92f1fce2864ce1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368394, "uuid": "a3dde934-2d7f-42c1-8932-b8e411731db8", "value": "T17733F267D368998EEB2C93FDBC2739958984900AD3B50BE2B1F4720D34E57E4452D31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368394, "uuid": "5d5146a4-23b4-44ec-ab58-97e8701c331e", "value": "1536:5a+hCx5L5iRLdeyxXFAeiynz0EjlVpnouy86U:M6CLQBdeiFAk0cV5out6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368394, "uuid": "1acc3823-32a6-4945-82da-fa04fe6d9dbb", "value": 51580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368394, "uuid": "dc0537b6-a199-4c94-80c3-a0130edb0d0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368394, "uuid": "265e0301-5c3b-440f-995c-3912e0a410bd", "value": "45b5a3df1262e2f0c8c325a4eb4caee0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231fc62b-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1711383861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383861, "uuid": "f7ccf58f-9e53-4eae-9525-35616cb80893", "comment": "Malware payload (njrat)", "value": "22589fa3fadb500aa0e5b0a5f88ec32c", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383861, "uuid": "2fcde35d-dd34-43f0-bea0-cb5bea8b545e", "comment": "Malware payload (njrat)", "value": "a8f33cbf55306f09f4181b3766fe7bcd39258c5ec33e4eaa57ab2bb581e23458", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383861, "uuid": "601c6de5-8ff6-4b5c-b779-b7c3126321d9", "comment": "Malware payload (njrat)", "value": "e4212c55062692b92231bcc42dab5f2cef89e033", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383861, "uuid": "b178037b-aa58-4a71-bb5a-9fa7241fd853", "comment": "Malware payload (njrat)", "value": "4500d342a7553fd09801a3b77356accec2615700bc0cdfe50f69df944c76a5cab32da07213a0fd78319fad265126b34f", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383861, "uuid": "5f458cf1-6683-416a-ac32-24dc8aa9a3f1", "value": "T1FAA3CF6BD77E3D8C8B4470B2B50A149D7F85CD48458788897DEBCC9DC81E02D26F6A23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383861, "uuid": "7cc865bf-7d43-4fc7-8553-9a2726c4ebdc", "value": "1536:Qhg1PQnVVVWR+H/Jn322khTrsJlI1byRqzMY8eC8lw8oQfJcNwxYNs:Qhg1PQnV/WRnVDyAMAhlrrfGw0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383861, "uuid": "c046b305-1bbe-448b-84dc-a007ff9788fe", "value": 100962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383861, "uuid": "e1f5a9a5-07c9-4acc-9f08-3e932e18e246", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383861, "uuid": "25c40f71-ac9f-48ab-a6d1-cd97b9e4162b", "value": "Offer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4235f0-ea5e-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711340420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340420, "uuid": "ac63abb8-909e-4d40-a816-05d637fcd97f", "comment": "Malware payload (RemcosRAT)", "value": "1511c1ff371af5f37e1d5470c1d5caf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340420, "uuid": "5ff43039-dd92-4268-83de-0bdd0c04ebf9", "comment": "Malware payload (RemcosRAT)", "value": "a932316f192e4a8d361857aa3555cd6597b96364e9ce1fa379e419b8dd437edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340420, "uuid": "703fde14-3a03-464f-9b25-6c641e668443", "comment": "Malware payload (RemcosRAT)", "value": "60296d0d34cf13621e5c749ef913c6fc234ee43b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340420, "uuid": "53534371-42ae-406d-946b-a76cf5c67ad6", "comment": "Malware payload (RemcosRAT)", "value": "ed2c7e6f1471194a6b335b25d30276262012b2d2a569ddce8f38b8b647d95920e3069b728bf14b254fd718b1c8599bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340420, "uuid": "04511f42-d919-4598-820c-124a1b808c97", "value": "T166356A3362F0687AE77E783C9C4A7364156FBD38EE109A0273E53D680E791D1AC36256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340420, "uuid": "8ac42451-6b1a-4c1c-96cc-1948a0e347a5", "value": "d9e0b0a083e7f2f7198f40fb54e0f914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340420, "uuid": "c20aebaf-5361-4965-90bc-a455feea2369", "value": "24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6esPEM:+PazuAOfh4RaR6URrNpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711340420, "uuid": "b624e26a-817b-4a1b-b400-9d8b5a6b9050", "value": 1071616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711340420, "uuid": "aacc3861-e9e7-436d-8164-efb57bf51d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340420, "uuid": "93f95879-5256-4e8c-9c12-d55c6c93e22d", "value": "SecuriteInfo.com.Win32.Evo-gen.9756.30202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee1bf01-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359776, "uuid": "51308f76-bcbb-4d87-b750-b48e86265bae", "comment": "Malware payload (Gafgyt)", "value": "9c29b5a0d957052c0934d1174b4ea2a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359776, "uuid": "ccd223ed-35cb-42b0-9ba9-13b1a861f794", "comment": "Malware payload (Gafgyt)", "value": "aa28b6d17857a03646708f6c8d75b69cae71fde812219d66f10234d4b0f0e0af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359776, "uuid": "9ddce0f9-7fbb-4834-8d76-c8b6a3ad576f", "comment": "Malware payload (Gafgyt)", "value": "703fe0fcb7326db7c7184aed38c89be5069dad41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359776, "uuid": "daca9fdd-184c-4d25-86f4-3578a68891a1", "comment": "Malware payload (Gafgyt)", "value": "eeb1637d98ec2c1d10b5d01163452952053a46a55feae809d21b1ef5c9c4ba5b01360430b6651b6291ddbda6b737dfd2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359776, "uuid": "cec033dc-b483-4a53-9f45-555821463da9", "value": "T142D34A37E4518F73C0836AB11C6AAD310F1595D31BAF268A267857F08B4F5CA744EFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359776, "uuid": "081ab9cc-a1a0-4fdb-a30e-2583f79e15d7", "value": "3072:B1E8x83QHjqmgjHmhQXnH5hZttT5IMmAK0qW6MyoQ6:/E8q3QeXrHXnH5hZvT5VmAK0qW6MyoQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359776, "uuid": "0e42be12-a17d-4f93-8eb1-3caf8b7e21ef", "value": 140225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359776, "uuid": "70f4e443-186b-4a6a-9b42-d83aaf7bb8a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359776, "uuid": "9ff844c2-340f-47f4-ba48-fefd325ac8fe", "value": "9c29b5a0d957052c0934d1174b4ea2a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223abae2-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711385148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385148, "uuid": "093018a0-10fe-4a33-a088-7bd63c2dba70", "comment": "Malware payload (LummaStealer)", "value": "6d6f545a51a1a03d5db37ca721bdbd4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385148, "uuid": "4887dd37-5a5b-4ec6-b67b-0bfcbaa241ee", "comment": "Malware payload (LummaStealer)", "value": "aa5033497dddf47ba4321adeb0146b9c887446e04d7975b9b429df9e86ba9c74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385148, "uuid": "1aa7c77c-cd87-4cfe-aa6f-27458358e336", "comment": "Malware payload (LummaStealer)", "value": "5255686367e5e614577f0c9f15d37156380b321f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385148, "uuid": "f97715a3-de1b-44d7-9c38-282c45da78f8", "comment": "Malware payload (LummaStealer)", "value": "cd79a3ece96ebc988c2c4ddd86adeafe282aa9e1886ee155379e4f7dfb9b66d38e84fd6527d7e605b06c97c3c0ccbeba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385148, "uuid": "842dc273-0d3c-451c-bf94-420a49631038", "value": "T19B84B003B2E1BC60F5B347328E29C5D4A63EF9618E69676733546A2F04B10E1C773B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385148, "uuid": "5a5aa7b7-b8e3-4b94-93f0-8435a98426b5", "value": "62246366230c14b496ff75f51cff62fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385148, "uuid": "acc7852f-6635-4b17-ad6d-fd17a776f8bd", "value": "6144:Hm4RDNKZfc6FFixSN4u7QsA2UPg2fvZZGZL6vBcwdZXOZkP:5JNKZU6FIxC7CjPl7GZL0KwHXOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385148, "uuid": "48d63499-bee9-4b73-9f93-025ce6f12d6c", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385148, "uuid": "faa96d31-5ec4-44cc-96b2-9b35c725af47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385148, "uuid": "2c69a4a3-f3ee-4397-988f-6cad7c80bde1", "value": "6d6f545a51a1a03d5db37ca721bdbd4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9de5fc-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383902, "uuid": "98b8dac9-3bbf-4243-9777-9da290d75b9e", "comment": "Malware payload (AgentTesla)", "value": "076cf92f619d12f0d132979802bf5700", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383902, "uuid": "bb6849df-55f3-42cd-81c8-a183292e494b", "comment": "Malware payload (AgentTesla)", "value": "aa64d8ae63a060c83638ad8a45e5a4e445a53845f4f22fe808f1828663629731", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383902, "uuid": "26acc3ec-a8ce-4990-b1e0-137ebe54869d", "comment": "Malware payload (AgentTesla)", "value": "51dea616dfa3dbff0d40078046f227e8f2dea822", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383902, "uuid": "c59c525e-6fd2-4c4d-a441-a89ddf636d24", "comment": "Malware payload (AgentTesla)", "value": "2851f815149f5eeb309fe26645e5f9fc8ed3d7afb17026a543c79dc70e3df08bfe19d2c9459e5f31a8674654d274eaeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383902, "uuid": "eb7a7a1e-5af8-48ad-b9c4-21f6e753814d", "value": "T1F535AD0273D1C036FFABA2739B6AF60556BD78254123852F13981DB9BD701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383902, "uuid": "06c0453a-51fa-40f0-9e68-e59c647fff2a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383902, "uuid": "e4dca431-2ba7-46df-ac57-a00312441575", "value": "24576:XAHnh+eWsN3skA4RV1Hom2KXMmHaHt3WOhH15:Kh+ZkldoPK8YaHlWOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383902, "uuid": "1d63c73c-41f5-456a-9b85-4e5e8860ae8c", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383902, "uuid": "241cb538-814a-40ed-b341-53f5e7fe6192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383902, "uuid": "fc5656b1-e5a4-4b59-a8f9-da41078a47d0", "value": "ESTADO DE CUENTA DHL - 695026972.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6febc2c1-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711369817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369817, "uuid": "b55b84ef-96ac-48a2-8a83-80e3618cbb67", "comment": "Malware payload (Formbook)", "value": "ca212d9f062a189528f1204eca8cce94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369817, "uuid": "cbb29959-1f69-41ef-9985-db3257761e7b", "comment": "Malware payload (Formbook)", "value": "ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369817, "uuid": "35868774-33d9-470e-b2bc-90fd69f3b15a", "comment": "Malware payload (Formbook)", "value": "f3bf213d6ba75390025f6534a539532fcccf4696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369817, "uuid": "3d088ad8-b79a-4d1b-b854-b14953b99f46", "comment": "Malware payload (Formbook)", "value": "fa7dc0129d46a19653109edd9e5fcd1f2a55b70477e81d401593862d5229f5570a9995481f5c0aa9f377623334fdd9a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369817, "uuid": "3d60bfd6-c317-4486-b407-46f84a95306f", "value": "T1FE04AF32D641C435F2B202B4B6BD1BBB483E0D353694A0AAA3F116E16EB45E5F53970F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369817, "uuid": "1ce118da-4d22-499d-810d-f20b31bbb06d", "value": "3072:PPlfxikQCGvR5XR3If1+WN6W5qLiHYgq/V9lOK1OEHKTAVeZsKGOSUh:0CENIthN6W5qe4Xd9NOgKxqJOSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369817, "uuid": "8e80a473-f9e0-483b-a6e5-3756b30350b1", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369817, "uuid": "3d6222d2-65dc-4dab-b8ec-a8f5055dce3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369817, "uuid": "e8feea07-9ee4-459f-acd3-796e0313eaa7", "value": "ad896a8982941cd8a7b4f237f775e712dc1a05cfb2d80601d45f4cc73475ecc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3081754b-eaa9-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711372287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372287, "uuid": "7199ce7e-cb4f-4269-b630-040451594cbb", "comment": "Malware payload (AgentTesla)", "value": "7c50d1c040f046fe6c3043316fd944e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372287, "uuid": "3a392c93-7892-453a-a353-5110d4aacfe3", "comment": "Malware payload (AgentTesla)", "value": "adeebc489ed24b4e3e8ca7d0db2a4fe9bfce24c7c7675d67d57712afce862a72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372287, "uuid": "c83fbedb-e265-4ecc-8ed8-4b941827fcab", "comment": "Malware payload (AgentTesla)", "value": "f552949839070e678e2951d0f4b17a3f01843f91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372287, "uuid": "f31c3d01-897a-4446-970d-42ce39fd6d64", "comment": "Malware payload (AgentTesla)", "value": "71da0e4a042acb1999dbe85bff9c0a0273fc0e0c5e5e9bdbf01f9be346472a97afd14604a603eac13aa5dbf8569c765a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372287, "uuid": "130d8ceb-28d2-4be6-8381-2c821b0753b9", "value": "T1D2E42365736D258BF76D8FB0AA7260018B32B8855C04E48D6E1D10CFA5D93C36E35BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372287, "uuid": "583420da-79c2-48a2-a7e6-69ca1bc66314", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372287, "uuid": "3fa6bcb4-52a9-4ae3-a735-9c0b9dc037de", "value": "12288:u5s3/5jUZ+FbiOPZHBztNXxwmK8kQ3OARtGEzWya5Xl8RgY9KZDll5d/3dUxuuct:SwBjU0fPfhwwk2+ECyahY9KZDH3dUxun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711372287, "uuid": "d0881ad6-76d4-4395-91eb-b4341dfbb28c", "value": 661000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711372287, "uuid": "b873431b-9471-43b6-9cd8-ce51751a2185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372287, "uuid": "95cbc6cd-2eb8-46ff-a283-d88271b66eb7", "value": "INVOICE BILL OF LADING PACKING LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcab7d48-ea5e-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711340418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340418, "uuid": "d02aa0b9-12a8-4d35-a55c-81d6788a15be", "comment": "Malware payload (AgentTesla)", "value": "18f6350205d7a67624a074a27f1f2205", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340418, "uuid": "bd37f81d-2a0b-43cd-b441-1360afc3cc1f", "comment": "Malware payload (AgentTesla)", "value": "ae26b0a63c0bd0afe48f8b9e662dce85e23a096b3c34178634417bca5495b024", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340418, "uuid": "1c3ba425-ef56-4773-8698-a1d5c65ba8b5", "comment": "Malware payload (AgentTesla)", "value": "0266dcbfdf0cd5d981dbf789feafc9e1551076cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711340418, "uuid": "13e436fb-a1a6-4897-90ee-9f801fa34b8d", "comment": "Malware payload (AgentTesla)", "value": "42cc58f432c715cbff3d375fb6f5ec6ac56c12e4672b0d4f8bbfc47d17fa9f565420800b876038a52a156316ae9c58dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340418, "uuid": "dcbac73b-dd7c-4303-b83b-00574d1947c0", "value": "T1EEF4120233BC6AB3E67B5AF24C62515143B1F66A5073D6EB1CC221DE91E3F044B92B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340418, "uuid": "466fd561-2c4f-483f-ac42-e1967093ee53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340418, "uuid": "1514d0b7-2377-413c-b900-013a0d713dec", "value": "12288:Vy4CMwnO25WGOwk+0j6HUxJGDfU9LGni83zOa/16Hry39emN9jdYB7EWcdXlnHgO:IOKiMUxJcwSi83zf6LywmN9jdYBgdnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711340418, "uuid": "3805319f-1560-482d-9265-e5e7af5ca658", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711340418, "uuid": "d3857ce1-86ee-49f2-92e7-be73df85606f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711340418, "uuid": "c07b7cb2-8b2a-40e6-8320-c63bb7002b8d", "value": "SecuriteInfo.com.Win32.PWSX-gen.32061.26885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6238e451-eacd-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711387833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387833, "uuid": "014d511d-1263-4ede-9c92-dfa6bb32a6fb", "comment": "Malware payload", "value": "46c562ee780a928145e854702c653761", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387833, "uuid": "0374b009-c927-4921-ba43-9bc7c1fa7d50", "comment": "Malware payload", "value": "ae929fbb262738444cda49033a1b3d57ca36b272b411970da268e31689d950ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387833, "uuid": "d7500856-1bd2-4659-9c7f-3365c13c1473", "comment": "Malware payload", "value": "d410e264e2fd9f5f673c89cd640940f381f9b358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387833, "uuid": "6e88e39f-9aa9-4bb9-ba2b-07d33a59801d", "comment": "Malware payload", "value": "bd9a221f6ef42b524d1923519f3a0bf32c918f874ffe4b29717f7016d44288d51ca27e50185086b8620c2b66077fe252", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387833, "uuid": "b4e65830-38cd-428b-842a-e13d6a753145", "value": "T1A553027DD570A232E47C027B893CC5D2632D7A7895F97563609A23A83EC0C9B64FA4D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387833, "uuid": "b1cfd5cb-0110-4251-959f-06383cd36661", "value": "1536:eKVIqO+upHzbBw30s6/3xv+S0na7T+hV2GG:eKVIqaHzS3fo3h+SzUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711387833, "uuid": "7736823c-5a24-4404-b884-4df1b60a44c0", "value": 64816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711387833, "uuid": "1e20fb0e-c436-42c5-a75a-cffe1f66ab4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387833, "uuid": "6cef7274-d651-48da-92ac-42e2361a17df", "value": "46c562ee780a928145e854702c653761", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5d89cd-ea4e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711333386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333386, "uuid": "968a9cbe-2807-4d89-b570-fb3d1a3919dd", "comment": "Malware payload", "value": "a6cabfcbc05ae0e9c699e098f34de430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333386, "uuid": "c675167d-d7cb-4b07-ba68-ea64a65f63b1", "comment": "Malware payload", "value": "aef51b0a6f458f78c91df37aea4cd033c85f178b2e06974678df7374e291ee13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333386, "uuid": "9247e736-2a33-43d4-88eb-2c4090a05274", "comment": "Malware payload", "value": "6a4426a9dc8ec8553697f479b50a02e0e6607e79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333386, "uuid": "c01f6697-3659-4b78-bc6c-11f6fe16f5f7", "comment": "Malware payload", "value": "09428852bfbd385ad99960a0f81cdc3f35c9e68d3c0328ab8b91353f77d31b1e4914e34504768054e4c624938be615bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333386, "uuid": "76a1b61b-155c-4a39-841c-e754cfd46486", "value": "T1538733F27DA451F5E6945EB00099EB7CF7BD9F850D250AD327F0CA2908B03B197BA624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333386, "uuid": "9a23263a-6443-4515-8f03-ca63748c9742", "value": "44e31a6889a8659cce2dbc18694ca7d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333386, "uuid": "82c3eb67-5de8-4033-ba6d-c5a457f1bd77", "value": "786432:qDXj1h0ScKDnLUZWPA2cZkDpbxpEBa+fu9dRSEytUpMCv+pwzCqvHKhRu:eh0ScenwZW4RZk1bxNLB+UiCv+pwTyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711333386, "uuid": "85c8c34b-a47f-40aa-8f70-0dddc4c48409", "value": 38459426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711333386, "uuid": "f20ec475-7ccb-4b5b-84fc-ec78341831be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333386, "uuid": "8638c713-bff9-40cb-ba4d-2b6cb65e1aaf", "value": "SecuriteInfo.com.Trojan.MulDrop.944.17985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52895723-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711383941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383941, "uuid": "63e0b7c1-817d-45c8-a019-73526087d240", "comment": "Malware payload (GuLoader)", "value": "83741a566ed8044f4692b4070986ecb9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383941, "uuid": "1120cf51-ab87-404c-a904-bc9c2c90864b", "comment": "Malware payload (GuLoader)", "value": "aeff431cde6f10580b664967efe9793aa19130934b0e9f9d01d152e028fa3f2a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383941, "uuid": "db059526-7f0d-4c37-aa79-8180059275e6", "comment": "Malware payload (GuLoader)", "value": "921fa0b4bbe043a6a2a9b972bceab1088acda6f5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383941, "uuid": "bcd3789e-8111-4547-9d03-e6814e2e1292", "comment": "Malware payload (GuLoader)", "value": "610d9cd62296e54118e466892e6ecc7657a3be0e72921b582d615c9a9e420d12873bba8a6c7247f03b614192ae58921f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383941, "uuid": "6e4f1f73-32c0-4ab7-86eb-a62929bebacf", "value": "T115223A90ED033A7EAC0033C08CC46A4285C441B95D3175B5FEDE92EA414EADDA7BDA8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383941, "uuid": "c440f915-a568-467f-8443-8ed0d033f0b5", "value": "192:2M+7O579hFNNFU4wlr4ZRR/038AVVtkfLda+V9+ZMoce5QmDRs4ngSN+:2M+7O57dFU4wlr4r038AVQfL4+SZt13w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383941, "uuid": "7e0ff83a-ff4d-434e-a012-5408d8e6909e", "value": 10555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383941, "uuid": "6c7d2c79-3674-4b5a-bf71-a3c0813565ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383941, "uuid": "6b2effed-106e-4bf6-a2b3-d3a7a140789e", "value": "Bank_Payment_Advise_Scanned_doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c543eb-ea9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711366448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366448, "uuid": "512ea80a-485d-4546-b7c1-e4d2696c6ede", "comment": "Malware payload (AgentTesla)", "value": "3ab8729776e449749ac1c016b0f106fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366448, "uuid": "b5956a21-1af0-43df-9610-085cebd0d3e5", "comment": "Malware payload (AgentTesla)", "value": "b0ef56341b6018419505bef0fa5d45e26d44975c6b4417a5784c33eab69818f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366448, "uuid": "f47b8b19-f069-4687-91f7-53cdbdcb1fbe", "comment": "Malware payload (AgentTesla)", "value": "460392af7cd00383c7820f3a51266f39a0cb4ab6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366448, "uuid": "f1fabe92-32a1-40a0-8213-c7a3fb35a152", "comment": "Malware payload (AgentTesla)", "value": "2cb98d73ede0f1bd95e82d465b3dee1032c0a2b653307ffde8858c71ad68682e2c4f1c67ee4d252b55533238df92a228", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366448, "uuid": "a1d24ddc-237e-432e-a436-3e3b415d8be4", "value": "T12BE423E6CB4151DF096E4202D6EACD1DD8CB3AD1926FAB7FE173205A7644B1C70238B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366448, "uuid": "9c7d4f3e-a968-4a0a-9416-23efbb29fb07", "value": "12288:B8suQeWy6WQOQzYi9kzrXMo3i1WI9SejUbc66hAPb2gm467yeGDyEg7hNakVDw:BqQufQ8iSzrL3iAIxjU/2gR67yni/Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366448, "uuid": "20fe49a4-2b9e-4ee0-9a80-d7d984c2fbac", "value": 687890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366448, "uuid": "f776ebd7-3e78-478d-8005-21ffbde530f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366448, "uuid": "47f018c8-7e07-4dd6-aa6e-83698594f5fe", "value": "INVOICE_FEB-888201-2024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc744b70-ea9c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711366966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366966, "uuid": "e2243c8b-b659-4d5f-bedc-65ac0c03c640", "comment": "Malware payload (AgentTesla)", "value": "e8cd841bc606098dbba375a6b1e47452", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366966, "uuid": "e7628aee-74ef-44a9-8626-6a6a7387ae7d", "comment": "Malware payload (AgentTesla)", "value": "b34916b051b86431b99658daaf2eccf9688d03818d82add102b3265c623d753e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366966, "uuid": "0a44c80a-b25a-43e2-a7b4-bee01ebb063d", "comment": "Malware payload (AgentTesla)", "value": "d736cb824cf94807570ef8b8c3414490443a6517", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366966, "uuid": "2fe62cb7-20ef-4e31-9651-2b91464e1cfe", "comment": "Malware payload (AgentTesla)", "value": "592754ab3c676737901fac7d02f2926b6720a6579da2520286c484a6add050213f796ac7b53e6f9708ddc2d4b25bd109", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366966, "uuid": "418baa24-346d-4385-aec8-3d197dd46a81", "value": "T17ED423C3B9BC9AC5A2132284ECDF0C53DAD6F0F9A56B414C9979703F76125A8E9A034D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366966, "uuid": "8d93aa01-56bb-4a27-8a0e-a2c0e7eef599", "value": "12288:lp2me7xPwdkAWPaOKodjZLtY+ZXscTBZ3Dlk+j9kkG5OYz50xXC:lpqwrO7djY0TB1DVu1zay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366966, "uuid": "4011f9a5-ba6c-4440-878f-00ddad5ac53a", "value": 642674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366966, "uuid": "972b7950-db20-481b-a8ae-676e80b2beea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366966, "uuid": "c9b5c45b-ac6c-4343-bd59-cba2360532a6", "value": "order - NLDB-082-2024XXX.