{ "Event": { "published": true, "date": "2021-09-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-19", "timestamp": 1632096182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "028b58b8-3b31-4665-a1ac-d92ae5b0c262", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09ae52c-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632032833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032833, "uuid": "fce7420c-75a4-41ee-b94e-636c728c4e3e", "comment": "Malware payload (RaccoonStealer)", "value": "7490e32cfb7d0e3ad788e47a724ca272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032833, "uuid": "bb884727-9b69-45f0-b5d4-98926daf4f45", "comment": "Malware payload (RaccoonStealer)", "value": "0036cbb0add5b8450be9eb58de9c150d160d87a924b21f049421f5d67d6bdfdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032833, "uuid": "17831b73-c14d-4c60-af65-d77c0f7efe18", "comment": "Malware payload (RaccoonStealer)", "value": "4c170840d9cd00091b51712e56df33ccfdcf0052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032833, "uuid": "c8cb718d-6c76-4433-b1d2-68c151e358be", "comment": "Malware payload (RaccoonStealer)", "value": "814009c09ae2ae119827457e4497784bfdb353e5392d757ea6ca1ef538c74beb86762307fdf3ccd2e1e6e3d82495a186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032833, "uuid": "a2e9aa92-b065-4feb-819a-7735bc609dc4", "value": "T12FB4E120B2A0C031F4B712F959B5936DA52D3AB19B3460CBA2D526FE2734AF4DD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032833, "uuid": "dd4465f4-403d-4849-a71a-91dc325e5a6f", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032833, "uuid": "af6b257a-93bc-4342-b795-2655e1de4994", "value": "12288:rZ15hrj6dQ87hidHvvahO5YbvFeiUaMkP3lubw:rD5hSnidHKFkaMkdub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032833, "uuid": "2e51a050-b05a-4503-929e-acabae018361", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032833, "uuid": "45025505-358b-488f-a4c8-806b1fee21a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032833, "uuid": "18e47c60-0d7d-40ee-95bf-41297ae316f6", "value": "7490e32cfb7d0e3ad788e47a724ca272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886a1da9-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070159, "uuid": "bf340121-486b-452f-855c-6c2ccee4498f", "comment": "Malware payload (SnakeKeylogger)", "value": "1a3718b48e5b3609163597b8219e7a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070159, "uuid": "8278be36-4326-4187-8b06-c9480df2410c", "comment": "Malware payload (SnakeKeylogger)", "value": "0066ef439b6a9758eff6e41fbbaa7b3c6676e04af629b92550591af0d3a86e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070159, "uuid": "e26e7efb-e293-469f-a4c6-72128dea2e0a", "comment": "Malware payload (SnakeKeylogger)", "value": "8dc450c63fee1ddc37b729b8beda3623caadbe01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070159, "uuid": "94ba719c-c324-4d7d-9ba8-99076a09d0bc", "comment": "Malware payload (SnakeKeylogger)", "value": "0608ded6672013b4ccc663aa33c357b35baa45a44cfdc729ccf94bae2980e4b75b1c25b1b5e612791d922196045abb77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070159, "uuid": "f4fd98bd-acf6-4434-8088-de5d592f9de1", "value": "T1FC84BE243AEA9119F177EFB55FE07592CA6EF773260BA45D109103CA0A23F40DEA153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070159, "uuid": "87d17260-8428-4ea9-943d-c44c73efaff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070159, "uuid": "b3bcf490-7226-44db-83ff-42b2e4dc26e7", "value": "6144:6a3xU38co7lQDbCMN4K4Cs3Gzbh22YBKzKkzmg9UOxgb3nUKbu63p5Z/v4ta3k3O:6a3xi8BWHCM2K4Cs3GzbhBYATn9cxbuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070159, "uuid": "afe798eb-6f85-479c-ada3-9053a47150ac", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070159, "uuid": "9c2bf521-96c2-4ecb-890d-aedd38e78725", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070159, "uuid": "7d79ada9-06d4-4510-9cb3-4f066698e0ba", "value": "RFQ NO 97121533- UNPLANED PR OGI 3214 - VALVES(FP 4333-17) pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b2c576-1902-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632025862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025862, "uuid": "b890025f-0a16-4a7e-a5bd-a56bb7cb0957", "comment": "Malware payload (RaccoonStealer)", "value": "a68752ebeaea96b15774848949e11dc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025862, "uuid": "40eb484a-97ef-4369-a875-98b382d49685", "comment": "Malware payload (RaccoonStealer)", "value": "00788a2af499441920ff0f204d7909fe507e3a6601fb128966a5ed365b8053de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025862, "uuid": "3f9c7cc7-374b-4df3-8606-4829895d8496", "comment": "Malware payload (RaccoonStealer)", "value": "63280fd30f798b98ce4643ecc3535551fc158c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025862, "uuid": "5b3e6550-acc3-4b74-b0d1-1d4f3958acb9", "comment": "Malware payload (RaccoonStealer)", "value": "b1d8cddc51238a2a553916c6fbc43d182ee2b7661a10dbdecdad4523fe620ea3a839825a822a89e18ec90e228bc6f526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025862, "uuid": "d8f2a98a-9e01-4008-b4a0-5de44d996505", "value": "T1F4B4E120BBD0C034F4BB11F859BA83B8B82D3AB06B3495CB62D656EE56347E49D30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025862, "uuid": "c6720c33-d0a0-446d-9ec9-abf3f683990d", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025862, "uuid": "551ffcc3-2994-45de-b45c-67560b03fb4d", "value": "12288:NZ4suueL62s0+e0UBCZ7iegVGU6L5+6iQOka3:N6suw/7/gs55TiQ1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632025862, "uuid": "4d248cc3-af54-467e-9990-09ff6d8c211c", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632025862, "uuid": "5a44bbd5-d73b-44ab-85f2-f7d3df932c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025862, "uuid": "8337132f-ffd1-4a1b-a3ec-994a4e70b459", "value": "00788a2af499441920ff0f204d7909fe507e3a6601fb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c65942a-1924-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632040557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040557, "uuid": "7f9286e7-3699-48a0-8788-5507aba7ac20", "comment": "Malware payload", "value": "c337803cf727ff01f1e6befe515b37c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040557, "uuid": "8ff96c49-2dbf-467a-88e7-df0b026136c0", "comment": "Malware payload", "value": "008ba1ba1b98285078098137058a51ec8e7a0808d93efade3618dc76755f0468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040557, "uuid": "19528e91-be27-439e-89ac-4feb59026a5e", "comment": "Malware payload", "value": "0c47d2285099636846d8b611cefa4801d3ce4724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040557, "uuid": "6bc62b4d-25c0-4d7c-af29-c07bf2462941", "comment": "Malware payload", "value": "cbbe8f91ebf3684f57a95110221b5fd1c5eadc36c97d06d85a0979bd42bdcadc1e7f2592c4dac0e0b360c11971cd8ce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040557, "uuid": "f7aefd97-6c11-4cd2-97af-736ec9ff2b37", "value": "T1DB8711618B34112DB17B4560DF25F1FEDE66089FD5299326FED2E691BE232F01D2E082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040557, "uuid": "ab64e7dd-a4af-46c6-8a54-c22a95e5a193", "value": "3c1bc37fad736b34c5bde4babbb3579d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040557, "uuid": "4d13434a-0ef8-4459-86a1-b7e664ca3ef3", "value": "49152:GHbsBjuuZ6cHSu9VBqjPpepNfLAteG3Iw:GHb6jiS9EPskewIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632040557, "uuid": "f7bd173e-af6d-4dc4-b051-6456c9dcbd00", "value": 38379008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632040557, "uuid": "c9a25f8f-0ba1-40c1-b6c0-f4ecbf417774", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040557, "uuid": "6b800aba-316b-4a4b-a8c3-4d91c23df56d", "value": "\u4fc7\u6dd520210915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a657c3dc-196d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632071927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071927, "uuid": "130e022e-eb73-419a-a189-31252bd6cf2a", "comment": "Malware payload (Mirai)", "value": "985bdd7622fd6a4038c1b4715b2ee952", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071927, "uuid": "0594bc8b-5b84-40c7-8c66-052b0b620e67", "comment": "Malware payload (Mirai)", "value": "01f5a2fa92b15cbd4946b022896756898dfde3cd703346ac2ae5515e81ac8628", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071927, "uuid": "c09e28f7-f417-49d8-833b-2f5e16322af6", "comment": "Malware payload (Mirai)", "value": "30a45457ea5e9245c861dac43d2fa987bbb10bf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071927, "uuid": "13083f1e-1087-4d5c-808b-7c7024061f6c", "comment": "Malware payload (Mirai)", "value": "38291c982af1efd5f1e96a6b78a4c9118ef843080ee5fd67bf83628e30e5a6c93484cdd7d6fed437804a05bee88d8ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071927, "uuid": "62024ff7-69ba-498c-83ea-0172f2f56db3", "value": "T1ADE31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279E1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071927, "uuid": "cfd1827a-ec34-4e25-970e-96c725e22538", "value": "3072:Z41HOuaGVV3NfHUOjqyl0qCw3jkmhxQwoVZUNu:Ze3aGVVdqyl0q1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632071927, "uuid": "e0545ded-3441-4525-ac64-dd5527bade09", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632071927, "uuid": "ccc4d37a-5a45-4988-93f9-2e673f501b68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071927, "uuid": "6117ad55-4dd8-40d9-a19c-32532620fcb6", "value": "985bdd7622fd6a4038c1b4715b2ee952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d51445e-192a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632043001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632043001, "uuid": "a04fb60f-729c-4b96-abf8-a69c37c2590f", "comment": "Malware payload (NanoCore)", "value": "aa21b26cec5d66760cd0817f93c49e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632043001, "uuid": "25536b55-287b-4b85-af1a-9673e885c5cb", "comment": "Malware payload (NanoCore)", "value": "0212a6f3797ab76db1daed6548c89db8174f07ab3376bf70a760361970506a88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632043001, "uuid": "53df38e6-e7b0-437e-8728-fc496028bcae", "comment": "Malware payload (NanoCore)", "value": "18cb331bb2f064cd202f45426b4062d6f59456f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632043001, "uuid": "566c6941-c511-4b74-aee7-cc3053747f5f", "comment": "Malware payload (NanoCore)", "value": "c24d93a892c65c737e92136a39857f82832435a0bce92ad4c07f5a29a33d3658807e8bbabaee1a6e31e0fdd48e739c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632043001, "uuid": "aacc45b6-1cec-4574-a2f8-6dd366e7bb9b", "value": "T14CA4120822EDAB61D63C0BF435925440E7B053EB7431FA8A5DDE26EE13BBF954290E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632043001, "uuid": "dab01fd3-d645-4adc-af31-dd632e3b34cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632043001, "uuid": "e0cca286-9199-443e-98fb-95573f90c40a", "value": "12288:7z29LDV4KqHGm9PHqYgEyZ3ihbt8w8jx:7M3VMGm9PHlsJSb49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632043001, "uuid": "1a7ec384-c4ee-453a-8591-363841a07d3b", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632043001, "uuid": "d3e2d8fb-cf93-4918-93ef-0d7044f842fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632043001, "uuid": "20377e6a-e510-4dd6-a111-865a6c1d2696", "value": "qOGkiZrrLqB6rrb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40210d86-18e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632014203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632014203, "uuid": "07b37979-6fbf-45a6-8e19-a10edbd1ef70", "comment": "Malware payload (AgentTesla)", "value": "01c33b70e33120cbcba4c4a6d486cec7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632014203, "uuid": "027c1da3-d1eb-4bd2-8147-b54437aad8be", "comment": "Malware payload (AgentTesla)", "value": "0247db3b4f5919c0b0c9e9c7856073fb09979b766119197fe60eb3432c49d68a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632014203, "uuid": "ded34016-be97-4e77-81ce-4039b051b5e0", "comment": "Malware payload (AgentTesla)", "value": "ab6f0955e3c79ef0fe57b65f38704e6ffbbef571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632014203, "uuid": "abcce298-9fc8-4745-8193-8bd44dd467c0", "comment": "Malware payload (AgentTesla)", "value": "9924fc7fd01c65263113f8e51f15ee467f57edd20c71a140b6dca5089150809ec8bf19e1f0ed7ae7c793c39893bfdfbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632014203, "uuid": "1e1faaae-ccc8-4bf1-80fa-bfbeb5eb3e17", "value": "T1B045DD296D2292FFC7EBC578D48C0FDEEA61A4937B524F0AC09397D6864F60BD94805C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632014203, "uuid": "f240c348-38a7-4bf9-aa89-3c8e6b6905ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632014203, "uuid": "fc5a96c2-b6b3-46b5-a363-f0700bd7fdfe", "value": "12288:OQm+P87jEws46bBdaAjHt1cTlvEVj+/HJIujhCS2ODUXgcgDB971hOXKAbEvX//a:E+P87oH4kH3c1mybjAS2ODlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632014203, "uuid": "c58a6bcf-fdd8-4dce-bfca-0af1d65f209d", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632014203, "uuid": "84c761b9-439f-4622-be39-269a4b58830c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632014203, "uuid": "31667de7-7119-40a4-9091-a5ff96cff561", "value": "Swift_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b423dff1-190f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1632031577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031577, "uuid": "61ce024e-4bed-4b5f-9686-991b0befb97e", "comment": "Malware payload (DCRat)", "value": "2c4f5612efef78a08226ac5f49b10486", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031577, "uuid": "3e9adfe6-87f4-4b03-8e77-63256c76572b", "comment": "Malware payload (DCRat)", "value": "051fc99ae126193d3336a2539b566507f7fef112ca6c5738c404a9e56e3aeaff", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031577, "uuid": "6f7cb9df-d13e-4a6a-b223-300340852dab", "comment": "Malware payload (DCRat)", "value": "808e5013efb052b74ad8d76c2bc47085f9c3c947", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031577, "uuid": "331bdeef-d8d7-4948-8a62-acbd53fe5d0c", "comment": "Malware payload (DCRat)", "value": "65a2c7d9686a131483075140e8f26a2440d2c5ae902f396734301c5dfc03f43eb5570749ee8b3cb7e9a36aeb895daa3f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031577, "uuid": "4c081fdf-4663-4a83-bcd0-9b0dcff373d3", "value": "T1C0645A60B694AC5AF316C8749CD5C31E3A22EECA5F874B072634F73D4576398ADF0924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031577, "uuid": "1895a49b-044d-4110-8bf1-e0c8217c700d", "value": "202ed20a6eb7f03326e5ec59aed0dbcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031577, "uuid": "17b7117f-9769-4c35-99ea-a158cdc8baba", "value": "3072:DEn4pskzOAd4vZlFOiYzHGSZCzDyWv0JEmkmheZmd/F9F+1H8YBeiug:YIiAdszOiiGSgneEmkqrZaH8Xg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632031577, "uuid": "ced1c248-00d2-44d8-a04a-252f009fa774", "value": 326403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632031577, "uuid": "cc510aa2-9e3f-4640-ae33-1840d95fdab9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031577, "uuid": "312af3b3-df01-424d-9fd7-de4d80e21d87", "value": "2c4f5612efef78a08226ac5f49b10486.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c2cdb9-1946-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632054952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054952, "uuid": "286ceae0-75ec-4799-8b33-4308f87c78aa", "comment": "Malware payload (RaccoonStealer)", "value": "3c8a6fb42666f6ee55c7c7a1ce833bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054952, "uuid": "9a2b16a6-c6ba-4ef6-9ec6-98672a62094a", "comment": "Malware payload (RaccoonStealer)", "value": "0597fec78019b2f9914df4a6c7f5a54eb0129ffb527bf9e7a144246ff6130eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054952, "uuid": "11ff1f60-2198-4a98-ab93-1b41192a9785", "comment": "Malware payload (RaccoonStealer)", "value": "d87e89a6d93f77c1646ac72179e36d945ffaa3a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054952, "uuid": "84213132-1209-40c3-b7e2-d0640e59b928", "comment": "Malware payload (RaccoonStealer)", "value": "6e08f195fa9646c001c6c6daaa46ef72e09f91821abf9fe33fbf0ab69f3f1fca2e5121b258fc2b49e63b9e61afeb4cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054952, "uuid": "80125011-5902-4b6e-945d-d7297b90bdb8", "value": "T117B4E1207AA0C035F5BB12F859B68368B93E7E715B3441CF62D516FE66382E89D30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054952, "uuid": "d59c8c8d-ff5d-4032-9a98-8a30b23ec957", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054952, "uuid": "0ea9886a-6b54-485e-9ab8-675806599221", "value": "12288:CZeD3PWfLmwAvn7DIXlG6SU7Pt6JsYXBpb3lvWWiS0EYqV:C0D3Pf4XlG6SU7PtSs4pb1tp1Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632054952, "uuid": "908df03f-e738-4d85-ac5a-f251475ccc73", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632054952, "uuid": "eec83fce-09b3-4b4d-b423-a1e90ea690a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054952, "uuid": "ff2ec9f2-98bd-428a-bfda-5ad64b254fad", "value": "3c8a6fb42666f6ee55c7c7a1ce833bd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb6edac-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070196, "uuid": "120f0410-c8f5-4afd-8d60-5e7552824dc9", "comment": "Malware payload (SnakeKeylogger)", "value": "63cbb6adf270a32b4db26384ff31602a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070196, "uuid": "29a54ad9-4a37-457c-8120-02bbf75a31f8", "comment": "Malware payload (SnakeKeylogger)", "value": "080a67d131facb8ce1207b2f2ac65d336aa328903f88ed8498ca3c0090a95205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070196, "uuid": "af8fa2b9-b9fe-4a30-ac00-047bb2be402d", "comment": "Malware payload (SnakeKeylogger)", "value": "75a2a6b198005bfe3b9ac8f3f10cd3a9377de0f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070196, "uuid": "3d028cdf-50b1-426c-a998-48e05170bf00", "comment": "Malware payload (SnakeKeylogger)", "value": "ac1c53ac2342d193b9ca02496b1d0591c6239ac79f46251e9346ee2e3d7272911ffe7ceeba3a58b3cbd21f0d67be3b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070196, "uuid": "ef60d187-ae21-43a5-bd1a-2b75cfa8deee", "value": "T1F9B42303A3E104F9D0A85BB4467D5A6EC37A8301D01B65538774FDB02A36AEFD72BD89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070196, "uuid": "1a850b6b-0cbf-4bc7-bc70-a5633f528d29", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070196, "uuid": "34ca6a37-74cb-4e86-936c-dbae333d7c9d", "value": "12288:BZ9adU8q/4OjxIaLOtre0eX+wogRQ499ZRD+cs8OUSM:BZUzqgkIaLOtr8ZoUQeRDPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070196, "uuid": "c81266fb-05ff-4f3c-8846-0d25be1e298c", "value": 526825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070196, "uuid": "170777a5-a888-4fce-8af9-195519b75d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070196, "uuid": "77a65e2a-180e-478d-9656-98596f27b28f", "value": "28765434580654245678098--0986545.