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c28cffc-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383850, "uuid": "d95d374c-40c7-4813-a8a1-191aa5b48ec8", "comment": "Malware payload (AgentTesla)", "value": "154c5d86522ffd7a1cd03d23b3b19ee5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383850, "uuid": "62ecad11-6a4f-4b40-9df0-d39f2d68e78e", "comment": "Malware payload (AgentTesla)", "value": "b3f2c0468d40628a6fa17d8dfaca76b89525063c9f1c3b337f9929311e4d7cfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383850, "uuid": "5bb2c226-4b4d-47a8-bd86-47330807f764", "comment": "Malware payload (AgentTesla)", "value": "41743b862c01c4c8eef124a85560657f58a0a575", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383850, "uuid": "b3ecbb90-c4d3-401b-99fe-6d6eb05e422c", "comment": "Malware payload (AgentTesla)", "value": "19a6fd86f74293ba3960dce6b93ba0f8c665025a463c110b23c879bfb701186e5ec93e1cb5dd8ad335a9941a4915e2b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383850, "uuid": "d2e3855c-d05d-444b-a7b8-e442150bdcca", "value": "T13914025BEFDF7E740B787901218868A91F6BF454C09D6F9BB4FD4AAF850602C21ACD12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383850, "uuid": "35e0b061-5907-4ad7-b662-333e47f97ea2", "value": "3072:k+az7K1R0Qnfs+7d7mz6WK5jiAQeQ/fCdkoLTIXlcoutMAp5Fvk2:SCXkKIeWK5jFw3CGc9tXp5Fvk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383850, "uuid": "c36ac06f-2ee4-41db-b827-561ad6669dc1", "value": 201682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383850, "uuid": "c9b3e0c9-4acd-44bb-b80f-be0a6f26d682", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383850, "uuid": "3073664c-6cdb-435e-b98a-dda7f4ec2980", "value": "Payment__ Advice_Attijariwafa Bank_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ac508e-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711385156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385156, "uuid": "774e31f9-625d-4364-ae0b-285b04c32efa", "comment": "Malware payload", "value": "00e6626f86f9c979a4c3c22bc395e338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385156, "uuid": "814c56bc-6544-4149-b9d7-1b4db4712d99", "comment": "Malware payload", "value": "b40c2a59483a325f19f496001775300f71e2eb5d1df1da5f2d182ad26520dc4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385156, "uuid": "bdf6eb38-fcfd-4b02-b0fb-628b592678f8", "comment": "Malware payload", "value": "2796e910c2b16bbf6824c158851faacc44256d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385156, "uuid": "1e6e4b08-07cf-47a4-8cfb-94ce1b36698a", "comment": "Malware payload", "value": "dfb9d314d7db85a5a17d3b70b8a0800780aa9c0a4aad643c78fa791c4f00386712088e72756b6061736a297dcc1c868d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385156, "uuid": "d6c951f8-9b25-4ee1-af91-e9ca27d705eb", "value": "T12C953359AF57B63DDF0C9A3317A925182BF21B8452D6AC0E3D8DC4BA48C6FCC31721A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385156, "uuid": "2858e3d3-76d5-4352-8421-7f07c3817414", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385156, "uuid": "b986c8db-0c5c-4f7e-9e15-8682d29ea915", "value": "24576:HkRixz0ofQOmMeKycOlYQ1eirzaA6oTgB1GQBhmmcBjGEZ02T/f86scNFm2MEdAb:H+ixzrbmTK3QXzacMFup1T/lmZ2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385156, "uuid": "529d5870-c2f5-476a-997b-94c1fe1b202f", "value": 1908736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385156, "uuid": "488f57ab-af15-4563-be8d-c24e8eeb8d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385156, "uuid": "e946534f-8dd6-42cf-956c-ba62a06f3134", "value": "00e6626f86f9c979a4c3c22bc395e338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0268d4b1-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711359755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359755, "uuid": "b19f13ca-0151-4b91-bdd0-9f4d98d1399c", "comment": "Malware payload (Mirai)", "value": "5f9fef533dda84f0ebecc09384cd1532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359755, "uuid": "3c2f9101-628c-4b2a-92a3-77348f8f06c7", "comment": "Malware payload (Mirai)", "value": "b44ff359df589bf0ffe7aca96439d35a4e51a8c0cc6d225a3ceffec2c26ed293", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359755, "uuid": "35a9aa6a-006e-4f2f-a46f-6fd5de014e4a", "comment": "Malware payload (Mirai)", "value": "9a07dd01371b415cc3a021b3c1f25c8b933bca55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359755, "uuid": "a1f68784-68e0-4607-879e-0f65c38e0396", "comment": "Malware payload (Mirai)", "value": "3b7dc72c49c18d0754bdf40a17bb28542b039b49a813fb176fb77f8d8b3c7e43c3915fc639b7d344fad32037b257c2ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359755, "uuid": "58d12b48-2ebe-425c-b06a-a1ae4898c5b5", "value": "T155C2E1E0B726FA31C4206C7DE52A4D893951067C91FF393754254D35CEC2A5A63F88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359755, "uuid": "dab5630b-776e-4c14-856d-3b44961d130c", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrCb9q3UELu4:OKy4qfqoeJdXWgC6Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359755, "uuid": "d833b209-4b0a-4b2f-969f-8d871e943d25", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359755, "uuid": "6df584da-475d-4e6b-868e-dc0a5ad06517", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359755, "uuid": "14e143be-fc25-4864-89d9-ac4a17b44b04", "value": "5f9fef533dda84f0ebecc09384cd1532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5345ab62-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711383942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383942, "uuid": "97653b20-41e0-42a3-9979-5752ea21add7", "comment": "Malware payload (Loki)", "value": "f8c1aeffdc1223345574d4516bb19987", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383942, "uuid": "9d823f33-4fab-45a2-9c0a-e61b936d6eed", "comment": "Malware payload (Loki)", "value": "b4b38cc10f119910b920ace68d036316e23631d69d6b6c437ae91732c7244cf1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383942, "uuid": "652c0ae9-c4f2-4553-947f-feb4bf3762dd", "comment": "Malware payload (Loki)", "value": "38de622dd0a35a74269ebecf56bb98c11237c79a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383942, "uuid": "c1690f11-27ca-4d30-ba67-2a22066bfea4", "comment": "Malware payload (Loki)", "value": "95542df04d5188231ab955455a6353b7df75e19c0048f89076c2d05fd578181f707f4ab62da76115f278b8a8e3f5107c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383942, "uuid": "59766fa7-d2ef-4e9f-a181-cdc14c781f66", "value": "T1330491E3DAC52A689A491AB3ED174B734DB0009C33135F3897BCD65DA143A5886BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383942, "uuid": "c7476c39-75d8-4259-9df9-35246027fbd7", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hy4:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383942, "uuid": "fcbef633-0690-48aa-98dc-719009518a85", "value": 186011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383942, "uuid": "fab01c02-844e-401e-93b5-6d4fdeee0177", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383942, "uuid": "95ed74a9-e43a-4d82-b14e-57c502c4a699", "value": "Consulta 49245\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b6682f-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373872, "uuid": "863272ec-8cfc-4bed-86e4-4e7b0512582b", "comment": "Malware payload (Mirai)", "value": "ba0314b841c4e9d6ea1ba8f5e5c5bbcb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373872, "uuid": "4904195d-b764-4980-859e-9c15ae43e9fd", "comment": "Malware payload (Mirai)", "value": "b5ba78679140fd6d6b53f45d56f572b630f138de9ed6ff8613eabb8f4015710c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373872, "uuid": "4d8e6c31-07b6-4ba6-9ff3-a1d09c8de04f", "comment": "Malware payload (Mirai)", "value": "4127607668ea5b2fa73365b16f636c45ad93eb99", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373872, "uuid": "af57a067-b783-4db8-988d-7c2fa7782798", "comment": "Malware payload (Mirai)", "value": "bf988706f907d829c744d912b5966a36de94cd044f0838f0a219e4e5231f10a9edd4a3ca0e013020856a6191bebceda6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373872, "uuid": "114eadc3-7d65-4a7b-9dd2-ec441ea5a3fc", "value": "T12E5302EB11A302B4C1782C797D5DDD11EB943C18F622974F96A47B68CCFA643D902BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373872, "uuid": "4d52265c-c263-44b0-bfc4-3731dc0850c2", "value": "1536:g2Q3dvd0ZmvDEL+oEHk4T7rc+YdlWNKzGbkhW/+8Y:GdvaZFLBEHk4T7kFz2kMxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373872, "uuid": "c17336db-1216-439c-bbac-585d70692dfc", "value": 62732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373872, "uuid": "16af32f2-94c7-4fc4-8dc3-7681786516fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373872, "uuid": "4ffd24ff-3f4b-4895-9abd-131c4c48500b", "value": "ba0314b841c4e9d6ea1ba8f5e5c5bbcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d049ca-eac3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711383653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383653, "uuid": "abf8ee08-5116-4197-8b8e-dc6063b1443c", "comment": "Malware payload", "value": "28ef73a1594e3aa6c03468b8cff311ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383653, "uuid": "34928a39-f432-46c9-a314-c39661107b82", "comment": "Malware payload", "value": "b5da31ed4d9e9ad79e32d059d546d4aa4d6769eb7f3a628fa44ef53273c7db55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383653, "uuid": "ae0b2175-ca62-4e0c-a61c-961999f94f04", "comment": "Malware payload", "value": "df08e65dcd3feafde74d036357912250eab54946", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383653, "uuid": "ca285b50-a115-4cde-b6ae-327912d92016", "comment": "Malware payload", "value": "d0508c3b1131d5ffe38c8693e3b0d88bc8b8a71d7e88442325437274616619fd3fd1f8cb3337e1b2be3fb24e73f1d38f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383653, "uuid": "2c187e99-8884-411f-b0ec-9016eef9a65d", "value": "T1945302774A26E8FBE1304175ADE802670F7459BFF1625C2CAD49FB63EED10143027611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383653, "uuid": "27ecfbae-0bc6-45ea-853d-9ff68e3570e9", "value": "1536:O+v83uLPrW1svNBDf+4l2Vz7ORL+/D/xRGVEWb:TgumiwVXORL+/D/xRGVEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383653, "uuid": "6cb516cf-635a-4f76-96b1-a77d4caeaa4a", "value": 66460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383653, "uuid": "c8468556-5406-41ec-aef8-ca96b1952030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383653, "uuid": "89f0397a-bd61-475e-a088-421cbd52e696", "value": "SecuriteInfo.com.Linux.Siggen.9999.13445.31919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168a3763-eab5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711377398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377398, "uuid": "0d7da5ba-4ce4-4776-bc38-9367d1c1af2b", "comment": "Malware payload", "value": "eea9ca06ea4a23c83cf996b44c010be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377398, "uuid": "22de0eda-9579-4291-bf88-ef951ce486b4", "comment": "Malware payload", "value": "b651f8a02f54e50c38195e62ebcacc8a7975aa8f8c5d763da0edbc15d205c55e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377398, "uuid": "f0af27ed-7d17-4468-9d39-f978b4b3b150", "comment": "Malware payload", "value": "2516453e5fd9b0eb837033d04682b1207eb9c224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711377398, "uuid": "54296d69-bd03-460a-bfc7-fabb03f9034a", "comment": "Malware payload", "value": "1c44d9adc512f63aa13053b9dbc1dcbcc4a8bdb26c4512f529819147b750b38f9a877563e2a3561f58094272cc9e8f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377398, "uuid": "12cbeb84-7bfd-4e2d-8776-eddd574b9908", "value": "T1F56302992706087DEF54A53C557EA6BAE6710BF8F340DE48A4809F86C05E0A0B5CFF9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377398, "uuid": "b3079a9f-8f95-405f-a653-e0e69f264dd7", "value": "1536:i37tr3ioL9o2yeSbatuJl/i0uCNfHUetJzhWVEWW:GX9o9eQJlxuCV0efsVEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711377398, "uuid": "cad98a3f-b83b-4c88-bcae-f2cb2243bb66", "value": 66836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711377398, "uuid": "cd40a983-9e0f-4467-8774-ed0c9c4359d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711377398, "uuid": "e0d3c262-5b42-4553-8ebe-24fc589ed4b1", "value": "SecuriteInfo.com.Linux.Siggen.9999.1601.19383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1cabb9-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711369839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369839, "uuid": "917fb54c-233e-4b5e-aec4-5fa4c4e1dbf9", "comment": "Malware payload (GuLoader)", "value": "f744b39f06cad577364eff72186e0626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369839, "uuid": "4ac142f2-e072-4531-b897-b4c3aae8b3f3", "comment": "Malware payload (GuLoader)", "value": "b67c5941b8a82c44ee8c876e53fc0435d8d5653491b6c61ef0ec5ee92bbfbed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369839, "uuid": "1ddd0c93-3071-4fc7-a2fd-9981af8276fe", "comment": "Malware payload (GuLoader)", "value": "a2e04a36a215a5a90838965126b5e0b8baa7cf88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369839, "uuid": "58074b40-f24e-4846-9efb-76c4a7ce3e96", "comment": "Malware payload (GuLoader)", "value": "8808cf541c2f23936e61a89d3b77d273bb0f6e0e4af2a0a0341ac6b3195fc2c9df4222bd43a8476c33a268fa0bca312c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369839, "uuid": "b3c933d6-0326-4dd5-8531-fe7f87c4d1f9", "value": "T10325F1CBE64043F9C8348A36D01F953206579D7FAAD99F06A1A0F52B2872183DF2FD59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369839, "uuid": "d49d0ec9-dbb1-4d18-9bd0-2a5c038e418b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369839, "uuid": "4a467484-f860-4715-8a20-a8f20ba0a340", "value": "24576:pbZCmf67FtuZFX3KJQghsUyj6/onNd5gWrotUF3y:R3f67FtuZB3oQyCG/otrfF3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369839, "uuid": "c5b5e760-93a7-459b-802e-67c615ebebad", "value": 972600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369839, "uuid": "8555fd31-4b96-4bd9-89ef-95f3ff8df29d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369839, "uuid": "d237df89-c0f1-4a28-af4f-bce0dfb2ed8e", "value": "Request For Quotation Details_Ref.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eea60ac-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711385250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385250, "uuid": "313ac40d-703d-4dc2-a6df-e563f07028e7", "comment": "Malware payload (Smoke Loader)", "value": "b6698f73dd3bce2646f76c9589256455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385250, "uuid": "e9420749-74bd-4184-b174-c02865f8f2d8", "comment": "Malware payload (Smoke Loader)", "value": "b6c6e0ed6e5aa62baec8de42d2d8fee52df072c6a2b33530fbf8bc73d36309a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385250, "uuid": "8d4bae9d-3363-40e5-b457-f7fdc2d7af2d", "comment": "Malware payload (Smoke Loader)", "value": "20f6bdd05ca92a1499fa6c0dab9954135bd2f194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385250, "uuid": "e18e9c6f-4c4f-4c3b-9ab6-70dfd90973f5", "comment": "Malware payload (Smoke Loader)", "value": "526ae101df8f0151fe9b66932676c0014f499cec26980cc46e97a16aeac84e58ed4764a4057ef5c72ac3e4f848c369ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385250, "uuid": "29f70c90-25d0-4625-a883-b5257c17e6c7", "value": "T13544CF1236E2D8B1F6B347321974DA95163FFC7749358A9B3384260F2C706C19A76BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385250, "uuid": "ce87d357-b585-4650-80c1-da8df9097519", "value": "ff23e32a63aac9251bb507fbef91be04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385250, "uuid": "315b2aac-4736-4552-897f-3eb3e1cc5d99", "value": "3072:5ArJBwHDu5z0XOs/AzR++VNX2VQXHtYOl07BBI60JOERR5vK7/TB2+xxdnPwZl4:kJBwPOs/mR+SNs7BJ0JOEDabhPdoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385250, "uuid": "b9cf5178-cf65-4c73-a278-141aa6da6a6f", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385250, "uuid": "88e72f4d-1b2e-41b1-9fc8-d8e93dee93a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385250, "uuid": "253bee39-515e-4176-99ec-0046b6bfbaa0", "value": "b6698f73dd3bce2646f76c9589256455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf97799-eaa5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711370669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370669, "uuid": "7ca132fc-be0f-4947-981a-c56fa1795bcc", "comment": "Malware payload (Mirai)", "value": "d92128f3ef5e948491b332dbf06936d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370669, "uuid": "dbad227c-305e-4018-8574-0daf11feef38", "comment": "Malware payload (Mirai)", "value": "b75a0a8b9c4eeb03ba67d942b16ee80c780101c6e0bf8c0a8e19cbc98ae755eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370669, "uuid": "7830e5e5-96ca-4765-9aee-cd26addffdc5", "comment": "Malware payload (Mirai)", "value": "609b650073414a77e40a906943a3e558d7d18b60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370669, "uuid": "84d125d7-c8ae-437d-9d25-e1107fd11af7", "comment": "Malware payload (Mirai)", "value": "c92db79ff97e9189e333025da5fde75d834699e34a0d791e178d29a5d076ded76fe4487df24c84c70b69599fa4c91369", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370669, "uuid": "688eea90-8ecc-4513-a4b7-fa3d58b1d595", "value": "T10D63ADA3CB5A2C40C14C827470A88D3D7763F65581A72FBA09E6D2AAD447EDCF1097F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370669, "uuid": "05271de1-28c6-4e21-92d8-20de6a8bef89", "value": "1536:m/RsT2BYFatLjMI0wUjJbSpnkTkBwf+KkHLscPyICNmBVwbZnN:m5p+KjMI0rdSkqGxk1PyI3VwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370669, "uuid": "9d390642-f48b-4a3b-acd4-4953f2e892e5", "value": 71768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370669, "uuid": "3bbdcc33-9735-410b-a762-fa81b23d5645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370669, "uuid": "afdf62e0-cd6e-4289-b2e0-2ecda91deae7", "value": "d92128f3ef5e948491b332dbf06936d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4c6a64-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390826, "uuid": "3fed9fe2-81cc-46a3-a296-0b74c2837c16", "comment": "Malware payload (Mirai)", "value": "ce9953035f970cbe0c482610224c73bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390826, "uuid": "777d701e-6981-4660-993d-20989c088a89", "comment": "Malware payload (Mirai)", "value": "b7775ab003353d3f0a49039ae7ff040de7639babe4e8b965d454ca721b7d2b08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390826, "uuid": "267da8cd-b260-4c15-b101-9686dc3b1dc3", "comment": "Malware payload (Mirai)", "value": "1b9559895c00dee7295e7086bcb79a43ae42245d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390826, "uuid": "e4a0d59f-bf1d-4c71-a258-74f5c620f151", "comment": "Malware payload (Mirai)", "value": "44d144c236c32419b1b18747fb2a4a493569c4b8106583f65ca772a7fb17abaf6c669743e559ff9dd26717ddad464ded", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390826, "uuid": "2241181a-37f9-43ca-9c6b-d35754e35cd6", "value": "T1B8C37C73D8656F98C554D0B0B0B08FB92B53A590824B1FBE69B7C3B45083D8EF945BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390826, "uuid": "3274755d-4ae6-40ce-805c-5e1d4a0b35b9", "value": "1536:7aapf7AbbcFYKvSX09LCGKVAjo7BYKC0brKo0WfAPt7avSlP0P:79objKv005UV7tC0vr0WIPt2+P0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390826, "uuid": "1b24c284-42c7-4ab2-90b5-70fa41985dcd", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390826, "uuid": "1c485998-6c2a-4052-aeec-cc00a2dab21b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390826, "uuid": "60bd2b92-4172-42a1-ba32-3a38648028e7", "value": "ce9953035f970cbe0c482610224c73bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802d1980-ea84-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356530, "uuid": "6203166c-cd5c-48f8-81bb-fe6fba53ec91", "comment": "Malware payload (Mirai)", "value": "c8456dc8668ebcd85a139da9abfc4218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356530, "uuid": "4ffa574d-e719-4c3a-85ee-af7099765884", "comment": "Malware payload (Mirai)", "value": "b8911cb46515904b88dba20237ec614ef2d0d66393c55d375300df2fe6033c82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356530, "uuid": "2659fd6e-4259-49f7-a23d-ab7134d2e7ad", "comment": "Malware payload (Mirai)", "value": "f49ac7ec6f2b8c93e95a7bdc6d2f204bc3effd20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356530, "uuid": "f08efae6-515c-45a5-a01c-8d519a122b43", "comment": "Malware payload (Mirai)", "value": "aa8a2e82cf9cf249e7a6252d6b8a490f828cb24a06a5ad7bff1717b5fe50422c9cfff1b524ea8bf046cce682799b2c57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356530, "uuid": "4f0d70f9-f4bd-4970-8ebc-0aaa2f5048da", "value": "T109239D71E8359D64E09A05B8B864CF381F13D2C1925B7EF31B6582B25463F99B90AFF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356530, "uuid": "9ef38239-7afb-4e83-ae04-19f77904d477", "value": "768:eaAT0wbGaiD1U8hSNfnp8MECJo5lldBCETwGaZY10U8ypQ:eaijiOKqp8MEN5xBCEcGaa103", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356530, "uuid": "72495478-dc0a-481c-9a82-42f93d9ba18a", "value": 47448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356530, "uuid": "a49ca01c-6a7c-45db-b607-bac4b828a24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356530, "uuid": "5ce50834-a2fc-48be-ad7b-0c539bf7e0c8", "value": "c8456dc8668ebcd85a139da9abfc4218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0fada8-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390852, "uuid": "b9b9ea69-d805-4255-b8a8-08b050bbfa4c", "comment": "Malware payload (Mirai)", "value": "88511b2f04ba0c79b860bd361d280e30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390852, "uuid": "971ab6cc-4821-4f11-9e3f-1d7e6a107402", "comment": "Malware payload (Mirai)", "value": "b9d489e087f1a34b53f65572bd52d31389b11f3eeb9957aa7ff4ee1e6894321c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390852, "uuid": "0c9b7e4e-120b-4675-85e1-e48f6b885782", "comment": "Malware payload (Mirai)", "value": "e52e4d1452015d308843a70875555dc835af83a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390852, "uuid": "0519314c-de13-40b1-b521-94ca70f132a2", "comment": "Malware payload (Mirai)", "value": "d5df606f4ed642e4e9995629729a55b2416867f70e6967803aa8dfa114b91b7778308d96eefcb0f19745ac4dc0bef2ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390852, "uuid": "917bfc0f-cc90-478d-827a-bc43dc92f14f", "value": "T13214985E6E228F7DF668873047F74A21976D23D627E1D684E1ACC2105F2039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390852, "uuid": "8cffe595-32b4-464d-9ea0-b330fae5e834", "value": "3072:1k79Ij/YoFdNDoH6JK1xkGQyblua3KzIzpH:1k79ardbo9QkuaazAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390852, "uuid": "76ee0fcb-524c-44fc-86b1-15e1b8c03ed7", "value": 190492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390852, "uuid": "23294769-86b4-41d9-9ee8-19f53df55e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390852, "uuid": "42d11fbc-1dec-4fd7-9175-a57d9a8e665f", "value": "88511b2f04ba0c79b860bd361d280e30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bc17f9-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365350, "uuid": "642295de-604d-479e-a061-0261e39f2c29", "comment": "Malware payload (Gafgyt)", "value": "4eafecd15c4154a4bd37e6d22263f928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365350, "uuid": "6863d46e-e4ee-4a0f-bd87-53f8f9351df5", "comment": "Malware payload (Gafgyt)", "value": "b9d84f7904006c21d0bdee32c725cf358a23bddb73b5cc0ba3a157b7bcdd1643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365350, "uuid": "ace6ea18-16be-45b9-8790-9e3698dbca26", "comment": "Malware payload (Gafgyt)", "value": "1adc1762e2c20e79274dfd9213dfb6db36263b44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365350, "uuid": "0dc817bb-bf74-47f0-bb0d-d5780e1add1c", "comment": "Malware payload (Gafgyt)", "value": "4281b2f6ee3d5a220b40a3734302c4c07a50393906d8f4b70a2fd678a9b1d294d6f8f80e48f2033bed2942632c7a967b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365350, "uuid": "b89ab03d-4dab-4b01-9b3c-575cc10f6c8d", "value": "T138B3F7CBE30C0B53D5C75BBC2D6737E14799A7A213BA2581900DBA8017A77781E22F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365350, "uuid": "6344196e-5235-4555-b0bb-34078f5fa84e", "value": "1536:bd3IphHHlff86C83j4ndkwnBxO5WRb5hKgUMvHrqLJP8K7uTPjYUiG1:bd4zqcidkOOI5hK+qLJUK7uTLYUiG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365350, "uuid": "611d0427-31c9-4ae3-911c-641642dd2511", "value": 115622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365350, "uuid": "8b261da7-8896-4151-a5a7-9be5bacda4b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365350, "uuid": "7da6b8ea-f35f-44f3-8940-3e2a9caeac61", "value": "4eafecd15c4154a4bd37e6d22263f928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f387b3ca-ea98-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365313, "uuid": "ddb18ea2-bdd4-472b-b8fc-84da44965271", "comment": "Malware payload (Gafgyt)", "value": "a99574df96d90a951511a327514fb4ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365313, "uuid": "d3db7e45-8f78-43d4-a902-cfe6343edc6f", "comment": "Malware payload (Gafgyt)", "value": "baad6057c142fd401540e67a518e13f2c524b83aed05fba9e4d48773c86e9924", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365313, "uuid": "7ce1cbb6-21ad-4efe-bfea-41a0658c7537", "comment": "Malware payload (Gafgyt)", "value": "18818d17ef3387f5a53943ea7bc242a1323da702", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365313, "uuid": "e4b4b895-a460-4ec3-935a-06cd87f4b2ab", "comment": "Malware payload (Gafgyt)", "value": "2d7bb22d0f841a27ad14f4b25e72416e52c0b4635cc1286fdcc1ee1fc7840d5b9081f0cb3db6e540cb4f245c94b83227", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365313, "uuid": "e80d5b94-40c2-41cf-8c21-72c4239cfae1", "value": "T11FD31A05D4509B27C2D2577AFBAE478F37225BA89BCB332256256EB02FC179D2E3D410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365313, "uuid": "ac3ed1f0-8e7d-41b4-a528-497ed9f3b1b4", "value": "3072:F/dxHETIJTWhmvPMw+aDNXVuu9KrKqdP5hFy2t4+hhOmyPQaS+pg7e:FfMw+aDNXsdP5hFy2mmyPQaSGg7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365313, "uuid": "280b7bb8-af37-4c56-9c73-9f462883d772", "value": 142361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365313, "uuid": "6786b2ab-5387-4000-9c86-9f60d52a0ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365313, "uuid": "536d68cb-45ba-439b-8f01-3d91f464c3b5", "value": "a99574df96d90a951511a327514fb4ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0ead91-ea8a-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711358939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358939, "uuid": "0f40b9cf-c79c-48a0-99ae-28d95dc6103e", "comment": "Malware payload (Loki)", "value": "0aa08a1de128f754244a41caad13b855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358939, "uuid": "584f477d-796e-4eac-a0a3-30935027ab03", "comment": "Malware payload (Loki)", "value": "bbc7fdaebde9c78601c1965f662082874bae5e023f85701316f930266b0482c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358939, "uuid": "86cf9aaa-d2e9-40dd-97a5-bd4d58d31f5b", "comment": "Malware payload (Loki)", "value": "d757260a3e82337339e45a596e7f879df42776e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358939, "uuid": "84abfa2d-bdc9-4212-9efa-8a43729625e9", "comment": "Malware payload (Loki)", "value": "dafea4cfe809038600f0eab32bae8a2d04c0d131afd06419511567b82fa38dd3c5376db5917a0defb2f790797ea0d066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358939, "uuid": "dfef56ce-1251-4b49-ad4a-a7f6ae581beb", "value": "T110C4120132BC6AB7D67F6BF18836001553B2FA2A6069D7DE1CC2609E44F2F518F56B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358939, "uuid": "b24f463d-5c22-4c86-8fbc-787fb45af861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358939, "uuid": "0ce04376-c811-4e7c-9bbe-85041a2054a1", "value": "12288:Zp4CMwaRzpgQF9z72qYps2bgBiFhNTetpAAI2xv2nA:izFFo4ALNyt9jxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358939, "uuid": "6116757f-32bc-4cfa-9c7e-a9d94ce65c82", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358939, "uuid": "1e5bc872-412d-4f9e-9ab6-67644759dd2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358939, "uuid": "0c2a4891-86ec-44cb-b792-6b6bb690b5cb", "value": "rpayment_slip.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066ff619-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359761, "uuid": "d7c685b4-ca26-412a-9392-732c92fe16f1", "comment": "Malware payload (Gafgyt)", "value": "1797acbbe4f4a249a379b80f923363c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359761, "uuid": "1d193f4f-5b0a-43f4-ba10-d47f7237a651", "comment": "Malware payload (Gafgyt)", "value": "bdda2f54c9e7ea759e1be9bbd25892563f229a3204df6d8291e6ff81c4d557a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359761, "uuid": "98e7b2af-be20-4588-bcad-c145df0e6479", "comment": "Malware payload (Gafgyt)", "value": "f8a9570092b91b46a10b0d662061a11c3eb9946b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359761, "uuid": "314b3e83-8e29-4d38-9fa7-4081c0d0b9e1", "comment": "Malware payload (Gafgyt)", "value": "2a2b25525787e2c5e300009d2f11024b1f792ce40d18d11fa4432a3cedd3b6b1a991872cbda3320d1be8faa75e0f1e80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359761, "uuid": "7f89f47b-6dcb-4fd0-95db-720707143e7a", "value": "T1B0E32A24F8404767C3D323FAA64D879E7F3517E623CB33116A389DB45FC2B992929960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359761, "uuid": "8d607e8f-758a-4e53-a440-3f8fa7b961eb", "value": "3072:6hlLp1zWvkO0PXs/DiW1VrdS5hn8eoadVjzmOMDQ4DtsL6Qse:O7J8/Di2RS5hn8eFzmOMDQ4DtsL6Qse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359761, "uuid": "0f7fe078-6a81-417e-b09b-d22995556cc4", "value": 149019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359761, "uuid": "ca0c54b9-ec30-4178-923f-385ee9f5068d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359761, "uuid": "a67b7d2e-a156-4efe-bc5f-b08a42462f96", "value": "1797acbbe4f4a249a379b80f923363c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dc4910-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409122, "uuid": "3a4e758e-f3be-4af8-95cd-934118dae2bc", "comment": "Malware payload", "value": "219386b5ebb6ecdf375939433b43b125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409122, "uuid": "9e0a44bc-fb1e-47e9-8971-4f6501d14e38", "comment": "Malware payload", "value": "be8e8fee33ebbe8b75b5715c5c64c542213abb5d5812c98fbe2635c9eda93e5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409122, "uuid": "af6905cb-c8b9-4e4e-a60b-1064aac88914", "comment": "Malware payload", "value": "d57bf77e40782f0996094acb8eb7b29f29c7c00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409122, "uuid": "fa2d58b9-f39d-42f7-a27e-d77d6c3d1e60", "comment": "Malware payload", "value": "7c2764dda7451ba3fe5d1a56c6cec22ad64ac2b2d4e7e75ed4d3cdf17944ce52aad68c85e17fddc4af16ea9c5474d373", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409122, "uuid": "18721a39-efca-49fb-ad76-76064183b8d5", "value": "T19E63026B3403258FF20FA1B854653BC8BD37A9499714E708E978C19BBE83231B776D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409122, "uuid": "ba138442-8540-4a51-a69e-bd824a19fa9d", "value": "1536:gc4AmkZxFEoxvhydDWGJMX1bUciz2o0LWVEWF:gLuxvsDzHzTbVEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409122, "uuid": "e2fbaa1f-0545-4e7c-a0b9-cb54190bbdf3", "value": 67020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409122, "uuid": "76cc835b-1738-4332-9d3b-481574b1ae6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409122, "uuid": "db1ec9c6-48d1-4e18-b79a-eb7b74fd7600", "value": "SecuriteInfo.com.Linux.DownLoader.598.8965.22917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9104120c-eaaf-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711375026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375026, "uuid": "687834da-9042-47a3-8722-0dcc7bdb8cc5", "comment": "Malware payload (AgentTesla)", "value": "c325a9001b505cff18a25a87d2d57b3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375026, "uuid": "7afa0579-7de0-4ed2-9dab-42ae42becc28", "comment": "Malware payload (AgentTesla)", "value": "be9c4de1bd9e9d924a0e82ded834836b21f3cee35501e66166c1f3e267204baa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375026, "uuid": "5dc9a551-6c64-43ec-90b5-89c29dc58bff", "comment": "Malware payload (AgentTesla)", "value": "40696cfd73b6f83634af9ef958a6f07306a10f73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375026, "uuid": "bda98350-f69f-401d-adf7-de601955dbb3", "comment": "Malware payload (AgentTesla)", "value": "020fbd7b5e5e16ef49355b6e3dd4b92582808aa25f68fa79a0d1f4c9595fa5d0c54b066338681e7060c2c38e0484e2d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375026, "uuid": "8af4414d-1e3c-475b-92dd-4460b525e8f7", "value": "T18AE533224EDF0C96477C5324613E1E5D17435FB88489F0FB12D1986320BFB9E5AAB86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375026, "uuid": "5b6f0122-4a87-4f9d-9b26-dba42467b6c7", "value": "24576:dzzVYYYeBKPerK2BMYzqoRiyaFP62KoH5de/vwyRJ83ppOMCEOBIVQ1su/2sAFgn:dYzgNrmSoUvzSW16s+h6x6yjFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711375026, "uuid": "2a265132-8b8d-48f0-bf39-0c6efda2fe3a", "value": 3058554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711375026, "uuid": "0eee107f-e418-4062-9dd2-18828872acbb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375026, "uuid": "755457cb-28f8-4a2a-ae21-8ca55b259b36", "value": "order - NLDB-082-2024.