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ddf99b-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070071, "uuid": "69b81e64-875c-498e-a16b-70d6aae8a200", "comment": "Malware payload (SnakeKeylogger)", "value": "7585f4eb5bf84ba087b30a942fc6a22b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070071, "uuid": "ca041ed3-dcdf-4f3f-9929-ee7c2bcd68a7", "comment": "Malware payload (SnakeKeylogger)", "value": "084f36f5c396edbd7c024d58cdc4bf3c9ecc1d9b5f4554bb82fb2d1dc1db94e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070071, "uuid": "b2708a47-7ed5-460b-ac4b-1965efb9b69a", "comment": "Malware payload (SnakeKeylogger)", "value": "95c8dbbb62540caea0c991220c317fb3ba385a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070071, "uuid": "1106529f-585b-4cfb-ba74-7f0228e4cbbe", "comment": "Malware payload (SnakeKeylogger)", "value": "e532de5cea8ee9124714d1dbd576a1492e2286a583db0cdd40bd0b81ffde43a6723ef516b39169674fe61a56e50a7dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070071, "uuid": "0d8bded8-aaaf-4f05-afff-42fd2dd72f08", "value": "T11754F13235782B79E9FA4FFC99E462001BFC36DB7992E38A0F5075DA20627905394E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070071, "uuid": "23c2f925-1cbc-49d1-9997-c2b1d84264af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070071, "uuid": "98c593ab-e0c6-4a1d-b45c-aceb7af9865b", "value": "6144:YRz2Dwtjv+ZQ439U5EAh7mFMK7LOjJpfVvfKfxnA:YRCMpl4K6mCSjD9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070071, "uuid": "b76f5166-d19e-432a-8f8a-e0ced0e7caf7", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070071, "uuid": "a50fb3f8-fb65-45f7-8264-60bd8121f704", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070071, "uuid": "8224ffec-7c41-4fb1-9651-4d3f4eddd668", "value": "purchase order pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489ab53f-1900-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632024955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024955, "uuid": "638fdc56-5f2e-415c-af13-66a29cf56359", "comment": "Malware payload (NanoCore)", "value": "e6af461ce5b1337c2a00f9d88aa72443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024955, "uuid": "3721b8e2-8824-4f6d-b490-ea88577b0e8f", "comment": "Malware payload (NanoCore)", "value": "08e42c3fc9e89bbf9462cd7bb583aec13c5f6b8e211f4a9fb2e729603a78ba7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024955, "uuid": "bc52c011-5fae-41aa-89ac-fa9884572bce", "comment": "Malware payload (NanoCore)", "value": "af39ee76b4a807f83606c7b02d6657740d84f002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024955, "uuid": "2277aa9b-0186-406b-903c-ebf48c61b835", "comment": "Malware payload (NanoCore)", "value": "203d15e947a76864e9878eaa18b5554db0168fdf394838423717954c788e0eb4c4624faee393cc9be81fae9b6c70bd81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024955, "uuid": "e99eb4f2-2b14-456f-aec8-7de1fbe9a6b2", "value": "T1E2C4E080BEB49F52EC3026B0E77389331266BD5B2031E7591597B56A7A7F3C20123E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024955, "uuid": "c3115b3a-c8fe-418d-be0a-07811700e629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024955, "uuid": "52e2169a-79e6-42a4-ac98-36c6b1b09e2b", "value": "12288:89xh89oOZiLav/hSwb1vaRihkYKDqxwrNiFTIJo:8f25imHgggohkE6sTUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632024955, "uuid": "e5a9fbab-5f94-4240-93af-24c3c11ad53a", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632024955, "uuid": "aab68fcf-5dfc-4105-a5b3-7cd676405d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024955, "uuid": "45bb2bc5-44d1-457b-93ad-f8f9e9e6c4af", "value": "01243544663524534524766423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39578e16-195f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632065731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065731, "uuid": "2ee4c86d-adf8-4afa-8208-1c757113d154", "comment": "Malware payload (Smoke Loader)", "value": "c04c4e622b896e68e20a158aed550e3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065731, "uuid": "e0ee0b51-84f8-4985-8581-85610568842f", "comment": "Malware payload (Smoke Loader)", "value": "090b8a9479907e3aa9b258d877556493fd7045c686ea24b4132da82c46c40c71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065731, "uuid": "74bc43a2-9496-41d8-886c-d44ab27f4d0c", "comment": "Malware payload (Smoke Loader)", "value": "45fc9906a8b7cd4f5c149d6fe97a21ce40b8c3d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065731, "uuid": "ad5635e1-2c8b-4b85-bea0-4eebcf5e6748", "comment": "Malware payload (Smoke Loader)", "value": "25d7c38369d671aef0505c008f2bc2637704b9216bdcae047c2db76d9f4a869c50cedda8915141a97015344c06a6a534", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065731, "uuid": "db6892bc-d5c3-4c4a-ac98-dbb91a20e121", "value": "T106349D20BAE0C035F1B712F84AB993A8A83E7DB16B3491CB52D516FE66342E4DD31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065731, "uuid": "aaf55124-eabe-436e-a00f-c7d457560b5e", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065731, "uuid": "0947f7b0-0bf6-45b5-b6be-2abf1ce8198c", "value": "6144:AnZQ286zwU0r6764J7LMY3Ct2HfIApx3sZwYa:YZrzwU0r6moMYycHQAf3a5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632065731, "uuid": "3a367a12-de55-4647-b518-8d8a0d685b09", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632065731, "uuid": "fc311033-fe9c-415b-b20b-ed8db47ceb40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065731, "uuid": "f2d33306-3a96-49ea-9c3d-195fc79f9f89", "value": "c04c4e622b896e68e20a158aed550e3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d733151-1936-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048290, "uuid": "9b604b84-c417-4ed9-b67c-778da5aa3a5d", "comment": "Malware payload (RemoteManipulator)", "value": "de0c319cf89185d64b806f6b70f0655b", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048290, "uuid": "5891db15-09ef-4cad-9f85-da20b94e3299", "comment": "Malware payload (RemoteManipulator)", "value": "0aae905ccc9b9336484663c99c911b72a36bed0a440b6d56b7b4e790ebd89728", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048290, "uuid": "2b5f27bf-7458-4671-9fbc-405c19074858", "comment": "Malware payload (RemoteManipulator)", "value": "df65c9fba1b27a30705c56a3e44f768af50838d3", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048290, "uuid": "b08cdda5-963f-499d-a5fd-645f954e9e31", "comment": "Malware payload (RemoteManipulator)", "value": "89ac2de7bf8ed3f9a82b2a6f4074b7f8590e69a00a5e7fe95665a2ea78d18ee4432e16f072e9c7fb17171cd9d5e3c167", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048290, "uuid": "de178319-4c8d-4e84-aaa6-c320f283ed63", "value": "T1DD31AF24DB02C6A16151A783AB8F5C33E732972BA65C463432CD53196BC8A58857F3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048290, "uuid": "4d6d9219-3655-4ee4-bacb-ebccf50e6b3e", "value": "48:8txsb8gt1WWkT8uz/R6Nl9CEZdpEE7XoJ:8t+Zt1W3IeeHRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048290, "uuid": "109b8cae-4900-444b-8bf2-e0326aecf513", "value": 1659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048290, "uuid": "26a63f9a-740b-4b09-9ffd-e1ddf3a4df94", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048290, "uuid": "8f77cfe3-6ba4-492e-8a43-1a1f5a0cd264", "value": "Run.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10dc475-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632032512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032512, "uuid": "6b1677a0-8a87-4107-aaab-a6a917442e5f", "comment": "Malware payload (CoinMiner)", "value": "e9ce0b2d088a7e3b8fbee6b2293b07ed", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032512, "uuid": "062f96e4-a855-4ff9-a52b-a647a93e16b7", "comment": "Malware payload (CoinMiner)", "value": "0b2c3a6f79db7046057e5a4114008001a9d64298b389d76a2a60ec9cec2757ac", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032512, "uuid": "00d484f2-7fd6-4b75-9d55-4d23b420a60b", "comment": "Malware payload (CoinMiner)", "value": "b8bf2575a62be5c4bfe7a474053dbce0738d06fe", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032512, "uuid": "d67ceed6-0c68-4835-aa49-550482f0f000", "comment": "Malware payload (CoinMiner)", "value": "e3620010da50c3fb397702b05ecb14ad2fbf1b35dc1f7d8b2e58fb82dfaf21508e6833d3339a740a4295bfbae68d2e97", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032512, "uuid": "a7cb7ffb-6e96-45a4-a5bb-c66d628090a3", "value": "T1CC14E035B1E90FA8E79B07752820B610AE30B3D69242FFE6288E535F270139F59F7654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032512, "uuid": "23eb4cfa-2bb7-44af-b1f1-828a2422a137", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032512, "uuid": "9c109eb3-6405-4d25-a3fb-a8996d77c96d", "value": "3072:sPijItfhl3iE3HHMrfyuq5mUF5eWEFb3AgM34udq9Y9fNgbec+1+F3t2OYD1Du5I:Lj+hlymHHrfet3Agp0q9ygbX+1RzDU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032512, "uuid": "e32e2b2d-95ad-408f-9780-4ba298d70572", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032512, "uuid": "4457e309-8124-46da-a6b2-e72b467a0edc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032512, "uuid": "c0357c2e-8b18-42b7-860e-79c2c206616f", "value": "e9ce0b2d088a7e3b8fbee6b2293b07ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e66db03-1980-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632079832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079832, "uuid": "4409479f-4346-49cf-9927-e403ffaf57df", "comment": "Malware payload (RaccoonStealer)", "value": "99f70d8349e2c2025db7758e47dfe2d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079832, "uuid": "41fbf63f-4caa-4d9e-974e-6a2206ef35c1", "comment": "Malware payload (RaccoonStealer)", "value": "0cfff6093535e3816840c50d4f1f4e17a3609a459527194c3cf4076bc4b529de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079832, "uuid": "bcc2e439-f783-4fce-9a64-524e3becd5f7", "comment": "Malware payload (RaccoonStealer)", "value": "09feb1078e6b31ee213c857ea59414f8e071377f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079832, "uuid": "c887dd30-029a-45ee-a731-d13cf2760eb8", "comment": "Malware payload (RaccoonStealer)", "value": "bcba5763331135915e05b785f942b023d56339261dcbf5455ce1f12fcafce62b66e05047cc2746174017718285734ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079832, "uuid": "8b725e58-3b53-4ca0-bab5-c674270d62eb", "value": "T11AB40116F9B0D472C3928D707427C7A4DA7ABCE2292C514B279C7BAF6E303D05B36256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079832, "uuid": "d4f9cf13-401e-4492-b00f-c82f88057920", "value": "4b2f006e9c8103411c7e9e0d41005636", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079832, "uuid": "efe6363c-7dac-4925-9077-5c3bc728fe51", "value": "6144:CBGn7d8CudGa5dEACz/XUpsjpzUwKWMiJb7q+PD+OyO8pn2vW3mz5JHQRV6XfuZP:9nuC09JUisjpIw/Mil7z8pn2SV8MP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632079832, "uuid": "08938758-b92f-48b2-bf7d-311bcd659ea4", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632079832, "uuid": "3cb5157b-a987-4a40-b509-d74e32be48fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079832, "uuid": "e8145260-1043-4276-8685-a2bb910aa717", "value": "09feb1078e6b31ee213c857ea59414f8e071377f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82498616-18f6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632020756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632020756, "uuid": "3d4d443b-a09b-4491-a6c4-f2d46d9d11ee", "comment": "Malware payload (RaccoonStealer)", "value": "3239e4f3b0fba87f37ddb187f98f2b7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632020756, "uuid": "66f65bae-0c03-478d-9d30-267fec586178", "comment": "Malware payload (RaccoonStealer)", "value": "0dba3c5d5fde0546888ff7a8ada90af3c2eefe6184bed4e579bee2418ac1c096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632020756, "uuid": "bfe58c88-c8a9-45c7-a3c3-fab03fda17ea", "comment": "Malware payload (RaccoonStealer)", "value": "56a49378eb37bf3b8d2a3ecb4902969b07726ba9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632020756, "uuid": "ecf8394f-5e5f-409c-803d-809005a9ca55", "comment": "Malware payload (RaccoonStealer)", "value": "00100c894b34e61af93e41e2ce0bc578cc9a56fcbc99450bc7dfdc3c74e5edaa0e2cbcb59fc8c2482de93fb8784e13e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632020756, "uuid": "954f23ab-adc4-4b4e-9b12-c9b78da10366", "value": "T105B4E120B690C036F1B711F899B983A8652D7AB19B3554CB62D617FE13387E8DD3039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632020756, "uuid": "e4181fd5-41f4-4db3-813c-ac7d941c8285", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632020756, "uuid": "a554165b-e7c6-448d-afe2-9afa92e80b6f", "value": "12288:VZrqtBL/a9Q8n6W12UuXHUzaB6JVP6Zgy2te2lr4SJKhR:VFqtBmn2UuEzEmh6ZJ282x4SJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632020756, "uuid": "411412ec-58e6-42fb-abbb-1a2d6d31728c", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632020756, "uuid": "fd380244-ccb3-4c0f-9277-8e411097bf89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632020756, "uuid": "381c0529-888d-4f32-ac2e-72dee596168d", "value": "3239e4f3b0fba87f37ddb187f98f2b7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a27f210-19a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632095099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095099, "uuid": "399d06af-a2f3-47b2-9b7c-dd5810f838a6", "comment": "Malware payload (Mirai)", "value": "21366acce4c5c16083e3bb34c24c2b14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095099, "uuid": "029f8fac-98df-4d98-a1e6-85a7b3029ab5", "comment": "Malware payload (Mirai)", "value": "0de930d00634905566f24e92f87899ef1d36b2282516e5dd975683aedbaaa24b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095099, "uuid": "19fc6466-a374-4427-8760-71fa85465285", "comment": "Malware payload (Mirai)", "value": "5436b7b6c3cdb2f1a84d10e906e0c21dc27ef9f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095099, "uuid": "d3dab270-1295-4858-9427-548c3d40ab36", "comment": "Malware payload (Mirai)", "value": "7820c1b8a6b60b5e0b8fd094076d391fe094b0ca08f1017cec28e4584efe7f638365a2c7c32b04e36314b0c4058c434a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095099, "uuid": "4df41f02-5df7-4670-9c61-1654c54a0a23", "value": "T1C1333A4332280A07F5A65EF0BD3F0BF083BEE99125E1B184654F9B564235E73198AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095099, "uuid": "1e524c8c-b076-4924-8c25-9b9cb0eb006b", "value": "768:ffQOM1vLx13THWDKlRE4hs3fU+1z3YDnBm6g94zHdsYVyKlRfWXXfiSNAmOz:mZLx13THMqfpT9mDWkGRuXqm1Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632095099, "uuid": "1156b1ac-4d21-40fd-b486-a2d6029d0040", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632095099, "uuid": "f2cb4aa8-8104-46ed-83e8-671ad2cb6c5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095099, "uuid": "a9df5db9-6dc6-4d8f-8e17-60aa9030d2c8", "value": "21366acce4c5c16083e3bb34c24c2b14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34de830-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070204, "uuid": "8b327945-a45a-4e92-8b0c-e40ebd206698", "comment": "Malware payload (SnakeKeylogger)", "value": "8067b82b436990f2a798578c5ab7b6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070204, "uuid": "9c663bb7-d34a-42ba-b065-3fb2a3bd2261", "comment": "Malware payload (SnakeKeylogger)", "value": "0e15606187c6e41b05a83e6e2d8b8c01447c64a81db126d257b07df145333030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070204, "uuid": "72b198d3-1a7a-4254-804b-c6fb0759fef5", "comment": "Malware payload (SnakeKeylogger)", "value": "846a6b62596f604429e377781afef338e9f0a7f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070204, "uuid": "291e72f1-92dd-457e-8211-dc2a49de5dae", "comment": "Malware payload (SnakeKeylogger)", "value": "77b16f9f9cd5f5811440391043dc6f42e7430d2588387e7253a9afb02c17d9a0a37672c457eaa4c8b63835a11060bac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070204, "uuid": "66d3b500-8cae-458d-a1da-3a8dfd5e376e", "value": "T18D848D10FA8DACD5E7E5C1B378268B100175FAE796F980AF2365370956B27C32177E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070204, "uuid": "b06f4151-eb33-4808-b226-700b1431701f", "value": "c2e2fa89aec204ac5f3945ce98025d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070204, "uuid": "567eb383-6593-4bdd-bcc2-dd6df5607760", "value": "6144:BCpGQ/TWTkHDKOBnMfalc351M7muC4TneVxsvvVtU4iDCvq4CT:4pGK3/ncz1M7bTneMnVOD6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070204, "uuid": "eb267d47-aea2-4a6c-88f8-8e415fa6b277", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070204, "uuid": "24d02626-9e71-43be-a913-96f71a85c569", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070204, "uuid": "03a08e12-ef0b-45d9-aa8b-d360ac899e3a", "value": "RFQ_AP65425652_032421 segera.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdc28a0-193c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632050758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632050758, "uuid": "742ba82a-54d9-4ee0-8337-ee70956e23ff", "comment": "Malware payload (RaccoonStealer)", "value": "de5679dbb09525769c1cd3a22c033405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632050758, "uuid": "79b34df1-f8dc-484e-82f1-b42b7fcccb5a", "comment": "Malware payload (RaccoonStealer)", "value": "0e7d90896c9b8a85c5fcc9d1e63dda2adb8e65b6b80168e57ad5b610d7a35c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632050758, "uuid": "e544d12a-784b-4fb0-b4cb-05b5962bd6a2", "comment": "Malware payload (RaccoonStealer)", "value": "3cf427548c4fdf6389003bf416ab273ae61ca282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632050758, "uuid": "030ce575-3dba-42c4-b30e-58c91e021060", "comment": "Malware payload (RaccoonStealer)", "value": "2cb99bd9041ea5f3e2f2739a12937f06d509c7a5c94c71a0230cb7d8733a3c6ca0f2d8748780450b2fa776c944544d43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632050758, "uuid": "d258cfb9-905f-49dc-a95e-a368f10144c6", "value": "T1C184236E65F57220CC1F9FBEAFE141212B94FB892D52C50B64DEE19C0947742EB98072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632050758, "uuid": "094124e9-f449-478a-a005-fe213a18dcfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632050758, "uuid": "3597568d-54d7-400a-a8d7-72f599f06f67", "value": "6144:knHsGcKPthRHlgYeZFQ8qIPFtJlo546vfEkjywlhQmexedzuX2tph48xt4:qsGPlDHl6/jqIPF5o5PfrFmhxedqGtbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632050758, "uuid": "7792f0eb-6edd-4b08-89f7-82508392a3de", "value": 373368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632050758, "uuid": "aab8d804-e54a-4de0-8b83-3633dbb0ff88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632050758, "uuid": "f309e35f-e2b2-4619-b628-fd8adb34b825", "value": "de5679dbb09525769c1cd3a22c033405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277a4b34-18e0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632011155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632011155, "uuid": "4a182b86-0b41-4aa0-ab39-ae4603d6721c", "comment": "Malware payload (RaccoonStealer)", "value": "48bf0cc0dd70e8515c925091f909ddb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632011155, "uuid": "dca0ec59-ed58-4daa-b098-1e1a28657fef", "comment": "Malware payload (RaccoonStealer)", "value": "0ebf095d8bc7029868cd05f7ad20f51c324755881ade188d88ba8ed94d67f788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632011155, "uuid": "c9bf2bd4-4081-4749-a517-a835f39c5dfe", "comment": "Malware payload (RaccoonStealer)", "value": "cc505c63e389482dfd09bf8ad44e633dfe3d540a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632011155, "uuid": "34d0669b-f327-47e2-82ae-ed4633ae9f75", "comment": "Malware payload (RaccoonStealer)", "value": "deb2e52ea24a842f5e6302250e83e821ef848bb5d4435391a2868f5fd64e2c1a37746e714826d1a40a6d9484a56b3845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632011155, "uuid": "35c1250d-367b-406c-8b7e-de9fab37b237", "value": "T11BB4E131A690C035F1B312F849B983BCB92E7A725B3451CB62D656FE66346E8DC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632011155, "uuid": "51933f31-8151-40bf-bb4a-b24b2c3d1ac4", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632011155, "uuid": "2fdcd0f7-5e46-434f-853c-b5fadac5586c", "value": "12288:2Z8KVLXfyf8oxkhhpsgW7WN9mafJ71BqZblvCFyM/l:2mKV+1a9bJss4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632011155, "uuid": "f4b0fda9-c75a-4ffb-8655-9b97291f47b9", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632011155, "uuid": "e74cadb3-1792-458b-9432-9ac92cf1e09e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632011155, "uuid": "2abfabe4-9ecc-41f6-b984-09e849d9244b", "value": "48bf0cc0dd70e8515c925091f909ddb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9543e153-1937-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048705, "uuid": "53593a1f-88cf-4cc8-8396-96634bb1b6aa", "comment": "Malware payload (RemoteManipulator)", "value": "84aed8b2beecc40d78fd620e5fa38814", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048705, "uuid": "a38828d7-647e-48d2-8238-56be21f5ee90", "comment": "Malware payload (RemoteManipulator)", "value": "0f91bf36a54f2525b96eebf25f3ea2316dcfd6ab48c71af745944d0fdd185fd5", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048705, "uuid": "fe279ab5-2448-4b62-829b-b3be742d5358", "comment": "Malware payload (RemoteManipulator)", "value": "954868ad657730aced46426ac811987d58c44b7f", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048705, "uuid": "85715ade-bafd-4feb-b0ff-bce238fd2ceb", "comment": "Malware payload (RemoteManipulator)", "value": "a0184b344025742ae4065cea9e5ab175d314eec40c398d4aef2c43b8e5f29fef68d2b3d8239ad0810042a4417da3e43c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048705, "uuid": "475ffd46-c5d7-49e2-813a-e7fb7afd3e1d", "value": "T15F271293F3C8653EE4BF0B32497786189D37BF6126528E1E2BF5740C8E36481293A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048705, "uuid": "d50697a4-89ff-4caa-8cc8-8b57616021a3", "value": "a2adaf9422c8d5596ce912860ce76592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048705, "uuid": "b351d15d-353d-4fa6-8679-ae2fddd92671", "value": "393216:jLpt6pWl0rL60i1KALzLGscMsgxJHCCExd5Q:UWlY6f1KePAMsiiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048705, "uuid": "6ca17f37-fe5c-4046-ad60-d7e23d8ac405", "value": 20606976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048705, "uuid": "92148bbd-0f71-4932-b2e1-00700558189e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048705, "uuid": "058e72b6-52a3-4325-ba10-7c644ed7d63b", "value": "0f91bf36a54f2525b96eebf25f3ea2316dcfd6ab48c71af745944d0fdd185fd5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51e977e-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632032519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032519, "uuid": "5430d549-5d4b-4108-ac2d-e9c11f74faf4", "comment": "Malware payload (RaccoonStealer)", "value": "55c84e52da01d33c4ac22063eb6e4623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032519, "uuid": "7066acc8-1246-4f25-842a-7e41f098fa0c", "comment": "Malware payload (RaccoonStealer)", "value": "0f976ffe5004ad6825e3eaa91a20a3cad5cb9eb14ff6eb5ca3dd1a8eb4f19fb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032519, "uuid": "191764de-a181-418a-bab0-918e802e82bf", "comment": "Malware payload (RaccoonStealer)", "value": "6f654e24830c3a232ef3648b3ede1e5659cdf5f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032519, "uuid": "5c457c79-5887-42b5-b200-80b493f5556c", "comment": "Malware payload (RaccoonStealer)", "value": "752bd853f45455054817b230b547a96dc40650d29ce2371a3e566151960bf2b2c6d14edc4b17c71bbc0d41d8eaffce9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032519, "uuid": "e4be1c85-4863-4dac-91df-e0956125df5e", "value": "T116B4E1206BA0C035F4B711F85DB997B8B82D3AB15B7491CB62EA16EE13396E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032519, "uuid": "e025554c-165a-4e79-bcf1-e4a6ce52623d", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032519, "uuid": "8b2a5bd8-4b6f-4e7b-8609-31e79b89d935", "value": "12288:0Z6MglX9AnEdt8vALJG5xeg60vr7RzBlPvIkdli:0wMgIS8oLJGnnR/Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032519, "uuid": "9fa5cd63-b784-493c-a547-715a393f9640", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032519, "uuid": "c4064f37-c385-4941-874f-fb61a6a8ef74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032519, "uuid": "1a78a420-0c5e-42ea-aed2-caab4a4db67d", "value": "55c84e52da01d33c4ac22063eb6e4623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2fba90-195b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632064045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064045, "uuid": "81e136ca-1b22-4f20-af6b-b5cd27663fea", "comment": "Malware payload (RedLineStealer)", "value": "2f59580ee2366c8c22bb7fb185fd3006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064045, "uuid": "bd8cf893-a8e3-4be9-acaf-e3cebe0e153e", "comment": "Malware payload (RedLineStealer)", "value": "0fb73b5a78afbb7675fcf2e772b1f2c45bb5791973434c2edd18539f611b93c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064045, "uuid": "aeb126de-7216-4d41-9028-bbc28a0c7cbf", "comment": "Malware payload (RedLineStealer)", "value": "3c5356b87fc875b563ebf98156627f57f0a6c26b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064045, "uuid": "4af3b739-07a6-4faa-b3bc-ca77e036d75f", "comment": "Malware payload (RedLineStealer)", "value": "2be940f583870cea07d6d00b1e89545a10ddf6a02d4eb577cc6decd031e8f7626845f4da66fae2d10c82fc790bdc45f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064045, "uuid": "5fc61250-cc57-48b4-97d1-8b6a0f37f17b", "value": "T137941528647FC01985E3EEA52EDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064045, "uuid": "cf300616-f213-4ae6-a317-7ba7f9e058a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064045, "uuid": "261444d4-ccc4-4c91-a87e-8b4533da2dad", "value": "12288:ZklT97ilmy/nRjho/1bmQxZ9yFhEloyof8zWt3hik6tiaj6PDY+XZGbmy:MgjhILk6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632064045, "uuid": "9eae5c2c-d105-4011-8954-4dc2a183e0d9", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632064045, "uuid": "6b766597-0357-4078-91f5-df3ea83b01ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064045, "uuid": "d480a9ad-ac83-4fcb-87c6-8e67bf5ffa1c", "value": "2f59580ee2366c8c22bb7fb185fd3006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661792f0-1937-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632048626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048626, "uuid": "75d9f990-af1b-4671-84c1-562f3f70947e", "comment": "Malware payload (Mirai)", "value": "eae4f5a1bb289f14e1517ff15c276473", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048626, "uuid": "f0a04ab7-5acb-4dac-92e7-fd76b2e02daf", "comment": "Malware payload (Mirai)", "value": "11b2052b76fa481335e6dfa260c448cdb866a0ccbe15a677b0897f06fe549fac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048626, "uuid": "8d624dff-86b3-42c7-b840-bdec377835b9", "comment": "Malware payload (Mirai)", "value": "9cba1e6a85bcd38679b77a3a9c017f9a27eee533", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048626, "uuid": "599b6c53-a5a0-4b3c-9a38-18511a7034e9", "comment": "Malware payload (Mirai)", "value": "f02d9439dc38d7a1a1fdb6543991057c7c781fd219edcfcbe391e95a6f8fa4baef9f2ae99d04a67a97f0cc851bcb64d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048626, "uuid": "84424b2a-c08c-44fc-a6cf-3f9f6c9cf069", "value": "T1A3731981BC809E15C6C517BBFA6F118E330297A8E2DEB353CD145B6477CA81B0E37A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048626, "uuid": "a0a5a000-7b23-43be-8033-677f68940528", "value": "1536:n1nblFlufknASOgUb+AAYg+y2HNclsuxIw9mrsplDKZUCQBKXAVan9X+F8Jyv+B3:HFlvO5bzA1+JHNcsS79mrsplDKZUCQBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048626, "uuid": "9b96fd45-d819-4947-9af5-a121d13ae93d", "value": 80108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048626, "uuid": "7972bd67-305c-4f37-96cb-7ef98519b4da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048626, "uuid": "4146aacd-b4c5-4fd1-90cc-576a102d3d14", "value": "eae4f5a1bb289f14e1517ff15c276473", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8711e7ad-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070156, "uuid": "562546d1-f750-4a32-8902-2af4ba614b9e", "comment": "Malware payload (SnakeKeylogger)", "value": "28da63869eaa2bdaea8ce5b38e91743d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070156, "uuid": "e0a301d6-cdbc-4ea3-a1e7-cfcca8927c7f", "comment": "Malware payload (SnakeKeylogger)", "value": "12b953981ab51aab44eadc729fbb03d0d6685a526b370de9d3a0ce390e14343f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070156, "uuid": "e23265ad-0bd2-4a23-bdda-26e38ff167c0", "comment": "Malware payload (SnakeKeylogger)", "value": "5b52c4d659f6d737f29685174ce332a3d603978b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070156, "uuid": "af76bcf0-b5ba-4696-b350-4c9e0d395c14", "comment": "Malware payload (SnakeKeylogger)", "value": "2a8f0c3e5a61142cbc33773039d291fe126e85680bc13224f5b2de0ae5014aaf27406194b17c7e4305258cc70b346626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070156, "uuid": "938184d0-7ae2-4042-ae18-4f94adaac016", "value": "T196B41865156E7D75C0782B3A477317E51BEE9C402A3ACF896B21F2BA103C6D77E4230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070156, "uuid": "9f6b8f72-c625-49f9-9f43-4a65bdef5c2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070156, "uuid": "2e9c7ef8-c696-470d-b7eb-34f3b1554370", "value": "6144:FZbzzCxC98rxjZMCWje+5W3TznyouSmSX7:FpCA9iF5B+5WD6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070156, "uuid": "8347bb94-9add-4ee9-a3b2-fabe5a0859ed", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070156, "uuid": "a8ca11d1-12d4-4fb2-b46c-23562a8c2601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070156, "uuid": "9ac71ebb-2e7b-4127-9a23-c5cf531cd056", "value": "eFatura KontrolEXD2021000000173.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d4c16b-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1632063682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063682, "uuid": "eea5344b-13cd-4239-bb4a-88cbd11ebd30", "comment": "Malware payload (AZORult)", "value": "b4a63ac7da5b4a174bb5343f65a0312a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063682, "uuid": "cc32bab5-4511-43e3-b6cd-5757cb2c0f81", "comment": "Malware payload (AZORult)", "value": "13a721ad46cfe0131e3089ee1df6f7b9e824db76548819b7c2000d0a58030ad6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063682, "uuid": "12e5ace4-214d-4be4-a950-46a7420b71b6", "comment": "Malware payload (AZORult)", "value": "2d6fbea08669131fd040c2898686603d8ea6f1e7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063682, "uuid": "04a2681e-4bc7-42dc-8182-ab32dfbd60f9", "comment": "Malware payload (AZORult)", "value": "259db7aa36ebcec1d6f127b329cdb074f92d2e04df4f0ea10f0dff79f9c839605d6cc853abeaa1f3af6d79bd023b3528", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063682, "uuid": "6874e16e-aa40-4d97-962e-34235c359bea", "value": "T15755DA254D6686F7D3EEC32CD09C0ACEDBF5A483BBA18F0ED88186C2165774BE59814D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063682, "uuid": "a6636ea7-9a9e-4c14-a1a0-710c59dacbe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063682, "uuid": "c51c1717-868e-4e9a-84a5-c2fdf9c2ed0a", "value": "12288:yz+zDdDP0a7u6JC0UkflDBkBPSAzRiPPIurBYVGB4xBscR:yuVtJC0Pfl9kxRiPPIAWxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063682, "uuid": "f66abb03-7530-4f09-86cc-6f74925361f8", "value": 1340416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063682, "uuid": "50f0eaa9-e9d9-4636-9482-7e07a16e32dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063682, "uuid": "6f075eae-9e78-4199-8275-bd53bf4e6e5e", "value": "RFQ101-231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e9f9ec-1940-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Numando)", "timestamp": 1632052404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052404, "uuid": "8ff01b8c-51bd-48a4-9be7-dd5eb7761011", "comment": "Malware payload (Numando)", "value": "16f43b0466a7cedc0d723f616dd557ba", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052404, "uuid": "f67f95eb-a25b-4a8d-89fe-4a10e730f3d1", "comment": "Malware payload (Numando)", "value": "14311672fd10033568ca291e7902a035b5062404d5582d4359c26d4e7a7599be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052404, "uuid": "9fd402c7-1cb9-4d5f-b097-e5263723f834", "comment": "Malware payload (Numando)", "value": "bb2bbca6ca318ac0abba3cd53d097fa13db85ed0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052404, "uuid": "67f2f122-ae1e-4d2d-ab7b-3d0e75a02c53", "comment": "Malware payload (Numando)", "value": "69d84495db08a242f8fff5a88cb4a48624fcf2dbdb4655691e8c7f662bfa54656c21d1237262f4528b9e7d0e742b9887", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052404, "uuid": "b8c077b1-aee5-47c8-9862-a13550afafbc", "value": "T1A2E61B21F2249E36C0ED073A44974A615335811B4FA7A74702E896BDFD8D3912FBAB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052404, "uuid": "088b19f7-b363-41e4-8c74-a18636f4f026", "value": "b6375ea5f36be51b78234746089d884c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052404, "uuid": "78b0ba16-6c51-45bf-b6e5-643405ea3a7d", "value": "98304:p34bYQyf6lqGW1+luO0bW0KE+28FwVFzzb9PgpDb1pThzdfalZLCwpokCFCxJD9z:p3o0QlnUtJ8UzkD7VJY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632052404, "uuid": "803f911b-2c60-450c-bf8d-92cdc99dfd49", "value": 14167457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632052404, "uuid": "5ce6dc8e-7f16-4dac-85d7-78b6e4c13517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052404, "uuid": "32eaad31-7d73-4ba5-8458-d87e4d09e84e", "value": "14311672fd10033568ca291e7902a035b5062404d5582d4359c26d4e7a7599be.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d6b543-1937-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048498, "uuid": "9de74db7-dd77-4d6f-9f86-c94ebef8a2ce", "comment": "Malware payload (RemoteManipulator)", "value": "b9ed0e9a6906b34511195e8abd283d66", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048498, "uuid": "32dd3fa8-0ca3-434a-80ed-dd7735011a7e", "comment": "Malware payload (RemoteManipulator)", "value": "1431dbb36083519aa9712f9ec93ff2ac04ac0f333db7eca3aeb253e69ed03948", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048498, "uuid": "4f1b3800-22da-450b-a2ea-d44c0623a1ed", "comment": "Malware payload (RemoteManipulator)", "value": "afbde9317c7af4b75bd1871e64266247fde12b2d", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048498, "uuid": "c775fd5b-5975-4e0b-9256-1fc9c17213b3", "comment": "Malware payload (RemoteManipulator)", "value": "486be955cd9db1cb2fc3582cf200ac625ed4e9f1733d0ab41c2aed58c84c82c5d550f0f58ab29b4bfc311a7dd5ecac59", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048498, "uuid": "a5ea9527-07c4-45d6-b84d-68aaa7fd4f9c", "value": "T112271253FB84A93ED4AF1A365477861C9937BF5166168F4B27F42C0C8E325802A3F687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048498, "uuid": "7370a3ef-ef02-445c-9770-bc72bafca5c3", "value": "a2adaf9422c8d5596ce912860ce76592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048498, "uuid": "d4b5d80a-3015-414e-a574-7dccfb2d7196", "value": "393216:HNKPxCR5x8WLx1IEMaVS+UstJLKAV6MOrgfg6saiwgIS4/v:tKPERoIhMKS+UQL9V6drwg5aPgIS4/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048498, "uuid": "d0dc4684-aff4-4fc3-8eac-9e95b525b3d0", "value": 20460544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048498, "uuid": "0359086e-fd24-41d9-9692-4a7b63af0ad5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048498, "uuid": "3747c5e3-2d97-4a5c-9488-b13b0399c415", "value": "1431dbb36083519aa9712f9ec93ff2ac04ac0f333db7eca3aeb253e69ed03948.