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7160f2be-eacc-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711387429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387429, "uuid": "e56e9e7e-3b19-4514-b589-b4311e193472", "comment": "Malware payload", "value": "507048fc3e8bf91b8ea467045bc2964b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387429, "uuid": "107c2d39-9e44-42d5-b46b-a57b6f2ad638", "comment": "Malware payload", "value": "bea1d58d168b267c27b1028b47bd6ad19e249630abb7c03cfffede8568749203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387429, "uuid": "56269b52-8db9-47c8-9f5f-d0883d3495be", "comment": "Malware payload", "value": "e790cdea39a0f8c0644425e762488f9fbdea66ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711387429, "uuid": "c1df268f-fb56-477e-b056-b5106913d3a4", "comment": "Malware payload", "value": "9ad08d8319a9c68104f240105a1d14ecc5513640d66fd74a3306287dbcc640d2c4871fe22231e7ee0142b04381060205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387429, "uuid": "25d9b36d-071c-4fec-ab4d-8036fda3347a", "value": "T128B64A07F8A145E8C0EDC1748A6281227F72BC494B3067D73B60B7686F76BD0AEB9754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387429, "uuid": "57662cad-cafe-4faf-b8f3-98daa58bb9cb", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387429, "uuid": "a82b8067-ca61-477e-b2b4-c44abdf95b08", "value": "49152:ooUwF2D7Ah9uRoSouISQFcd2fRMEhax30H5YeFQZc3jg7RaOa1mRI0oet8HOgrbF:ohshoqSPBk2ba14oodw5f9UEHz5QMjOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711387429, "uuid": "8816058d-83e8-42bf-8246-44955c5f844d", "value": 10525696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711387429, "uuid": "f21e8f21-f41e-4816-8c73-9c5b54b4078a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711387429, "uuid": "69d741a6-2b4b-4c40-8394-6b47575bbc06", "value": "CelestialCodes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39038ef4-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401937, "uuid": "1820cf41-01cd-4c0a-a82f-97881f4e6a95", "comment": "Malware payload", "value": "3909a3eb1ffd4b08eb076712dc3cfc78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401937, "uuid": "3d6dae45-a392-453f-b0d8-42f4ee4feb41", "comment": "Malware payload", "value": "bfd240e4856c4db4d44e030b7d7d10a09deecac4b113b35db010c126a81265c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401937, "uuid": "68aa632e-096d-44e0-bf36-e113193a4c45", "comment": "Malware payload", "value": "40b5fc2636d306787fb4f3af0df24bc338ba2296", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401937, "uuid": "58bc4b54-a6db-4726-beff-467061229dbc", "comment": "Malware payload", "value": "5a354711f494978344de343c5443c387d036d3b108ece0c6caaf9d4f4a9cb09ff6e24f6b92db726019e46a67dae887cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401937, "uuid": "85b6a02f-7d82-4f2b-acd9-af837b6351a4", "value": "T1BD53F157314DC9F3D9F00828AA998A06B3171BBDC1CBB4612D4DBA50E2A0B4351FDE8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401937, "uuid": "8d6956ef-33e0-4eae-94eb-a4e45000dd13", "value": "1536:YNsLrLUteCL84oDo4nWU82FtzkgCob9YDnOpJFsQQK:Y6LPCacWWUdF6gJUOHKQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401937, "uuid": "c088a407-eac6-47fa-a569-9b19189cde0a", "value": 65216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401937, "uuid": "bc947330-e406-4bab-b2f2-7186fde26b2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401937, "uuid": "bd40e1f9-0506-4fe9-a988-6c0f0645fd4e", "value": "SecuriteInfo.com.Linux.Siggen.9999.28025.18955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564b673d-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711383947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383947, "uuid": "500c0ba8-505e-4404-b3a6-40889c4eb283", "comment": "Malware payload (Loki)", "value": "9f57033572498841276f3d0d93de980a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383947, "uuid": "7398e7e6-9801-4e49-b059-e3c4ee7c1ae7", "comment": "Malware payload (Loki)", "value": "bffdb577c988ed5e51afa15e6ae61122e05f1101ace3ae9fd045ee98305da19c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383947, "uuid": "1a24ad84-b538-4d1c-bb7c-540ad8924563", "comment": "Malware payload (Loki)", "value": "aaf80fab90cb109158d7d4498c05913724acc7e8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383947, "uuid": "9717bfdd-7873-47e9-9b87-38641e6c5328", "comment": "Malware payload (Loki)", "value": "76f26a0e08dc0be31c1b110922c14a6bdda80ca3746f0163cc4574908990d07d5524071424bec2cf30e7f0ca29c75420", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383947, "uuid": "d16d28b2-2af4-4b68-b365-6df31dd8a8bc", "value": "T18F0491E3CAC526598A861AB3DD134B334DB9009C37171F3993BDD66E60439588ABFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383947, "uuid": "a57fcc60-a20c-4a00-a92b-312e25815df6", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyN:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383947, "uuid": "1b016783-1548-4e3d-abc2-9d12143f98a5", "value": 183813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383947, "uuid": "d9b096c6-d2f4-4eef-b340-aa18adb413d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383947, "uuid": "ca219910-3a9b-4ef8-a701-555534536b23", "value": "Document BT24\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4210f928-eabf-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711381766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711381766, "uuid": "1201dff3-4fb5-4d27-89be-1bf32fb4c4cc", "comment": "Malware payload (RemcosRAT)", "value": "6f76fb672d1db1c3dbe4770981c7fec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711381766, "uuid": "abacf8ba-9b27-4df9-92f6-37e9662466d1", "comment": "Malware payload (RemcosRAT)", "value": "c04f7cfb13eff22b612e0809dd48b2c3ad4e6ab8ea30d0d91fd077194eb52cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711381766, "uuid": "9e1e3c3c-f494-4126-88ea-dda26b85edf2", "comment": "Malware payload (RemcosRAT)", "value": "3d208d34c71f1108a53b5604615db4d71ddb5002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711381766, "uuid": "4a7ffa69-a11c-4bd1-9b75-f165ea59269a", "comment": "Malware payload (RemcosRAT)", "value": "5aacc24384d5418215d638d11487dff70ad9ffe9c43cb914edf98b9f40c8e55fe2125f7e252aa0961ea9b5d89d6c1e71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711381766, "uuid": "95af4528-6131-4788-91b3-f0ca0b2e8139", "value": "T104B49E01BAD1C072D57524300D3AF776EAB8BD2028364A7B73D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711381766, "uuid": "12f6d912-5861-439f-a465-a7fba793792b", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711381766, "uuid": "a0a4a51e-d705-4ff7-81d4-29e01025bd30", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNt5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/Zskcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711381766, "uuid": "54096f2f-4ed3-4a40-8a1e-80be083633c8", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711381766, "uuid": "8194d9a3-61b9-420a-9edb-4bb7565eab65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711381766, "uuid": "889e5330-8acd-4a8d-97d3-f0348391c27f", "value": "x6lYwBfoAxDR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5c0277-eada-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711393514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393514, "uuid": "f566e43c-a299-4945-abe2-25b74f42f9aa", "comment": "Malware payload (Stealc)", "value": "43c5713ae4558b597efd3bc9c222b717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393514, "uuid": "969538d1-8232-4ae2-a99e-d54a1822dc3b", "comment": "Malware payload (Stealc)", "value": "c06cb240f563375429c18acd4d62f8cb0bfd87955decbe6e0569b58f734e1fce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393514, "uuid": "16053a12-5b34-41e7-9360-c480551cb772", "comment": "Malware payload (Stealc)", "value": "2956770b8ac99752906f2d9c4a7701cab822339d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711393514, "uuid": "d9c53dcd-7061-4bf4-9e15-d8167a7c118e", "comment": "Malware payload (Stealc)", "value": "7d42de550ba979d93ca305ccccbec5316a21a6c793804c18d09e303c2489cc3975fee8f53c05c8d353284b327fd841bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393514, "uuid": "51d877c9-6741-416f-8f47-0467a3cc077c", "value": "T11AE33B10F503542EE4A304FF6AAE5F7AE59869A20315C1C7E3D06B9827F01F6AD7462F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393514, "uuid": "84749f86-b1b4-4b54-abe4-786cebe25316", "value": "1ef0d6e4c3554a91026b47d9a27bf6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393514, "uuid": "f88ab27b-0a21-4415-8ff4-fd8280974a1e", "value": "3072:NvtlGc6fgpJSG61doHN4N4QSUukO/yIfz4ZhBJuOy:NvLJryZoI4RvkOK3nun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711393514, "uuid": "d7ae948c-26b2-4b9d-a862-66cec193be1c", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711393514, "uuid": "bdaba855-cbbe-4221-97f1-f3338a90cd4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711393514, "uuid": "b022bdbf-74da-4d91-b46f-708430305b84", "value": "43C5713AE4558B597EFD3BC9C222B717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adf9048-ea8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359796, "uuid": "aa057dce-c313-4a4a-a5d1-7260d7970428", "comment": "Malware payload (Gafgyt)", "value": "67e7666bab427c80a523d5acd1bda5c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359796, "uuid": "0635680f-d796-4d85-afda-34eb91389cf4", "comment": "Malware payload (Gafgyt)", "value": "c0b3560310b81998442ba520db31b4b7a517cf05b746a0c7095d7b025eafdb20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359796, "uuid": "35f10b27-df9b-4be8-8764-94718a1a6c68", "comment": "Malware payload (Gafgyt)", "value": "e53d26288d704181aafda1fc55c1ccdb6f70d2b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359796, "uuid": "40e44ded-b83a-44ab-aeb9-a6de210c9959", "comment": "Malware payload (Gafgyt)", "value": "c6aafd29e059331411ac8f9b466fbd471a0709d097ea2b6e45b11cb953770b7b0b7db638542387d44f831823006d5366", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359796, "uuid": "4a2416a4-668d-4910-a4d3-5c43f560dab5", "value": "T189F33B24E4404767C2D313BAB69E866E3F321BF653CB33115A349EB41FC2B992D69874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359796, "uuid": "05139889-1efd-49be-b424-e416699c0e1d", "value": "3072:cyd1BPL8Z60aMnGjuog68Fi5Ly5hM1D1/6JrTKxmfQOYbr5Wn:Lz060auGjJ5Ly5he/6YxmfQOYbr5Wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359796, "uuid": "7752e967-19a7-4a05-9743-3c3db4cbb05d", "value": 170949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359796, "uuid": "81e69c05-792f-4c2b-a205-217d6c8016d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359796, "uuid": "3a188557-fd07-40ff-8a11-0773613003e6", "value": "67e7666bab427c80a523d5acd1bda5c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7056823c-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711365523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365523, "uuid": "ece3159d-374d-490a-8c2a-57a50480843d", "comment": "Malware payload", "value": "af5ba6f16dfb4a2e5ec62cd539400aa7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365523, "uuid": "a978abf7-b4c7-4417-8440-890d7882af27", "comment": "Malware payload", "value": "c1c622dd11fd5ef3adfca6682db7639790ec048ddce7075c837cd8458fa763fb", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365523, "uuid": "0490dac2-af31-4aba-adda-d33cdfbdfbaf", "comment": "Malware payload", "value": "9ff2b2d1a5501b1e295a09e842f49af9a846ec63", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365523, "uuid": "b2ca1a84-f5ef-468e-8698-3f5b97807e60", "comment": "Malware payload", "value": "ad2b66ac5bb1cdb73286869f30a7c42b359ba76f07f3de682b2099ce4d727b034b4d42468cbeeb80b10339f5588bb584", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365523, "uuid": "935e8830-9dd0-4f2c-a0f1-335b901bdc87", "value": "T1B5D5182919DF120EA5B3FF629EE47DEE8D8BF672540958ED108507478B03D80EE2693D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365523, "uuid": "6569943a-f790-4fc7-a047-093eb482503c", "value": "12288:pgUEuxWW+ZMcV1vvLWrG/JPsSCP+XqyPpXmfp8SQMjQ7IOvRcypukrmyZYKH8hyH:eU6jkmRl8hwNu1aQ9SbNnDIDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365523, "uuid": "9227ead3-fc84-402f-ba68-c8b138eb5cdf", "value": 2861926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365523, "uuid": "50088a4f-e594-498e-b41c-9bff458d9607", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365523, "uuid": "723dbfb0-2ac0-4345-a79c-21e0bd5b51a8", "value": "newdrop3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962ecb21-eaa5-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711370740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370740, "uuid": "f2512224-6d2e-42e9-a763-dbbcbdea7e1e", "comment": "Malware payload (RemcosRAT)", "value": "a9438d893c19d866cf720a581c9476bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370740, "uuid": "6fdb0173-cb8f-42dc-a87e-d339ff2870bd", "comment": "Malware payload (RemcosRAT)", "value": "c204c4829e79a4b78fdeefcf587eabc6e508402d132d00e37c74fe5fe8cf325a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370740, "uuid": "5b9d40b4-ebed-4b9a-a38a-f4c1c4cb55e6", "comment": "Malware payload (RemcosRAT)", "value": "76207198002c4e5188d7a35cb5c64bec0d7a4453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370740, "uuid": "188a4417-9f50-48c2-aec2-2f340a45cfec", "comment": "Malware payload (RemcosRAT)", "value": "0375db461d7a2238e2c2b91affbf62cede4194f85b9a0ee9362031ac6f5fbc1f676bc6daa6c3ad67097e9e76859ad2bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370740, "uuid": "68f5f382-7d97-4ec8-90ef-77af7b22e1fe", "value": "T1AE437D563550C03AC41650754839C2B29B7FB93116B6C587BFD80BBF5F322E9AA3E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370740, "uuid": "f1f7f52b-b436-462c-a8f6-4803d6e0449e", "value": "4749670ac3d28d6761142b0dcb4f5076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370740, "uuid": "caeaad9c-518c-4e5a-ab1d-58b822c91857", "value": "1536:NWfqqj/DMFv8I8ReUWflaCoa7CYsIRJFdQ:NGVDSbca7C7IRJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370740, "uuid": "48ee5838-b295-4305-9574-1d2413b9d15b", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370740, "uuid": "df4fad90-c4fe-446f-8daf-c220fdaae733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370740, "uuid": "4c0887d0-1bb5-4e15-a45c-c3a631c1db50", "value": "iMOyFZuS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47198990-ea9b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711366312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366312, "uuid": "31c75114-5cb9-4b91-acca-f1b40a22dd05", "comment": "Malware payload (AgentTesla)", "value": "5d6dc0cc7530a4c720d000ebd2818bdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366312, "uuid": "a92cb0ec-c2ec-4d98-bf4e-b19e908ee237", "comment": "Malware payload (AgentTesla)", "value": "c37ab5dfe51203a7597c48320584457c90fdfa9c9d0f8f6a86e24a5f1e719463", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366312, "uuid": "ad7f067f-4a11-4063-9980-75851a174e75", "comment": "Malware payload (AgentTesla)", "value": "1d7506c3bb104fdf4eff1a7502c24d26059cb060", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366312, "uuid": "5f0b7358-72dd-4ba1-896d-80223a344317", "comment": "Malware payload (AgentTesla)", "value": "15cc505254002ea043228d67b2d3f1b7871f99cbaac9b7de1f681dfbe58b04248f0046e57e65f4b64d7ef7eef8bc020d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366312, "uuid": "b88b78e4-cf53-42a2-abc6-5bee6e014904", "value": "T16AE4121EB7A803B7D2AA43F1567B19487376502B2365C5081EE451EE23B7F008B76BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366312, "uuid": "0411a655-e71d-483c-85a3-870a12cad4d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366312, "uuid": "32bc5535-906b-4e1b-9b0a-4845be9cb0b0", "value": "12288:mjUgC74CMw1+i1kfj9M0FbBJosy2f5huX5JJ5m5OMz7VpkKI:mjUFn+i1kJ1VpUX5T5bA7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366312, "uuid": "c9c275ca-76f3-4fc7-afe3-17c3bb0a2a58", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366312, "uuid": "b124e15f-0f9a-4cf8-ab4a-2722154c4afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366312, "uuid": "b9656dc1-39df-417c-9f29-ffe01a7fcaa4", "value": "Quotation 1563058092XXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0567f92b-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (RevengeRAT)", "timestamp": 1711383812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383812, "uuid": "275cac24-aa9f-43c0-bfb4-c6ac387cc98b", "comment": "Malware payload (RevengeRAT)", "value": "a1d2e92429553425cf7505c8563b84ed", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383812, "uuid": "1e78770b-662d-42c2-a067-53bd5348e6a7", "comment": "Malware payload (RevengeRAT)", "value": "c495ec8d688d14f6e90a75d6570ffbb3f34cd716e05f661a5c57acaf7cccc10e", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383812, "uuid": "d61fde86-d6d0-4e0f-a0fc-1f802d58d2ea", "comment": "Malware payload (RevengeRAT)", "value": "d5550fa4da1db73fb15f3fcdd8935504350c392b", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383812, "uuid": "8cc0e4c9-9d80-49b2-afe1-fbed726cd7f1", "comment": "Malware payload (RevengeRAT)", "value": "c5edc470825b26946831762a14c152bb5f635dd4bed6073f56c86c426bd92e808537cd9d5070260ad5041abe4e93f32c", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383812, "uuid": "050c3f51-f1de-4cd6-81db-3f1aede34f2f", "value": "T18C42AE0FB545561FD62796F9720A7C080F1FF24A516ED30BBA42F18D199D74B3B090BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383812, "uuid": "550f5883-ccc2-48bb-a61a-52371d998464", "value": "192:xrXP/Rz9m/qgC0XvXUyhRT2QiDjhmdihVGBZGinvSo0Ctbc7PHET:dXPWqgvXmQiDVm8GBklWbc7PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383812, "uuid": "d605592b-456a-46af-b506-f5e61c09c44b", "value": 12957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383812, "uuid": "325a10d4-4e4e-4cc1-988b-4214e49f7c91", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383812, "uuid": "04474dbf-ff71-4074-be32-1aa105bd146d", "value": "Reserva Detalhes.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399fec5b-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401938, "uuid": "9b00b694-0851-4481-95e6-c49402318d31", "comment": "Malware payload", "value": "aa862b9c1a071ea75622ef8d506e1dda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401938, "uuid": "e4618078-b60c-40af-bfdb-117dd46d32ba", "comment": "Malware payload", "value": "c561b3c6cf8ca5288935a8aa1c9d0d4b74040d177eaec2dd3538ccdc1f345e40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401938, "uuid": "d9c57e94-59e0-4593-8494-fa7e9748ecac", "comment": "Malware payload", "value": "0c203cafd5edde1f1af2686226089d241274b1a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401938, "uuid": "9996347a-6617-4053-84ac-5b8708d1d61a", "comment": "Malware payload", "value": "75cb12c30aec62c6dca005a028b9c006916e2afb3bf434a303da081905d6db95a3072e632c7e25f7747931de5bc2f27f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401938, "uuid": "ebca0f3d-7fbe-4a78-b322-a729d179b8d9", "value": "T1B45302F2D317D87CC8A8B53E666D429DADF5B010A10FE84740C57687BC3C865A232F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401938, "uuid": "9578e24c-3ec4-41e8-9d5b-cc0f95fe9a4d", "value": "1536:dOpWaZB1OdXTW++ABiCzf0+6W0tc4nVC+Rp:UpU93oCL0+b0S4YSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401938, "uuid": "23fb8da3-349e-4fa6-9fc6-87bfa7152ad5", "value": 63372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401938, "uuid": "6b69faa8-ef12-4f76-9c79-985a77420b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401938, "uuid": "4ce3344e-d090-40be-b422-17708b4a725f", "value": "SecuriteInfo.com.Linux.Siggen.9999.21167.23279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe4fbd0-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365388, "uuid": "ba793189-1759-4f1c-b786-bdf5bc336c81", "comment": "Malware payload (Gafgyt)", "value": "5cceeed3983a4f311d7428797d531425", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365388, "uuid": "43583fc2-d452-490c-b923-c1ee4a286e0b", "comment": "Malware payload (Gafgyt)", "value": "c5c5328917f5af36c486187574156b90cdeae273523068dac062837fbd1108d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365388, "uuid": "a7d377e9-c54f-4d4d-b5a0-ea7bd83517be", "comment": "Malware payload (Gafgyt)", "value": "8b3772c82cf1951ed9308705203099857e55f4a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365388, "uuid": "156fcd0e-0310-466b-8ad3-bd58d085638b", "comment": "Malware payload (Gafgyt)", "value": "e9e4dfe9976a02bc6342c5ef48df3dd689a45ae7facdb60b76b6fdfc095fd1b23771b2492ceb74f7ccc6370d58bc415f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365388, "uuid": "00129fba-38e2-471b-963b-cd5cf877cc07", "value": "T13AB3F856F804DE66F40BBA3A05D74B21B630EBED4E931D2272273967B9722C4E423F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365388, "uuid": "210647f1-4889-4e00-8d57-b6dfe5a95631", "value": "3072:sijWA3VbS8Wgzk5ik3yW+eJ3PK2maK7uTyOUiC1:siSA35S8Wg2yWvJ3PK2maK7uTyOUiC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365388, "uuid": "c6b31a16-9e58-40b8-bca7-8cbef1d3b32e", "value": 115223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365388, "uuid": "b1594ac7-6fe9-4416-8eaf-6f9f819a642c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365388, "uuid": "a130cf98-75a9-42f6-b8bd-6582bdd3809e", "value": "5cceeed3983a4f311d7428797d531425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746e9d9c-ead0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711389152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389152, "uuid": "7b761388-f9fc-492d-a967-d43275832a8c", "comment": "Malware payload (AgentTesla)", "value": "f9dbc840710615a02ff1f964aba0828e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389152, "uuid": "8ced9ad8-edfc-4bfd-839e-7247db088c2a", "comment": "Malware payload (AgentTesla)", "value": "c67364d7cdad141966f7e14ae1ab855568fd781d96ea847c5575359537312c17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389152, "uuid": "6350da3a-afb5-4664-8be8-89e07f6a4800", "comment": "Malware payload (AgentTesla)", "value": "df64cda83916f0313ee0b659353f172424ba187c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711389152, "uuid": "d4293ce3-5b32-4d23-9df4-256afd7da122", "comment": "Malware payload (AgentTesla)", "value": "3670f09c723dfd78997ce81e8b55617d3a63b86dd73ea228ff9e296d2f69793558b8f1f6b5b6e6f24e6776983173baa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389152, "uuid": "5df05da0-1214-4c28-bdb4-4a59747dacdd", "value": "T1DC459E3273818322FF9B9D32CB5EF61D46786D260123A51FD39C2B79B9F0161463E662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389152, "uuid": "8656bb22-8b46-4019-9716-6fbde8ec3ed1", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389152, "uuid": "7c482775-868f-4d93-817d-3f4db2fe1c86", "value": "24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aFoauhP3:5TvC/MTQYxsWR7aFVuhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711389152, "uuid": "01c83c98-9296-421e-a255-4b62e85163cf", "value": 1185792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711389152, "uuid": "d8bcf041-e829-4d71-9417-44ba4518044e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711389152, "uuid": "582b1486-5fda-4468-a8c4-8fc7ab7e1ae8", "value": "RFQ-5662545178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d460382-ea91-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711362135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362135, "uuid": "ce79be9f-bda4-456f-8b98-a3a10b47aaf9", "comment": "Malware payload", "value": "3d9e9dd3e83c43f38327a04670113d40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362135, "uuid": "89cf90b7-d24b-44dd-aee9-dbebae535a37", "comment": "Malware payload", "value": "c683a00adcd645c6a48da21e7466eff13a193e3595b1f63e940a31776eb6d53e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362135, "uuid": "9751570e-544b-40f3-98c7-2172a119abb6", "comment": "Malware payload", "value": "56267b043d2cbb5fe8aa934191846c650c7bef8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362135, "uuid": "64f6e707-5f7b-42db-accd-d99d69fce50c", "comment": "Malware payload", "value": "681c1e0af492792918bd1b32e0192dce2ed7e10a924d89c4ac1f303f7921ee51abb860ad1efd5c9ca890bbad86fd9d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362135, "uuid": "9bc7e988-a0e5-4f93-a908-355414470dfc", "value": "T15FD3F0057B90C467E9F64F714AF583EB2EB6F52228244B4727C02B1E7DA2791EE1D342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362135, "uuid": "090c3649-e1d0-4ec4-a8e6-bb4ff5117e15", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362135, "uuid": "faeb5766-9f62-4f71-b209-41fe32ac72e4", "value": "3072:on77v00hEoDEtausceASnFSzV8DVRe6FaWaH2tvhOEA1RJCir86SrSrn6Ia3a:o740IcmSSWW65s2t0EyL+iaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711362135, "uuid": "ef62c1a0-3213-4322-b449-e654044a55fb", "value": 139277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711362135, "uuid": "13adef88-830c-4d39-9f4f-845cdc36eb6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362135, "uuid": "edfdb4c1-eba2-434e-95ac-7ac8b609c608", "value": "SecuriteInfo.com.decompression.bomb.17315.15223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a26371f-ea85-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356869, "uuid": "61fc8c09-fc7d-4450-bc44-0dc8e1948882", "comment": "Malware payload (Mirai)", "value": "30cd21f4e472e4e2191cbecf4dea34f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356869, "uuid": "7f874629-2897-47ea-ab88-d67530160d03", "comment": "Malware payload (Mirai)", "value": "c6851adf4f68fbb3690986886eb2eb17c9aa344bffb0b09ca419a7d3e6e07ee3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356869, "uuid": "862cd00e-153b-414a-b3ad-e618c1684806", "comment": "Malware payload (Mirai)", "value": "eae90f1ebc24b2017df39fcd662c1fc3c07d674c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356869, "uuid": "eed8abbc-9d91-4b2f-ab62-b39a55a6072e", "comment": "Malware payload (Mirai)", "value": "481b124e9e1df1c29fad84e7e329a5065f87f594ecb218c22800609831a02e438513544f3d8f95bbf429af87ae0cbae8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356869, "uuid": "188e21f2-1ced-4a68-9d2f-4016e75ffadc", "value": "T164334A60730C0957C1931A70293F5BD19BBEEFE122E0E6C265AF5B868474D73958AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356869, "uuid": "d05b2005-c790-4d97-9e22-bac2e0e31aaf", "value": "768:LNf2CDQtxzpyboHDbLV7fxyXPWMbJ6vIc4M3/bwcZY10UEX:pctxzpOYe8vIRSMca105X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356869, "uuid": "cf9633ce-da16-4cd3-9e64-23e12d37a9c4", "value": 51648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356869, "uuid": "a46a947f-ba6f-491e-a73f-003840a6dbb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356869, "uuid": "e4a9b5bc-9968-431c-b848-d9eabc8f2ac9", "value": "30cd21f4e472e4e2191cbecf4dea34f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132c044f-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365366, "uuid": "74a80420-c459-40f4-b8e9-80f53640ebbc", "comment": "Malware payload (Gafgyt)", "value": "ca5a75338015adb7f508108c6e2bd199", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365366, "uuid": "fc55a9d9-6550-4adc-83b6-677befe671a0", "comment": "Malware payload (Gafgyt)", "value": "c7170b43119c5f979dcc529944b345fd4f7b7358c526a8e1dc95b9125f98048d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365366, "uuid": "a28ae77a-7207-4140-9ad1-fd3cc3787928", "comment": "Malware payload (Gafgyt)", "value": "fe826223a0629d023650d1b9cee4751c0b505e73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365366, "uuid": "66073f95-ae29-434a-85b3-4a94bbc5b06b", "comment": "Malware payload (Gafgyt)", "value": "f7bac5be26c4afc8befcafa33455ff3544a0d172b2477fb328df0e8f87225f8185ca2c7f85b11998ba1e9bbeac5ee985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365366, "uuid": "f5c5b758-8ea8-411e-bbc9-fa2b61a2e994", "value": "T16AD3D537A7D73E23C0C9943146D30221BD79DB6435BD13DBA4A09CB92F2AD643492BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365366, "uuid": "bc2f57ae-b718-49bd-adaa-3c15fc64026b", "value": "3072:WHnzNcjhowwcsN8JRphacJvC/qVUKLuryOUCT1:WHzijhK+/phacFC/qVUKLuryOUCT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365366, "uuid": "cad61b69-3bf8-4bd9-8a01-6861287c3363", "value": 133942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365366, "uuid": "18882512-7f9e-4de5-8a05-50dbb7c935ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365366, "uuid": "b39705bc-c65f-4014-8eca-80cdd6be3357", "value": "ca5a75338015adb7f508108c6e2bd199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ecd418-ea85-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356883, "uuid": "8671f245-43d7-4294-84f0-e3d1f2160208", "comment": "Malware payload (Mirai)", "value": "a3226f7e62aa97540b853094ebc18f18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356883, "uuid": "f35ad106-1158-4081-b9d2-fd8191355073", "comment": "Malware payload (Mirai)", "value": "c7e1993166dc1f2650a37a3611d40c4f6ab8372a71135b497709c93341d9bcb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356883, "uuid": "ab4021b0-7207-46dd-9334-8c75cd7efed0", "comment": "Malware payload (Mirai)", "value": "e2eb7cff5c74c220d8a6815bcbe8306d9f6d5538", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356883, "uuid": "5ec90ac1-b60d-4edd-bd4d-558bb5051ca8", "comment": "Malware payload (Mirai)", "value": "294949a0d7f56544580b1b6591dab20a2e5587eb9ceb1d24c2a4d85af6a50b01d4c92e7c72c897361fd4affcedd91973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356883, "uuid": "d25b7ecd-0dbd-44ff-bca4-54b27490825c", "value": "T1CE330996F801AD7DF90FE67A58170D0AB93163D542C38B3223FBBDA3AC3219D5912D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356883, "uuid": "6023bcdb-0265-433b-bb2d-0e7da2a9750f", "value": "768:hhelJQbi4O9EF2dm9wGut85G2jq1ykvTiTQYDEgXZG+VoQLDhr:XUmE9EFQm9wvt85G2vkvTi8Y4NcLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356883, "uuid": "b137e9b0-80f5-4e40-bd63-400138775f73", "value": 52228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356883, "uuid": "42b60278-2c85-45f0-b27a-dfcbc37d027f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356883, "uuid": "28a6557c-79b3-4eb8-9607-14d2eef400ca", "value": "a3226f7e62aa97540b853094ebc18f18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9bfe01-eaa5-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711370781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370781, "uuid": "02e4fdb0-f0f1-4826-a68a-e81c4fc59218", "comment": "Malware payload (RemcosRAT)", "value": "e43fcf60b434a68344d602cce5e32b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370781, "uuid": "bc49ddcd-149b-4eda-8739-a42f694885f6", "comment": "Malware payload (RemcosRAT)", "value": "c836fa8942e3a26fd68bf4de736d4758f3531efc8ec38510e0216d7df2bd7ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370781, "uuid": "c6d9ec68-cb9b-44d1-8e05-1cedd699f19c", "comment": "Malware payload (RemcosRAT)", "value": "69d09236b07a58d336f1dff4142b3709d5e30216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370781, "uuid": "60942073-f933-4e17-bf67-da0c7816f651", "comment": "Malware payload (RemcosRAT)", "value": "396b79f90e5202edbda072571c3653ebe67f6791de3499d42ccd35bc7e01a18d61217a6f6724a8307f585c6c42693513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370781, "uuid": "6a62c11f-a8f9-4dd9-8b23-d27e52918b37", "value": "T1A94384078600C03EDE9401B441EBDEC212FB6778E38EAAE79FD4511269525FF6CB0460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370781, "uuid": "f8c69a21-b774-4bde-b059-6ce93d537c9a", "value": "48:cUDdjByfFGxOgw4txVrAus1hQqEktq17RZ/Q3WVLLm:7D+tKOqtHAusyaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370781, "uuid": "90ded46c-bdeb-4509-9233-9991c252289f", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370781, "uuid": "99719a5d-d673-4b72-8bed-fea853ead56a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370781, "uuid": "fb72a07f-9b2e-4cb6-966d-ad42ccc32b39", "value": "MtpACkkh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fb901f-eaa4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711370122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370122, "uuid": "a3c93b57-4645-44d3-8412-8befdb842754", "comment": "Malware payload", "value": "1e3a61ccf2ecee426403085ebd60885e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370122, "uuid": "b045167e-3936-4c80-abed-c861f68ad3bd", "comment": "Malware payload", "value": "c8e26ad5a427f3a46098d65e1ac16f2ad45ae634a4b2edabe7d1c0ce012aa798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370122, "uuid": "65d6f73d-95a4-4ec1-b81e-4e766a059d8c", "comment": "Malware payload", "value": "1f8b4d13aa55a3c2367fc512e4638cff90d94958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370122, "uuid": "5728a44f-d100-49e1-ba85-cb02a530c3e9", "comment": "Malware payload", "value": "b95ea86da560680f855120a55a17c7d41e3aa97353037d90b589ed8d0a3e46e9e6ea117c6a7815352d3aca0d051a62d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370122, "uuid": "5ae44163-c0c8-43ef-bc5e-08e6a5bfb91b", "value": "T170E34A98D983B17EDA0348B2418FF2BB9238A73115309D17E24C9E75FF369F15940AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370122, "uuid": "9800dd65-d1c7-4a81-bdb1-219c5e954ac1", "value": "eebb8ecc6f8d13393737435d389e3d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370122, "uuid": "ce295e0a-ace0-44bf-aceb-aef9e17771c6", "value": "3072:eqeQYnaiIANwkK44yrdb5/RrrekstlnqY/M2+ae9xLT/LHkKJk:reXnanD4bdN/R2kwnqI5+ae9xLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370122, "uuid": "4c5a059f-0eca-49a1-92fb-3c6abf52250b", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370122, "uuid": "37f7cfc7-6401-463c-842a-bdac9e3927ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370122, "uuid": "76482ad9-f73c-418c-b829-5a0549a9eca1", "value": "SecuriteInfo.com.Trojan.GenericKD.72021345.25176.27185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef587b6f-eaa4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711370460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370460, "uuid": "ef899198-314d-4f91-8dde-ef3347bb50e6", "comment": "Malware payload (RemcosRAT)", "value": "1c759ea6f86b05ee9837c66fc35d8fbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370460, "uuid": "0b7a99e5-868a-46ae-a363-630fdeec91f1", "comment": "Malware payload (RemcosRAT)", "value": "c98f4135f4c4eaf6e0ee4c0cbfce4682b1f45026df74c0d015b62b69da9674b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370460, "uuid": "0408955f-fd73-469d-8222-e9d6c5f0ad03", "comment": "Malware payload (RemcosRAT)", "value": "0384bdc41ecdd84ad480ed0f93c17e5f01d54563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370460, "uuid": "ed01708b-ec44-4f04-9de6-c1e5e7d91fb8", "comment": "Malware payload (RemcosRAT)", "value": "d5723342482bce2fb05058f3f019e007a656e4d02f486703cb6b9e51230b70de5569e466113b39626334b7a666b6c5a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370460, "uuid": "0bbe8972-540b-403f-9555-36d8e9807ee6", "value": "T19A437D242650D03AC442A475453D82F29F7E6E32116AD9C7EF951F325F322DAF63E24E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370460, "uuid": "43b466f5-6a55-4826-bb74-b06f02216693", "value": "768:NiHaGmJqj/DkKqn5FKwQE8IWlReWfDWf9zTjaCuGiyqFdQ:NWfqqj/DMFv8I8ReUWflaCoFdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370460, "uuid": "e326e2b1-3894-43ef-abf5-8b154f36fb05", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370460, "uuid": "4abc7a09-ffcf-4902-a4b4-11e4f8308a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370460, "uuid": "e216aa06-49e2-47d3-9f73-9bfd20950934", "value": "BQkrRFZe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbba43c-ea8a-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1711359101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359101, "uuid": "32dc9211-6726-439d-acdc-ebfb607a82bf", "comment": "Malware payload (Vidar)", "value": "763ffb80e9ec279e081ef0fbc7b64ece", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359101, "uuid": "a4e9b766-6b25-427f-ab9b-761583595e75", "comment": "Malware payload (Vidar)", "value": "c9cb32e5640fa80d0cf9fdf066c74731393a76394f06039ce894a243da56cb74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359101, "uuid": "ba77eb65-39fd-40f0-9702-376d40e0f2a3", "comment": "Malware payload (Vidar)", "value": "c348bf347c5d74c73f223efad48b7d95923c502f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359101, "uuid": "36ebc5f2-fb49-4a24-9197-f44481f01749", "comment": "Malware payload (Vidar)", "value": "83354f12cb918447230f7378dc58307544f5e3759770bce1e8f6e57382ea5ee92811a48713cf6850576231d94d3df883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359101, "uuid": "390a0d91-c9fc-45e5-a205-f33d707c5fc0", "value": "T165240216F3AB5674C92C8F7588DAC6040BFA43587E17DA9FBA4F2E051C93B8AC711391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359101, "uuid": "549205e9-a498-4aab-8f58-40dcf5c72506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359101, "uuid": "1463d0d5-1761-436e-8eba-10038426da62", "value": "3072:nhyua89gGI3OVBfMjjIoLXpKh0YzIv+/oDsxV2y1C/qqPXq9XVqpti7rN7nhZ9or:thyjxL4h0bg0mVD1tqout2RjhwsU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359101, "uuid": "a1046e12-aae7-49bd-8f62-32c8b91e2eb4", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359101, "uuid": "4cac40d1-fd58-41bc-8490-938634ab24f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359101, "uuid": "5b6193be-06dd-48d2-8479-530deda0d93d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ae7db1-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369818, "uuid": "4da36132-bc56-48bc-a72c-cf4cabe5ff34", "comment": "Malware payload (AgentTesla)", "value": "893ecd485c999112ee703a344ace974f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369818, "uuid": "de9fb4d8-d29d-4386-af0c-7370c216f0e8", "comment": "Malware payload (AgentTesla)", "value": "ca647bc3a505b371e10874685d6dfd703f645faa287aabfefa7186c6da7c8de4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369818, "uuid": "a15008d3-11f0-4b01-bba9-150f39be6f36", "comment": "Malware payload (AgentTesla)", "value": "2f5324f71504473c2f6ed2be4065adf4a0c7ca39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369818, "uuid": "1a196535-3a8a-46dc-980c-98c4f684d300", "comment": "Malware payload (AgentTesla)", "value": "603e75c68b6cea778ad38d798822b782ce8d2d80356270ad3e6c88c2bab31c1c5da5b33544becbe243d2af87f5197abf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369818, "uuid": "2eb6a2f2-67b5-4ec5-b0b9-f9fbabea5ffc", "value": "T16134FE037E88EB15D5A83E3782EF6C2413B2B4C70673C60B6F49AFA518516825D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369818, "uuid": "9e70aa9c-1b94-4a7c-a56e-20d3614bdc02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369818, "uuid": "d2eb2f15-cf5b-4711-8c69-3475cb515a86", "value": "3072:2XBfeCmyt1P1nb46Wm928nLs5rhJgL+G:2XBfeCmyfP1nb4W24Svg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369818, "uuid": "32b2cdef-b36a-4147-9b37-21c97e065ce3", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369818, "uuid": "2982b017-f4d9-46a1-bb34-35186c2a2f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369818, "uuid": "f55f453b-6c3a-43ac-8f2e-0f71837882e4", "value": "ca647bc3a505b371e10874685d6dfd703f645faa287aabfefa7186c6da7c8de4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b842a8a-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368360, "uuid": "9d664522-65af-4abf-b7cc-6e7e475a37fa", "comment": "Malware payload (Mirai)", "value": "cbf7753a682f24d4a1b9fbc79cc22720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368360, "uuid": "ad7f53aa-b4fe-4a7d-a88e-8468d413fab6", "comment": "Malware payload (Mirai)", "value": "caa046dba7411b0c3b25a42eec100643cd59f24a2c097db11efc936524fe15c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368360, "uuid": "60b5ccf3-8877-464e-967f-ac6d8acc3b3e", "comment": "Malware payload (Mirai)", "value": "7b9e3a5f109c1422ea56814fd0db659ef437235e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368360, "uuid": "707090a3-2531-467b-87ed-32904750750c", "comment": "Malware payload (Mirai)", "value": "56749c9328a3645faabb1d7b851ce440fd43559766fc016d68faa226d84945e62ca1b31d59640096cd61e4f9b9412043", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368360, "uuid": "af4fa9eb-624a-45b3-aec0-aaeaee703ec6", "value": "T159430264C289918B4BD67C7A905E01C0AFB917E6B1FCAB6032CD1329625EFCD453E1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368360, "uuid": "92c5adc7-7a4d-424e-a4fc-3c997af5a447", "value": "768:mt4HgH6uabHW0T60p12F7ds3vRH0oyr5ae1TfGI0krRFTnSjRYbZq1MsNiGCcE3W:mtZ6uq20N1S7EpUoQ5aif0krRFGlsqTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368360, "uuid": "4aa46d07-4ef6-4aca-aa0c-7c62f7f33739", "value": 58076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368360, "uuid": "ae8730c6-81cb-4eb7-9f9d-c66d2c462332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368360, "uuid": "ee65c96a-91e0-48cc-9477-a36783efdda7", "value": "cbf7753a682f24d4a1b9fbc79cc22720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee5e136-ea8a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711358943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358943, "uuid": "dd3cbcaa-b611-43fb-9a53-c01c5add99a8", "comment": "Malware payload (AgentTesla)", "value": "5d214c711766dfe3d505a2ea55a66797", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358943, "uuid": "55545ebf-dc14-4ecb-ae6e-36cadd58c2fc", "comment": "Malware payload (AgentTesla)", "value": "cc01947c77b007c115766cfc45885b9c9363afba490b38516d0e82a80d185ca2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358943, "uuid": "2c9784f3-edb6-4fbb-8351-5a8c85866f34", "comment": "Malware payload (AgentTesla)", "value": "6be12d40e82146617a596ac2ce73c16996755bd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358943, "uuid": "15eec47c-c1a2-4ca2-b1b7-93ff20dbaf3e", "comment": "Malware payload (AgentTesla)", "value": "41f14a6123fb06f38f9f060a3859f62ecdeea2545eec92fa488c182f75c9258001f99810d67bd061cc82ecb10e2805a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358943, "uuid": "efdee904-7cbf-4f08-bf07-cb0225db62b6", "value": "T11CF4120976BC2E27DA7FAEF34866009553F1A13F2066D6EE2CC250CE59E2F411B56B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358943, "uuid": "fc33de0e-db10-44e3-80a1-ebe8b7ab86b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358943, "uuid": "0bbef872-1b47-46c6-b427-77a3b4da0128", "value": "12288:+t4CMw1DQdl38VgcTsO5D3xXiYKx5sN3asc9qnW9FaA:Sml382LoxyPwP29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358943, "uuid": "99afe5e2-7164-4ab7-8c32-1f1dc6f679ae", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358943, "uuid": "316c78f7-bb3f-4d5d-ab46-2cc74f50bbce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358943, "uuid": "79c9fbe6-e954-40b3-ad6a-908dd53656e1", "value": "rSWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d896b7e-ea84-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356525, "uuid": "7e964984-8471-4f7b-aedf-822e741f50b1", "comment": "Malware payload (Mirai)", "value": "297ccccb9b91b91231e8e7156c76bf63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356525, "uuid": "8622835e-fdb2-4fd7-82c0-6d8078bad0c0", "comment": "Malware payload (Mirai)", "value": "cc24c3bab0cb491ccea6894d57d3144c2f361e8203e9978aa8d458abb380dafe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356525, "uuid": "fec1d9d3-22ca-4491-b4c2-52375f7c33b5", "comment": "Malware payload (Mirai)", "value": "fe2eb3248aa60a9cd8a6ccebec6e2794444af54d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356525, "uuid": "d12f1650-352c-4b4d-a147-8f2c0ef554b6", "comment": "Malware payload (Mirai)", "value": "f5afcfaaf832cad40638ca50e3b74dc75ea00930f3ec6d84dbbe3cf6b2c1e92a948971586cb1c53c85bd16bbb0b23672", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356525, "uuid": "88c950ba-8c48-4d0b-9dba-9486aaa1f758", "value": "T17C53B4197E225FFDFAAD423487B78F115A5923D632D0D6C4E2ACEA001D7020E245FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356525, "uuid": "3f0dd5a0-20f5-4a9f-902b-f31387b1ef5e", "value": "768:xAExP4KAKeIAMC/Ljo57/Ed1yKQ5PO8jZa+mV/u6FTo8w1ZY10UJv9iRve1:+qP4phIAp/LF1yKUfdmcITod1a10Zg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356525, "uuid": "5ee5410c-e4f3-450b-bab8-f2602aa88d09", "value": 63608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356525, "uuid": "67d055d3-b3df-41dd-9d1a-aeda31f97b46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356525, "uuid": "bc23f24a-c757-4672-8eb3-d7acb88e59f4", "value": "297ccccb9b91b91231e8e7156c76bf63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24732f6c-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711367972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367972, "uuid": "c138a0fd-8ff6-4f26-be09-3c3444a68851", "comment": "Malware payload (Mirai)", "value": "4dfcfb430959d90d8292c55c8d75da1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367972, "uuid": "e9cf0f27-a869-4ae8-8b01-dace8597208b", "comment": "Malware payload (Mirai)", "value": "cdd175c889b62b24e6402172daca4491ec86b6fb3959cd1c975e82eb208717a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367972, "uuid": "38e52d01-1867-4fae-8647-2f7f40db91c2", "comment": "Malware payload (Mirai)", "value": "547f06f395174987646d67008d387e55c0be1a8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711367972, "uuid": "6a206774-c0dc-4d2e-96e5-3489e4aa6832", "comment": "Malware payload (Mirai)", "value": "91e714360099158d1e641873a1a1ffc52118974e31527a413cc3dec0f0d2514621575495ff68f590211feebce9c5dffe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367972, "uuid": "daa1ed98-6462-4788-957b-2032a3db1a1f", "value": "T1434301496F988522D7A0153EDD35A3431F5233A0F5382208F9DE8B5A6C62FB1C9F944F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367972, "uuid": "e43a0d5c-bde2-4252-a248-a40cd49bd1d8", "value": "1536:QrsFMv1hEa1r+D7X8X8acAAVIXDZzsDnsnT/Dvvxmy:gS61hz1CD42AzX1wwxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711367972, "uuid": "0a7a4611-eadf-4d0b-a652-2fc02a50c894", "value": 58556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711367972, "uuid": "6560a14a-339d-4949-b7bb-de5dba21517c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711367972, "uuid": "9bdc649b-19e8-4af4-a8b2-239dd05058e7", "value": "4dfcfb430959d90d8292c55c8d75da1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663a6af8-eabc-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711380538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380538, "uuid": "3ab014b5-8af2-4779-b93b-209574a280b8", "comment": "Malware payload (Gafgyt)", "value": "a98b418befbedc82bb89036e8d02c139", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380538, "uuid": "e65ce4fe-f8a8-41a2-90e0-96529d35d407", "comment": "Malware payload (Gafgyt)", "value": "d00b885be884e9d9801a7b13634d0279220db8dcba9d8216ceb5cbe09b2141d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380538, "uuid": "7096132d-72bc-400e-a380-c5b6b7d4d7f9", "comment": "Malware payload (Gafgyt)", "value": "9e2c4c7c9692f83d227ad77b3198f9ad8f13be49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711380538, "uuid": "e53d47d6-10c2-4679-90f3-ce673347ebb2", "comment": "Malware payload (Gafgyt)", "value": "a65b6544dad7f2f6112b20fe3e3bd1b1cc0b20a0015a46c1a72128f9aa7ff8ee7ba850d324df3bb65c88abd887846b6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380538, "uuid": "8cda90ec-33bf-4d49-b92e-7bf23f25290d", "value": "T1A5F31B45FC909F22C6D611BBFF4E428D772A1768D3EE720399255F24378B85B0E76242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380538, "uuid": "de81e224-d0e0-4251-8c0f-abd2a09de7cc", "value": "1536:eorPjtg5iLOy8XC/YFoDhjd3lA9L5UHHcNCOPHykADdTd71sAnltPUOtuhSFftEm:VjCji9VlAv08Np9ApdpJnPK+fSJz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711380538, "uuid": "928c8128-00c6-48c5-8611-04cdbcad5ad9", "value": 158432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711380538, "uuid": "66e21e63-c610-488d-b089-8824d76da7fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711380538, "uuid": "4e4e606e-7627-4a08-b4fc-5285de07d2c6", "value": "SecuriteInfo.com.Linux.Siggen.9999.6912.26986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee78d67d-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409113, "uuid": "141ab384-2b18-40c1-ad52-2196e4cae4a2", "comment": "Malware payload", "value": "f389df2840150b2285ab99c3a50467ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409113, "uuid": "1e18d2c3-00e9-4f00-9509-0f9159c80b3c", "comment": "Malware payload", "value": "d065a8e63974d197f5588c33a083b087f386fc61af8670b3beb53cb4a37a0894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409113, "uuid": "7ff52eb9-5c84-40d3-a4dd-cb4ef8a557ad", "comment": "Malware payload", "value": "88681d6f1c289b9f8d101b42d7c54e73f4045bf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409113, "uuid": "dab91e08-e0d3-4b5d-8a96-fc509a06ccd4", "comment": "Malware payload", "value": "347254534eef8ec80cf9ae306ceabaeaec095ab79aebbe3a5abb00112f9dd3d31e4cc995acef525130d2c49f880341a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409113, "uuid": "841e4a96-5443-495f-bcdf-b0117f59d7f3", "value": "T1CE530271A53AF774C522F43B7813218DFEBA64041F2D9AEB4EAF7AE2D09B084C119D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409113, "uuid": "63461931-777a-426f-a5c7-eb5acdb90540", "value": "1536:nUWURgQrDnOHM2lwsmEznn+6nHdA57L+VL:nggcDnOHllmcnvA53YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409113, "uuid": "0def98c7-643d-422b-957e-52f1afc9ec22", "value": 63372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409113, "uuid": "50086e07-90b0-4f8c-85b2-f39b607da7cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409113, "uuid": "7476d039-1c09-414e-9758-3b336907dcc7", "value": "SecuriteInfo.com.Linux.Siggen.9999.18067.23635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12462e88-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368371, "uuid": "1106680c-6902-415c-bc2e-daa56ed7ed03", "comment": "Malware payload (Mirai)", "value": "f582214acca1d490e68e56c44a3486c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368371, "uuid": "f163e5e4-075d-4182-893b-5a32b5cb0996", "comment": "Malware payload (Mirai)", "value": "d0731722f085a3e443c1375fde26bc16c3644424ed4ace252492e9fc1cdc912d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368371, "uuid": "91ed78f7-bcd3-4c20-9303-9855317adfc0", "comment": "Malware payload (Mirai)", "value": "45d862c12c7389c4a322e4c9c2c125147501f654", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368371, "uuid": "4056b3ad-7f56-4348-ab92-3fe636f76dd9", "comment": "Malware payload (Mirai)", "value": "9986d0f68e0fa5a8be1d7c6dea41b311b88559d48057f5c38dc687f0263d9b6022b116167f946f43d196949cb8d2ee8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368371, "uuid": "bc5134d9-9857-4704-aeca-a716062bfe30", "value": "T1E163021FC6C79E9BCD9A387F89315E43D6DB74047D8412AA32148C14B0F6F8A5515ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368371, "uuid": "15de2011-7fd7-4c19-838a-68e67c497b20", "value": "1536:2EDZpVAOM6Kihufz1wqDhBmbqWHhxfaEZzRqNa:2EGt+aBsq2hxfaOdKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368371, "uuid": "767aaecc-5390-4ffc-83b2-7cd88ce0ab20", "value": 68212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368371, "uuid": "8cee16aa-b694-43cc-aeaa-2bdb82876dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368371, "uuid": "dade6b92-9e60-4f37-b43d-3d6b371ebf18", "value": "f582214acca1d490e68e56c44a3486c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f20a214-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368366, "uuid": "2cdbf90f-393e-4999-9e99-12ab97ab2e11", "comment": "Malware payload (Mirai)", "value": "e8319b0105f112f7813e7af3b296d7d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368366, "uuid": "74b53ec4-8233-4292-8fb7-39dd08d39a43", "comment": "Malware payload (Mirai)", "value": "d0ca9ff1304cca7a9ffe1ba91fbd444ae0aa2f67b38d7b906cabcafa351c6315", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368366, "uuid": "a45fed55-c9fd-4754-a637-3d139d8ee39e", "comment": "Malware payload (Mirai)", "value": "7f08d7d238dd91ee38658ebd784ef03806fb954c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368366, "uuid": "757cafae-7f7e-4fc4-93d3-6331bb00efbb", "comment": "Malware payload (Mirai)", "value": "7f37cca10a67062ae0db20fec07e9aded94231bbac368d16073124dff10627a4ba1f365864e92e4e0b5cb424cec8a0b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368366, "uuid": "f03f1998-9f42-4945-8a53-3e48a9ee9a0d", "value": "T17C8301A971A1E428E6F2ADF552220283F12359F8EBFD85F370459E98BC1514683FF242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368366, "uuid": "360be72d-3d03-4d76-9b78-3be23831b90c", "value": "1536:Ff0U3/Cu7f6EBlJ8DxPyVfzMrw+m67nlNzv3aUmSbBAe7y:Fx/B6aMPOfIP7nldaUmSb2ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368366, "uuid": "44d7915d-fdb5-4878-be80-207d3196b21c", "value": 81240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368366, "uuid": "9e247a66-db29-4b0d-bc1d-582ebe6bdf91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368366, "uuid": "b1feb4e4-0b48-4872-b2dc-91929e8fae74", "value": "e8319b0105f112f7813e7af3b296d7d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598543e8-eaec-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401133, "uuid": "12adee8b-d88f-4f7b-9f5d-13ed46451cc1", "comment": "Malware payload", "value": "4a00c7483080667b9fd2fc71396e64e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401133, "uuid": "a3d8efab-1cef-423d-abc5-b9cc9907d841", "comment": "Malware payload", "value": "d36b118bacd8620378beab682138d003e44f51feaf0fb32fcf2987c9b2efe74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401133, "uuid": "d7e164f7-060d-4243-ba8e-84dfd332684c", "comment": "Malware payload", "value": "9dad7a3a39235a8399c0cd715ee95dfd550a8d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401133, "uuid": "95b37b25-eb00-49a9-ad85-f4719a31a92b", "comment": "Malware payload", "value": "fbe4d276a94362850d0aa525f6dce7c5a82230a6019baab2b128f183e55664b7bc91271de85c8f7dd1e5bb10e0613767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401133, "uuid": "2451809f-1b03-4f57-b0c6-1dffcc1d8312", "value": "T1E7043B60E608497AFAD215774EFD2CFA06B9A8348B8F41E7F3C64EAA44197C13731587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401133, "uuid": "74cace19-57fc-4549-8445-6811648391ff", "value": "cd58ca1bc446bd2beeb1896d153ecd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401133, "uuid": "56447d72-5e87-4803-ae07-14ac0b0e7864", "value": "3072:zo70CY90C5UzDQ0cmLi9KMoDAGEYpwqoRQFViFLM8NJ:c7q90KaMyi9KtDAGEfqoRQFVi5M87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401133, "uuid": "a8d66520-179f-428b-9974-72aad715278c", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401133, "uuid": "de4a09e7-9b59-40ba-a98e-76325cbbb3c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401133, "uuid": "51415059-6164-4a93-a313-d1270373fdfc", "value": "clamfam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46563977-ea91-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711362016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362016, "uuid": "129eb3be-93db-4bc1-a6b2-71522026755e", "comment": "Malware payload (DCRat)", "value": "a62ffaaaf98c2fe04f9f6e9af383c313", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362016, "uuid": "80245075-742a-4902-aab7-6ff176736d90", "comment": "Malware payload (DCRat)", "value": "d3a6e5b3d3282a3b47296defa8671c679d816470a80d4c2aa119fdcb97a4d026", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362016, "uuid": "d0d221fe-345f-476b-abba-70c799b03771", "comment": "Malware payload (DCRat)", "value": "64047159573c36543b9284b6f12d6145ef97c823", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362016, "uuid": "ebdf451c-766c-4b9d-8825-f86143e82bdb", "comment": "Malware payload (DCRat)", "value": "c76ceef5e2ca310215cfb09d3840dfdea42d0da933ab85dbfae15bfb320fd4783e1058d2dcbc269ab3db1404923243de", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362016, "uuid": "d4817209-cb43-4da9-9bf1-184a9e3cbd28", "value": "T1F706F117B9926E73C2603F3184DB452E42B0D6627A53EF8B770F20D5AD16274DB12AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362016, "uuid": "6459371d-1f30-47e7-8fda-4a5a493da4aa", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362016, "uuid": "b8b47159-2716-4460-8bc0-615973a5bd57", "value": "49152:IBJ1pIg5cedTF4vx7y04J4SMl9Lkt+RNIdKV3OPzL2DpIFCfoED2gAepbPehr:yr56S4xkHq316cou9yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711362016, "uuid": "7462db81-f5aa-43ed-92a2-a024a9537cf1", "value": 3933523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711362016, "uuid": "64353636-6cb6-44ef-ad0e-1ba4c5abb078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362016, "uuid": "b22503a0-8fc4-413a-b5e7-30535de17d17", "value": "a62ffaaaf98c2fe04f9f6e9af383c313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc196c9-ea74-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711349597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349597, "uuid": "13738773-d898-4105-b315-fa205a971e46", "comment": "Malware payload", "value": "83f9422da81d3c26f22420118eebb0c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349597, "uuid": "2c990cf6-53d2-412f-aad8-c986163cc36c", "comment": "Malware payload", "value": "d42ce863d02bc970b632e8f6794d433fe059670f1bcd42aaec99bac868d6ebe1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349597, "uuid": "4704db62-e51f-4254-8ff5-127cf68949a1", "comment": "Malware payload", "value": "5aaea6fbbef5d16e0e001110ee5f298257d016d7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711349597, "uuid": "5916c7c5-7edf-417c-849c-71130d272e5d", "comment": "Malware payload", "value": "8a8ce5599bcb0ce55a3ec58636b6e5468b2bd6eb5c93d03b0f40eb0f4c18e1768e9a79852533be05e822b36812e2c825", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711349597, "uuid": "8bbc0b9c-428e-4e09-a46b-9f4eafdf289b", "value": "T1EC6475FA6036ED8A86370E80D1043F179C299EDF66B847F8778815D1C19CA8C9DE75B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711349597, "uuid": "0fab2d50-763c-4e8b-aab7-679272230b77", "value": "6144:w1LLuFuk4xdLIVerYUUq9gUp+C9I3qrDes/:whu0qVg8uDes/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711349597, "uuid": "d14f8700-3ffc-4cb3-8aca-857db256a82a", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711349597, "uuid": "ea187380-d928-4f14-a22d-901c88c196a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711349597, "uuid": "273b1e8a-2e15-4eb3-aaaf-32816d7a9eb1", "value": "pe.