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e4d58f-1959-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632063445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063445, "uuid": "89bf87cc-e73b-44b5-a9c7-908cefb777ba", "comment": "Malware payload (AgentTesla)", "value": "e147993cb8a2b648f65a583f90d953a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063445, "uuid": "6839ca44-4178-4290-a68f-91d1b0951d7e", "comment": "Malware payload (AgentTesla)", "value": "1515e265c2b1faaa1763aae137ea1fcfac304be301a30911fa5a3f64b92355c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063445, "uuid": "49911ad4-3eb3-4b46-9604-b9014630e790", "comment": "Malware payload (AgentTesla)", "value": "6b6aeebaba0b4da69cb21dc3c2447f26bad759e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063445, "uuid": "8880aff6-cd35-4aa4-b45b-e41ae537cb4f", "comment": "Malware payload (AgentTesla)", "value": "a4ad90683a5e662d99cf210b0202fecf63f54bd4ca7237f8a654be25287da0e696f7ccae15705807bb51001bde68a437", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063445, "uuid": "114bd934-b1d8-40c1-8799-98b2a4d1c1bd", "value": "T12CA30973328C1FA7E73D99790121404605F6C9133E72EFAEBED542DA49D2F4047A1AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063445, "uuid": "df114a74-b9c1-4aac-9f34-e5e0c57bbd68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063445, "uuid": "361add3b-a6f7-421a-bd19-9a269a82b693", "value": "3072:4yALd/zffrf3EXpAVaMvR+70pKXQl29ur4cctl:4Pdv3E5AsMp+70pKXQl29ur4c0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063445, "uuid": "8d94261a-5840-4c87-b961-9b7961e1f679", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063445, "uuid": "27ea41d5-5bd9-46f4-8f84-048e9e6f83cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063445, "uuid": "57994a40-6fa7-42a8-8b15-16668e82c897", "value": "DHL_SEPT 2021 at 19M_9B7280_TXT.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61f946c-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632032547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032547, "uuid": "7e9216ab-28f1-440d-9188-a247efb06d56", "comment": "Malware payload (RedLineStealer)", "value": "afe1c0478013c9de8932bd09767c237d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032547, "uuid": "ed7ead30-c9b4-48f5-b94b-5439bd09a83d", "comment": "Malware payload (RedLineStealer)", "value": "158dbf91ef7983fc7afe94b1a95337e2972cee8c513bac274dc64126dedf7e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032547, "uuid": "147ac41e-e9f8-4f44-bdd3-22cbb61f7ce2", "comment": "Malware payload (RedLineStealer)", "value": "59703fe227d52b6b351f6bb7cc0f0a1b94c330ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032547, "uuid": "cc0509e5-6c8f-4c96-bb01-17445fb151af", "comment": "Malware payload (RedLineStealer)", "value": "7dafa143a209ca96e8280d70d0629a783ce0a6f132926cc52c04956d5638b0c634b7c3024eb7ce2b60a33436a1cf7f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032547, "uuid": "40269286-38c7-43fd-b2e0-dba57bc67104", "value": "T155D4F120B790C036E4B302F959BA97ACA83D7AB15B3451CB63D61AED23382D4DD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032547, "uuid": "b061f833-61ec-49a9-8663-2af37879e4b6", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032547, "uuid": "f52ad4a6-9913-40ab-a49c-d67c4d4b9506", "value": "12288:gZrVFZXtqX4kAuOKbNmunOZkUMN/uPF3QzOaWi4TiRX:gFVFZ5uOOm2j3NGPFo7WHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032547, "uuid": "b06fc8e8-f61c-4a71-aeac-b3c4f8865d6a", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032547, "uuid": "e4cae5e4-cdcd-4d58-a448-11dea109297f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032547, "uuid": "75944704-56eb-4d22-b664-de32b6c28b0c", "value": "afe1c0478013c9de8932bd09767c237d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e654fe0-196f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632072746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072746, "uuid": "c297cc66-5e1d-482f-98fd-67bed9bd3a09", "comment": "Malware payload (Mirai)", "value": "6cf4520344f2771e667ffb44ea49fbe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072746, "uuid": "dd44df80-c050-4718-ab49-fdfea504ed44", "comment": "Malware payload (Mirai)", "value": "165ea430671511dc2613e8171f320ce1af74b907d05c44c2a80735e6004c2bd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072746, "uuid": "9566bfa2-88e6-4496-80de-90f51163eded", "comment": "Malware payload (Mirai)", "value": "565ab36aaf6aee947559c080da73e01f76cf312a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072746, "uuid": "8eedc313-9c69-471c-a49f-cfd33ff147bf", "comment": "Malware payload (Mirai)", "value": "4b7a87e19de8e54759218582ed391a606ef54860721d00c0ea31c1cdaaecfe49c099551f3928e1b84f41038ebe47c842", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072746, "uuid": "6fb36288-bf56-4430-862f-7de71c85f3e2", "value": "T11FC3F772B804DF66F40AD6B604D38B227E30BFA70E631662B31739669D331D52867F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072746, "uuid": "043d66f2-506c-4935-a6a7-6386eefff32b", "value": "3072:L+YUpmc5hIof5UM7XgYjykKdNmm/QcuLB126DNb:LwU1of5UMPyk2Nmm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632072746, "uuid": "9f12f830-4dd4-4013-ba08-24f9e0adace8", "value": 118319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632072746, "uuid": "9fc427b0-9533-473a-b302-51560986add5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072746, "uuid": "2af24fcb-06f1-48e1-8031-885da26bec71", "value": "6cf4520344f2771e667ffb44ea49fbe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5f4c16-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632032610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032610, "uuid": "a7677ca6-def9-4b36-b6cf-b65eb6c47cd7", "comment": "Malware payload (Smoke Loader)", "value": "20d179b470dff4506f08ceeadfc0348b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032610, "uuid": "188e2d89-2927-4749-9e25-ca3af26c438f", "comment": "Malware payload (Smoke Loader)", "value": "16718a9f7c14bb6b5ef506f0893784bf691f1a4e69a03889c18e044d934e8c4f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032610, "uuid": "2b418e1a-850c-4af4-8b5b-7df90351e678", "comment": "Malware payload (Smoke Loader)", "value": "3384f371dfae8ff9b75065899ca81851781efabb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032610, "uuid": "afcc9f8a-44c4-4728-9185-a881c53f3cd6", "comment": "Malware payload (Smoke Loader)", "value": "5b1481962456706fb489190df5e98efc690283600622c44031d1ce053d566b8525c7c6470ddf8cb998a41f66acb5ce56", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032610, "uuid": "5850fe3f-01e5-4923-9edd-3060a2487c72", "value": "T1A534AE20BBA0C035E5B712F9597A93BCA83D7A705B3450CB62D626FE56386E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032610, "uuid": "ca42368f-21a9-4e6d-997b-9c6c43bf57eb", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032610, "uuid": "5ace0f71-aaf7-4538-b08f-0e441e4e7126", "value": "6144:14ZQPyLXZNCvfO2Wn3M00LMJTTsaY4TovS:eZxNCvfOm00yPrY4QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032610, "uuid": "4576993d-4c9e-4649-a5ca-14960ad249a7", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032610, "uuid": "e8be0582-d541-4ca4-ac78-16be195e3bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032610, "uuid": "04b38d97-ed4f-410a-a059-c9c0053eff15", "value": "20d179b470dff4506f08ceeadfc0348b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064857d2-1972-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632073806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073806, "uuid": "806620c2-4364-4da1-bbb2-c45cc1e63494", "comment": "Malware payload (Mirai)", "value": "61a6a633850b49b1508fa21f5dd21c68", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073806, "uuid": "83f9c5d9-fddc-4fbf-a7ec-54d1225306a1", "comment": "Malware payload (Mirai)", "value": "16d551495fc8114b681bd3f652fd21ec119546d8c347fd83cac9eeb3611ccbac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073806, "uuid": "a631a4de-3897-433e-bdd1-cbc17f63eb23", "comment": "Malware payload (Mirai)", "value": "b55de40609c40a2603b427c264790a384595f80f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073806, "uuid": "6903e644-1ae7-460f-846f-c597a87ee1e9", "comment": "Malware payload (Mirai)", "value": "0f799f48ae3561171d6d0c7cbd20583d95aeec555ef569fcc1fa2d644a6ac7fd62b4bd029c62f0ad07018ef84f54188f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073806, "uuid": "966db967-3aa4-471e-9927-7a4d8e2a257e", "value": "T10CD2E17132008452E5F20436D23D09CB1BFF15BDE2DC258299BE6D6ABEC549DF87C192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073806, "uuid": "34ec2517-8c78-4802-9792-95ada6926e0a", "value": "768:5cjQBkEBr7hXfL8HsVcv+Pt4DoBR8RH0s3UozC:5cjaBr7hXfL8HsVcvQj+xzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632073806, "uuid": "550315e1-d0fe-46d9-8808-3d22da81d128", "value": 31096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632073806, "uuid": "f7ca6786-0ee5-4964-9dc4-fee627f954b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073806, "uuid": "140e8986-a34a-4153-9872-f20110efafa6", "value": "Rakitin.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36e26b4-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632063762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063762, "uuid": "6064fb4c-7615-4b21-a4d0-91d8863a3330", "comment": "Malware payload (Smoke Loader)", "value": "894e61c9670a43c03eae56cb8a54371c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063762, "uuid": "123bb858-da44-4a18-b42c-e0e2c1220953", "comment": "Malware payload (Smoke Loader)", "value": "16ea3c8232c0e41dd102a54e70a116f58b73c778390f563301f3d3f1685cc156", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063762, "uuid": "aabf2083-bdc9-450d-a412-c021086f23e6", "comment": "Malware payload (Smoke Loader)", "value": "d57381d64c59c6c2457e4882c554297599a7c919", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063762, "uuid": "8b12677e-c932-497b-bb89-fb2b06c542dc", "comment": "Malware payload (Smoke Loader)", "value": "f3d42fa9a574c5c94f2559be746eb212e28d1582d0a4af5d5a515ef8e046f15ce8f5424e04d1677f8942dd659a0f8a81", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063762, "uuid": "be631f35-b6dd-431f-9a75-7e5e3039e304", "value": "T1D7349D20BBA0C035F1F712F8597A83B8A93D7EB15B3491CB62D656EE26346E49C30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063762, "uuid": "f20bc875-ef69-437d-a035-7a4d95d8be00", "value": "8291a520c0f405cf4a58a301dc5c7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063762, "uuid": "4dd14f3f-cd25-45d3-9ed0-641ab516c7ea", "value": "6144:5sZQdwskUPKT2tdG/7SIZGKGQLqZzJba7VXYWh:mZcPKT2tnIAvnz8xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063762, "uuid": "e0429782-7949-499d-9fa4-15ebb4e9fb49", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063762, "uuid": "a55f6e3d-7ef6-4b53-8f00-4e1778847c40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063762, "uuid": "0a87c0f6-b561-4605-bb34-48f75d5f4029", "value": "894e61c9670a43c03eae56cb8a54371c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8362a6-1910-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632032127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032127, "uuid": "246849ff-3962-4ecc-9fe6-180673ed369f", "comment": "Malware payload (RedLineStealer)", "value": "251f7a346d17e3deafc9c0deba82f71c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032127, "uuid": "324dc9f6-4a87-4a14-84e6-c0824f837828", "comment": "Malware payload (RedLineStealer)", "value": "1a57787821438ee75708c8921d11dd26d231881e3e075d1e9cd95b1d2ff0d505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032127, "uuid": "5d823da9-5077-4df6-9906-4a94ab6cfd31", "comment": "Malware payload (RedLineStealer)", "value": "7b662f878d03292fb8f56f5cebd42f82832e7159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032127, "uuid": "32733dbf-c614-4832-bad6-3a71b7dea31d", "comment": "Malware payload (RedLineStealer)", "value": "04e822f8bd9254ca5bdc9c32a2bd16974dcdc2579632f44769c0606a1f92d7309007e3ffb58c331c2ce5ae1bed521471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032127, "uuid": "93a7a845-76c3-48f1-aea0-54fbc1ccbee7", "value": "T1CB64BF20B690C035F0B712F959B997B8B83D7AB19B3550CB62DA1AFA16343E4DD30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032127, "uuid": "f1a5fa46-bcdb-4099-940f-537a1a4e03a3", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032127, "uuid": "1c30ee92-b7d5-4b33-9e89-8349b13edd8b", "value": "6144:4uZQcY5ww7hz56mk3MI/wJ9sEvfNIc9+WC9Y0JbM8fV8Upb:RZI7hz564I/utV2YK3mUpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032127, "uuid": "7dc3cc02-18b6-438c-a23e-23f8bf0595a9", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032127, "uuid": "cb1bb41a-a8dc-488d-b599-92dd91eaeeb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032127, "uuid": "0750aab2-a6aa-4348-9864-aec72cfaa937", "value": "251f7a346d17e3deafc9c0deba82f71c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2901ff8-196d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632071947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071947, "uuid": "61ae4b99-914d-496b-92e2-04d9a8ce2dc3", "comment": "Malware payload (Mirai)", "value": "4a0371dd5eb1415e9f226314802d7dba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071947, "uuid": "6f9e7797-9004-41ed-9436-3c569c006f51", "comment": "Malware payload (Mirai)", "value": "1b74f97843a4c3a1019cf2ebb73e12a4fcf641967e52f6999ba8210007f4d99d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071947, "uuid": "1a479eb0-673e-452a-b2e1-88aa12fc4d86", "comment": "Malware payload (Mirai)", "value": "7d7b95dfecd7c1d201152c03cbd8c56bd5e8adab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071947, "uuid": "18f0b002-bd7b-4a8f-8dd0-24a5a41953ae", "comment": "Malware payload (Mirai)", "value": "d51a4fadd512d62d4f7c6adc84d383a6c776904254c9b4a6cf45418fe10901d7a2df65eafc9639b194edbf364003bb15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071947, "uuid": "b5e465df-3a69-4b9a-a4b0-efbf6f433045", "value": "T117D3F730E8044B1BC2D227F6A79E469E3F351EA7979733115A387DB02FF27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071947, "uuid": "27457c1a-c7ce-4c14-b922-e1cd1e90fd7e", "value": "3072:+DShVLkDZ6waCAdclNbYJOmP46aQyfPluesNb:VhVeZ6zclNboOmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632071947, "uuid": "d3bd7532-74fe-4b68-8a2e-3405624d6e5b", "value": 130115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632071947, "uuid": "a32e0f8e-617d-4de1-a835-b695d68fe08e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071947, "uuid": "54fa7217-de39-476c-8d21-d48739f057a3", "value": "4a0371dd5eb1415e9f226314802d7dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3ef38f-190f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632031428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031428, "uuid": "63a8c240-16ab-482b-a879-9f098fae9c31", "comment": "Malware payload", "value": "92484b3f2fd1c8d8a1b9520648b0ecf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031428, "uuid": "06cb4740-9b95-4dbd-bffc-b7be483de9fd", "comment": "Malware payload", "value": "1cff2d626e3acf9dd2ad652fbc3b89ac7094289df7c4cf957e6162ca51dea567", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031428, "uuid": "793f7afa-cfa6-4f0d-ac5e-cd86ad3aaf10", "comment": "Malware payload", "value": "aeb22c8d865b2447f6ae63719baf199af0f73fed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632031428, "uuid": "3b0ea7f5-6029-4ed0-9c20-a48dd4f6238a", "comment": "Malware payload", "value": "1e067bf5ebcb59f745468a6c599a54e5587d0055bc8139f636722bfac248e783acf27032cc139418b6c9a54311daa656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031428, "uuid": "26745fc9-a3a0-4e42-8952-9ecfa432b539", "value": "T19F352361E3A8107AED63413A003766175F34BE1AA1759B2FA3E4E9AD78715133C1CB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031428, "uuid": "e7995957-bd62-44a9-bb3d-df3447e68adc", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031428, "uuid": "0702d6f7-6628-47a0-a701-a2861d3fae3d", "value": "24576:N81ZQmnS8YbJIoX5NY50ZGu7Iaj1wCAWzlFXDyO83H+oviT7:C1ZQmnbYbJVG5kLxDA4FXO3Bvq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632031428, "uuid": "4abd4da3-f123-4efb-a5cb-8a7c32fbb9bb", "value": 1136806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632031428, "uuid": "5ebce7a3-452e-483d-828c-ed382955771d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632031428, "uuid": "66c62a71-9c72-4b80-9c8b-7874bd2555d8", "value": "92484b3f2fd1c8d8a1b9520648b0ecf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48001db8-191e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1632037838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632037838, "uuid": "2e1c2c40-b88b-4e01-ac87-01df934e8da0", "comment": "Malware payload (Glupteba)", "value": "1de811bbb79351a681baa13ff38cd835", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632037838, "uuid": "90e5b0b6-2c04-42c1-a811-1671bc215305", "comment": "Malware payload (Glupteba)", "value": "1db9ab5cff09340433604b9148483cdd81fcbb082816b85a55669ff39cf6a7a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632037838, "uuid": "ed25ad19-ca29-42ea-a9bc-232463e8a7a2", "comment": "Malware payload (Glupteba)", "value": "3e06e7a982451025ec0b6b8f7ba0e2d0fd83a099", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632037838, "uuid": "08d87875-4e13-40f5-8afa-7bef5ccc2d1d", "comment": "Malware payload (Glupteba)", "value": "d64cf436b74bd2ea8c3453c62279ce41420f7ac53f83a936f155bdc0d8c9db86f249b2038cab06d814e6a4e1146d8404", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632037838, "uuid": "3823f4e5-8e6c-459b-83ba-8ec8ff212b79", "value": "T1C526332079A1D039E4F729B998A5A62C6C2D3EF15B3482CFB2D105EC433A6E4EC71757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632037838, "uuid": "dea34045-efd7-43d0-812b-062f7b597653", "value": "2b14341588588a7736588af3b9a80be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632037838, "uuid": "a62b0d22-266e-44f5-ba50-fdb6b52c03a1", "value": "98304:g+pBXABU2RBF8HP/zmpSYeMVWYXEiVDHcbHu3aFd3F8gKyFRcdnZM:YUu83iiMsY0iYuKFd3u4+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632037838, "uuid": "7b17220e-7446-4e46-b8fb-dbe4e44055fb", "value": 4631592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632037838, "uuid": "b56a42d5-1aaa-4e7a-8bb6-03047642b1b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632037838, "uuid": "387884f8-a054-4f8b-a3fb-667bdd37e5a4", "value": "1de811bbb79351a681baa13ff38cd835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9735ae0a-19a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632095094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095094, "uuid": "602d7f92-b716-4e9d-9d17-abd184362862", "comment": "Malware payload (Mirai)", "value": "7151ea7349f496cbaf8d0e73a096211d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095094, "uuid": "0d110809-3e7e-4666-b794-67c19ac80f66", "comment": "Malware payload (Mirai)", "value": "1e899dc9f1230c53a1c3749ab4ff187798b4a209b8dae38c97c9d98c673b6cbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095094, "uuid": "3f51d08d-560e-438d-9dff-171d353b290d", "comment": "Malware payload (Mirai)", "value": "a5909992772071ae01f7af839effd96ddf3cb3e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095094, "uuid": "a1620d8a-9b2c-43f2-be2b-87bba1954c5f", "comment": "Malware payload (Mirai)", "value": "a0d5297fa1bf69d1aceb5aa9c76b058db0282bcaebdabb6ed95634d0e6eabf2b75532407f15f11e082e8d1addbd46902", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095094, "uuid": "2f54230c-94de-4ec5-9976-187630618275", "value": "T1FDC32A46EA418B53C4D51B7AFAAF41493322D798D3DB330689186FF43F86B6E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095094, "uuid": "099ccebc-b883-4cda-bfe0-4da170fc2fd6", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl7D1+bA43xV1ce/:skHK8uz4hlVPqRJd2NSbA43xV1ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632095094, "uuid": "91162882-3134-401f-8b18-1c08ef5b7fbf", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632095094, "uuid": "df819f76-7eb2-4465-96b6-a88370c1b630", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095094, "uuid": "153dfd56-27e6-4634-a925-977c600ba6f2", "value": "7151ea7349f496cbaf8d0e73a096211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbed123-1957-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1632062462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632062462, "uuid": "a5bc2d7c-e99c-45c5-81cc-2eb8c8f1840e", "comment": "Malware payload (njrat)", "value": "ec9f108d335607135782af17ab903592", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632062462, "uuid": "cc813ae4-1112-46dc-9d17-9d3866468f0c", "comment": "Malware payload (njrat)", "value": "20031bbf53fc23ccbcc482f37c73975ffe6187151e49939f924b468ab566c73c", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632062462, "uuid": "bba582f0-69d9-42e5-bc1d-151f1437e55a", "comment": "Malware payload (njrat)", "value": "8587a5bb04991cf200922d0a9dbd8e12a8f5691f", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632062462, "uuid": "0e9e6259-1359-44d6-8bcb-e0930c4b651a", "comment": "Malware payload (njrat)", "value": "f9569ecd772d6b0c33e8533890fcf20d83dccbe8230dc5c65a5ff51828971ea4b0df6a85e6d4170f6b74ca74f55b92a9", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632062462, "uuid": "d3a337fb-6a2f-4eff-b432-9e011f029766", "value": "T17AF11E9F9FC8B8470051A75D20A4CD58E08998BFDDBC9791ADCD130ABA7C714354ACEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632062462, "uuid": "ef48c5f2-f7ac-408b-8fe8-4dffcc0f6fcb", "value": "96:Ekju0O1LiNRj1LCNHzVvVFuKO1L3NVj1LwNWIvvjufRycQEO1LuNnj1LONKeVvV9:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632062462, "uuid": "d69ab4bf-1a0c-4110-85d7-3079c3fa7c51", "value": 7644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632062462, "uuid": "7cb16b11-9b66-4c9b-bf21-59af23d45121", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632062462, "uuid": "a935f0fa-f6f7-459a-a342-56e43f6f819f", "value": "Reservation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b54b8c-1968-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632069882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069882, "uuid": "63892c88-d07a-4f42-9da0-492dce28dfce", "comment": "Malware payload (AgentTesla)", "value": "d6bedcc5f49701f7aa76770d64fbfbad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069882, "uuid": "ab2d7ef5-a876-4327-9118-281d219db7c2", "comment": "Malware payload (AgentTesla)", "value": "2122b2672f94cd556326b014ac904cc4c5b3bd18d2405984038f24adeee5498a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069882, "uuid": "7cf42bf2-c41b-4ea8-8d9d-7ab900a74fa5", "comment": "Malware payload (AgentTesla)", "value": "227b2df33f2949d2e88ce0e6d6684c78fba4f236", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069882, "uuid": "42680f7d-d03b-4352-97d3-b5d9d87aba57", "comment": "Malware payload (AgentTesla)", "value": "42d8423615a08435f381fbb40005b3bfa89380415adcab7296d4c691c363093e8e54e4f4c67e109946711a1bfb11076a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069882, "uuid": "62fea784-d0c2-455e-abbc-8213c5d2a1a1", "value": "T1AFD49DD1E9405A85FC2717F15D399E2011B77EAE64F5E20C34AA7E2B36F3382106AE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069882, "uuid": "5e09054b-cc51-4466-a3f2-179f633a3b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069882, "uuid": "60c8c447-6491-4260-9747-8bc70624bed7", "value": "6144:Oxr2xMVd022MYLmZVKeQ8I8BFYvIzwZ/fbUDHNo7hrdRG5/UBWAoN4iy88888OmS:OAxMV5NKx8ByvywZ/j0toldRu/gOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069882, "uuid": "2353945e-cc13-45af-bdb1-2749c8d3de1e", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069882, "uuid": "e31486e5-31c1-4b26-a2fd-57423b5b2df7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069882, "uuid": "acc0bf44-c2d6-4a26-987d-f141c98520d7", "value": "Bank AL Habib Payment copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8864668-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632063904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063904, "uuid": "86c68bb2-2474-42d9-99ff-b9b36f8e7987", "comment": "Malware payload (CoinMiner)", "value": "c09865ba240c0a4888d67fcbdede865a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063904, "uuid": "e56fc6e4-7a54-4f83-a53b-abc0a324b586", "comment": "Malware payload (CoinMiner)", "value": "21cf93848a82539601c9a5e2dabc11ac5c208be141cc0412bf38daa15292dad1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063904, "uuid": "ccc66d82-9cba-41b5-a0ae-df3e49cbdbf3", "comment": "Malware payload (CoinMiner)", "value": "3799b7898daebd063636c267451332daacc2205d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063904, "uuid": "485c3abb-44fa-45ae-8d3d-d4954b97484c", "comment": "Malware payload (CoinMiner)", "value": "b321cd8eb4740b9b1293a3ae6a8546911d59c546d76c8042516a9d7210594a4a740addbfa2778604764c6d97605d41a9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063904, "uuid": "df9a609c-491b-4eaf-b598-9aa4e1f2fb28", "value": "T14714D075B1F90F98E39F067A2871B600AD30B6669513FF262C4D57EB16823EF02E7581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063904, "uuid": "f8d04ad8-878c-4efa-ab96-a7f637e7e6ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063904, "uuid": "185cafd1-8ecd-4d37-80c3-37dad60c7aaa", "value": "3072:1iZuC/tfOJsYtrfyuq5mUF5eWEFb3AgM34udq9Y9fNgbec+1+F3t2OYD1Du5S/C:4b5OJ6fet3Agp0q9ygbX+1RzDU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063904, "uuid": "62bf5bd5-8c87-4e61-875f-280b8f355a60", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063904, "uuid": "4466610d-1a49-4195-a2b2-db48661e2245", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063904, "uuid": "3434071a-891a-469b-b159-639544f4d468", "value": "c09865ba240c0a4888d67fcbdede865a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6bde78-1927-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1632041743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041743, "uuid": "ac5efead-6c40-4cce-a80e-56b8516d96b9", "comment": "Malware payload (STRRAT)", "value": "dbaf3259e26cc1b482b693eb2fe45ff7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041743, "uuid": "8af4e9c6-47d7-4ff4-bd0f-49d5dcf97774", "comment": "Malware payload (STRRAT)", "value": "2225bdb2695a9909409268db13e40fa7f3390d40308dde661e1225058e4c0deb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041743, "uuid": "e83458d3-e227-425e-950e-43a05f19c128", "comment": "Malware payload (STRRAT)", "value": "f2c8b8e2cb7706a47fada2a4647afa21c881b08b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041743, "uuid": "7299a3ea-4302-49c8-8e7a-fcc11bced015", "comment": "Malware payload (STRRAT)", "value": "8a059d5d350e610cd6cecf0d84aeef5a899d840da78ac3ca8e87dfd62180b2c232b5434f357494a3d685e5a4cd7c9bbb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632041743, "uuid": "24f5d172-aec4-4444-97db-dc8aa9edbe64", "value": "T19114BE662F8FFB908746FA00802D25667DA3C75DA5DEE840B99D5A11CF36C0C8B54C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632041743, "uuid": "ce62ad80-7686-4205-becf-fc8f758203d9", "value": "3072:k8TIXGmE3UXXL0zViTUhOUPKe5la1pZwBAtCbTMjtu4XJ9ILlGG1Gkz:9I2meUXwzViTPUn61p+BZIuEIZGkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632041743, "uuid": "931944e7-348f-4d25-b1b4-f8e63f1b6830", "value": 192198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632041743, "uuid": "334fbbb7-163a-402b-a120-3e03aced73a9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632041743, "uuid": "59f7d0fe-e906-4488-94da-b4a0519879aa", "value": "Dhl Waybill Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f06e069-1930-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632045608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045608, "uuid": "11fde180-7156-4696-ad71-0833dbbb2ded", "comment": "Malware payload (Mirai)", "value": "95bd332dae9544eed6baaaa4019143bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045608, "uuid": "575833ea-f355-4cc8-9ea5-3de77977d118", "comment": "Malware payload (Mirai)", "value": "229333222bdda290de4adb483c4e9b245ce854daebca247ef87fb4565ef30c96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045608, "uuid": "543584b8-76d9-4753-b808-b7915693fd46", "comment": "Malware payload (Mirai)", "value": "6ccb956c1126de4d8020574b5968ae062f4d45bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045608, "uuid": "2bb61e72-2814-45f2-8ac9-3b0c6350cd58", "comment": "Malware payload (Mirai)", "value": "1176a1814e0b689f17a077daa60b9d835d7e0c7982b6a139d85965478b281a02b0b3560cb9725acd7112c71869f46275", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045608, "uuid": "c4b11c5c-cc5f-4deb-9043-77b75ad98776", "value": "T1916319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045608, "uuid": "cce1b17d-f314-4dbb-8c48-f189bd4e6f8b", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwbKnJeZWovjHJkKjg:at/LY0bKJwpvj3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632045608, "uuid": "37010399-b2ee-4a31-ba51-0010dd2e3d0b", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632045608, "uuid": "93dc3b8a-0512-4864-ae65-75bb21f917bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045608, "uuid": "d340acff-f3d6-4a73-a182-0e2a1707436a", "value": "lessie.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba872fba-196d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632071961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071961, "uuid": "ec3d139c-ca14-4340-a97e-871c7408e214", "comment": "Malware payload (Mirai)", "value": "bb9647d3eecdf849ca0dd240ae87002d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071961, "uuid": "2312ed66-a5d0-4f9b-a754-3a3b02a5f537", "comment": "Malware payload (Mirai)", "value": "22e5c0d0f8326b2b30c20c8cfaccec2b157bf2ef0b29900c924c74253f0d4d3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071961, "uuid": "3fde11f1-7290-493e-89aa-c62e6a6e9312", "comment": "Malware payload (Mirai)", "value": "2d4dd9ad9411cf942b8ce102b2f6b1da364b816c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071961, "uuid": "3acb4db5-080b-4b12-93bf-92cd1913e628", "comment": "Malware payload (Mirai)", "value": "a2c1ecc26b4a7028d238f91a9dbcea5900166e87c47f7a7e25fccde8cdf3c80d44410e9526311a74a42638bdf29f6f52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071961, "uuid": "bcaab61b-06fd-4f05-b041-ec24e82a8adc", "value": "T183B32B37A61C0B43C49B55F02CB77BF24F69AEA312A611C4A309FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071961, "uuid": "d3aa51b9-dc01-4545-814a-202486787954", "value": "3072:Uvc29uyIcxE/sZxw+OqQKZmm/QcuLmH26PNb:Uvl9jIg4sZxjO54mm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632071961, "uuid": "7b6bd03b-79fc-4780-8500-2fb04be5f9c2", "value": 117027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632071961, "uuid": "89498fc0-69aa-40c9-a0b2-c3c8e9f6a01a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071961, "uuid": "081de440-2e86-4531-98a3-9454ac131177", "value": "bb9647d3eecdf849ca0dd240ae87002d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b3afa5-196c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632071449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071449, "uuid": "02722605-b381-439f-b5b9-88e79d9cf518", "comment": "Malware payload (RaccoonStealer)", "value": "0feb35a0a849c2bb40a3076097bfdfd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071449, "uuid": "e6a55aa3-b0cd-437f-a51e-f05665830372", "comment": "Malware payload (RaccoonStealer)", "value": "22f3b23ee63e47656daa0fcb45c58b9a2665e28f54b56766b6dddc94d8781281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071449, "uuid": "832a0656-93e6-4119-82f5-474e0300d32f", "comment": "Malware payload (RaccoonStealer)", "value": "3734252222cdbffe367798b97ea3aed2ec1c4e4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071449, "uuid": "415fa233-e290-463b-8408-8c2a01f57195", "comment": "Malware payload (RaccoonStealer)", "value": "901eec0774c3b05dae012642f406d03095df45cd3894fe07d1161da6835d960ae49d09130ab5d0979076849b5ee7b654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071449, "uuid": "a779d233-c1bb-4a55-9f70-72884b7c1935", "value": "T172A4F10138B1D472D39258B0B423C6A4A93BBDD1526C51AB7798773E3F32EB26A35347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071449, "uuid": "3a6b8fd7-c2a0-4813-93b9-8e06da605e74", "value": "b6847043720ac758135cfc4be1dc3a6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071449, "uuid": "42730b13-9a24-4e1f-8d04-b8a96a9ca2dc", "value": "6144:9nsMONNHIWOB1zVjxEAejIo/nkvUd5XcG1M7O6vd9TP7iMDoMjdz5JHei:5vONNoB1zNo/nksfXcGyd9TP7/oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632071449, "uuid": "dd17702c-cfd8-4b20-b571-07a47039acec", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632071449, "uuid": "b111085d-4f8e-41ec-abae-3417a1fbd8da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071449, "uuid": "aff2fb1b-dfc1-441d-9a3b-f04b9796c4f5", "value": "3734252222cdbffe367798b97ea3aed2ec1c4e4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620c2f7f-1902-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632025856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025856, "uuid": "e7f4b02a-751c-4bed-881f-c873aa0bb384", "comment": "Malware payload (RaccoonStealer)", "value": "ac8db6941d1bd062f9f0cae02c7bfac5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025856, "uuid": "2e34ee7e-e756-47ad-aa4a-30c95f98e5d1", "comment": "Malware payload (RaccoonStealer)", "value": "237c6adb7012050c271ed33932bbd6a18a86dc18ace5841b5c0d52f3fe79dcc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025856, "uuid": "6b5211eb-74de-4a02-9ea4-6b043ef5b99c", "comment": "Malware payload (RaccoonStealer)", "value": "9481d1bf71d0100639662939461fcf6bfae134cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025856, "uuid": "2eb7d816-e58f-4781-ae54-0ddd44dce3d7", "comment": "Malware payload (RaccoonStealer)", "value": "e487084f8f53ebda9ba1a4e0ee6e5c11ba94dce877a9bb6fa0395cc13bc3bef8fd3ec90863644fec57ebe768f7b70bf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025856, "uuid": "4f0b98e9-adb4-42f8-b080-da80d1b01a98", "value": "T138B4E0206A90C034F0BB52F959B997A8B83D7AB16B3451CB62DA16FA17357F4CC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025856, "uuid": "f76758db-c325-4e10-b9ac-58e6fb907055", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025856, "uuid": "1c52a708-0a76-4cb1-8c9b-b89cdaf1b118", "value": "12288:OZ/KSdrfV9cBIICj1cHuegrYjGbWa4eiQJZ5gXcZ0zAA:OVKSfbPjqHuqjGCd6gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632025856, "uuid": "052525e8-ec6d-486c-9449-7acea11dcdc9", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632025856, "uuid": "ccaff3c6-6edd-45b3-851f-ce107fa4b1a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025856, "uuid": "6428a853-dad7-49d4-8d05-a4ee78f2ed0b", "value": "ac8db6941d1bd062f9f0cae02c7bfac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93625602-19a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632095088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095088, "uuid": "02ddf0ab-aeed-45a3-8879-1806bca82f75", "comment": "Malware payload (Mirai)", "value": "84ea5b10b0421e6dbb3b587a9b236b56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095088, "uuid": "74f493c7-8056-47bb-8171-4cd6d0a95a7e", "comment": "Malware payload (Mirai)", "value": "2445d2da02c24f06380cc6d46caf3f95b4d146c47377e84ac8fa6473826b5205", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095088, "uuid": "0b6726af-3bfb-47a5-8d03-1e6c212ca871", "comment": "Malware