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6237d4-ea77-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711350911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350911, "uuid": "7e43917a-5cdd-4820-be18-2b6b1c0bb20f", "comment": "Malware payload (LummaStealer)", "value": "29447b51ed950d6b101a8ff1494814f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350911, "uuid": "6fd5858f-fee1-416e-855e-4f9af8cfbc65", "comment": "Malware payload (LummaStealer)", "value": "d44d746b20df4825c851c93cc6b7a29eb6e4029dbab4fb2c5584c172b822802a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350911, "uuid": "bde37f6a-863c-4d2c-8786-2a47d3803f83", "comment": "Malware payload (LummaStealer)", "value": "77b10964e0faaffb5cfb743a9a64f108becb50b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711350911, "uuid": "c16448df-457b-415c-8bfb-022c59beeae9", "comment": "Malware payload (LummaStealer)", "value": "821c66b7895f51c90c963cf209387b8bc5cfdb67f6787add79a6558a225f2b2959fa1a445ec58125be6b4f6fb6c52d67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350911, "uuid": "9a1e8613-3934-4862-8a27-fa5a091ca25c", "value": "T1EA840207BBAE6256C5159630C0C7587642FAB68B2273E31E3E8593D80E137C8DB987DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350911, "uuid": "88850e57-d06d-420b-857d-2e148f1cb841", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350911, "uuid": "9013dc19-2c06-4cfd-b6d3-918c267abc94", "value": "6144:/Is89E4qYj3shY4FHAg0P/MW2SpOFrbRGFIyaB9Vcb0YVPH5RlaHtkzk8hUMfebP:wsMrshz6LP/MW2S24bXxTaHtkg8ZebP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711350911, "uuid": "70714871-bbe8-47e0-ab71-50aa7f5121b3", "value": 377992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711350911, "uuid": "bc54b1ca-e723-40ef-8d8c-3e991fafb263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711350911, "uuid": "903a93f4-1b43-427e-9da0-34df4fabf73a", "value": "29447b51ed950d6b101a8ff1494814f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02ec0ecc-eafb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711407430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711407430, "uuid": "8eb61a4a-db0d-48a2-8d68-a2c0cbca8ef0", "comment": "Malware payload", "value": "1d189b171fc5c7924c9f4992131bbdff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711407430, "uuid": "7d42e3f5-e115-4983-b16f-302b9a182b3d", "comment": "Malware payload", "value": "d485685e2c57dcc67d578ae658e49b9161a0163e9b4b05f887eb009f7493ba11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711407430, "uuid": "17546f69-4b56-4daf-a3b7-d1882d615108", "comment": "Malware payload", "value": "014ce1c0ce11e114a28280c9f1c74d990ea6dc86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711407430, "uuid": "d6df7f2d-f8d6-4745-bf3c-f704b718e4ae", "comment": "Malware payload", "value": "2d14c43a678e1deb7d5b9f5496f8f84e29c513ffb1d173a453ebb0ad1258363d8484108edb9af1913dd94f56e0fabc35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711407430, "uuid": "d5e87c57-b5d3-4315-9e15-90c91e71aca8", "value": "T13338339263B05C7AEFB4C37FE9359CB221B3AD5E148CDE466810FCCAD53E618886D095", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711407430, "uuid": "f8823518-aa38-4b0f-bee2-ee0b0ed984a8", "value": "7cfc673bb4d426dcebc76a3f9ab61eae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711407430, "uuid": "37fdc1bf-e681-4dd2-87a6-6d07c30201e0", "value": "3145728:vrj8eJ8DAurOgSYgm90ue4nxUQSxwKJofk7PCp5VDa1G:v3801urOgQm90uhuQSxwJ+P4VDOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711407430, "uuid": "2e8444dc-31ec-4e51-ab9c-5acd62fee0f5", "value": 103691256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711407430, "uuid": "6ddaf2eb-72e9-4679-a4f0-1653659b65c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711407430, "uuid": "9c3c644d-1bae-4330-b93e-12807aed35b3", "value": "tor-browser-windows-x86_64-portable-13.0.13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ff693e-ea40-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711327419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327419, "uuid": "09db497c-b4b1-48f8-9826-db454dc0c083", "comment": "Malware payload", "value": "5d01b01155b9d00b13daba5f0f1af460", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327419, "uuid": "6d2bb048-71bb-43b0-9897-c6d1c68bbd4d", "comment": "Malware payload", "value": "d4f1f91eb591b0e8e825af19bcfb19ee4fc3ee9c53f79b3a2c267ef6a8533450", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327419, "uuid": "55201f26-d0df-42f1-9544-7d0d72f6cb98", "comment": "Malware payload", "value": "656ac1182433987a54560a9a5400d52e99d8597e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327419, "uuid": "6d0d2a67-e421-46ec-940a-fde80dbb557b", "comment": "Malware payload", "value": "28645d63cf7cc6a9692527e3644145358350d35c9d1feab22e7e76a0aeaa72424970a531b534f3cce2e28cec1d2422bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327419, "uuid": "e9b7d2f2-d77a-47bf-9c99-acedc6904c21", "value": "T1B2667C62D1858427DC6CA174B899976EC27DAB600B7B73F73B883556CE20FF35236290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327419, "uuid": "f080bc8f-a52e-42e9-bb6a-e7758ced198b", "value": "2a261c2f5ed6589432f768205084f000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327419, "uuid": "a1d6ad8c-b95e-4789-9721-1c8c74e9c71d", "value": "24576:+0h1cZalg/EOR4iBdU8nR8FfqOVvPofvC:foEOR4GR8FfqQMvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711327419, "uuid": "fc82850c-6eb3-4611-8fdd-28c43dadd1f2", "value": 6678528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711327419, "uuid": "9f32854e-6e82-404f-85f2-813736cce149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327419, "uuid": "9b0a3449-d34b-4a14-aa24-4e14b7b68f0a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16128.28408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76110322-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390872, "uuid": "74142909-588b-4c45-ab04-bf276b16babb", "comment": "Malware payload (Mirai)", "value": "963249873e77d0c7fe12539cf30ca0c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390872, "uuid": "b27c26b4-f23f-45e4-819d-7a52fd7742e6", "comment": "Malware payload (Mirai)", "value": "d50015a8716a82a9def5c2e4ff5ac8e8ca3fb7729c2656aec5b52deb87b1d94e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390872, "uuid": "9dd3d5c7-a204-4234-b4b1-9c1649313a9f", "comment": "Malware payload (Mirai)", "value": "75eac9696895b0e44fc1833d98c21dcb233daa79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390872, "uuid": "07b4bfb5-cf4a-4577-8103-1aa15fd89a9e", "comment": "Malware payload (Mirai)", "value": "2a6f8c1cd604a6449e9556be61644637683cc828e8b9ebfd9a35c9ab002deb73f707283622bed4871941129ef9287c28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390872, "uuid": "280623dc-cf02-415d-958f-acf38dd52259", "value": "T199142945EA418B13C0D72BB9FADF42453323AB94D3E773069528AFB43F8679E4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390872, "uuid": "61aec5ca-beed-44a6-ad95-d510451f0cef", "value": "3072:ITfQeB+smIw9GXl3aMjfGEgOSMsS4Y2SPRRiMrCzgoHM/RwH8:af5mIEE3aMjfGEgfzYrPRcMrutHM/Rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390872, "uuid": "2696e219-1484-4ec2-a910-15725ba668cf", "value": 196272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390872, "uuid": "e6c92a08-705b-41d3-b293-0c74e179e413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390872, "uuid": "3e8587a2-df74-4f51-8d33-a8ea4d0b46ae", "value": "963249873e77d0c7fe12539cf30ca0c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f90764e-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711383963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383963, "uuid": "34d20e72-1ce9-4e31-b6bb-dd3d90b2092d", "comment": "Malware payload (Formbook)", "value": "c77b45b902fb66b1bda25f0c9f32c152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383963, "uuid": "3af78c48-2962-40b5-b4f8-f4cd6bc29f4a", "comment": "Malware payload (Formbook)", "value": "d56e9061e7f6df6e094d1582d817c381f8ce9ac6c3925cba5da96464487a18b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383963, "uuid": "32a04dcf-dbfc-4242-9d1e-fd4c090cee0a", "comment": "Malware payload (Formbook)", "value": "e17705713ede18731797bbfd7b5eb31a7ca52477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383963, "uuid": "9bab2de9-eea9-435c-8d7b-81caf1e72497", "comment": "Malware payload (Formbook)", "value": "11a807e8ccc22f3f1400dcacc91373a178d110f75b11685863d7065cb46d4142c890c35b480bac004c205805c3ef91f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383963, "uuid": "a1a1bbfd-0d47-496a-a40f-b93b3908e6bf", "value": "T1E5E4121137BC9B37E6BB5BF0A965100243B2B13B6172D6DE0CC250DE8AE6F415B66B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383963, "uuid": "39862291-c75a-4cb5-86fd-e10acdddbb8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383963, "uuid": "45fe76f7-4551-4c1d-9438-97ebadfb5706", "value": "12288:Td4CMwtBBGV/8nu3JKhuL3RlcYgbXvApn76bUtaj6b0jZEgVzvF7B5P9ylA:FBJu3FLBlcYEXvApn76bJ3tEAzvNDP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383963, "uuid": "cb541560-9a0d-4c49-9dcc-4dc037399dfb", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383963, "uuid": "eff52aeb-175b-49d5-a111-4a33025ea0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383963, "uuid": "9e899ea1-f976-432d-ac25-1e1e842767cc", "value": "GSO3357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f232ce-ea4e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711333377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333377, "uuid": "d0832e9c-17b4-427f-b247-35dcdf16c18c", "comment": "Malware payload", "value": "83762c50504623e706932d1e0c2afb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333377, "uuid": "e4fef1ec-dd76-4f63-a328-2b24f7beb326", "comment": "Malware payload", "value": "d56f060027ef9f1a8d988b18bc0f17af0f3e656561eed053aea00f80473d13a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333377, "uuid": "509ca303-2e0a-40af-b8f5-aab85a8c3beb", "comment": "Malware payload", "value": "e0a48aed97555cc805836657b354a170add3114c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711333377, "uuid": "b658bb4c-9495-4f4b-a428-67d3c3424dcb", "comment": "Malware payload", "value": "580b2a0a4effa52cb75ff85107aedeb5b0905268d26494ad2f3d65e2404fabba11653f5334a01c18eb3df9ec2afd7a54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333377, "uuid": "0f974cc1-2b46-4e4b-a669-486962fe55c8", "value": "T17DF49E1275D1C072C2732130AAB9EB7156BDFC324A354687B3883A696B742F26E34777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333377, "uuid": "af7b73cb-6c8b-42df-ac99-fd511b2a20c9", "value": "213e0a4928f644955b6c40c3acf835d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333377, "uuid": "143622e4-928c-43a8-959a-64a42558edd2", "value": "12288:QNp51L0Z775xs2qnf8PtVXJSLKlK4pKJe5d0nocsxa3k48118t/HY4EErtkTd2h9:WJL0Z/mnet60yocssl8gY4hkTd2hCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711333377, "uuid": "46fd6a06-8313-4a89-8744-6f9b6812cb12", "value": 790064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711333377, "uuid": "d446f089-3fe7-4346-ada9-edd8368c3fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711333377, "uuid": "5277d8fc-261d-4c8b-b73f-19cbc4f727bb", "value": "SecuriteInfo.com.Trojan.Siggen18.38249.17763.30138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72322304-ea82-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711355647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355647, "uuid": "b2c91e8e-3a79-40c7-b8e5-d36e20e687fb", "comment": "Malware payload (AgentTesla)", "value": "256ab4b69efe3560e3589e6d7c0d54d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355647, "uuid": "ab795875-68f3-4780-95bf-40aa6c3557fc", "comment": "Malware payload (AgentTesla)", "value": "d5af1b5ed5eeca90dc835ed26ffc8a8854890eeefa32aacaa094b5d606d4edda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355647, "uuid": "19eef57b-b463-4100-bc4a-c66eae12e175", "comment": "Malware payload (AgentTesla)", "value": "b138a1744e1030a7bccf18c0d30bef2525be3176", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711355647, "uuid": "dbc89e16-41a6-4966-90b6-dd4424172451", "comment": "Malware payload (AgentTesla)", "value": "07f1174380dd921672f5cbb18a5700e85d2df97a025b771d001b63895b4ab36ba62d85bc6ebbca69c3a0512982fa2480", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355647, "uuid": "16f6de37-da9c-4048-a3d1-3156da8b4fe4", "value": "T187F4DFAD760072EFC45BCA72DAA92C64F75174B7431BD203A05301ACAA1DA9BCF255F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355647, "uuid": "7542f466-e6ac-4064-954d-9315b5897dc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355647, "uuid": "a48179cf-fbec-44b3-9762-31392b72909e", "value": "12288:sAQK1BxgC74CMwbQScLYiDMzBXcU1lBIWyX7tQMwkh4fb2gC4GhgeUns0Q0D93IF:lVbFRvckiozBDDBIWye2gVGhgPns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711355647, "uuid": "5d2b0193-800c-43cc-9748-1990151708b7", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711355647, "uuid": "734d7867-8d36-4fe6-a8cc-d2ebe9fb70ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711355647, "uuid": "8fafda35-9ec8-4300-ab84-1716d6bf97aa", "value": "SecuriteInfo.com.Heur.18737.25106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e748f2-ead6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711391953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391953, "uuid": "aab0db1d-3dcd-4521-a856-5a1948af9cc2", "comment": "Malware payload", "value": "c974d162d58e5535973a8a95775f1d14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391953, "uuid": "b6074f29-9de2-49c4-85a2-81ec7d817d76", "comment": "Malware payload", "value": "d777cde866f1e60ff0040c5e5ed1eb0a05eb86c46eb90a38637a7c12f8506042", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391953, "uuid": "126aa32c-8fd6-440c-b983-8b2e257699aa", "comment": "Malware payload", "value": "748853d78df14efb6c76ebba7916dbaf0a60fcfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711391953, "uuid": "3947cc50-88ce-46e5-bc9e-f4e0da9099f7", "comment": "Malware payload", "value": "19ac416436d9e7bbc8afc5bc749c8a9f591bbbd761484e8ed37a676ab00a17de50c83655935ef7d9deddc84514b41d7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391953, "uuid": "7d477c87-c32e-4d75-846f-c40b619d1796", "value": "T15453F2A2555EEBEBC0377C35060D25C0F694E88C5627132D0DBB26F9AD2B7815B11CEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391953, "uuid": "c19b24f9-b95f-46b7-a5ae-0cc6b0174e88", "value": "1536:K/oDTB+kNYAu8uymLcztahtItRSwbSLweG1uhnC:nDTFuR8uNfQTgL809C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711391953, "uuid": "76e45d2a-7a21-4ba8-9f76-454c4e20850b", "value": 62716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711391953, "uuid": "2c5d142a-8129-437d-a260-3bee449caa32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711391953, "uuid": "6c63991c-169b-4502-90bd-bfc8ed3822dc", "value": "SecuriteInfo.com.Linux.Siggen.9999.12996.19062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ac7b33-ea8b-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711359733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359733, "uuid": "06cdbfa2-3b39-463b-a04d-1c7e1e18554b", "comment": "Malware payload (Gafgyt)", "value": "f2a5749014dc2c2c060b06d1a1887102", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359733, "uuid": "578debc9-2378-47f4-8a95-3dec1810c986", "comment": "Malware payload (Gafgyt)", "value": "d7e3112049c120623ecd43b59a9b8f78762ac2dfaddb022d52b34eb64a7b41a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359733, "uuid": "8df7e76c-b070-48f0-bc97-80a01ae647ce", "comment": "Malware payload (Gafgyt)", "value": "1809bea5f3e2a2493c7199ee223102659a5e056f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359733, "uuid": "0c8074f6-c0d2-4482-a0d3-2d6e207a6ec8", "comment": "Malware payload (Gafgyt)", "value": "6bc858aebf74c62411129df04f11960199915700dd203400eba55a28dab77fe010d5ee29c3b4a1423728d507683b52f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359733, "uuid": "d90fb987-98b9-48a1-8657-185fff7cb352", "value": "T17904B63E7922AB7EE268827107F76F71CB5511D333929392E13CDA145EB224E188FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359733, "uuid": "d37b3ca4-cac2-4a2f-8344-bbd8efe65690", "value": "3072:UhZRj5n9EmzUyMho5hWTt5s1qANhmv8uqx1BVnKoe:mjrYZo5hWJ5Yhmv8uqx1BVnKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359733, "uuid": "b833bfaf-8a1e-49a4-aa55-2ac7b2be531e", "value": 188384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359733, "uuid": "c601e1f5-7217-4e3e-8c63-23c4c78a6335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359733, "uuid": "af949805-bb90-4d49-ab9e-1d14662968a4", "value": "f2a5749014dc2c2c060b06d1a1887102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0567df-ea56-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711336930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711336930, "uuid": "b2924a88-f54c-497f-a8da-16fe57ac9f15", "comment": "Malware payload (AgentTesla)", "value": "bb93f6377245f0b482dbb9ef146dc066", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711336930, "uuid": "158e4091-3d99-4e89-846e-86dd7c50487f", "comment": "Malware payload (AgentTesla)", "value": "d8385e24dcc05c0115ca31d9af40862be2918e6e14f1d5c83925827484ecdf8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711336930, "uuid": "3aec3427-e891-4732-aef8-b4b3440961f9", "comment": "Malware payload (AgentTesla)", "value": "3fb27defe4feecb0d0a9a59e08edb8a686b7d7b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711336930, "uuid": "59898542-c459-4371-acd8-d98fdd024675", "comment": "Malware payload (AgentTesla)", "value": "695d63c43f0ac287e2b7a10caf195395c121e084f2ff0aebe034f5b1e8f5672c443db56e50937ac234319571bcb72447", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711336930, "uuid": "d4321094-d201-4ac0-aa59-b4fcab4fe7ed", "value": "T136E4121173745A33D6BB57F54C63005263B2B66A2277F7EA4CC2219E25F2F008B96B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711336930, "uuid": "d65ab583-7a3c-4d1c-8d58-c092475d66d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711336930, "uuid": "9077b536-4a3b-4045-bd48-2e21e7bcdc4b", "value": "12288:B4CMwco2+lAgNpdYpuHRe280fA/K4BMWS2HhB2SmPvFCA:8o9WgNpGEHW0fMKqVH+SmPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711336930, "uuid": "75b420f2-9429-4e88-b452-22a1ca7b8fce", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711336930, "uuid": "cfd77318-688c-4eec-9b16-714cef311058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711336930, "uuid": "97153de9-2ce5-407f-9d73-348db47a013c", "value": "SecuriteInfo.com.Heur.18949.24225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a30461-eab3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711376643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376643, "uuid": "fcef97bc-264c-4f19-8aa1-709d8b5879ad", "comment": "Malware payload (AgentTesla)", "value": "ab176d9ff89425626d8177b7372c9e12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376643, "uuid": "50a95790-ff05-4576-9938-230bb7505487", "comment": "Malware payload (AgentTesla)", "value": "d90243827ee248cafbd1fc8b858e239f620106882989ca7a3c5452dc7bb595f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376643, "uuid": "c193fb55-af9f-4cfe-81d2-380058955c84", "comment": "Malware payload (AgentTesla)", "value": "c6a1d7b44ca6d4cf5691fde872ffe05113707da3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711376643, "uuid": "9a663fbc-f3d5-4321-8a64-7453eb151d27", "comment": "Malware payload (AgentTesla)", "value": "a1c2062fedd00978d749e38e641555c1d0fe8215c077f576c20ab479706e1a5bfb721426cf8c573fcaea565de637f49d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376643, "uuid": "35ed6b44-5f37-4c77-988f-b538713e1257", "value": "T1ADF4BE1137FC222AF2BF8777A8B444914BB6BE071E66D35E48C139CE0873B419A52767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376643, "uuid": "118041fe-d964-46b5-b905-691c40cfc62d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376643, "uuid": "c4d160a8-ccb7-424c-9a86-6930b1a2fdb7", "value": "12288:6pahc53EubfeqaD7lt8SeUGE7beceokZb3vPkQigpI7jJbq7:6Z3EEyIUGkCgqr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711376643, "uuid": "556da208-fd7a-44b7-b0e3-bd36e5e09e5c", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711376643, "uuid": "7e220e0a-76fd-4660-b253-56ffd067c052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711376643, "uuid": "2e9ca222-9780-44be-98d6-82d6e106f677", "value": "microzx.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cbf29a-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711383945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383945, "uuid": "783dca4c-1006-43d1-9621-bf4771f6e1ad", "comment": "Malware payload (GuLoader)", "value": "937285e67679dcbd6d3a218cff5723e4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383945, "uuid": "3f08f465-14e9-4e62-b94a-41298b9f8a87", "comment": "Malware payload (GuLoader)", "value": "d90f3ab705edef2a59cc39b6269f1a149f0f6e43e0aa4f128d05c1697726bcdb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383945, "uuid": "d651d5b1-a7f5-4702-a358-6e933682766d", "comment": "Malware payload (GuLoader)", "value": "73023fa293fc84f1db845a75a4be3c2337c8da4d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383945, "uuid": "bcc71449-3fcc-4281-a9aa-050171304264", "comment": "Malware payload (GuLoader)", "value": "3e2907e15ad7bdc80148c1893a65ac4d17f44b83de5fc73dfc0361b51b20688e70c481dddba921a8c9448a8c2c6a02ae", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383945, "uuid": "0a491aa1-1342-49c7-aed5-ad0c6b3c0896", "value": "T10F342AF0CFCA26394F4B2FDAED64445289F9809A012224BDA6D917AD7243D6CD3FED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383945, "uuid": "7c8cdcc2-3789-44d1-be26-e71940bf2b3b", "value": "6144:lyhQMLtOBxJrv5lttSP4KuK8jWwoipSRUiGT9rS2fTicm7jImE9uAI:ekVBDjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383945, "uuid": "072b63c7-c77f-4eeb-8ff7-8dc8dde993b8", "value": 243209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383945, "uuid": "478d94e7-f493-430d-a434-78f86045cead", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383945, "uuid": "c902db2c-98a5-44e9-b078-6fb3699f6a53", "value": "awb_shipping_documents_25_03_2024_000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d1e7be-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409117, "uuid": "cb6892c9-f079-48b4-9a1a-e1df2a8517c3", "comment": "Malware payload", "value": "e41521980189308f25248bf0ec57197f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409117, "uuid": "8471aea4-7d72-4d64-a619-2322295d3a50", "comment": "Malware payload", "value": "d9c19288bf7903140eb492b6457fe133ee87509799a0c297a30d728c24b25953", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409117, "uuid": "658111bb-0c2e-4df8-bd66-85eb61a90d25", "comment": "Malware payload", "value": "56caa8f5659e1ca71c1b554ccab2d6128a69ad3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409117, "uuid": "d21838e9-a095-4873-8eab-c4b55b585771", "comment": "Malware payload", "value": "d1664ee9f751ae6f6d6c45800117419c9134d60fbeabf432f9e02c42d724a65136b7251402db19184cad4c73694c35b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409117, "uuid": "9a3910a4-5481-4611-be6e-9c46606822be", "value": "T1535302CBE0909652D61019F29C91D4D3E14857F842F3B1E23160A6DBA1F23C797BB2E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409117, "uuid": "d996350a-8229-441d-a9ad-a81d4af13fe6", "value": "1536:SuIK/7491DQ78pudeeQTeHbsFDWqMgUuXjqcBU5Twv9:t/7+Q7YudFQTeSWqus9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409117, "uuid": "0ad1c9b9-aa3a-4893-bf4f-373bd08f01bd", "value": 65220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409117, "uuid": "ae1b2be2-9d29-4fe1-bbca-5e1615786a2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409117, "uuid": "e3ff7d97-6bd9-45ee-a187-e46d765b8636", "value": "SecuriteInfo.com.Linux.DownLoader.523.14587.13753", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648b1462-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383971, "uuid": "e3f16bc3-2fc2-43f7-9a87-537938fc0577", "comment": "Malware payload (AgentTesla)", "value": "56d14e3987e9ad35bf1bd23f860bd9b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383971, "uuid": "3e6814bc-cf59-4ac1-9844-a2ac50857388", "comment": "Malware payload (AgentTesla)", "value": "da453b1b8927be6d7714036b6089a94641f7eafcac495be86d121543d42b4679", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383971, "uuid": "6b7c539c-4d56-4194-8537-4ff454b974c4", "comment": "Malware payload (AgentTesla)", "value": "56d0089f14f78f23c67270036881a052b1e48c4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383971, "uuid": "81753285-565d-474f-9c7c-a26b6cea1ffa", "comment": "Malware payload (AgentTesla)", "value": "2d9c19e6cb73e8b819148ae2546e931a25ade1c1443ed4c80db3d59bd185a6a179ca9e4a7c80b99a26320cad72d0a180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383971, "uuid": "13b379d0-fc06-46b4-80b8-92d13332adb4", "value": "T184F41201337C2A73E6FF6BF65966005103B1B63A6035C2ED1CC2948E4AE2F51A766F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383971, "uuid": "82ef5dde-931c-49b6-8040-ae03895a5a7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383971, "uuid": "26773f79-8ba7-4793-a154-e93b63a9e6ba", "value": "12288:Q4CMwhob8XQbTa+e5ssnnRLhXPxdWEcfTI7ecBgLGwNsTtmX2NaZBqiA:2obiQPBe5ssnRLNZdyiOhsTgX2NiBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383971, "uuid": "a3b64f33-4f85-455a-8d26-5bde691efd1d", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383971, "uuid": "bdd11a63-39b0-4acf-addf-ca809e763cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383971, "uuid": "ce4256a8-dff1-414f-917a-84592f704a77", "value": "a7cM5MqeLl8qfNe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e23f1e-eac3-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711383455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383455, "uuid": "d5d6847a-378c-4a94-b363-9dbdac426b27", "comment": "Malware payload (RemcosRAT)", "value": "e7051ed29a0503d3cb5551de6dee0326", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383455, "uuid": "2f37baae-7d9d-41b4-9423-7ff5fad445a8", "comment": "Malware payload (RemcosRAT)", "value": "dbbaa8a3f350fc9ee75bc0d81c0ae4be1f0e53e62765900fac80f9f7ec541176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383455, "uuid": "a75dea8d-f4e2-4631-bb3a-14bde15ef4a0", "comment": "Malware payload (RemcosRAT)", "value": "a6f7ef215c2ceabfe67b98d3a463f296f4d1e6e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383455, "uuid": "eec01178-cc2f-44ff-b33a-20b4c717cc69", "comment": "Malware payload (RemcosRAT)", "value": "16c8a8b6771b55b3f442f7d519badbab47d2d341b049d83da0b745291637a70e5a362a742ed33e9759586465ed081a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383455, "uuid": "31623e99-0c73-4c9d-9e41-5d6b4aaef172", "value": "T13215231DB94B5263E48E203084205685E776BB4A4FEDC61FDF2AA404EB53A41FB71ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383455, "uuid": "450ea738-b517-4582-9287-67b7863502e0", "value": "24576:RqPj0C+UdQ0+asWpOckHte7zMiHdElFqG165oeBhE:YPXLAgOVte7zMpC5TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383455, "uuid": "f88d4e01-6450-483d-a6c5-48ceaff2fd86", "value": 882260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383455, "uuid": "bfb5f0f5-321e-4cfe-a1e8-c6228aaf62b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383455, "uuid": "f1f301ae-282d-4b70-893c-726ef7d25632", "value": "Inquiry APS 0324143 IQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f37d22-ea40-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711327418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327418, "uuid": "acefe174-ae23-4a46-b324-3e764a9fc09f", "comment": "Malware payload", "value": "4acec9b729a2c607f9f3683316757f9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327418, "uuid": "fed1ba89-7fb7-4ab6-a552-2ef90b7e6c3e", "comment": "Malware payload", "value": "dd0b2a908d7f6cc154c21894a54f41f567adbbda3e907356d01d6e4474a7bd79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327418, "uuid": "09048cfc-d228-4352-a667-3a75097e44f6", "comment": "Malware payload", "value": "9b6c41b4368b82db5abd7c25e7e0355b2ddd096b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711327418, "uuid": "af77b982-a3e9-4497-89af-9de1ba13979d", "comment": "Malware payload", "value": "c6c4473ebb992e7d554025ff27763726dd81117f9d16c3b5b0828248f879b7bcbbe6d2a6ae8f6d476f8d56db07874847", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327418, "uuid": "5b1213bd-f912-491f-bd72-c1a237b080c4", "value": "T15423C391B2308036DCBF05FD05AD537465196AE1CBB625FB2CC066AAFC649D16FF2382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327418, "uuid": "f3726591-3490-44c8-baed-53baa2a8009b", "value": "b2f2c8833675650c4d79e336e7930b6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327418, "uuid": "7ac8277e-8fc3-499a-b899-a836d4efffba", "value": "768:YTAJL9dC8XgkJUli7nRHEsbUDYzUPCI3Jq:uAp9dJgkJUQnZEsbUDBBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711327418, "uuid": "05460e4d-7c53-4f0b-83c4-311142802535", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711327418, "uuid": "3cdee0ba-212c-4a07-ac88-50648f616adf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711327418, "uuid": "75a0fc37-9fb0-4a5d-963b-fb2fbe86c318", "value": "SecuriteInfo.com.Win32.MalwareX-gen.2227.2689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6682e12f-eab1-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1711375814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375814, "uuid": "0e1bcf8a-07aa-4c2d-87d4-9486958c29ad", "comment": "Malware payload (RiseProStealer)", "value": "1015b9cb9b0f8acb6f32f82294741cba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375814, "uuid": "9628f198-5057-42f4-ad43-b0c932d3b7cc", "comment": "Malware payload (RiseProStealer)", "value": "dd72c5a305a1104568ce6b31a016f6099950be6e751f7569bf766add8c3767d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375814, "uuid": "b0a1a951-860c-4a3e-bdbe-ca6e09f50207", "comment": "Malware payload (RiseProStealer)", "value": "eb718d7765733f576004016a14e91a5f12973c50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375814, "uuid": "a193bcce-ce83-4757-ae1e-ad0e701b1b76", "comment": "Malware payload (RiseProStealer)", "value": "7d96312edcb68a73b50219870af8e7bde5bd6b5793c9fc03518ddab35aec474045e69f3f28327433ba35d15093283632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375814, "uuid": "cca05b9f-f2be-4546-9a0c-60ca8573d0fd", "value": "T10E46334DD1D50694E4E6A6B00B12F8FDB3FF2AAD02A4CD6E809C6EC599F31B56332047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375814, "uuid": "7e85e943-7594-4cbf-b902-95131c8a8b8f", "value": "84d3942a6283bd1fa0ecc5bc71ddea94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375814, "uuid": "66e909a9-eb6d-4f08-8bef-fc74c327375c", "value": "98304:B9jwL5kme5BYsmXZp9i/OcQItBftG3w+CdnFs/djCfnqg3mePCCFEz:B1aime8L0mI7fpjnFsfahPv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711375814, "uuid": "6f1844f1-a9e2-4c89-8b52-f716dc47a52d", "value": 5668400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711375814, "uuid": "e784c03e-9aff-49d5-97f9-1adaa5582b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375814, "uuid": "fc02057b-a938-4489-bf67-8637a7db0421", "value": "1015b9cb9b0f8acb6f32f82294741cba.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a4493d-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369825, "uuid": "ff641752-c054-4671-bebf-32b6c57946cc", "comment": "Malware payload (AgentTesla)", "value": "47c3ad6f850aad34e8dc69e91956b5e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369825, "uuid": "54dc5d53-2b24-4f15-9d76-892e8f158f0b", "comment": "Malware payload (AgentTesla)", "value": "df5303e177917d9fff2e518cde4046d81c4dee7e1baf36034ebdb92ffabe86a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369825, "uuid": "c044be58-9ad9-41dc-a944-771bbfd1734a", "comment": "Malware payload (AgentTesla)", "value": "7c4c207406f6bc80266a79e4034b34a2dc3ecc73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369825, "uuid": "5407434d-33ed-4548-8581-5a0f9bc786e8", "comment": "Malware payload (AgentTesla)", "value": "4230504ad50ec34869b12cec50968dca3742bdf3c3c6fe348b2054eeb1242c6d909d725487d88f2bb6be4d9c5ce65da3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369825, "uuid": "513ea534-23de-40d2-8787-ff2a7fbeb87e", "value": "T12FD42352928D03F1DBB90A7265EE44639BF1B1A75C98CA6A189725DEBCD2FF05408E30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369825, "uuid": "a17f5e3f-1573-455a-9c77-dc06f61f659a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369825, "uuid": "be095165-3373-49b5-823a-781272501789", "value": "12288:vEVX7VBKBCXjNFaa4f0QyQXVMhuhzqL+I8GV85o+eamiROJRYWqaDkR:vEVX7eBCqxMQyYVMhgg8GV8zDBROJb9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369825, "uuid": "932cfa6f-8d6b-41b0-9395-c537d2d31274", "value": 649224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369825, "uuid": "e3f7364a-360f-4167-b1c0-1636ee1c3314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369825, "uuid": "4c937d29-bb4a-4dc9-adc4-5625de4e9f09", "value": "ESY610940BI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154d1d4b-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711383838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383838, "uuid": "d331901c-3ade-40da-80af-3c8385b8d493", "comment": "Malware payload", "value": "13602ee1a06b6afae6186b5d8263391f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383838, "uuid": "3f0a9a85-3d95-4817-af92-93a2ac22fa09", "comment": "Malware payload", "value": "df6591b61f1031d7f2cc290c1c0009f8de4b5e96b03870b8c58dc61f4b2d3047", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383838, "uuid": "740bc382-481b-4319-9681-1825e15446d0", "comment": "Malware payload", "value": "7e1bf47f6f2f6f345a0f67754b9629857a3dd89f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383838, "uuid": "1487c9aa-b4df-410a-9282-2dcd6f216852", "comment": "Malware payload", "value": "cba9f4badccb3ca4c2c021acc43a91058840ede4bf559a1dc71ec53bf5b1a7a6b6978a48aeafa1a190e8ab04c0fbb239", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383838, "uuid": "9cd365a7-8147-4804-bb61-0ff7cbaf81b6", "value": "T1FA226EE0F94705894D4237819DD45E26C16A862DA4FAA42DBDCC83CFC24EDDC537C96D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383838, "uuid": "55677be1-ae31-4ca4-ad03-8429b0744347", "value": "192:2cnCMKwXHsGaFzo2KHVZELF4u4EGo1GEGH5dx7d3SN+:2cVXwsHg4/GxG5T535", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383838, "uuid": "3a9a5392-797c-45d6-b223-7798cacb1e9f", "value": 10582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383838, "uuid": "0b314ad5-e206-41bb-afc2-18c127ab8053", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383838, "uuid": "e34d0d2b-5697-4bd9-8541-3918255e8933", "value": "DHL_INVOICE_DOCUMENT_73835665756_6884983743_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e4d68c-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711368750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368750, "uuid": "c0669db6-b8ef-4a93-ace3-3ce3de8a2f8f", "comment": "Malware payload", "value": "79fe3f26f270b244c1f4dbb3be99421c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368750, "uuid": "2eab7f49-068d-497a-a65d-065a5d7e3dfc", "comment": "Malware payload", "value": "dfcddc7be7462ade5a752a54af56bf9f63780a173fb2211b3d9e3dcac63748c4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368750, "uuid": "e03f9d5a-fda7-4347-8d8b-463603d0ee47", "comment": "Malware payload", "value": "c866d88a847df7fd4f9efc5058634216ad95122d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368750, "uuid": "fbfe79be-b484-45cb-9870-84f336246a7c", "comment": "Malware payload", "value": "c47696687fa2d8eb89e16096f0d0cff0f32d3a4c310a513c7387370aa8872f5afc1357564761e1bfb90b0daaee55a1ea", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368750, "uuid": "ffa2ae8c-3bc0-41af-9bf6-282faf2f19ee", "value": "T13041D02217D70764E2F5CA3598BAE700A9667C1AEA178E1D0185E38C1C20514EC25F3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368750, "uuid": "2ed24c95-ab73-4ac0-941d-be296f049da4", "value": "24:8zJcJMLYWczAUFSyL0erUMkWI9wCc5zTS9Zm:8OkcUDyL0erHyEO9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368750, "uuid": "a65e3643-f6b4-4c44-bf69-a361c86520d7", "value": 1993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368750, "uuid": "ab6eecd8-5183-4c5d-b011-1cdd79f25a91", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368750, "uuid": "60fc3dfd-41c1-4fa6-bb8f-0671c81b1e25", "value": "Document.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ddd9b3-ea9a-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711366069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366069, "uuid": "6536d792-3fb9-42aa-91c5-c1b0c0fee362", "comment": "Malware payload (RemcosRAT)", "value": "0acc894a421b72f77d8f825865710ec4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366069, "uuid": "124f6bb1-9f16-47c3-800e-ad4392f80c07", "comment": "Malware payload (RemcosRAT)", "value": "e03f365bff6dc4429c91f0ebd0bfdbf6eadaeb3c3cf4b3b30ecb8e9797f46c5e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366069, "uuid": "624a0149-10ea-42f7-84ad-51ac8ac7f0f2", "comment": "Malware payload (RemcosRAT)", "value": "e51bfe768ece4a254a5f85c977fa65dfa963c3b8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711366069, "uuid": "f47dd5c9-7f87-42c2-ac9b-f34fa519c356", "comment": "Malware payload (RemcosRAT)", "value": "61ceff27a805aa92ecc77d13341ac253446e0671caf4a2fb3e78769464cf4357da755f862c22f6d9cc0a4239900229e1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366069, "uuid": "3ac8c3e6-576e-455d-ade3-2f36eb4b4318", "value": "T139E52DE3EDBD2BC6230523BB6B4BF5040A27CC3A6A822D9411D625DAB11D71F2D50D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366069, "uuid": "8894c5c7-fb57-4559-817d-58e5347c227c", "value": "24576:yn8Rm6aVrLy7bOkM75parJLzx60bCNB0PEsNl36h3vKYtKYKCgsX9t6HtzA6GC89:KomdNy7bOT5u9zgApY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711366069, "uuid": "5a6096d0-6b24-4354-88d1-059f41451ac8", "value": 3026925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711366069, "uuid": "215f4d7b-aaea-4054-9ea3-a76ff6731d9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711366069, "uuid": "a0215686-c574-43b1-a192-c19623392cfc", "value": "Statement Of Account - Overdue Payments #94839540823489.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054a685b-ea99-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711365343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365343, "uuid": "ab4f73ea-5f30-4e30-aeef-b45d07bdc135", "comment": "Malware payload (Gafgyt)", "value": "1d85e091ebd0523e1349d188874da6ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365343, "uuid": "c25bfcb6-ac43-4221-a1f5-965271c907b7", "comment": "Malware payload (Gafgyt)", "value": "e0c17965177ad76a35427374a06d2c4e8521fd54c46012cdd1842211b50d50de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365343, "uuid": "050066ad-6b83-41ec-bd59-f6604c3d0b80", "comment": "Malware payload (Gafgyt)", "value": "76d98cd983cc3d65e19fbdbcd7bb6101d7fe44e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365343, "uuid": "2267452f-41ba-484d-b9c8-3cb14b753c06", "comment": "Malware payload (Gafgyt)", "value": "b898340e69cd79969faba61a51e6e9d5539255d58682c4011f55146d7ebf5998ba34ace6e3c9703eedad6003b638523c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365343, "uuid": "1f50b47a-4ac2-4cdc-ac18-961669e8a810", "value": "T1E6E385177B519F77C81ECE3216A94702208DD59E22E92F6B73B4C61CFB8A55E09E3D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365343, "uuid": "ef2c6ea5-3080-4c04-b6eb-04b48099cccc", "value": "3072:av5sD053wuMD+9lx5hap2Pqr3rM0BRTFC5kj1:avBMD8lx5haAO3rM0BRTFC5kj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365343, "uuid": "2089970b-0517-4933-8cbb-c0166050b582", "value": 153433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365343, "uuid": "496f525b-b0eb-4dfc-9752-5732a9722425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365343, "uuid": "64754201-430b-48dc-9281-07d0d46f4701", "value": "1d85e091ebd0523e1349d188874da6ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62c29d5-ea88-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711358365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358365, "uuid": "968b8383-3706-4140-9f4d-35e93839c670", "comment": "Malware payload (AgentTesla)", "value": "d0df1b4b1807afe39497ccdad8acd48b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358365, "uuid": "c9ec37d5-e3d8-4ab3-8e25-3d35c8af634d", "comment": "Malware payload (AgentTesla)", "value": "e1e2efb1c4ca047cdc08cd33831f0b466eac9d25c479a7a435aef672726efb8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358365, "uuid": "809c5d98-d0ff-4602-a322-aad7d76276ee", "comment": "Malware payload (AgentTesla)", "value": "be392a0e771803b0ac8cec4060ca35c481431bcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358365, "uuid": "8b168fee-a82a-4681-bf4a-84d4469b3644", "comment": "Malware payload (AgentTesla)", "value": "ff8c69f92b2db5c73d596080008ed622cb589d3620fa600f9dd324363cf1d53859b761f9345935382ca6076ca64ec6f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358365, "uuid": "38d5e916-f523-470b-bc71-dfdcc42b07bc", "value": "T18047252439FA501AB173EFAA4BE479EADA6FB7733B07645D109003864723981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358365, "uuid": "5a6cc083-e54c-40ff-b8b5-689edb15aa2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358365, "uuid": "04284928-e35e-4921-86f7-49ce5d00ea72", "value": "393216:AtpjoQb6pkFGB51P2Bb1ksn7O3x33ftDt5TG08:AfcDpeGibxn7OVv53h8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358365, "uuid": "c78ca73e-5491-4ce4-83cd-69e981f2dc97", "value": 26249728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358365, "uuid": "a57114d8-269c-4255-99b5-e5aafca2ab35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358365, "uuid": "07c75433-e4cc-4256-b452-9c07cbe6d1dd", "value": "SecuriteInfo.com.Win32.MalwareX-gen.21073.8844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db6077f-eae2-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711396818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396818, "uuid": "0aeec423-a513-46bd-b456-d723b72b0742", "comment": "Malware payload (Loki)", "value": "f13f9ca5ede930df8310e504372ca4e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396818, "uuid": "bf7bdf39-a5ef-4c17-ba4b-5625fecac937", "comment": "Malware payload (Loki)", "value": "e20cf5c319fe815eb1845556289e56f8c3241019a907adb6f4a33e8dc9ecab59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396818, "uuid": "971d0a12-5166-40a2-b329-7c54df4f95c8", "comment": "Malware payload (Loki)", "value": "bd28bfbb2472cd7f66be9cfcc11b77c17d08cec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711396818, "uuid": "c822b35b-03cf-40f1-8578-1c85a16704fd", "comment": "Malware payload (Loki)", "value": "5dfcba2547e33f791c7ac0895dc3a99aa1030a379c24dee9752acba2067a2a7bcc40950bdae0a89709f1636f5ef95fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396818, "uuid": "6d471661-f23d-4108-b55f-d6269b5b1370", "value": "T166C4235666D1E499E12223B9D07BCEE0A6727931CEDA3F2A4700F79F6C703C1D406A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396818, "uuid": "4320d0c1-2cfc-41d2-88b3-30a4104cd3fd", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396818, "uuid": "d34a8373-ffef-43ab-a3bf-81a67308957b", "value": "12288:CsHzOUNUSB/o5LsI1uwajJ5yvv1l2ihNYL+58d2:ViUmSB/o5d1ubcvvu+502", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711396818, "uuid": "f0594811-10e2-4a75-9824-7928f67173be", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711396818, "uuid": "264153d3-8467-416a-afa8-93e08286c3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711396818, "uuid": "9bfcbb4f-3132-422e-9694-4928514f5e49", "value": "orden de compra ##T784984560898789790798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5404d8f3-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711383943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383943, "uuid": "e3c28920-e89f-4e30-a49d-9ca9f59f768c", "comment": "Malware payload (Loki)", "value": "307a1323f5e5fcd11b36d491514d4ce5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383943, "uuid": "07597b1d-0975-4553-b473-b54a1ae07e6b", "comment": "Malware payload (Loki)", "value": "e2ce7a507a8cdc3eb8a4c35bb12adca85a4b46ecb3ebba5b4a1b232dfa3fa1b4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383943, "uuid": "598f2a9a-8b91-4c96-ab05-29f8c8b2e477", "comment": "Malware payload (Loki)", "value": "4862c75c5db73cfbf4e339da52fec72c96528af4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383943, "uuid": "3dbff4c9-1f08-4174-b790-5336062cd309", "comment": "Malware payload (Loki)", "value": "80a5d73584068e279897a8543524d6dd740fd2a90c087fa777bff978488498ca7e80a1ed264f226a21ffdaf7de5b852f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383943, "uuid": "9d71c374-ddcc-4f8f-94e5-d697a0b463f6", "value": "T1D6046EE3DAC926688A851AB3DD134B734EB0009D73132F3893BCD65D625395886BFBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383943, "uuid": "9605defb-61b7-4fc7-88dd-9ce4c40303de", "value": "3072:XPvtrVR7t/zhP5AbvMZoxnRcRKKh14t8EIuvQcVi1l8ok/1fyLbvj/3s0oV++hyk:/vdVR7tLhxAbvMZoxnRcsK3M8EIOQcVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383943, "uuid": "3c45d231-1dbe-4ea8-b030-7a6898142c27", "value": 184054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383943, "uuid": "66c7644e-9dd3-4a56-bac3-16a9e36a82d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383943, "uuid": "c27b7ba7-b02b-407c-9f52-6d932dcced1a", "value": "New Inquiry PKN-L24-433-50\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a635ec-ea8a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711359030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359030, "uuid": "4b5e3d73-e754-4792-8a1e-d9966ae0a15d", "comment": "Malware payload (AgentTesla)", "value": "ad33be98d7a5d3ecbeb8e41b530e322c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359030, "uuid": "5ca970ca-c613-4a04-888c-d5358a7d45fc", "comment": "Malware payload (AgentTesla)", "value": "e34fc5d7edce98f9d71c622b5c475aa8bff491011ff6795a99c679fb247d1f81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359030, "uuid": "6b1fafaf-81c0-4f05-a855-58b1cf3e33ea", "comment": "Malware payload (AgentTesla)", "value": "76f20d18a14588ec48dfe15c7de43bef979c6bc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711359030, "uuid": "ab5bb57d-dbe9-498d-903f-9ccc25f1450a", "comment": "Malware payload (AgentTesla)", "value": "864e91bd409ad65897c7501132f78ac45c7ae82afeff4be982a30e9b0387f27edbdc47ed29a4232461461c1fbd6ff323", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359030, "uuid": "dc4b9bb3-4d26-4a36-b0d5-78f91d2f7d6d", "value": "T157D4333A46839CDBCCAE9206034F02E4B6555FEC7B8B1B40A05A9D76F9E5FEC7A50118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359030, "uuid": "35136ff3-93b2-4723-b8e4-824f08f174cc", "value": "12288:53Uhyc02PSCMbMfv27eMbCMO7L/uf4Vh3n3Ss73Zi9KaENwbHZbtQy:KhLr/2LuMEjB33Ss73M9KawwbHZRQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711359030, "uuid": "7b532570-fdcf-4a5a-b427-6a63f115aaa5", "value": 638777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711359030, "uuid": "62b42d47-c5b4-40f0-8ce0-0d5102f876b8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711359030, "uuid": "de7bbd54-09c4-42af-b81b-cf653ea73a27", "value": "nRCP000004689 Scan Copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99014077-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384059, "uuid": "b45f9aaf-c3fe-401c-a8c9-6939d0decc2a", "comment": "Malware payload (AgentTesla)", "value": "0aeb7bc1e4ef7693e20f2e9b3cfd65a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384059, "uuid": "0f920098-a812-4c4e-a324-1acd9c757a50", "comment": "Malware payload (AgentTesla)", "value": "e43f623e317d13daa4383aa020274df52ca9a807efe597f34ae7126ca6067029", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384059, "uuid": "8cdb128f-b5d0-4cac-a019-0e4f07a4b8a9", "comment": "Malware payload (AgentTesla)", "value": "1c6f6a8e9bb62ee29c3c5b23f73d660db3954ef7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384059, "uuid": "a2705450-7871-4c3e-8d31-3a5075f163e5", "comment": "Malware payload (AgentTesla)", "value": "e7fa4bdd89647568f4be5f1725be89b0ebecb15b45eeeaa25278329279078a72cd37818d79701e993196a887d91d177e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384059, "uuid": "4fc3d8a4-8aaa-4bec-bd6a-bd51a66b863c", "value": "T1AED42329F37DAC73E07E93B9270081DA241DB78D93D0DE0AA9A752A746D37D0A1B1E11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384059, "uuid": "85800289-f782-45c5-ae1b-1777454c9cb4", "value": "12288:VI59EO75O5kk24qJB0cfscFFlsQczFo/HyfPuD:VI5B05k6qMcFszpGS3uD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384059, "uuid": "10cc0a03-028e-4890-b316-663e2b53c392", "value": 622676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384059, "uuid": "4d109108-bc50-462c-8329-7cd048f135b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384059, "uuid": "640a8a36-88ba-41aa-b15c-5b74dfb88f09", "value": "Dekont-Formu20242503-DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57663bc1-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711383949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383949, "uuid": "4c75fc0f-d857-4bf2-adb7-3143d4a55258", "comment": "Malware payload (GuLoader)", "value": "0eadfc44822525f76780b70af36acc7f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383949, "uuid": "a8cb3142-cb97-4db4-b69c-c2dc26c6d3ac", "comment": "Malware payload (GuLoader)", "value": "e5a75d4957728ff547abb3d7826de2292947602b560b53e9d225d94549833bad", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383949, "uuid": "f59c54e4-d72d-46cf-94a0-6bc75db7fa15", "comment": "Malware payload (GuLoader)", "value": "d55cd3ff4e483da4d1a9af1c9b00073662c98bb6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383949, "uuid": "1d4ff65d-8b48-49ad-93de-d76166eaf1a9", "comment": "Malware payload (GuLoader)", "value": "f2b5d4c920b110babb88a34920ca8954e98ddfe5b9cd0f9d9391200ca149551551d44c50232fcebaa83c1d2da23ddf3f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383949, "uuid": "2ab931ab-3dae-4720-b805-3bb8614e5135", "value": "T1AD5491E3CAC526298A861AB7ED234B738DB4415D73131F3893BDC65D609395882BFBC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383949, "uuid": "1ed6db8e-55ff-4647-8dde-2f7078fff69e", "value": "6144:YLkLMX7IYSHPDvPKbhikkFnEbzM/PDiXJfljw91aVX/e+B97TpgxZFMwgwxYRsnq:Yoth32KjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383949, "uuid": "c3468b1e-3591-4b23-a148-5b1159a4a680", "value": 282435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383949, "uuid": "784bfb57-5fc2-43e8-a741-c3722e20b7c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383949, "uuid": "accc5c8b-f7d3-4bca-b7f8-69c92d9d5e59", "value": "2323213789_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a62f62-ea85-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356859, "uuid": "0d008cf9-f40e-4a1a-8c41-ff82672f43c2", "comment": "Malware payload (Mirai)", "value": "eec5fb517494723106244115ccb6d08a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356859, "uuid": "bb219ce0-1028-4dba-83f4-170428a178ce", "comment": "Malware payload (Mirai)", "value": "e5d8cc0187d123f852b369d1ba976bfd7856a5d8f498a299f2053981e0178c39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356859, "uuid": "c9f3baed-b851-43b8-ac00-ad979f97ab0c", "comment": "Malware payload (Mirai)", "value": "bbcfb502cf3709bea2c7fc47be2a6d0e488a2521", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356859, "uuid": "8d6ee605-4f84-4933-9126-061f65419e66", "comment": "Malware payload (Mirai)", "value": "30c298e2098f85e25f7450167b304d76da11e0a176921313244847ba7bad71bc7654f227cb6c3b440d80fef08943c581", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356859, "uuid": "f7f3642c-2f91-4b91-ae80-06cc8a6606ff", "value": "T1DD334B52F8819613C6C04276F66E568C3F2963E6E2DF3303AE221F5237DA52B1D5BC46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356859, "uuid": "fa58c383-e01c-492a-997d-15dfac13d51f", "value": "768:eJ+S/GthJVl/5HFLAW8G32auENO7l//jxz4wE1UZY10Un7:fSOnVTHFLAW8jHhVlE1Ua102", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356859, "uuid": "1adbe1c7-beee-40e2-b8ca-395433e959d2", "value": 51548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356859, "uuid": "a490a02c-bba9-4d99-a17f-22150bb3b82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356859, "uuid": "fbaee56a-30bc-4081-924d-f53d4685cc2c", "value": "eec5fb517494723106244115ccb6d08a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836eb363-eace-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711388318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388318, "uuid": "e5c745ab-6f84-45c8-86f5-8abe5b9febf5", "comment": "Malware payload", "value": "9499f14143b34ea7703c73b5f9b37013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388318, "uuid": "8bd74c08-5a4a-474a-934d-fe3615578f8e", "comment": "Malware payload", "value": "e6991b12e86629b38e178fef129dfda1d454391ffbb236703f8c026d6d55b9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388318, "uuid": "4db4bcbd-c7f2-459c-8644-602896e2c865", "comment": "Malware payload", "value": "ceff6b19826c9a4e9b9e8cbcc512d5241a27825e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711388318, "uuid": "405dfb89-2d1e-4ad7-8ed3-f51fce67915d", "comment": "Malware payload", "value": "a862e427d5d2273616558de4567b33413d8f786cbc550e0218d124921dfc5d5057d8b0d00d6a66cf23095daa96a11182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388318, "uuid": "584cd456-b4fe-49ca-b3c7-1106cf707e11", "value": "T17D449EC7EBD24CC6D9956334E0D01648EB3C7A70A932C7D612AE51315633BC43A9AEDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388318, "uuid": "5e96673a-2b07-48f7-a323-4443cfce14af", "value": "c21fd41af2cf2392ca8ea5044cf42f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388318, "uuid": "17458407-4cc3-4bb3-ac68-7938efe87034", "value": "6144:jzsV8coTHnuHTUhgYl8b56IqokNJpgGpkeUB:LTHuHT01B316B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711388318, "uuid": "2c941034-9560-47eb-b6ca-7d74891ce274", "value": 259066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711388318, "uuid": "64ea0b2c-d198-4d8b-afe3-5eac0df8d3b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711388318, "uuid": "f499d7ba-8b17-45a2-a750-b8d1caaa0052", "value": "returnready.