payload (Mirai)", "value": "86bea2323122fa907531c288754e8067993ee03c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095088, "uuid": "a0831a0b-d7d4-4025-a40c-d12ce66e913a", "comment": "Malware payload (Mirai)", "value": "00aa915a47b4dd929ecec10960f1dbe334d3323655cdf81f8442dbe16327771216eacb8026828f5947c5a73483cd9c13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095088, "uuid": "a14f49a7-1dec-46f4-a140-5df511165ae1", "value": "T1C4637116BF601FF7E8ABCC3785A95B4A25CC541A31A93B797D34D428B24B25F05E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095088, "uuid": "aa1d2464-de7b-4677-b521-b2d24e53b85a", "value": "1536:FJs9gGYlZma+9KRJisXkBg0rruxyD81Z:FJs+9mLiJMruX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632095088, "uuid": "fc34b016-3792-48b7-bbb9-baba5359a148", "value": 73324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632095088, "uuid": "2051d817-10a6-42a3-8bf3-9eeeb54a0e84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095088, "uuid": "ae52bab2-5efb-4543-b325-639367ceba3b", "value": "84ea5b10b0421e6dbb3b587a9b236b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55164d1-197f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632079656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079656, "uuid": "29b18968-c69e-45d1-a6ff-6bac3d8bee37", "comment": "Malware payload", "value": "08c886bd704afd6266c1964f1bcf16ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079656, "uuid": "b220f3ba-19e5-4718-ac4d-860ae9bddaf4", "comment": "Malware payload", "value": "2532d19b1bad310b12319611d0264a94dcc5bf25883302e89210ae5b8b29c818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079656, "uuid": "5d36f747-6ba5-43f8-84d8-54a5a2ec1580", "comment": "Malware payload", "value": "035f30b98a51d50103b381d68ce688b15f443f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079656, "uuid": "f469967f-8b1f-4946-8d4d-f8fb85eae260", "comment": "Malware payload", "value": "656dd974f4dcdd49110c30a06907b53f9607bc17cf0be99eb4dbc6e5f117e5801c2764aa7f44e9a96000977185ae76b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079656, "uuid": "3f9d78e7-870e-4d3a-a2a9-611425c14cb8", "value": "T140B523215BEA53F7E0633B3258D46725B7F5E92A8B1344DB938167026C443E2DAFE903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079656, "uuid": "a5ca9a32-1e5f-40c1-9e43-afe88c0ba99a", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079656, "uuid": "796ac24e-a873-499b-ac5d-c60e2c8b925e", "value": "49152:s5+hFg/Unzs3Et+f0mdzgM/o5Aik2X4t7UA5bml02rxiz8lVHTIioOFZQ+z:s5aF2UnpMMaUTKiFXuYvl0AxiqZ7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632079656, "uuid": "0469d9b2-481c-47c6-8382-012f4fb1cede", "value": 2426112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632079656, "uuid": "437f7110-55b0-40c5-b37d-7b1cc36b3e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079656, "uuid": "9258783d-de0d-4ef3-8df3-6afc2328613e", "value": "EuphoriaH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c57853e-196a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1632070514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070514, "uuid": "feaab31a-ed52-4dbb-8cd2-3799a8feb360", "comment": "Malware payload (BitRAT)", "value": "1b5253f12a76c5b111750d1e2f22d5b6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070514, "uuid": "a0131b8c-d93c-4fb4-b3f9-811d31f87c34", "comment": "Malware payload (BitRAT)", "value": "27a51755658dffa009dc5e26be2f3df865a56ed4e2f3d2f0a6f726ad2a3d7b7a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070514, "uuid": "2fdf959c-8f50-439a-a415-cdf03ad909a1", "comment": "Malware payload (BitRAT)", "value": "cd5733b0d0c8ed5520f017e50c9e4b992f260b88", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070514, "uuid": "00211d00-bb4c-48fd-adaf-b149b4ffb93e", "comment": "Malware payload (BitRAT)", "value": "ec048cf56ffb5b578b3fd76d7da12c2290ec3bd6e8d1ebd1ef461535c83aa6deb4acd880619e387f7a7a613acaf6b871", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070514, "uuid": "d839e7f4-7c51-4e69-906a-86ffcd24fa9a", "value": "T108658E12B3844CF5F931193A8EDA77A13929BDF024A95D4F6DF43E142A647A2393C48F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070514, "uuid": "68461f25-16b0-456c-b66c-2166c0b49538", "value": "12288:bmnGyuE9fz9VBCY4Alz2MjbjBQHhazE2mdvnk6LHC7WWnMvwfHVBPggseBnDz5ZE:bmnZbz9e0z12HLBngseBDz5ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070514, "uuid": "31d97a30-cf1d-4052-b2d2-faee33cd47e4", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070514, "uuid": "9f090b5a-6c30-4ce0-85e0-e235b4054691", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070514, "uuid": "c4c2c6f4-6a86-4dc0-b051-c80e96db06d8", "value": "DHL_455462.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba1685d-1901-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632025550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025550, "uuid": "9c33cae7-aa51-4488-99b6-f6fc8b99e975", "comment": "Malware payload (RaccoonStealer)", "value": "bddb04869ca96384229e3e268663dffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025550, "uuid": "241d203b-3d5d-4309-924e-aaac0149a0d4", "comment": "Malware payload (RaccoonStealer)", "value": "28a1d5fa2dc4e99192f634223cd08d146980534b6f51b36842a2d7c471868fd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025550, "uuid": "5d5f79bb-9e64-462b-8ec6-6b8d84f5d67d", "comment": "Malware payload (RaccoonStealer)", "value": "cd5334f0d78b8b349d9495bcb25255273e919a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025550, "uuid": "49e16e52-3c49-46df-b52a-780047ca2c3f", "comment": "Malware payload (RaccoonStealer)", "value": "d4efd3436b594825e1bf07390a1f336d54929e51b61283151550e4b67925d7c812579c6e2349add4b351bfe8e98c78a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025550, "uuid": "4d542a26-ed96-453c-a3e4-4ffe5373adc4", "value": "T1FFB4F120BAA0C035F4F712F85AB687A9B83D7E719B3451CB52DA16FA56346F49C30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025550, "uuid": "7740b8c1-1eab-4e05-baee-ff262c7dc4e3", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025550, "uuid": "8bba04f3-e742-403a-80b5-33460b5c6d06", "value": "12288:IZyxD4yq0mdMkpzD668S0yCNManKn/eH:IQxD8xlnCNMxn/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632025550, "uuid": "6112c801-e8ff-47c1-a834-afcf3c71d254", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632025550, "uuid": "f9db22b3-e0c6-472e-bf35-4dff95ae9e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025550, "uuid": "bb5a7fc1-97c0-4520-9281-b2fa6177645d", "value": "bddb04869ca96384229e3e268663dffa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d225b2-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070228, "uuid": "c3defd9d-8037-4a42-855b-3eacac8ddd33", "comment": "Malware payload (SnakeKeylogger)", "value": "4da1515d3ec8c5f7c5caf69bb6cbc91e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070228, "uuid": "33d9d9f7-c024-4ab1-b670-ffa287b2d97e", "comment": "Malware payload (SnakeKeylogger)", "value": "28c85ce815a5ec78b83e7242c61a532b20a35d98dd477444f31cf6bfa1f3b581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070228, "uuid": "bb6eed77-729d-4d5d-8cd4-caf1f636aaaf", "comment": "Malware payload (SnakeKeylogger)", "value": "a1079cc63d6aec8eb5a65ad6c4d7a4ccfd742bfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070228, "uuid": "bb68235f-32a9-4fdc-bc96-0d0d586565fc", "comment": "Malware payload (SnakeKeylogger)", "value": "2094a6fb351cea84f69ff5dfd6a46719f9fae8253ba8f07e9e405fe6d43d41ffe257cbe8caa80ee7e04fb3607bf6485e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070228, "uuid": "1079fa2f-b796-49bd-ab44-9b248aaf42cf", "value": "T11894C0343EEA9015F273AFB58EE5759A9A7EFB233703D85D2491038A4613B80DD8153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070228, "uuid": "3b46ee43-1536-44dc-a051-ee2eba05a76d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070228, "uuid": "949661c3-da22-4460-b452-60111d3b8bfe", "value": "12288:zjYwWHCM2K4CZbh3mulXbWVfoYlxk5RHW5VK2+Jg:3R3CzjlbcPH4oj+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070228, "uuid": "74eca490-63a5-42d3-a95e-47ecc5619d04", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070228, "uuid": "af4c8ec2-50e8-4c9c-b7d7-a9ab4f274901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070228, "uuid": "933b2e58-e7aa-4250-bb40-3c0c1b51c9b0", "value": "Z320803BBSNKKMC360868,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327c03f7-191c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632036943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632036943, "uuid": "044c2bae-2c4d-4e05-a267-9456d8d50f04", "comment": "Malware payload (RaccoonStealer)", "value": "32ccd8f8a61f62b22bb5d2d37fb2f1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632036943, "uuid": "8c125619-bbf4-403d-be64-dcd7243d1096", "comment": "Malware payload (RaccoonStealer)", "value": "2b2394b8ecbee2ffe037f5eb6912ce33e6a1800a7c2ab772d2136e55dcad5693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632036943, "uuid": "98053691-2955-462d-8328-cca9b988b15c", "comment": "Malware payload (RaccoonStealer)", "value": "4ac40fd19492421345cdf93b9bcc07c36a355de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632036943, "uuid": "ce04ccfd-8b4d-4cb7-9968-2a5870607d8e", "comment": "Malware payload (RaccoonStealer)", "value": "94f4b76871d8b608bf7d3e0d6b7c99c5ed4b7fba4b89ca145382929314d499225e756d0cc0741c7322adf6f92cfd6bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632036943, "uuid": "f5edce6d-7fff-4b93-bba4-059d66a389e7", "value": "T10AB4E020AA91C035F4B702F85AB983A8B53D7EB19B2454CB52D616FE27386F4DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632036943, "uuid": "f2925860-5224-4992-bd0e-ef5f96336840", "value": "0a50d73f84b858f7a49d0d60fc59dfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632036943, "uuid": "5bf62049-c123-487f-8a97-49f24d15c650", "value": "12288:kZ/DulAfGi8xo154PwF4/c7keg1ViYW8IVZ4zXd:k1Dup+Qwm0Ng1ViYWZZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632036943, "uuid": "3798f5ac-08bb-4928-b22f-904f50d0ebab", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632036943, "uuid": "4f586c6e-efb0-4df2-87f8-68bc9043cbed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632036943, "uuid": "f6af8557-bf70-469a-af6f-42ef6e7d44b0", "value": "32ccd8f8a61f62b22bb5d2d37fb2f1bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857aa959-196f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632072731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072731, "uuid": "8a12bc60-8ce5-4264-b051-1a4d6f17aa6a", "comment": "Malware payload (Mirai)", "value": "a7d5620e8329c7735a7dc493f02ff89e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072731, "uuid": "058a86d4-5735-4335-bb02-8030ddd3e216", "comment": "Malware payload (Mirai)", "value": "2b453f5446bc12688036714b1daaef2c1a28de941b317c2fffc5f95a569700a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072731, "uuid": "c6522488-f719-4a37-8022-2ef3c8457856", "comment": "Malware payload (Mirai)", "value": "d71e8cce786a5b9df14a328c50c699255d67802f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072731, "uuid": "89931576-aaa2-4e80-b1e3-6d75cdeb9eb1", "comment": "Malware payload (Mirai)", "value": "42532023ecc70864725bce7e7173bb8b96174cd9dd6c9931de84096d218345fd47053e192e4ac5da1cd1e2815cf10205", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072731, "uuid": "12f4b0bc-f507-4fe5-8156-0453789a210e", "value": "T1DBA3F972E642CA72C44306F102A79A6B0D21BE7B0A3A5E86F31C3DB49F334C97555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072731, "uuid": "7406c6fc-3919-4ffa-b473-06a68d0816de", "value": "3072:SOGAEtZoGZKWl6u4YTnbHBbimmFVcqq0G27ZT:SqEtZ755nbHBbimmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632072731, "uuid": "26963034-455b-45cf-b109-4ccb1f1d5ab7", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632072731, "uuid": "7df53dd9-4374-443b-bba7-8960bcc04ff5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072731, "uuid": "341981e9-1529-4c7f-a917-31a9fc938857", "value": "a7d5620e8329c7735a7dc493f02ff89e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d4b2aa-1971-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632073726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073726, "uuid": "7b721a3f-24cc-4c48-be21-d91455f22087", "comment": "Malware payload", "value": "ef7173b03c9e2d414d8799a1b5753b13", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073726, "uuid": "71f365f3-0164-4476-8b13-d482d871330f", "comment": "Malware payload", "value": "2b4fb8da8c7c191418e66e8630c9269a3d090d908e17b1daa16fcf9e9566502e", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073726, "uuid": "07f0ac8f-0d9a-4da4-84a4-6b164e3ba2ab", "comment": "Malware payload", "value": "508cea62f4eaeb919abec7875c96760877c3e65a", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073726, "uuid": "2b4ce9cc-5bcf-4de7-9914-f707d5483865", "comment": "Malware payload", "value": "868b01dacc6af6be660649afa3570c52d1a4b5b6dc04b1c2b51fe93e784bcb92eac8a0ae8e247b3473883a6f3b70fcba", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073726, "uuid": "ea575b2d-1477-42c8-ad2b-127dad282ad1", "value": "T1B7B133AECA31F8E8436C76A088A23D5F21DC5B57D7B39A68E9050CF72960314EF2575C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073726, "uuid": "55338242-3261-4553-8c21-6ddad55e8a24", "value": "96:K+leTrwr4XzkfAA9QlguA7N0XDSGPW7oIsd0X0W0Kvieb2Si8mL3R:KVQEDYuA7+XLJxdGvi1Si8mLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632073726, "uuid": "32dfdfe1-c345-4c1e-b710-0d88d9be9a1c", "value": 5154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632073726, "uuid": "269ee779-f86f-410e-b109-f31b6a646f67", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073726, "uuid": "a80a7c4a-5c63-4d65-82ea-335456730a4e", "value": "plugin.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc03ed16-1949-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1632056528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056528, "uuid": "f097812c-46e0-489f-83f8-f1062d0f6571", "comment": "Malware payload (QuasarRAT)", "value": "5aca117237e9c37136529d3778ec0c4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056528, "uuid": "9415a77c-bec1-42a4-96fd-f0005fb875e3", "comment": "Malware payload (QuasarRAT)", "value": "2be86f526d00c0647dbe4c9c59a8f2faa870d7fcaf575ec42f7d47f8c86defc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056528, "uuid": "dda88480-88a9-43e3-a80d-06523b036a0e", "comment": "Malware payload (QuasarRAT)", "value": "cc9080c78b4afcf728fea50b4774e8977158b300", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056528, "uuid": "68fd6586-41b2-4c06-b321-449f0475b5a2", "comment": "Malware payload (QuasarRAT)", "value": "c2d16ec418e5e4ce9abcb4669058d08dafb088ab0e8be1cf8404312fc905944e3357f80e62a26358f5ccac6c3deb3d12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056528, "uuid": "2b6b16bf-cbc9-45cc-932d-f06948ef54a4", "value": "T134063302AC8559B1E4224D365BAEEE116178BD711F285FABA3DC6A18D5700D0FF30B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056528, "uuid": "f7297639-0a96-495a-be99-6c9b82ef4091", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056528, "uuid": "27676868-788c-41ee-9e9b-e4779d2315a4", "value": "49152:J84p+ldtH7riKKjJlrsJ3jD1jAwGe8mE6cO8GV4ijRE2HiBCbq7Nt8E4U:JzKh7KjJlINX1UwGeZcO5G2CBSUUE4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632056528, "uuid": "68d2944d-2067-48d4-b4c1-db8a9b752a6c", "value": 3672107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632056528, "uuid": "55356bd2-8c38-414a-b48f-3978324e1a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056528, "uuid": "f882ad7d-82b7-4107-aaab-ff0c9374f129", "value": "5aca117237e9c37136529d3778ec0c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3121ec95-1963-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632067435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067435, "uuid": "2194a3df-e44d-4a04-b236-8b1efdd31abc", "comment": "Malware payload (ArkeiStealer)", "value": "f6d536f3d6c49ca7da650f972fbcdd00", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067435, "uuid": "5d85e042-d481-47d4-9959-8d5b4d83cf5c", "comment": "Malware payload (ArkeiStealer)", "value": "2d91e376152618dd6a130215eb8db5c438eafa6738d62266e3edec027a58e88e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067435, "uuid": "4321643e-d2f2-4a21-a6b7-1e9242db0b2d", "comment": "Malware payload (ArkeiStealer)", "value": "98c33fb3a48130f8082051c0c834bf865de709a1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067435, "uuid": "83062d4b-f03e-4a04-b886-34de98b732d9", "comment": "Malware payload (ArkeiStealer)", "value": "69a8e4fdcc7c661a9f580343e971b6b0b3e7cbc235c67298e0acd20580d98240db1eef950a14070b6a58b032f0ba5953", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067435, "uuid": "54d1a545-63b9-4a8b-9669-4e5448e794b3", "value": "T13505C8E5A91D4C77FCD8253816D31D6C68253FC7B02D358F71AABD28A9BBE81A847D00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067435, "uuid": "4ad7eadf-48d4-4f03-bfd4-2a25f21de117", "value": "33b96b25a561ce662403f8f66fbbfde5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067435, "uuid": "eb26229e-2d04-4569-8efc-a1017c96ee1d", "value": "3072:GU2LrHQLZTF1aI2LsEBsabgMArKjXGI3UbSLctvkn7aOKzXgVg3Zeu2GBlF0EfY/:l2L4TF1aI2LsYsGsrKD03vplFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632067435, "uuid": "64ed6ce9-c61b-4334-b3f6-b86dc865a898", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632067435, "uuid": "4de40680-b730-47da-96cc-9f4ac7ad1238", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067435, "uuid": "3f5f94a5-2351-4653-9692-620556f9121d", "value": "f6d536f3d6c49ca7da650f972fbcdd00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bf7a2b-196b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632070849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070849, "uuid": "98fa7b23-f650-4f60-8489-89ded91da1ae", "comment": "Malware payload (RaccoonStealer)", "value": "2b872886528bdf12653713011d1a591a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070849, "uuid": "57443e13-b4dd-4b3f-9d47-d49e48c729b8", "comment": "Malware payload (RaccoonStealer)", "value": "30caff968b27304bf8c52ed3d94e56aa277cd20a3851dcfc89950e5cf879a864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070849, "uuid": "5994ffed-f156-4a9d-9fee-dfb5bcc78b5a", "comment": "Malware payload (RaccoonStealer)", "value": "6525745fc8aa8b3c087a4194606a0d4be084ffd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070849, "uuid": "411e1b5e-1fa4-4527-9b28-60952d7b0278", "comment": "Malware payload (RaccoonStealer)", "value": "b1d93231366f853a680006519c5ea7e5cdc7233aa9173a411520882808a9380c60d8c41eb42795dd9770819f62153778", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070849, "uuid": "79be0bef-e8f7-41e1-b8f1-027f079d3da9", "value": "T138B4F112B3D1E423D6D946755434C7F56EFEBDB21A64850B7368EB6B3E302C08A2274B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070849, "uuid": "11003a60-516b-489a-98e5-56e764968207", "value": "9c3501e221e7e06d3e51bfb52c2b6518", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070849, "uuid": "0ce4c951-8442-4dbc-b339-5eee9c9edb41", "value": "12288:j7MSW3BcJyHC/n+vgmeJWUxYGdA6gKSzDmS:M3qyM+ImeJWUxYUXNcSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070849, "uuid": "f14e3763-b299-445f-b65d-9176a21251f6", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070849, "uuid": "84e30442-a4b7-4287-aaea-3a2db76d31f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070849, "uuid": "290b92a2-dbcc-44ce-b0ba-e328c0a857a8", "value": "6525745fc8aa8b3c087a4194606a0d4be084ffd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89be6c1d-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070161, "uuid": "e9dea04c-c77f-4ce8-b70b-3a038d599d51", "comment": "Malware payload (SnakeKeylogger)", "value": "282ac661a4d8a69c32e1710e5e15a1a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070161, "uuid": "96332f36-b0d0-46f5-b918-67d8e3184a37", "comment": "Malware payload (SnakeKeylogger)", "value": "33de5939ba0e41536521d712d584b663eae1386c533b7676ee1c20b9be5ff32b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070161, "uuid": "2f6e6b3b-7e17-4a05-bc3d-6388e5a95994", "comment": "Malware payload (SnakeKeylogger)", "value": "11d86dcb524a1e890b4e3b7a824245ff43d5ae85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070161, "uuid": "1b5171ea-bae9-4860-9416-71333cab0d12", "comment": "Malware payload (SnakeKeylogger)", "value": "e296684b87528c741e20d14f731f678bf701508bc9b6e7abb6e5eebb0c5bdc87ac4d503c3742e01fce7a6c93cbc85b15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070161, "uuid": "4c8b4fa4-75ec-4e94-b794-e97c7106b283", "value": "T133158738ED0B22BBEBA6D374E4BA150AA1F414BB33358D5DD992764D090370374DA3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070161, "uuid": "ab24394f-f757-4a80-b913-db3adcda15c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070161, "uuid": "b6b8c22a-9a14-480f-a41d-9d60b1a110ef", "value": "6144:N3p96Q7bncvjAg/BBn1/oQdwQl7cvZNVVBBJJEP/C/vHM88ePMS:NPN5UBZ1/oQrMVzCS3HM88ePt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070161, "uuid": "dd6657aa-f6fc-46f5-ad86-de09f5020bf8", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070161, "uuid": "54c87f49-cdfb-42ba-ad52-3f2182592910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070161, "uuid": "c53f883d-c0b3-4b71-bb5f-df7d679057e9", "value": "Drawing and Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb854ccb-1937-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632048877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048877, "uuid": "7eee09fc-b301-4f7c-9af4-f6e8108f0bb0", "comment": "Malware payload (Mirai)", "value": "2896679c934da9f7ae41af4d15771f6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048877, "uuid": "d9a2b810-1625-4637-a17f-da9ad8281e54", "comment": "Malware payload (Mirai)", "value": "36d67ccc73899203ab3e1ca88cf58e0b72f3f815da4e522459fb2b4ad26a82da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048877, "uuid": "d5f8c199-3de8-46e3-84df-2503d6c8bd88", "comment": "Malware payload (Mirai)", "value": "1f9e5e36439ac036bb56ef0938296855f3338583", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048877, "uuid": "2e80393f-a981-4ecf-91e3-e2caed9defe0", "comment": "Malware payload (Mirai)", "value": "c7cf5316f325d09f8d5232a55486aabbce844c5f3a67b7baa0898fc1f243f1c350f12b9da267bf67edf9a7cedae138b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048877, "uuid": "95f3e58a-d1d3-4157-8abe-1595c1baeda5", "value": "T10383A20AAF614FF7E89FDC3749E92B0624CD5416219A7B79B974D808F20E24F19E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048877, "uuid": "086c25dd-2be6-41a8-a809-3f94e009a91b", "value": "1536:WCdHTb4ob1jz4T+3BLy0u/0NPJwo8KkPaJ7HTvEzS4a9TEU:fd6+3m/0NPy1Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048877, "uuid": "dde54264-4c43-44fc-88b9-04e6a4083531", "value": 88660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048877, "uuid": "a2f37133-8a2d-422d-86af-f783659c6e07", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048877, "uuid": "52ecf683-4a68-4d0f-9838-b275ce4d36a2", "value": "2896679c934da9f7ae41af4d15771f6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca6299a-196a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632070730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070730, "uuid": "dabc4a16-2524-4da9-bc9e-de492465ceac", "comment": "Malware payload (AgentTesla)", "value": "64c6673705540b9e8eb286be90112902", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070730, "uuid": "db548c18-5210-4470-903d-c257573429ca", "comment": "Malware payload (AgentTesla)", "value": "36d9a7a775950f4f2c6571a79515fe5cea1f1db853635c29c250f7998dff909b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070730, "uuid": "5caa82bf-5db6-4307-aa40-8a4401b6a215", "comment": "Malware payload (AgentTesla)", "value": "eef9e748d39b5ffc2da9c91ed1b1913c77549953", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070730, "uuid": "dbaa3b9c-8c68-469a-9a23-c963b2776bd0", "comment": "Malware payload (AgentTesla)", "value": "2fefd76bddd7bf6fcb8626e43c2845c1ac42d0ca42577d0775c87aa77cdb728a06c89ece6cce2599b793bc1b6a2934e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070730, "uuid": "b26cdbf3-8f7f-4410-86ec-836850774e34", "value": "T1D4A4233A29003EC77A14C7372EBB6978BA83134DF25444A16AB85778051937E68F3AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070730, "uuid": "71dae8d3-b039-40ff-9774-77eced6fd784", "value": "6144:YmDdbtpS35Dh15EtbhxzCN1S3qktXhrSX2hDMCWL7YzTijLuz/fiVnyW:YwdbLiFM01S3nXM2h01WbfiVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070730, "uuid": "6b1f342b-94c4-4e87-ae60-777ad8e834dc", "value": 479615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070730, "uuid": "25b19422-139a-4a58-8620-8f47cc974b68", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070730, "uuid": "66da43d2-462a-4818-b819-9388a5aeb795", "value": "Approved Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5989233-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070208, "uuid": "234f93cd-be55-4194-9e1c-c33558e02c48", "comment": "Malware payload (SnakeKeylogger)", "value": "593c6a29f83e8f59729eaeec755bc60b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070208, "uuid": "fb2b1e66-a93d-4a6a-9187-83e1acf60e10", "comment": "Malware payload (SnakeKeylogger)", "value": "37b1bfbeba21ff08c551b0fc2504eb88933d28944c055e1ac5f983dd10c7767e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070208, "uuid": "c8aa0ec8-d5fc-4dbf-8a27-6de9105bb620", "comment": "Malware payload (SnakeKeylogger)", "value": "eeafd16d108934e9613068c0977a08ac2ee7d234", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070208, "uuid": "7589e030-6114-4d60-bf83-850fa87cb326", "comment": "Malware payload (SnakeKeylogger)", "value": "949c4d15bf44faa1f8cabd1d36f15c2727b16398f773c1455e40800fb73ff3d79d2f25535e9263014e6e9f5b242b28a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070208, "uuid": "f6f240b5-b50a-49af-a4f8-03badfb3c134", "value": "T10A848C10E54DACE5E7E5C173B92A9B11057AFAE782BE805F2365371816B33C32177E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070208, "uuid": "4bf522f3-a4e1-48d0-92f9-8e53278acf8a", "value": "c2e2fa89aec204ac5f3945ce98025d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070208, "uuid": "39992e21-363e-4506-ad19-2deec5ee67f2", "value": "6144:byr1l5W5NeXM6PPiRAV5ilhiveE672WgFsOyaCvq4C:byr1S7eXM6PPi/rybWM5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070208, "uuid": "7603d0f1-8d51-4d9f-b747-fb9c7ba57752", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070208, "uuid": "62735e44-fb6e-4499-adcb-297bc13c9f8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070208, "uuid": "25f6b020-48f9-4777-ac93-52bbe8a0568e", "value": "INTR_ORDER 5676-SEPT1521,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991d8d0b-1938-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632049141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049141, "uuid": "6e58f14d-52a3-40c6-aee6-c3566252b935", "comment": "Malware payload (Mirai)", "value": "b442eb89145687404f16532717218a85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049141, "uuid": "34781bfc-1b5f-475b-bcfa-b0d04510335f", "comment": "Malware payload (Mirai)", "value": "390e59769543c621e8859a3438afbe4484a5d6ea6d621a310160c7c32d62f350", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049141, "uuid": "2a6f0a0b-964b-4b2f-803c-5c8fc1bb1538", "comment": "Malware payload (Mirai)", "value": "c4810fd7dd36f5314a5d46a3b761ed3da96b3589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049141, "uuid": "f4b93bb9-5de0-43a1-b3d7-722486ab6f38", "comment": "Malware payload (Mirai)", "value": "511021c8c0bef2415ec8d702612fb1cedd8c09f5d15866764326c831490c5186f8f6d99a979674e5f1f68c4ec889fe0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049141, "uuid": "920dd0a5-6e1f-4a08-942b-6ec0509e4d74", "value": "T11333198D64112E2DDAD66CF954624F0ADE441221B1A3171FA3FEFDC33D33268EE51949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049141, "uuid": "1ce7e460-4dc2-4897-a150-45f8afda8253", "value": "768:qOEBCfhT04/suEUuMK0yer1gRu7Y+YxZWCPVfdKRiJ7QIQm+f1prZ+i/ig0e10J:REBC5JsnUuMKFIYZR757QIXg1pStJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632049141, "uuid": "90941417-f0f7-4763-bcf7-e1d11ec0c255", "value": 52780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632049141, "uuid": "dff0431d-81a6-43b8-b85d-9ead1f8da7ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049141, "uuid": "1cc6fa41-6caa-4988-9aaf-e8d2bc585750", "value": "b442eb89145687404f16532717218a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6eecae-193e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632051836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051836, "uuid": "d2740241-1c5e-4e16-99cb-6ccc894dafcd", "comment": "Malware payload (CobaltStrike)", "value": "e379027953362134e41188ac0feb608a", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051836, "uuid": "aee0973a-6c0b-4adb-bad2-0e4689c53e78", "comment": "Malware payload (CobaltStrike)", "value": "3c336d601752fad36de33e98b8840d39386a2a3b80e5a4c2360e4fbf87003304", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051836, "uuid": "8e7c613f-66a3-4e43-bdd5-5afcd52e7f4f", "comment": "Malware payload (CobaltStrike)", "value": "95092374903e22a4a2087616adb22e1c86af8455", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051836, "uuid": "cfe98103-1526-4fa7-8ef7-fbe4bd1b5b15", "comment": "Malware payload (CobaltStrike)", "value": "ca7c8ec50f6a58694b2b979f8a61ab00da90ee1f7d7457bbb896f3b04403fcc99bfea42172ad66e65fd39ebc396a7121", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051836, "uuid": "5b49235b-ba7d-4034-b9fd-d55df92b6a81", "value": "T18324E0B6497B7960EA61D4F611F7B47D0E3187F3E037782FA7081199A018163AB1E2F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051836, "uuid": "cfdcdd36-bf4a-4f48-96ad-04cad9c0e311", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051836, "uuid": "5c769616-f8d1-47c0-83bc-bdcdc89a3984", "value": "3072:vdUQzhzvfZecn/8yrTxDNmfK1LLFLfq/h4m1pP3WTaKQEorSVEqPyZZFIBO:FfzBXZecDs/hN15k3o+NaCBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632051836, "uuid": "078062bf-c65e-4234-b11e-20e5b4c21ad9", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632051836, "uuid": "8c745edf-101c-46fa-b7ac-1a382cdad12d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051836, "uuid": "60857e7f-a9e6-4f79-a577-1133271d188e", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd2a66b-196a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632070681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070681, "uuid": "10351d7e-a3b0-4eff-8c71-d242bab65ab8", "comment": "Malware payload (AgentTesla)", "value": "8e53961dc2c5f42e17c79eb30a8bb872", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070681, "uuid": "1a380887-4b70-4eeb-9c86-c575085433a8", "comment": "Malware payload (AgentTesla)", "value": "3f095cfd5019b487e62a640354b4620d33a3dec5e6c5cf86ff1c300f77e36485", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070681, "uuid": "d73781fa-9662-4e56-9818-e8515d9f0da6", "comment": "Malware payload (AgentTesla)", "value": "6e2c9e82520cad1b25628770f2f6fb381fef66a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070681, "uuid": "701118d7-6680-46c7-8268-f217a794d4c7", "comment": "Malware payload (AgentTesla)", "value": "e8fc6feb1dc7a314b5b9fb1f1dbaf23a8c91b66092db081c0dea60c6565dcba6be4829c897879c593852254582e61abb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070681, "uuid": "cfd688af-1591-449b-808c-6ce71484b68c", "value": "T194A4233A29003FC77A14C7372EBB6978BA83134DF25484A16A785778051937E68F3AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070681, "uuid": "4ec7d991-0fbb-40ee-8143-c364dc873098", "value": "6144:FmDdbtpS35Dh15EtbhxzCN1S3qktXhrSX2hDMCWL7YzTijLuz/fiVny3:FwdbLiFM01S3nXM2h01WbfiVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070681, "uuid": "c21e5fc3-e0f7-4b10-8496-d3fc37e640c1", "value": 479625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070681, "uuid": "d63d528c-a239-43cc-a1d4-eefb1ff08af5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070681, "uuid": "3acdb63a-099c-4222-a427-7fb62abb95c8", "value": "SHIPPING DOCUMENTS#ASIA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d7647d-18dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632009896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009896, "uuid": "86d4fa58-1f96-4d4f-9dd9-b89cf716bc02", "comment": "Malware payload (Mirai)", "value": "26038cd997f85c9710d8cd2541156b47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009896, "uuid": "6d7c104d-37f3-48e0-ad0e-fec3e39a4c4d", "comment": "Malware payload (Mirai)", "value": "40999f7ad95e8fbc2454a79dc02fd25a4147065a2ad39ac2f9568eb5ca115192", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009896, "uuid": "d24d4a8a-2342-45d6-a998-d7704de826ff", "comment": "Malware payload (Mirai)", "value": "60288bc562ad54a2b12ba1a113b6c433ebcbfcba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009896, "uuid": "fc37294b-e64b-40ea-a1ea-e9857836bc60", "comment": "Malware payload (Mirai)", "value": "0ad79b3ed46507778bfb8cb56965d34af19c652c2e62e7015ee15ea862722b15d2ab61cf6cf6e32267fa65008b23080d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009896, "uuid": "97f4b272-bc42-41f5-a2ed-402d190cfe88", "value": "T10653BEB3C8192D58D65A41B4B0284E3A6B33F01452D76EF559EFC22650A3EECF50A3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009896, "uuid": "db017075-bc4d-4a39-96d1-f1a5fdaadcd6", "value": "1536:4/e/aU1ODyazF8vQEHfQ8P51c/kKe1Thb6+/CQI235:4W/z119vQEHfH4/LeH6IV35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632009896, "uuid": "8aa1df43-63cb-4366-a246-4df4efeb1691", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632009896, "uuid": "a6e5357b-560f-4fbd-8601-1df146bb9f73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009896, "uuid": "17c1e79e-b667-4d8f-879d-06dfa7f8e7b8", "value": "26038cd997f85c9710d8cd2541156b47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0544f598-1972-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632073804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073804, "uuid": "e4a7c28b-3b6d-4839-af66-d7b662a049dd", "comment": "Malware payload (Mirai)", "value": "48c70820dcaf4f228d1ef20e618d4420", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073804, "uuid": "2341a84c-2d61-4db5-92aa-3885d2cdf8d4", "comment": "Malware payload (Mirai)", "value": "41d657a249975e80066e0359154a6c8d0642e28d4efa14de4e8cfe0188054839", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073804, "uuid": "2e742235-032e-4452-9b04-6b1eb247f4ba", "comment": "Malware payload (Mirai)", "value": "0716e35208cbfb46a7525db703d034b6dbd1dbdc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073804, "uuid": "ce081b0b-167f-482e-9623-243a667a2553", "comment": "Malware payload (Mirai)", "value": "8af6d82b5a6b02ec140b0f228c324cdce50cf3ebacba68b021e0f29f0bcb8a8ec11b4c200ff72cd7c2aec31a4787c00e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073804, "uuid": "acd95f7b-3d5a-4559-afce-d1d5bb58405a", "value": "T161D2F1DABBD2B59FC004A077089A8D4CD5F86C711B9B4607AD9D314EED5B06D1375B0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073804, "uuid": "394ea2e5-09a4-45ff-bada-c5d8d5bffb35", "value": "768:MzW8IjJ/Z/Ti+/oFoGKG0wYLiCHtkx/oEIvYPmGVStWRSl:eWRNTi+/oy7FHsjOcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632073804, "uuid": "38e6ce87-8ba8-475c-b82a-8b9602d20864", "value": 30844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632073804, "uuid": "61ce8400-c459-4adf-96af-4a4a97fcb40b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073804, "uuid": "4a9ccb8c-23a0-4671-b229-59dd5f4e1c69", "value": "Rakitin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7383c2-1916-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632034710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034710, "uuid": "de977d6b-30ad-4a5e-9570-afcee3f8e068", "comment": "Malware payload", "value": "d5d4f07e59ffad621f322b68c12e411e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034710, "uuid": "0647d419-bd68-48c9-ae32-57c14a8e06ad", "comment": "Malware payload", "value": "42506f9e15ffdab6fce67556b602075ff779e2e84c6a40058a3941f0f71071b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034710, "uuid": "030b9722-60a3-40e1-9986-61da34ae03aa", "comment": "Malware payload", "value": "c29e234e8ecf6eeaa4b6f6fead0f69d14865805a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034710, "uuid": "88aefd0e-45ec-41ce-9746-b4879edc0d2a", "comment": "Malware payload", "value": "39f63d34c016e1bc04df960b08504defa5c4ed4d4b4f24c000580ab6bc2ce0d964fd4611e61ecce30a77740596d28441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034710, "uuid": "c258872b-b014-420b-a273-ae9715145b25", "value": "T16BD52339C159422BD37EA7F19D36809B9CB563D286C50E0DFC87F06982845BCE70F99A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034710, "uuid": "f54f4716-eef3-46bc-9726-93f2eee9d4b3", "value": "2a2a662be9dffc461398e7c94d0b55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034710, "uuid": "2ab859c7-f29c-4ddd-8d2a-b2b4667d60bb", "value": "49152:8qgCWU4cUagFjTlMnE1mrswa9dKsxGzVCRRU30ZLozGEXwacq3QTPXq+2:8qgzjrDFP+VrvaJx0C03xi+rgDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632034710, "uuid": "472a0287-afb5-405b-92ff-0b40f765d441", "value": 2812416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632034710, "uuid": "140a0c61-27bf-4a34-818f-3c3323b5fc2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034710, "uuid": "e1ec2ca0-fcca-481e-845d-f422937f4971", "value": "d5d4f07e59ffad621f322b68c12e411e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c939eb-1954-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632061007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061007, "uuid": "7839ef47-a8f7-4eda-992c-f7a3ae25f638", "comment": "Malware payload (AgentTesla)", "value": "828c0d6feac678b39e8ee9c713b55508", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061007, "uuid": "4a8f2e20-b3bc-43d9-9d7e-cc06bf448c3a", "comment": "Malware payload (AgentTesla)", "value": "42f238bcb0dc59e15acc6e7f9d1cae5658aa1fc250e609ed4b2735923ae6da74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061007, "uuid": "3857cddf-851a-496c-ad4c-fbf8fdffe5d0", "comment": "Malware payload (AgentTesla)", "value": "58cd8466eed165c2dac82283591a4c67afe6fb11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061007, "uuid": "96d140b1-6649-493d-b379-05b156ebe9ba", "comment": "Malware payload (AgentTesla)", "value": "3dbb0c75f75424e5bc88b0e0bd2a4c3cb502b91af795f606918cf58c9c4fab83194858d6f697dd552507f7885aeb96d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061007, "uuid": "41d9d1ff-575e-45a9-af9b-2b968683fc89", "value": "T1C065FB254D6696F7D3FFC36CE05C0B8EDBF5A483BB918F0E98918682469770BE98414C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061007, "uuid": "2c241b81-6e2b-4e6d-92a6-e015739a7204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061007, "uuid": "59407962-78c7-44b6-ab72-944bd4fb5cbc", "value": "12288:NSmW6WDsSa//amaWzwfEICvc8eGgBBr6/VoNaXGG1Rx11F:Mut/oWzwTomfaVSOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632061007, "uuid": "c1b9cb2f-60e9-433b-a4be-16185f21ed7c", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632061007, "uuid": "0d000af4-4e5b-44ca-9a1e-0c5b5fb367fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061007, "uuid": "ea52e3a8-e804-4265-96c8-a41fcaf1fe2d", "value": "PO_101209192021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a16166-1925-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632040973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040973, "uuid": "4bb073c7-5e6a-4e01-bd30-74b3438d47ee", "comment": "Malware payload (RaccoonStealer)", "value": "51b57dc594d37ff7961be2711379ad33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040973, "uuid": "08cee789-028b-4356-8400-1e152e67f2d1", "comment": "Malware payload (RaccoonStealer)", "value": "4536b4f09029d0abdc6d7b2fac07d6df06b6a7f3ba38e8f8de143ad3f24098a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040973, "uuid": "9d96ba29-38ca-4aa3-a0e7-839583363900", "comment": "Malware payload (RaccoonStealer)", "value": "8a1f138ac39cb3429369c2c74e245d50f98368fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040973, "uuid": "a96e1100-2cfd-4d09-9c2a-c56307cc5ee0", "comment": "Malware payload (RaccoonStealer)", "value": "008c065765758d7b238c36d1cb37cc546ef562ea10dad6e652819434ee06dc9e635fb382017aff43a6c8a980355c9282", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040973, "uuid": "6f2157d5-cc1b-45a0-90d0-7340ed325ddb", "value": "T12BB4E030A7E0C035F4F716F955B983A8A82E39B1AB3494CB52DA16FE26346E4DD30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040973, "uuid": "1be3086b-c33e-4307-aaf7-bd3d88d6638e", "value": "2b14341588588a7736588af3b9a80be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040973, "uuid": "4e072a17-0fa7-466f-a1dd-46c42421af4e", "value": "12288:5ZGbCJQJHzGR5KD0UsHYH0VQ0hsga78ItBC70tKL:5UbCJXnKD0UsHYSQnP+70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632040973, "uuid": "7962d955-f2aa-4d77-8577-e6e300a943f6", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632040973, "uuid": "283dd92d-b526-4479-8526-28f698f6b0c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040973, "uuid": "b18dbb35-891e-44c5-8d79-85ddcb0bbb20", "value": "51b57dc594d37ff7961be2711379ad33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdc335a-1968-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632069634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069634, "uuid": "58594029-e973-42ac-a313-37a872c5c437", "comment": "Malware payload (RemcosRAT)", "value": "886aedd70dfdbceda111d0e8b8ac2333", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069634, "uuid": "016ae684-db0b-4f73-89da-f20f796bd23d", "comment": "Malware payload (RemcosRAT)", "value": "453e07776e07268a23e0f90a6dde1e3bc9f55179a6bf55853e5d60fc25f85f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069634, "uuid": "66a505b3-a543-4b63-9e93-95e4b2b97da6", "comment": "Malware payload (RemcosRAT)", "value": "2945fb2b9aa25e48017eeb191c45c16c232fe027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069634, "uuid": "05ce9772-0a72-43d8-8c2f-62a831eb11e1", "comment": "Malware payload (RemcosRAT)", "value": "23a57d748af1df1ab3005059f2d4bab13f34417a1921219e580fd1f682a191d0f10cfa07d4456129181090760239d381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069634, "uuid": "78c1e6de-8d6c-4677-8203-99bcba36a708", "value": "T1FC753E254D6696F7D3FF872CD05C0B8EDBF5A483BBA18F0E988186C6065770BE98814D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069634, "uuid": "82cd2c05-d3cf-4299-8243-f97067ad0768", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069634, "uuid": "6faee859-df74-40b1-be9f-803323a3a6ad", "value": "12288:hSmW6WDsSUDrtC7uT/0k45PYv4VMQ99PMAVd5swuYDrD7UotpKVGIozKvESrb2Dj:gud9CaT/0k4l+4pz35sipKVmz+HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069634, "uuid": "320bc2bc-c9bb-4b35-b6b9-c82425704953", "value": 1630720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069634, "uuid": "a2cacbf0-8a67-42f1-9116-fd98afc242c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069634, "uuid": "378e8861-bcd9-455c-822f-162c49febb37", "value": "AW QUOTE 21505 HQ1-Scan-068703_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb1a80c-1913-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632033100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033100, "uuid": "14539d61-724e-401f-90b2-ebbafbf1ba7e", "comment": "Malware payload (ArkeiStealer)", "value": "5644b24a1f96f764095c9314d0106c7b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033100, "uuid": "b334ceee-9c74-48f4-aac8-92b77b0eda79", "comment": "Malware payload (ArkeiStealer)", "value": "461a8adf2ceed23fc21c2d8b0a45d9dd91d2d9f0af62b3f8850f8d2920d8b7f9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033100, "uuid": "b87f272c-3fa3-463d-9741-21bcd12f402c", "comment": "Malware payload (ArkeiStealer)", "value": "cd0e6d370edef78868f3b73854491afe251fc64b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033100, "uuid": "9eb89040-8c97-454d-af90-248b474adb03", "comment": "Malware payload (ArkeiStealer)", "value": "f88d8d3bdeb79e00377a8b79014819977dae785c2f221d65dc9ceb74f39573384e1ebbcf1a3d0ad6a2bc48e7c86027e3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033100, "uuid": "d8af13e1-efd0-4200-8473-2e200fa236c4", "value": "T153E40120B6A0C035F4FB52F919F993A8A83CBE70577451CF12E923EA5A346E4AD30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033100, "uuid": "aec6c96d-c1a8-4dff-a1f8-95541ac1ed79", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033100, "uuid": "2420bbd7-731c-470e-a9d1-d84500521344", "value": "12288:3ZAmYnntRMkj6QqfqZULlxNaYHG9GX5otLmNVC9/0+OEhXlYlQszx:3GmYJQdxNJm9OMLiE/0+OEh1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632033100, "uuid": "c97091ba-e73b-49ea-9ba6-9c38b0ecc2a0", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632033100, "uuid": "cee1c667-a458-4d97-9fb5-01ddd7dbff9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033100, "uuid": "ff1508e2-267b-49c8-8415-11732dba241e", "value": "5644b24a1f96f764095c9314d0106c7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86c4002-18dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632010163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010163, "uuid": "393d2fe5-4f9a-41c3-8303-0df498997744", "comment": "Malware payload (Mirai)", "value": "479a49d4aa1416b95722d3a24fc11b63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010163, "uuid": "4e710e81-220b-46b9-aff3-c513736bf5dc", "comment": "Malware payload (Mirai)", "value": "46291c0c5e66ac971e401b5d585a0cf59eea0e1929f53fa0d9f2186109fe4ddc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010163, "uuid": "3329ced3-6971-43e8-bc4c-9d976d648a11", "comment": "Malware payload (Mirai)", "value": "2f9af9e786e5252f3cdc74211234036ad9ee4958", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010163, "uuid": "3ede2e93-9a46-446e-9776-fb08c9ace4cc", "comment": "Malware payload (Mirai)", "value": "93f5f969e3b5811b31474b9a3f5ffdffefc3671ac33014f99da5730a940d53332732ea251b8b1d714288b18cfcdb3b78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010163, "uuid": "86790bc4-1245-45bd-aa2e-ca20a13385f0", "value": "T1A9130A8DA8012E2CEDE65DFD54636F499E516211A0E7070FD3AEFD833C33269AF06598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010163, "uuid": "e162093f-89bc-456f-9ec6-754967d7b272", "value": "768:lxpPtHthviqD21PeSCEMHton86xKhJuphEXqrA0sBQ0fQVTTw4mYNgOj0YmIqGln:PpBPvxD29wgA3Q0f0TMSNgxYmap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632010163, "uuid": "a3c7a3f9-8407-4d68-a653-a92e1f326d0b", "value": 45456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632010163, "uuid": "2b55a00d-29cf-40ba-a9d6-4cf07ec172cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010163, "uuid": "5e34891f-05f8-498f-a89c-1a722e026d88", "value": "479a49d4aa1416b95722d3a24fc11b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee018ad-195e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632065311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065311, "uuid": "4d638519-e79c-475e-b378-7ad0ed2b8d4d", "comment": "Malware payload (Mirai)", "value": "6a419289c5ff976f82a787b3ec4afe83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065311, "uuid": "0a8499fb-995b-4127-979e-baa1e8edf1c4", "comment": "Malware payload (Mirai)", "value": "469aaf9e093a866f5e4dd48077acc367da84086c02623f655762ebe4ce23f462", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065311, "uuid": "054fca40-d881-4742-a15d-27a9cde4eab3", "comment": "Malware payload (Mirai)", "value": "7bca044c5643c5ab5a1a076ed22adc068ee2aab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065311, "uuid": "9df3537b-c085-4e4c-a458-358f59bc5ab6", "comment": "Malware payload (Mirai)", "value": "a71d063d43d7463a7b673c42628e6728a36f13b5e523a9e6fbb5cfb4107827911e9f4742a7f4e53f3fc8ae289a88c11c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065311, "uuid": "ff4e93e4-cec3-4e79-9f8c-ca0543a84527", "value": "T17AD2E030A7053461C8A51C3EEBF9075617B730DAE98BB2705F4155349BE714463B8BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065311, "uuid": "9dafaecf-b2be-4909-ab4c-bc4b2b9e1caa", "value": "768:c9f4FKCpiH1QlKZ13b5iRW2qqZeJ8uUTDE6I72jyv73UF:c9fjCpsqlKn5ji5ASjyvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632065311, "uuid": "65cd7a0b-03cb-4456-b89b-bd907a4755b9", "value": 29920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632065311, "uuid": "95a4ff49-b9d8-4f62-9c0b-e7600c962a53", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065311, "uuid": "531b154f-7292-4349-bbc3-c6d061bf0e2d", "value": "r.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319e351c-1913-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632033076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033076, "uuid": "a053c10c-5a56-4845-845f-721ed105fb13", "comment": "Malware payload (RedLineStealer)", "value": "3f0ae1e3bfe4a7082e07344a1b2ae694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033076, "uuid": "dff56751-e50b-4582-a1d8-db221e9a1f43", "comment": "Malware payload (RedLineStealer)", "value": "46fa3d475c4f406890b4c26589c6c937c58813c2ee5a3782621e1b78288e35e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033076, "uuid": "6825bad8-c996-4f51-ae5f-3ddac26c49d1", "comment": "Malware payload (RedLineStealer)", "value": "727f85bd339fa0da213b14ee7fa5a2e68d8adfb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033076, "uuid": "8883378e-c5f6-41f8-a246-59bbcd6c42ab", "comment": "Malware payload (RedLineStealer)", "value": "3b0e6f3b3fa3a98e77d9d95a46c32007f08675d006eb37e6d80cb6f6ccd6719f194301f06ee4799ea3392782378bc515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033076, "uuid": "d7acc8d6-798b-4bee-b208-1c818b54c702", "value": "T156A4F0ABB2E101D4DAF242FAD9921702E77174722714A3DB677413B21B2B8C69F3D394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033076, "uuid": "383ec0ec-5fa4-429b-9452-78bc042a9757", "value": "f326f88ca83c9aacaa44acfb8884f1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033076, "uuid": "e70ab4a0-2559-4e4c-a23d-cc7a91ea44d6", "value": "12288:65oaqjp/9TlIwxt/oIYmJoJDHN+57aAK/AZ51L4nV1Gk/JGK:65v4DTlHxZjY1DHg7U45EnVV/IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632033076, "uuid": "641612b3-e844-467a-912b-1e3ca2f1e544", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632033076, "uuid": "e8bf63f6-5cab-4906-8f70-fb275eefabb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033076, "uuid": "4aa00770-c2b3-482e-8dd3-7cf2d6e063fd", "value": "3f0ae1e3bfe4a7082e07344a1b2ae694.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04604122-1972-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632073803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073803, "uuid": "631cdb49-fd23-4216-a3ad-eaab4ae76ac2", "comment": "Malware payload (Mirai)", "value": "dcfe8835e26c8de62aecb2d76c228f44", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073803, "uuid": "09ab603d-3bd7-4d23-b598-ad7ad0dd6e22", "comment": "Malware payload (Mirai)", "value": "479707d5e1b6b4b496ea651a86aae923323a647d3f76d3bd9c9f98f78a7e2bda", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073803, "uuid": "7349d8fc-1d05-4d3b-9cf3-438a8327347b", "comment": "Malware payload (Mirai)", "value": "bc586c481d95ac1195438e3f87f8a75994ed9776", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073803, "uuid": "79e46c3d-d35a-44ae-ba4e-62248e5d8c81", "comment": "Malware payload (Mirai)", "value": "3506477af62b6639f0e54d91a793b7c580abcd6ce8bc08840d9dc6c0d25050a2ea6bdb1f66cc0397218fc546ae0049a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073803, "uuid": "3049667a-95d8-4c3c-b1db-f3c5342bc2fe", "value": "T14743F1A4D662F9B1C8A00E3339B8ADC5DE560DB991FF2287276606DD08C2907D7B06F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073803, "uuid": "3fe01da8-9d62-4194-b15f-80d1420410b7", "value": "768:VdXkAhpfWn5/7Anor7st+pGdpSDOv0ttpMc0Mik2+gT5Xg1P9q3UEL9DWBoKtzRP:kAIEnU0+p+IDOv0ttJyd3L8tPTW+yq/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632073803, "uuid": "52e83323-abad-4db4-ba92-6c374f378a82", "value": 58144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632073803, "uuid": "c2a1753f-594b-4bbf-a39c-179509d43a5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073803, "uuid": "76bc277f-704d-4bb7-9216-e4e33787f813", "value": "Rakitin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388dd272-1937-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048550, "uuid": "8d8e88a9-8bf2-4ac6-95ef-c2aaf69c800d", "comment": "Malware payload (RemoteManipulator)", "value": "fa3559fda854ef25a46ac29063c8d43e", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048550, "uuid": "30a3dbbd-5ba6-4360-a834-9f9f3f0a608d", "comment": "Malware payload (RemoteManipulator)", "value": "48c19ad7436f3d311e9e63327801d0a2d6d25c0d7c7bbc3d2c6a32afb95a0187", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048550, "uuid": "cf05ab66-9813-4631-8e86-d1ba35a96fc3", "comment": "Malware payload (RemoteManipulator)", "value": "2cc7c71737c0378e941d4574e162dbca47f52e76", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048550, "uuid": "8a5dd079-1f4d-4ece-a00f-ebe6e4ae7fd4", "comment": "Malware payload (RemoteManipulator)", "value": "706d2b9585ec07d249efaa02d2343c4a7e59b4437f5293d9fc43186e05c56dc6ec9ac255743ea1d1d4cecf53e9f9feb6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048550, "uuid": "2c5db8bb-3a71-4dd2-bec5-7c82e2e87ec2", "value": "T10CF62327F284E43AD4E927790923A790C83FB7617927CCAA17F048C8DF358451B3A65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048550, "uuid": "3eb8c192-fb50-467d-a4e4-0c488e227e7c", "value": "c690b039bde324b6f88e949261e3a42a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048550, "uuid": "ed16a887-e464-47ef-8686-75b442eee553", "