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d22fe4-ea88-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711358366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358366, "uuid": "a5c27937-3a99-4ffc-b604-cacb332f29b6", "comment": "Malware payload (AgentTesla)", "value": "9a6265aad62d7fb1964191414684654a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358366, "uuid": "309f0bc4-dd57-4376-8844-47017d29b781", "comment": "Malware payload (AgentTesla)", "value": "e7692d992063cc29d26970d7b1721587b343687e12afc68683450650643ed103", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358366, "uuid": "7d7139f1-1621-47b0-b980-c38924bd7587", "comment": "Malware payload (AgentTesla)", "value": "b0df621662fac8fca8011a7f8d616638f944cc71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711358366, "uuid": "9fee8297-ae4a-4a33-ada6-b7294e23d38d", "comment": "Malware payload (AgentTesla)", "value": "83d32fbdfa839444212de6f728df732f3060134d2d41643f4488a8bf69006f355618b56a836851543cd6fe0edcb56a6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358366, "uuid": "5e5e317e-8b0a-4530-b4fa-28bf7ff38804", "value": "T142E4126EBB582677C1BB06B1524B494F737991361731C2DB2D90807D27E3FA08B3A9C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358366, "uuid": "e5095c50-b323-4dad-b30e-63e08ecf071a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358366, "uuid": "4219dacf-5968-4f70-b6d4-8bf5d66f2858", "value": "12288:V0AC74CMwP6BExRCSIk0bJW0xevpe2DyCXLGGalwUM:GlN6uHCdxF3x8ptDzXL2wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711358366, "uuid": "c5235088-90c9-429f-8c8a-5533dc6b4dda", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711358366, "uuid": "eb236a9a-c6f4-473a-92d8-a7ba96a91e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711358366, "uuid": "c79f4715-0430-477c-8064-c86ca9f7db5a", "value": "SecuriteInfo.com.Win32.PWSX-gen.16434.27915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30d8ce1-eaac-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711373902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373902, "uuid": "37cac24f-6422-4b0f-be0f-cd4dbd46ea05", "comment": "Malware payload (Mirai)", "value": "cdba14dc7070bfe3f5fe953d81684f83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373902, "uuid": "7a6d32eb-e482-4396-9ca8-eec73ead0280", "comment": "Malware payload (Mirai)", "value": "e7af5f1d5d68f75ee03a37ee8016695e35edaae528cdba4ab7b9a90570a1e4be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373902, "uuid": "29d31c66-7e74-4c8e-a553-5968f1c4107f", "comment": "Malware payload (Mirai)", "value": "5dfeaeb9d4a88c8c06d03f13025c2c0fd00645f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711373902, "uuid": "2fddb9ad-8120-4c6a-b8ea-311f32b61f59", "comment": "Malware payload (Mirai)", "value": "71ede7fc1f57ecf493ff58039dea262e44edd6b9815f6a1233e03843f92f92095233bc479f34f845ca05a922ff04e94e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373902, "uuid": "2f5b44c1-109a-4d23-8a2d-fd987d9786ea", "value": "T1F0B34A77CC2A6F98C159D5B0B0B09F792BA3A58182471FBA55B2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373902, "uuid": "67f46838-4614-4570-b18c-ebaad4e710fa", "value": "1536:Ka97/a/qUAm/uwY3mOCRYKtKBhLfdKaqXzURDWUdWN4DJ+LhHK:Kyan2wamOMftsxKa2sDWSWN+UHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711373902, "uuid": "f92a7b9f-b72b-4431-98ff-ece0e9220381", "value": 116512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711373902, "uuid": "b0085372-4835-4ea2-ae1f-07e20f591c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711373902, "uuid": "d58ca67e-bf5a-4e12-b147-7f645e69ccfd", "value": "cdba14dc7070bfe3f5fe953d81684f83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edbb9a2-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711383908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383908, "uuid": "a63e19e8-5fe5-4dbe-81ea-913199c1956b", "comment": "Malware payload (RemcosRAT)", "value": "f3e307899834694db498e895cac1dbfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383908, "uuid": "ac4ed557-546a-43d1-bbe6-6054e05b22d7", "comment": "Malware payload (RemcosRAT)", "value": "e825cdfc2e4a1b1c6a56602cce16417f55e4f42c699cea18b4dddbbf85d9527f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383908, "uuid": "f2507d6b-e1f4-4a96-87a0-17af65c98284", "comment": "Malware payload (RemcosRAT)", "value": "70b232b365656082f79d07c4c4db584d90befa6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383908, "uuid": "4976dac5-ca2d-45d8-9e17-c1a94a00ab29", "comment": "Malware payload (RemcosRAT)", "value": "17eb6587a6ce4ee2667899e00dfecda260a0b8a378b5275c7a8a9b54cd794a6e23d3541baaddbde258a9a745d4427a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383908, "uuid": "3e37fc57-b524-4018-811f-217c6e6e4c9b", "value": "T1D4251242772C6D77DABB57FA596A402143F2BA273071E2EE2CC3148A55E3F405B42B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383908, "uuid": "422e2262-c548-44c0-b66d-524dd86708f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383908, "uuid": "7708c678-8dbd-4401-8b25-5dc632ae21fc", "value": "12288:24CMwo4aGsl0flTM3gk1LOjUnF5r1xyJnyrO2xM3agDrkPNCT7vI1Jhc0Xr1A:mF9TMprr3yRz2i9yNk7vI1Jhc4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383908, "uuid": "e31017b7-02e5-4e06-89b1-c3780b16476d", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383908, "uuid": "e4034aae-69e9-478c-af8c-b8986f30cf9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383908, "uuid": "9db78d88-f5f4-4fff-9947-c0ca1b86eb32", "value": "Ref [HSBC Ref# H240322-X793Y1] Transaction_Confirmation_2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3b3807-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711401939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401939, "uuid": "4c1aa443-a586-4d16-91ad-32603b0a2d0b", "comment": "Malware payload (Mirai)", "value": "74575425e7405fdd6e55251a16d61d31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401939, "uuid": "4036873e-e760-4d35-9583-d6f3f3df95f1", "comment": "Malware payload (Mirai)", "value": "e96acdca1aae64f008976a8fc178ec73c067e3a6fa4769ae647f4de4bbc20370", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401939, "uuid": "ae3cd6c2-4bc8-439e-a046-5d8b13e53069", "comment": "Malware payload (Mirai)", "value": "db4a2a0e865296ae406c9f3c160dcf6328174f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401939, "uuid": "7df2e320-2364-4caf-9513-108c7b5cd65e", "comment": "Malware payload (Mirai)", "value": "c4325a338a1de1dec1ccc04aa77293a938363337891fccd31b6da9d974e2443955d312bcc7bc2f032802164b044cc9a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401939, "uuid": "44b85ab6-47de-47cc-bbea-b7ac084b0d6c", "value": "T156312E9863D09DF8CCE481BEAD56031573649F80E0C732A3920C7B15BD2EE785C27486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401939, "uuid": "6009030a-b4d4-48d9-97b8-5f8b4118e3c9", "value": "24:lpKGpa7Urz/jlfR5XK1hUVev3gRGaJ9iM/BBuk3blxrR+zHGS90t:/KGpa7UrLZRu/+J5Buk3blxrsHGS90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401939, "uuid": "cb51b794-3ac1-4f83-bc5c-f038a2086169", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401939, "uuid": "02c6081a-15f4-4783-ae34-ec3e49170b4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401939, "uuid": "03ff23c9-37e3-4379-81c5-ed164c75371e", "value": "SecuriteInfo.com.Linux.DownLoader.523.15323.13767", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dc2c25-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390877, "uuid": "a0f2b9d6-545e-4e5d-b748-49ccd544a307", "comment": "Malware payload (Mirai)", "value": "7aa22254016f0ddfd3797d9722f818b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390877, "uuid": "4ca130d7-d391-4473-8e8f-5e38091985df", "comment": "Malware payload (Mirai)", "value": "ea66749c138b33d7930e244b5022d6e8516932e4d9dbfbe2626e30313dfd51b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390877, "uuid": "4f523ea2-c629-4de4-8491-a9a7a605f3e9", "comment": "Malware payload (Mirai)", "value": "ffa7c3b05f2e7560432a9b476243e70aa7b53ab7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390877, "uuid": "74375420-1d72-4a00-9ea3-d5960b9ae767", "comment": "Malware payload (Mirai)", "value": "cece6b5794b0fd781d88a9385e55ea2b2d2c5749315adeb9ab7dd6972a79a282beb50e99637027308d44f22a4a5dd174", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390877, "uuid": "872dd5f1-97f1-42cf-9c05-4c47a5765a12", "value": "T1C014B70AAF520FBBD8AFDD3702E90B0639CCA55722A43B353674D528F54B54B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390877, "uuid": "271ff881-c9fc-4142-abb9-a29ad64a0725", "value": "3072:b7NabdYa6DMxtk43O/e1ingJHBct6SII7l:b7NabgDMo4+/eZPDSIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390877, "uuid": "a50b1c91-193c-4658-861e-7e9285e74365", "value": 190908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390877, "uuid": "3fc3e357-7ffc-401d-b409-511ce636a9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390877, "uuid": "7e630847-c8e0-463a-af13-709deb0e06ad", "value": "7aa22254016f0ddfd3797d9722f818b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738c2397-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711369823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369823, "uuid": "fd9ed752-ece4-4686-89d0-d4c5f5a61723", "comment": "Malware payload (Formbook)", "value": "190871c56fc1d961689c60ca0b827c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369823, "uuid": "945054a7-0261-4326-9b73-90bd8e86aa4a", "comment": "Malware payload (Formbook)", "value": "eb69b0b605ee28f734dd788a37d0af07446c49c2376e9620275940dc7b6cdda0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369823, "uuid": "dac7dc73-e05a-45f6-b403-5104097d7c0a", "comment": "Malware payload (Formbook)", "value": "fe0b91b6063280b17c96fbdfe2af8660e788e752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369823, "uuid": "0c28f488-238e-4b82-ae21-c1419c8cb0a0", "comment": "Malware payload (Formbook)", "value": "cb540e0d2a81398f01f6614a37e9845fd9d490e6e11ea29f2781fb441fcd2b960ce9df4077229b110727a2b1a52d477c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369823, "uuid": "2196c207-45ec-4cc1-ba6e-bef3360472c5", "value": "T1B204AF32D641C435F2B202B4B6BD1BBB483E0D353694A0AAA3F116E16EB45E5F53970F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369823, "uuid": "0dbb2be2-025a-47e7-a1d0-6fa422521fae", "value": "3072:JPlfxikQCGvR5XR3If1+WN6W5qLi+Ygq/V9lOK1OEHKTAVeZsKGOSUh:CCENIthN6W5qepXd9NOgKxqJOSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369823, "uuid": "12a85368-25f4-4f23-b5ad-c434c80ab19c", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369823, "uuid": "3b08b053-79bd-4d57-acfc-2a62550aa403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369823, "uuid": "667e0d17-b739-4851-bbb5-b0ad9a7d3d5f", "value": "eb69b0b605ee28f734dd788a37d0af07446c49c2376e9620275940dc7b6cdda0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd834b0-ea9f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368334, "uuid": "6d71433c-9a25-4831-84a5-e95fb676e69d", "comment": "Malware payload (Mirai)", "value": "44d452242203142658a71cdeb6db1350", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368334, "uuid": "e792437a-f656-401e-870c-8799cd34f19f", "comment": "Malware payload (Mirai)", "value": "eb7f1f11a5e88c8c035bf521d569b5d32d6523e749dcfcbea210a63e8ecd7775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368334, "uuid": "3382f18a-9b94-4cb1-ab3d-c48619b6019c", "comment": "Malware payload (Mirai)", "value": "597bb24a01001416fdcc1703a228a7b9b6144ebc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368334, "uuid": "18948b5b-7b51-4bdd-9458-322e89c38332", "comment": "Malware payload (Mirai)", "value": "1c79253f4b443e885f9373d3efb3f238c46bcbe41c12af8aa481ba9de557b272967bbda8d7e4b7cba2f27712a8d0b265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368334, "uuid": "7610e178-c9b5-46b5-8fdb-168fe2dff245", "value": "T1FE31DC95A7D08DBDC8F451BE9E5B0314B3799F40E0C67223830C77296C1AE3D5D27446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368334, "uuid": "a23267ce-bf42-4997-9b91-1fbdac7d3536", "value": "24:uTcRKGpa7Urz/jlfR5XK1hUVev3gRGaJ9ixBBuLlj9gjSq:uARKGpa7UrLZRu/+JCBu1Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368334, "uuid": "c20bf5ae-9fed-44a9-8746-cf49011d32d4", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368334, "uuid": "5f4073e7-0a0f-4aa4-9354-e197d689c6f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368334, "uuid": "78f9ad91-05bc-4748-823b-9774f8e4a87b", "value": "44d452242203142658a71cdeb6db1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f206cc67-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409119, "uuid": "07f47349-7c1d-4c86-b1e3-d1de301ddd72", "comment": "Malware payload", "value": "d20a14c5f0cc6c8e3e990814d1e69d0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409119, "uuid": "cc9d93ee-53aa-4ba6-a352-c91292d56e6f", "comment": "Malware payload", "value": "eb93c1e2560e399110e63a6c2eb7a622e353c6d059afc0165cc1ad79a7a56f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409119, "uuid": "a8812fc3-db55-432a-b9bc-b7ed0a8e4e47", "comment": "Malware payload", "value": "2640b08b87c834bcbe8bdb23d3af1d747463b503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409119, "uuid": "d0392cf1-642e-43aa-be73-b5d828ce7141", "comment": "Malware payload", "value": "cca1bcdace3cec35210e50b3d4177985bb3e68b8f9b251795d8b0e713ad6b67414f3505d79dc3e94ae006f589ee24d9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409119, "uuid": "c87ba338-b659-44e4-bac6-e75b89d3ba74", "value": "T1A721B19A67D36D17CC940277DCEF5710F362AE54859EF503E32217290C3F21A1F2214A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409119, "uuid": "650755d2-0c2e-4d88-a392-7c2ed2213f20", "value": "24:JYolMlgP9qD0at6EocGArUlFSy4PzLCkIddgCGIvnaszNfc7:JYolMOFqDPtDrkFSy4PzLmGI/aSNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409119, "uuid": "1b26fb57-0604-4767-86ed-cdbe01baf219", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409119, "uuid": "fe6345fa-e389-4f34-b81c-e5743a594544", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409119, "uuid": "85e8ec0b-d14a-4b64-aad2-a6fa8234a412", "value": "SecuriteInfo.com.Linux.DownLoader.523.5954.14227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea517d91-eaa8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711372170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372170, "uuid": "9eed7f3b-bd22-4a30-9dfd-29b41f681fac", "comment": "Malware payload", "value": "2cb3ebf46f926a9771f130b1ddad1554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372170, "uuid": "1c44e3e4-b943-4f7c-94a0-fd34b3b9346c", "comment": "Malware payload", "value": "eb9b09d17ca47cc78eafee771932ef7cbdea9a00cbd2800c8a73ad1631bcfcd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372170, "uuid": "2ba1c8dd-669f-4b7d-a209-bb1e52491358", "comment": "Malware payload", "value": "2e011d83dae28bcc810943fa297217656c8a93ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711372170, "uuid": "fe4e00e2-923e-4bc0-a0b3-3c8cc34ac5ba", "comment": "Malware payload", "value": "ea6d9202e88a079dc3b414fae964fc3ce420f11618735970efe36dcb8375262dc1a6660ff7b60be5c0d13e7f05c659b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372170, "uuid": "142044be-63b1-4aee-b00d-79abd24f441c", "value": "T18AF23A33B8440238F8C231F28AA97725C57969461F39A3C7226E4CE54E39BF759386D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372170, "uuid": "88cce1c2-c3fc-4f51-bc9f-bfa2d3a68122", "value": "cb962d5e08a5d6e10869cbd16545ea1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372170, "uuid": "8f25fa98-8eaa-46cf-a990-1e7a3d143bd2", "value": "384:QJcP4kq+m5MXhIgUN0zUenES0IQoLtEucPlfqfRVZ9WY8PW+DsT:d8+kMXSX0znxQ08P9KvZWXDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711372170, "uuid": "673d9baa-a938-40e0-b998-fb449376a3d3", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711372170, "uuid": "d3cb30e6-5d17-4e97-a7fc-81e37a638736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711372170, "uuid": "99e58580-c5ab-454d-b71a-e05ff85ad452", "value": "eb9b09d17ca47cc78eafee771932ef7cbdea9a00cbd2800c8a73ad1631bcfcd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f488fd-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1711385160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385160, "uuid": "ebce52fa-aca1-4479-812f-bb9a87168635", "comment": "Malware payload (RiseProStealer)", "value": "bb2dca9753b1d42e4711f67ab64e8ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385160, "uuid": "b3dfb304-26b0-4a92-8fe6-c400a977bb8a", "comment": "Malware payload (RiseProStealer)", "value": "ec03a903cb74030622ac957e6aaefbb7437b032a4e6db82c33126016ac6c7d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385160, "uuid": "2622b595-bdaf-4fbf-a0e4-2e2e5033cb35", "comment": "Malware payload (RiseProStealer)", "value": "70cf25896537a950d7a6dda9f56040f4d372d303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385160, "uuid": "ecc7e4ef-147d-4196-86f9-d185676a8874", "comment": "Malware payload (RiseProStealer)", "value": "8787d25ae589e390b615b1cdf8bca9d5496e1d9ea3f94a0fdb41697e298ddfcaed1b2f18c0fbabccb61ea1c13f72a7b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385160, "uuid": "7084f2f8-657f-4446-8b76-4e9ba3f14f63", "value": "T11EF5116336DBDA0ADBF23071D614B1541FC41A3FDE015232B5BE1961BAB806D7FA3A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385160, "uuid": "8f6cba95-5da3-44f2-a079-bfdd18665b2f", "value": "a21d450c6ebc519c43c3140940327537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385160, "uuid": "dae3e86e-b14b-4e8b-8f14-66bf5d0fdc94", "value": "49152:J1UHC6vWZtnxJB9qBBmAAcuXshmk2sP4gNi1KEj39tpz7vDZvtNUZRMYDiTYwEq+:J1+WZtzDqBScuXKmk2RXKi17NteXW6S0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385160, "uuid": "64d67877-7354-422f-830f-627c0f96168f", "value": 3554600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385160, "uuid": "b932ee42-4930-41ec-b2c4-7d13d2c4bcbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385160, "uuid": "21e4afc2-cddd-48d6-9151-166a48243b29", "value": "bb2dca9753b1d42e4711f67ab64e8ce4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7632ba92-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711369827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369827, "uuid": "6f87df42-cf4a-4581-bd20-ea475c7ab006", "comment": "Malware payload (AsyncRAT)", "value": "e95080f3424abb82522d32e0f161d302", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369827, "uuid": "beb0aebc-adae-4dc8-a001-07e6bea647a3", "comment": "Malware payload (AsyncRAT)", "value": "ecc2196552c7dab7c4df4044600b47d28dd87c0336fd2c3575e9788722f5492a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369827, "uuid": "fdc75af7-8991-4935-b2e5-315608fbc709", "comment": "Malware payload (AsyncRAT)", "value": "807d52234556d21957cb919c20a550bda4364e40", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369827, "uuid": "5cb13735-51d0-4f50-a2e2-6607a5907a3a", "comment": "Malware payload (AsyncRAT)", "value": "a632bd2131520c382cd2e024bfec2ed0f60780032727a9579441eeab12436d9afa40db2277b958d484766a43b4309e85", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369827, "uuid": "c110a9fd-b642-45e9-8a75-f5e5c35dd77a", "value": "T153259C0273D1C036FFABA2739B6AF24156BD79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369827, "uuid": "aff5b310-cc97-4620-81c5-94d511848176", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369827, "uuid": "47cf9e2a-a830-4cbd-8a7a-8ab5b36920df", "value": "24576:dAHnh+eWsN3skA4RV1Hom2KXMmHaMnStNALTp5:8h+ZkldoPK8YaMQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369827, "uuid": "41c1cda3-0ca6-4291-b9f8-f3c7e4829cfa", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369827, "uuid": "16b2aceb-fc63-4418-8cfb-bb1dc51f86f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369827, "uuid": "46e8ce63-0ba5-43bc-9bac-216532fcdc35", "value": "Invoice-AWB-Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e201db8-eab1-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1711375800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375800, "uuid": "ed8600f0-cdb4-40e8-83bb-91537668262f", "comment": "Malware payload (Loki)", "value": "31622d9e964f5065f6940c1771ca0940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375800, "uuid": "18d4b92a-7d63-42f0-8941-2a98d2bfa323", "comment": "Malware payload (Loki)", "value": "ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375800, "uuid": "89406d57-186e-4059-9191-6e23921917a7", "comment": "Malware payload (Loki)", "value": "a3212dad73b667a3e555cefe22512e22633f7a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711375800, "uuid": "b9689484-5119-48da-9feb-d46096b0dfaf", "comment": "Malware payload (Loki)", "value": "1ed2d43fd3b669cb7806915776de4bfb62f8cfb84af44f95140c1d3677136a4a79e8e164435c912052155c5956af2b0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375800, "uuid": "31faf317-312f-45b1-9ae9-fbc7d465e2bb", "value": "T1FAD40112336C2963CABEA6F6847540594BF2E57E62A2D7DD8CD124DE4CF2F025281F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375800, "uuid": "facbb93e-56ed-4c79-a2b0-0e3cd11932f9", "value": "12288:v5E0oN04j4uYuDHppCK1oIG6k7BKkCivD0qkLwPFA:uA4//cZ6kckCwD0Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711375800, "uuid": "12ef8def-cd99-4eec-b73e-c8056245be90", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711375800, "uuid": "150da275-b2fd-4364-b7b4-0b62ca089ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711375800, "uuid": "c4fea91b-55fe-478b-9cdc-4ad9d0d2dbe8", "value": "New Order-F9000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f341a118-eafe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711409121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409121, "uuid": "4a8f08b2-c53e-45b9-8d4d-1dc9c4732d28", "comment": "Malware payload", "value": "73943d4e23ef6fe0e6e8255fc2e2b893", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409121, "uuid": "dad5a63a-888c-4520-a229-bb4f94d29cec", "comment": "Malware payload", "value": "ed5f3afceb3fb7c8930e9186bab92d11b4aafc2ec6350c6da398a62d24927102", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409121, "uuid": "146b22a8-50e7-4204-9e40-3cdc91f1b067", "comment": "Malware payload", "value": "ca365dea316fb126c7c11bc740666d928857af24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711409121, "uuid": "eb2b83d3-35d8-4f86-ac61-961412e3dbab", "comment": "Malware payload", "value": "006e2c3cad693d5c4ae4d6a939a32b18e94627f0c2ea7a83610b452d7ff3eafb12d12e19d13ff194878c73627359a67e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409121, "uuid": "92020dec-6965-4a2f-b568-1aa7dd21d1c1", "value": "T12C21979AA7D39E16CC940277DDAF6710F322AF84869EF503F31126250C7F31A1F2218A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409121, "uuid": "158ca794-b22b-45e4-8acf-69ddc346423f", "value": "24:JiAtVsgP9qD0at6EocGArUlFSy4PzLCkIddx2BWQIfsmNfe:JPtVFFqDPtDrkFSy4PzLZPIfXNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711409121, "uuid": "d1434edc-e5e6-4029-83c4-d68cd64bfe33", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711409121, "uuid": "8be22537-b6ab-4e8b-9c76-5b26dddce59f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711409121, "uuid": "9c58cde0-88af-4aba-8ad7-b893873cf185", "value": "SecuriteInfo.com.Linux.DownLoader.523.23349.17205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21073cd5-ea6e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711346921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711346921, "uuid": "b7dd1158-e318-46ba-adb3-447c9532d6b2", "comment": "Malware payload", "value": "594b073b5b5d30deedf9b4c045b63f7e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711346921, "uuid": "371b3382-24b0-40d7-9aca-7abd163f7bfe", "comment": "Malware payload", "value": "ed7b525ff2b5d6c2a63878a1d7594b12025f3d7525898adb3c02cb958df09be7", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711346921, "uuid": "d93476d5-dc25-42aa-98f3-ee7fedad4288", "comment": "Malware payload", "value": "ce4c3d5b9d7865d732e8edc2ee077ecfacc230ed", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711346921, "uuid": "07f32e90-6351-4239-8ff0-e6de3e3eebc4", "comment": "Malware payload", "value": "cbaa060a05e3cf4c909ff8a712c414c5ec01f7686b76085e2e2c99eec7073b79c6a060138ff1c3c6a8f72579d2fd557d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711346921, "uuid": "47bcde93-5cab-4c10-a6a7-1eae042f24b8", "value": "T1E7C3121FF0F29578E13B263F57167ED35762075185FAE58381A0738B56230EB8A6BC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711346921, "uuid": "9217c259-f11e-4b4f-a178-6e68cda1c664", "value": "3072:HdALcrcUNpHoD1ANvzCtmwkEa+EdeG9UgicNvEDS6J9:HG446pikzCkrEaddeG9Ugi6+S69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711346921, "uuid": "14cf162c-7bd3-405b-9b25-8ab584024611", "value": 128956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711346921, "uuid": "7cbef1fa-62d1-4216-93ee-ccf0dffc848a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711346921, "uuid": "93cdbf14-540d-4b57-aa6d-e2f08ee09562", "value": "MJFW 2024 Spring Cleaning Finale.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c53ea458-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711385422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385422, "uuid": "66d63280-ebfe-4613-8268-95283d592873", "comment": "Malware payload (AgentTesla)", "value": "ca2e7abccc5cb10dce5c6e7374fe5a35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385422, "uuid": "f597e8a4-149f-4d26-9131-3e762aa68a1e", "comment": "Malware payload (AgentTesla)", "value": "ee1f5806bdc523e06b98c513142a735ac3c16da9948c645a9916bd68cf24673b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385422, "uuid": "b772973a-0702-49f0-8079-4e602965a3a4", "comment": "Malware payload (AgentTesla)", "value": "4c4ff642534ebb32d4edd6c752f6309ee9fbcf02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385422, "uuid": "5bda91e8-56c9-43bd-ac1f-89dbc213ba4c", "comment": "Malware payload (AgentTesla)", "value": "91e0ab0fc04a9a7173c25f88493af90543d17b51b23fd5f4287c4bc329edb1018c137ab1543504705d7c8ddd590bb0cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385422, "uuid": "85afc4ca-3d0b-4965-8fca-3a5219b34039", "value": "T18CE4125BBB944377D25603F195AB198573BE602A3231C2581D9090EE1BB3F148A3AFE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385422, "uuid": "09a419fd-0f2b-4885-a753-3d9182bbb698", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385422, "uuid": "194795ac-134b-44cb-99c6-2cff8e9169f2", "value": "12288:BJggC74CMw3iOdiDSZnRtnt9iXSSfI5qIFngvpZsG9WxzQaU3y:BJgFoOdjtnOSKPhh6GEQn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385422, "uuid": "5df03718-fdf8-4dbf-8962-7ae000ec92ae", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385422, "uuid": "c1fe09ea-c1bb-4ab9-9b2b-d83773a0a54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385422, "uuid": "ddc12a2d-5cba-430a-9455-b4933634b046", "value": "Price Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799a8649-ea98-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711365109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365109, "uuid": "fece0ac6-3ce5-4064-a82f-98c74be685d3", "comment": "Malware payload (AgentTesla)", "value": "9ebc4471684c5683826aa31dd8c85de7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365109, "uuid": "7f4021aa-1096-47f4-9abb-902d09f2bf71", "comment": "Malware payload (AgentTesla)", "value": "ef274d62fd8b447b68f031a13500e37fe991a6f0bec09b731e936769917076d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365109, "uuid": "798ea927-f9c6-4765-8bfb-d781cf98830f", "comment": "Malware payload (AgentTesla)", "value": "e1f7565dbd5b472a8b523c8dccf27e50d72b09bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711365109, "uuid": "52fff66e-a4a9-44df-80bf-3dfeffbe834a", "comment": "Malware payload (AgentTesla)", "value": "604ef1109bdab6708aadb6a416444c7bb6452609263efcc0b94b1b6c02d63300209382137c8e160211a52c776b364992", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365109, "uuid": "db19bb06-3c8a-499a-af61-55f643c6de7e", "value": "T11772AFAE95C8416DC38748B800012160F7ACE5E7BAB69D1BA79CB71840766FFC751BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365109, "uuid": "22d9b805-1f40-42bd-b18b-1deed47668e2", "value": "384:nyX8Pd3Wzs8PL8wi4OEwH8TIbE91r2fRlJYyvi4Ud8f+:nc8hU5P3DOqnYJzzvFUd8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711365109, "uuid": "1cbeee19-6ed3-44ab-9415-1a321c90b1f4", "value": 16426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711365109, "uuid": "4441e22a-e9a0-429f-a7fa-481348f1d445", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711365109, "uuid": "0af7694b-00da-498c-9494-6f4bf5af941c", "value": "aaaaaa.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833b3696-ea84-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356535, "uuid": "97d089bd-b6af-4b0b-aeb9-49a2738ee9c7", "comment": "Malware payload (Mirai)", "value": "fdb4d4225c366804f2edc5c6d6198f97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356535, "uuid": "488b669a-917b-4e55-8fc5-c900af25a589", "comment": "Malware payload (Mirai)", "value": "f0827fb4c51f95934f2aa253ba6f287060ef38a2a9285e86da9f844efde846d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356535, "uuid": "7484c5a6-d848-47a6-84d2-dea356627d96", "comment": "Malware payload (Mirai)", "value": "28b3644fb28edacadbb53a258f5705db130bba2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356535, "uuid": "7ddc727a-4920-42d7-9f1b-d5cb8ab4993c", "comment": "Malware payload (Mirai)", "value": "6fe45f65c519c50c8307f5ab52dd59bb593a499409644f190165b09f0b693ad7a45bf0dadb6b040a3e1daade0c00d8b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356535, "uuid": "9b5b1b58-7284-4c71-9008-115724c21617", "value": "T1BC033B62F8C29B27C2D002B9E57E9A4D3B31A7E8D2CA7713DD640B1137CA01B1D67DA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356535, "uuid": "05d17ab5-9511-4973-b4e7-1aeae3e8fd55", "value": "768:vjOpNXEPIyXtph2Xu0Ltzdq334927ZN4wwOkZY10UBc:vwEZXx2Rzd43Nwba104c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356535, "uuid": "18fc6786-3557-47a9-bdd1-5f287ca46d68", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356535, "uuid": "44a06149-eebf-4932-a96e-94c063f22f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356535, "uuid": "280a5b75-53b8-4f41-89e2-1d80f8a2e9e3", "value": "fdb4d4225c366804f2edc5c6d6198f97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8adcfe4f-eaa5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711370721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370721, "uuid": "c2eaa746-9d4f-4b96-9e74-51fec5929db4", "comment": "Malware payload", "value": "083132a46ebcf19e7c1f12b4f4ad6f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370721, "uuid": "b64806b7-8b85-4094-9939-05e1f6a1fc12", "comment": "Malware payload", "value": "f16e5cb1aab47f341fbad4948923f25b0cc4fcd5cace3d0bfd176da3863241c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370721, "uuid": "37fb5fc2-77cd-4d42-8dcb-65c15646d1e3", "comment": "Malware payload", "value": "55b07c3ae228be0c28f551f05f45be3f6956457d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711370721, "uuid": "1eecd912-593f-4e1e-ad82-28600034d39e", "comment": "Malware payload", "value": "0309c750ea8d28c6ba2ccc1ce2c680acb7dadb9b684cd3505836a3e2b8877b30dba1fd38af5f21b5433323254c3fc814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370721, "uuid": "f2db1087-f4a2-4290-948b-f2a86ebe411c", "value": "T156E0C2074660C8B5CC1802B80753DE102369BB98D6C98733DB68017A69002785491CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370721, "uuid": "77b49036-b79c-4071-a624-99f471ac81b2", "value": "6:idqovVg3F+X326PyDRH8ywdsG4CwtQZ/3tyelz:enGSG6qDRHmdsG4CwW/dyeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711370721, "uuid": "073670d3-11e3-42eb-a628-354d2b5ed316", "value": 420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711370721, "uuid": "44e6d27c-e86a-4db0-a608-f7e84c8eca23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711370721, "uuid": "e5c16cb9-dd4e-40e4-8f11-0aa8d556b5d4", "value": "EwPWNBML.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d27f839-ea85-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711356874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356874, "uuid": "4373d1d0-426b-4571-b885-996c3ff7dc40", "comment": "Malware payload (Mirai)", "value": "b4d7326227873374cf477db5464d2b17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356874, "uuid": "6ce06ea4-8ddb-48f6-aeda-246ebcbab69b", "comment": "Malware payload (Mirai)", "value": "f21a17935cff024f4e0b5ba9603eb6ebbffb4afda2952e6cae41dfb28d858c63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356874, "uuid": "61281396-2bbd-46cf-b32b-577e192bc660", "comment": "Malware payload (Mirai)", "value": "cb2efaab1aadfd3b9b200f2e8156c58856b10d96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711356874, "uuid": "edacd041-e7e1-4f99-83c6-cc7b90bf0961", "comment": "Malware payload (Mirai)", "value": "a7cca2d7e1246b7459ef72fbd287dad7f91102574973100e33597ed2bca2a1fabd1f48607034ec2549815479ab594cbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356874, "uuid": "d210e6ea-0720-4c6c-b0c2-25688efec137", "value": "T1E453B519BF610E37D8ABCC3709A90B0229CC565722E93F267970D928F60F54F19E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356874, "uuid": "02822299-9786-412f-8718-43b0ae65e8cf", "value": "1536:8JCCIGIQ68wmqibkkn+KzI4gdbZWwWuO1a10:8JCC8Q68wfipbgbKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711356874, "uuid": "ed17a27d-ad08-4f31-b75d-dc5835737f9a", "value": 65208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711356874, "uuid": "2e9a482a-6df3-4791-ba71-9a48b380b3d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711356874, "uuid": "87bdf21a-c803-466a-bffb-ae58077f1751", "value": "b4d7326227873374cf477db5464d2b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec3896b-eac2-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711383290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383290, "uuid": "8412506d-9ba4-4bc5-8d4d-50c721ee268d", "comment": "Malware payload (RemcosRAT)", "value": "530e8e04a85a0d33d960e21318b80478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383290, "uuid": "e38581b5-fe91-4708-a4ee-8861f70add91", "comment": "Malware payload (RemcosRAT)", "value": "f240a81fec7de0227d57e18da194b50d8cada15613719b3bda6236c401e0e8ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383290, "uuid": "a59ea046-25ed-44c6-9bc9-7c4b4d19b55f", "comment": "Malware payload (RemcosRAT)", "value": "c44ccc95de3b32b60c4c2ae6684cd97b253bc88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383290, "uuid": "cccbb2e2-5b67-42a7-8822-8b9d706e850e", "comment": "Malware payload (RemcosRAT)", "value": "97d73c2ccfd5ecd53175f513fc9005f955ff7fcbd66cacf654778eb06d7ee94465c7c7cce0113ee79463230c6b896e3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383290, "uuid": "7d451635-795b-4871-9def-b9eeccce1fa2", "value": "T1C5E401C5F2508457C69A26B08B95FE79232C9D591C02F29733E33E1F7A7BA4389A510F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383290, "uuid": "0bab20dd-bfab-4cfb-9211-2cd1cb38ee79", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383290, "uuid": "a737512d-417e-4d0d-85fa-d1c1e253ca7a", "value": "12288:ewWNc8eZ5YG4rtXzlrkipUe3mQakoeN4eN/FH6+C8XKDem+Gk5lIeF3jYFTKE2:eBM74BJkipUQmsN4eN/FH6+CLDeT5bt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383290, "uuid": "f9ceaea4-737c-4175-98d9-b93bac2810f7", "value": 657104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383290, "uuid": "15f8769c-1bcb-4904-a57f-5254d463c04a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383290, "uuid": "0efea065-7e40-4b1e-9f62-cf53e2038324", "value": "ORDER88273747829304.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9110b4-eaba-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711379532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711379532, "uuid": "6a2abe7a-62d9-4850-8696-bff26ff26986", "comment": "Malware payload (AgentTesla)", "value": "ecc6e9e230bcf7b188a046d8e6de9393", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711379532, "uuid": "16f7e6bb-4414-4ed9-9367-78d5c958064f", "comment": "Malware payload (AgentTesla)", "value": "f2684f314bd809180a5eab027fbe1e4fd685835770fb725cf6b03def71b5b732", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711379532, "uuid": "5f497625-4f9c-47d4-8bd4-75496ee8f03e", "comment": "Malware payload (AgentTesla)", "value": "e3077691c911ecfbd1770515d0056b6c6f772ceb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711379532, "uuid": "7de2197a-06a4-4509-99ff-892481a168ce", "comment": "Malware payload (AgentTesla)", "value": "46d588fe3ca2555c9df97e2408ccf57c2ac92b85de8f6d0a9de20389d7cc3471c8fa1699e745cc893db9040cb7f5a4c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711379532, "uuid": "e5a79bb7-ccde-454a-8134-676756c12c75", "value": "T127E40202797102A2D191B0B326B3DB21C9BB2D60D8E3172A5B14FA3D2A795C3F65F91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711379532, "uuid": "939fe6b9-2228-4863-b3d4-28f407dc97ca", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711379532, "uuid": "49c0331e-256f-4c41-b7ec-f80d7103d103", "value": "12288:FLTA8PHO5mU0It61O4Rc8xvbHje3mgSSBwlemT1vDfrYI3b:9TA8PO5mU161PFxvbS7w9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711379532, "uuid": "bfb8267b-fa87-49ed-b1a3-536cb1298fa5", "value": 699666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711379532, "uuid": "5b6238cd-70fa-4f93-abf3-07f4353e2a62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711379532, "uuid": "c44cccf2-aef8-4f44-9104-853d83b3f74c", "value": "I_DEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f31559c-eae9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711399934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399934, "uuid": "357acee4-e025-4e33-9ba1-1152e632e94c", "comment": "Malware payload", "value": "bf0f433abcabe437a72b128537680a49", "object_relation": "md5", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399934, "uuid": "58a2094d-6379-4efc-83dc-afcdb7fe3ab0", "comment": "Malware payload", "value": "f3330af910ba83f74deec6ffd26a5401360f0e984678a8fae64cf8f944cbce5b", "object_relation": "sha256", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399934, "uuid": "16cf9cdf-81a5-42fc-bdce-b3dd601351ae", "comment": "Malware payload", "value": "91c39fbe0ee33855de3b202f9b658eaa8ed70a8e", "object_relation": "sha1", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711399934, "uuid": "2054c860-e134-4306-b061-1f4498530802", "comment": "Malware payload", "value": "4812284d95931783d4fccde8e4abb55fa7da3f9b4f53ff1a986e11d883aff15c773049a6af82bc897374c96d8be1dc06", "object_relation": "sha3-384", "Tag": [ { "name": "admin888", "colour": "#E903D8", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "newxls25", "colour": "#4A3966", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711399934, "uuid": "424b8fc0-0ba3-432c-8153-bc8439b3943e", "value": "T12D6302EBF17E5902D7727036584A21E6355BA03CE526FA590806BBDE87C042733E47AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711399934, "uuid": "83041a6e-21ab-4e9f-9f3c-c0961a9cb89f", "value": "1536:C2i3OnslDGe2eGyIvJhaaO5Ny4iUvRB75d/wSgE9pgyjxOqTY:C3Osj4yIRAzHiE/7n/tgE9pgyjxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711399934, "uuid": "9d51b43a-6fec-476c-9b52-784b9ea630d8", "value": 67582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711399934, "uuid": "9d1150cf-3fe6-4340-a035-c0def76e3d89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711399934, "uuid": "46e6190d-e55d-491d-9eaa-8d6abecee53d", "value": "march-25-2024-7320.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94846714-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711384052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384052, "uuid": "4c5b6a77-e377-4c9f-8f84-9b0d9a64e2a0", "comment": "Malware payload (AgentTesla)", "value": "935e5811eb02289f3fa02f46b6642f52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384052, "uuid": "9b32a525-0c79-449a-becd-192ff85e57fd", "comment": "Malware payload (AgentTesla)", "value": "f34c081e10503e1930c7a24c39e144c78bf59c22e6741e9c991334ca78fd34c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384052, "uuid": "9c20ec3c-82b6-43b0-9162-8051cd8fabee", "comment": "Malware payload (AgentTesla)", "value": "9cd13ee6a79720b8ce134c73d14531a925243a43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711384052, "uuid": "2599b77d-2935-4adb-a6ab-0752494993ba", "comment": "Malware payload (AgentTesla)", "value": "6acd25279ea5f4778416340f3c1dc1dd10c983472ce2f811898cb55785640d581b7802c93c616fef0ee8929e4b1dec6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384052, "uuid": "954163bd-e41e-4c15-8993-1e37a749d5d1", "value": "T142E41256FB9403B6C1A903B115BB1585B37AA42B6631C7582DD040ED67B2F208B3BFDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384052, "uuid": "6acba84c-b8a8-4fcc-ba5d-f9506eef4a8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384052, "uuid": "4f7dc082-bec5-4d3c-808e-b3084aaf1b03", "value": "12288:TN3gC74CMwbtve4PamkHhrIF52iyEO4SKvAGHYWfs11qBGviKmmZgDgNjIN:TN3FFCDhkFAuOBK54WUrWeiKRgDgpIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711384052, "uuid": "193654f4-ccdc-4304-88a7-91664b8a9d54", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711384052, "uuid": "08b853cf-78d2-408e-b368-2c2baeb24f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711384052, "uuid": "10b6031e-4ea1-4507-aa69-2b9474724a58", "value": "Dekont-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184acdd0-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711368381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368381, "uuid": "656b5200-b5f3-4688-8144-25f2df82418f", "comment": "Malware payload (Mirai)", "value": "5e9a8b70e6d83c226ebe04fef1b1a447", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368381, "uuid": "f19e6b0f-e616-4222-91bd-06a251783033", "comment": "Malware payload (Mirai)", "value": "f61d3e004cce67f579d005667efe3137218d2a18946cbef046aec5af36f38436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368381, "uuid": "aaea2eb7-0282-41ab-b0a8-ae6471244c55", "comment": "Malware payload (Mirai)", "value": "82063096081bdb0a9238822c240d4d9cebb835a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368381, "uuid": "0b897a0d-6d77-45b1-a599-9e224a8e66ab", "comment": "Malware payload (Mirai)", "value": "8030a47b6e90753794ddc356bd67e13af61c91e8fd395c5a71387c8237e0146a0450b6336efa2fdb4b9389c30cb20396", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368381, "uuid": "09aac77c-0831-43c6-87dc-c7908f82a427", "value": "T1A853027227DDDC53F2A40EB6D6765A05DE883DB4D003B0565A0D9AE1338CAEB22E64C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368381, "uuid": "7d16d462-ad4a-4f95-96a3-cbd716693197", "value": "1536:3P/eGwg0T1u5Pe8QMwCj6TmeEBn4O6mqyw68adN:/zST1utQMwCj4mekomqy51N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368381, "uuid": "17bd81a3-467e-4b4c-989f-c31ee9874599", "value": 64508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368381, "uuid": "fe4e4910-82f6-4efb-b4c3-9b3f792f072e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368381, "uuid": "ab6fb880-ae6d-4af1-9b2a-d284ada40182", "value": "5e9a8b70e6d83c226ebe04fef1b1a447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8035a05d-eaa3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711369844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369844, "uuid": "1d9773e6-4bd5-450a-a10b-3aaa16a6605e", "comment": "Malware payload (AgentTesla)", "value": "279d6bc5065b1059db35609bfc38e26b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369844, "uuid": "28f35b58-6f36-408d-a9aa-5d8b544d40da", "comment": "Malware payload (AgentTesla)", "value": "f6e524a0bcc7d66fbb77fac6ec0fd0cd34743c04efdc13f7f39f85b7aab1d48d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369844, "uuid": "f1fc0aa8-d82a-4a1c-9a9a-8d73947cffe5", "comment": "Malware payload (AgentTesla)", "value": "f864e61eaece05436681fba8e44aa79ffd014674", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711369844, "uuid": "ca1fe30f-44a6-4d1a-afc7-2b444c953921", "comment": "Malware payload (AgentTesla)", "value": "a83318641ea2fa71acff5ae7c7eca2035851e8db967a4e0a4c03bb81b9222a63ec9e18ba6a52f8f7973abb3973a4d848", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369844, "uuid": "202b6e5b-003f-4060-9e93-0ddfa6452585", "value": "T1E8B5332C179D5B41DA0FBA70E10055861FB3A255114ECF68CFEAB4DB9147FEA0E863A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369844, "uuid": "0878f24c-946f-496e-b821-2188a11ae7a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369844, "uuid": "75e7b7a8-5354-4a63-8171-844721a32948", "value": "49152:/p1U9pT7QQiouzxrsWvyW4Z+usj2slxBw3n2Ri+bTfEbsRtfX:/bCgjouNrsW6nZ+lvlHw3/FoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711369844, "uuid": "b8452899-0cc3-4e19-a4d5-11975748e621", "value": 2321920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711369844, "uuid": "0af57631-6315-4a36-872c-f0b63a8bb207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711369844, "uuid": "ad2975f4-51aa-488c-a82b-fba2057834ba", "value": "Twoiotycwhi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612a1c49-eac7-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711385254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385254, "uuid": "caa8c20c-61be-4ad1-af38-e99cf78a5162", "comment": "Malware payload (Smoke Loader)", "value": "bce7ef6b7637f81040faab799996028c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385254, "uuid": "0a93d538-9183-4eff-9b1f-1c0664ab5328", "comment": "Malware payload (Smoke Loader)", "value": "f79fad860397942a2d808e1d2b5601f7d3b2af5057195507b782d797be07f301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385254, "uuid": "059fbff4-d274-4cf1-b6ee-af0b3aba6fc6", "comment": "Malware payload (Smoke Loader)", "value": "dbd45c8bf5fb1158ffa1721850af0afe592a30e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711385254, "uuid": "ceb8a54f-d1e8-4f53-a314-627089b5f9f1", "comment": "Malware payload (Smoke Loader)", "value": "bda01ccd37294e9385282614a1b140ecb109f7fa44c1b48521e1f17fabf7eb9c45f41afb1f90573d505cd9f0e649ee0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385254, "uuid": "90473cac-d833-43b3-89db-54e97efaa56c", "value": "T1F744BD0236E2C4B1E5B7463A5974DA64093FFC73C935C99B3784270E6CB45C1AA72BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385254, "uuid": "7dc90d31-9daf-4580-bb00-d0bc139c41bc", "value": "ff23e32a63aac9251bb507fbef91be04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385254, "uuid": "1c5d6b1e-396a-42b8-a346-e987a1bb45d7", "value": "3072:l2pdBCN1S+lg6Oy/+VNX2VZXgvrraCUee8JY87PV/Yz7uUsNjp44:0dBjJy/3oaCdlJc2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711385254, "uuid": "6804db35-3377-451b-8c3d-997d08133d27", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711385254, "uuid": "9e3349d9-3974-48a0-aa3d-27418753b509", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711385254, "uuid": "bcb9d01a-09b4-493f-bcc3-42910b85bad1", "value": "bce7ef6b7637f81040faab799996028c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363f3300-eaee-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711401932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401932, "uuid": "4e519923-7f11-4fbb-ad99-9c0d9a14bdeb", "comment": "Malware payload", "value": "f21ee6525b7c1a25ace738d80f751d42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401932, "uuid": "dca711e5-6f50-40f0-81ad-055595b98312", "comment": "Malware payload", "value": "f934f17876a84737f1674b440cb8e29adeea5e4955ad7e8dc5fd37b6bfc9bad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401932, "uuid": "e17f8821-e776-4ff3-acb0-9639156fecbf", "comment": "Malware payload", "value": "5c4be2b3a19bdc64d50442303d19522563d4c4a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711401932, "uuid": "877e2e46-e389-401a-9809-cd3153c4e911", "comment": "Malware payload", "value": "9b0862296ce5dc728ccea922e88771559f13d0763c46b5e7a345e56af9f300f0335edd6868af7643a054b718dcebc567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401932, "uuid": "0db444fc-ac6d-424b-b150-6f8c65f386be", "value": "T19521789AA7D35D16CC940237DDAB5714E322AE84859EB503F31116150C7E31A1F22189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401932, "uuid": "9d93b150-08f9-4b02-95ce-0c59a8089b57", "value": "24:JiAtVsgP9qD0at6EocGArUlFSy4PzLCkIddx2BWQIbaNfe:JPtVFFqDPtDrkFSy4PzLZPIbaNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711401932, "uuid": "bb1b5078-b358-46dc-a346-d4685ebadb20", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711401932, "uuid": "5835f55f-1a11-40a4-83ae-66149963c622", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711401932, "uuid": "2723bb71-f219-4e0b-acd6-26006b4da7a7", "value": "SecuriteInfo.com.Linux.DownLoader.523.17619.29529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f530244-eaa0-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1711368393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368393, "uuid": "0a75e290-c9b2-44fb-9f20-67acf8fa6926", "comment": "Malware payload (RemcosRAT)", "value": "8bddc2d176b374df21988621d1e34229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368393, "uuid": "191c7423-42cd-4f7b-ae1a-0a572a37d8f4", "comment": "Malware payload (RemcosRAT)", "value": "f9905175d2bba89cc70840195fe3ab71f3da27cb466e532f5e58c0b89f6880c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368393, "uuid": "f7c850b0-0c00-4907-9ee6-b7fd30761684", "comment": "Malware payload (RemcosRAT)", "value": "e9482bcfa0106160bd0d8c535082ec2a64d8e620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711368393, "uuid": "b579fc20-861c-4d67-98ff-50ad64bade6b", "comment": "Malware payload (RemcosRAT)", "value": "3f8859225c7d49e657905031ab427ece47e34f2a08cf7736083ba03e5ba4d7d68d257834cff069d4672ea54362b06e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368393, "uuid": "f142c26a-e0c1-4a64-890f-20b31681af68", "value": "T146052345B57C3313EABA9034600326E050BEA3ED6FC6C2034D465A175E167C5DAFAEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368393, "uuid": "869d3e6b-b6ec-4799-9ee8-7d5751278e1f", "value": "12288:sp4+EpVjZsEpt4Q8gn/pu6JnTzk9Sv+LWK+WGnsVNvlkYkBCdonHi6NQkt8YfhvW:m4Fpl+yD8c/sXwnmYk4HtSkt8WhMUPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711368393, "uuid": "f646dd24-d1d2-4b0e-babc-ff129e4185b3", "value": 864340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711368393, "uuid": "0f0740a9-707d-49c9-92de-54cb1cb4d63e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711368393, "uuid": "60f04f2c-6e24-4468-ac91-5821f636b481", "value": "DHL AWB 9284730932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731f6317-ead4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711390868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390868, "uuid": "a98a3721-d967-48ae-85e7-45932f7fb08b", "comment": "Malware payload (Mirai)", "value": "e8e37bea41b921c300fd7dd7776d9e2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390868, "uuid": "529a002d-ffa3-43a3-b7dc-fd1f13901863", "comment": "Malware payload (Mirai)", "value": "f9b389f4895fbc45328f1403ce5c0c40a33c0fd3165ed367faab6b5e6cb66d94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390868, "uuid": "1fdf3886-6bf7-493e-9316-706cd7225132", "comment": "Malware payload (Mirai)", "value": "fb1a188012e12f2e7ea6246eb2761de77aa40b26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711390868, "uuid": "9520f9ec-c0b0-4c8e-aef2-8bb4e9b33880", "comment": "Malware payload (Mirai)", "value": "2507f570f179210af3e8653bb19742e4f995e84eac09c38891aa4fea9222f895119a6cd30cb001b2bb64a2cbbb509888", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390868, "uuid": "a4fa6e39-ee0c-4875-aac1-ab295d62c1ac", "value": "T144B38DCAF283D4F6F85B04705036E77BEA72D06A2129FA86C7299D31F8D2940D62775C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390868, "uuid": "d59b3282-8e31-495a-b936-eaf7094a55bc", "value": "3072:ZLaZHpbENQmlS3nPX2Tays8pFFG3rto9vK13/:ZgbENQmlS3PX2TP235Iy13/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711390868, "uuid": "77d88787-ca0e-449b-9bb5-6262b3fd2456", "value": 116524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711390868, "uuid": "cec69bef-0e4a-4f3a-8286-7a0b6d70b595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711390868, "uuid": "36589c90-1c67-48bf-855d-36a55c558203", "value": "e8e37bea41b921c300fd7dd7776d9e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614a6a0f-eac4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711383966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383966, "uuid": "3a2eddec-c5b4-4a61-929d-a76bb1ca6481", "comment": "Malware payload (AgentTesla)", "value": "9be19c8e10fb09797a0e3d3c5fc7396f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383966, "uuid": "c3f34fdb-adb9-4360-a3fa-edc9c87177ac", "comment": "Malware payload (AgentTesla)", "value": "fb73f5a127c2ad0f07f45f1c4c556213dd3ce4b4076f4ae20fc8d37988fc883a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383966, "uuid": "7e2b18b3-0380-47f3-b5d0-95ca1884ff2e", "comment": "Malware payload (AgentTesla)", "value": "51a0a99ede2c3be78a34699fbc213c449c4a1fe3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711383966, "uuid": "3a225d6f-2358-4824-8601-1c1c9db60071", "comment": "Malware payload (AgentTesla)", "value": "ae8d43c56a6617c738ca62fb40f87b5a55706f1e66997841df3f65705e6032cb9c42ca6170ed6b004c3de62134df51c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383966, "uuid": "44197caa-a5a0-4632-842e-73482a5f87fb", "value": "T1C8F4124132EC5A33E2BE6AF958A6010547F2F57E20B6EBD92CC360DA19E1B405F41F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383966, "uuid": "e6cb8de1-6f95-496c-bf9b-a3473adfa759", "value": "12288:UyE0oN04r6Eqc9IVZcrur34V2y9PlQZaePquUvLwW+mL0Sq4e3AyfijHBA:AA4m3xZcruj4MONMP3k+mL+ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711383966, "uuid": "f5d8ad02-9a0d-484c-929d-226b72f061c1", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711383966, "uuid": "d3ceefc6-16e6-4000-be9c-eb83e2482060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711383966, "uuid": "ae602fd2-bd68-4b3b-917a-c314eaa96abc", "value": "EKTEDIR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a80e63-eae5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711398336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398336, "uuid": "72ff7998-5dc1-4f7c-a3b7-63fda5d52926", "comment": "Malware payload", "value": "b39ac38fa0a7dd2bd9786c3944e087fa", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398336, "uuid": "14e06f96-15ba-40e2-a1ed-691d9114d0dc", "comment": "Malware payload", "value": "fc383ae9ae43ca53b0cea754c85e4cca4c978ccd45f4fdc1a19ce3f2c6857bad", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398336, "uuid": "bb674d08-495a-4fda-be80-b4cdec373d21", "comment": "Malware payload", "value": "761926f3ea3b5b68ac0749ff965aba15b67690d1", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711398336, "uuid": "046983a8-c498-483b-84cb-36697a925508", "comment": "Malware payload", "value": "13dae10b81beba7f515f4f1ba4b09dabb5a1b9d6ec44f6d1724743daaeffd84e182afb25559c209a1647caa52a105835", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398336, "uuid": "8f95ef86-e9fe-4a6b-85c8-78b2333cac09", "value": "T1C764DF51BA80861AE856033649F78B9A6321FC419F935B0F325CF72D3DB43A55D3BB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398336, "uuid": "d03192b7-3a0b-49ca-ab92-48e816ffba32", "value": "6144:oPunhXxdY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVOHMIj25/EchYVmGmvrn:oqhXxk3bVOHMIjgMQYVwzEQqgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711398336, "uuid": "1d2ab8ce-bb5f-4230-8540-215c3878c06a", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711398336, "uuid": "faf8c298-92ad-43ec-b69b-ba1610a05b5d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711398336, "uuid": "da7e1198-2eb1-4f13-a921-0292e02e60a8", "value": "po3495954.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e736268-ea91-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711362137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362137, "uuid": "f6e6cec3-6c3a-4f27-8110-63519cc8c7a7", "comment": "Malware payload", "value": "3b6170f5087f64d3f07f6516d9ec7d85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362137, "uuid": "bafde3a0-0109-4782-9077-20d240bb6440", "comment": "Malware payload", "value": "fc73cf7545236fde6a32a980c34ba9350015fbad23f6e1e908e6a24afc5387b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362137, "uuid": "985900a7-0c85-4271-bcf8-9ed4866f99c0", "comment": "Malware payload", "value": "62fd8f30178c12a87c14fa2255f1f73adbc30b1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711362137, "uuid": "90ba3bc0-b0aa-4521-be12-bab2048b876f", "comment": "Malware payload", "value": "5547cced22abd14ee00698fff76c7b9c4ce4dcf6a0723c0681b1ba4489bfaf7f70b2e31577baa65b4b02e1ef31767c66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362137, "uuid": "de535383-6cfe-4d2d-93f0-877c7847471f", "value": "T196863385DA887FA7E506DB7806B57BB39EA73C00CF9C426F2B84FE3AC13559516C6201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362137, "uuid": "e38a9fb1-f14a-48be-a43b-441260f70365", "value": "b361afc246f8e38dc307f4498ca4d8a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362137, "uuid": "1004252d-386b-4c8a-8182-d6ddb6d16c8a", "value": "196608:EgMu7Jgn1zMwtuKcRSkHd1tNlrZ1jH07uuC7gxFzW:pgn1zRtpcRSSJHexBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711362137, "uuid": "68d28a57-63b7-48c7-beaf-70440dd22f2f", "value": 7872456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711362137, "uuid": "a584d2a4-f91b-4741-a37a-d25d8c23dfcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711362137, "uuid": "209639ab-3d34-463a-bfb3-96a803ebb241", "value": "SecuriteInfo.com.Trojan.SuspectCRC.16195.25670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }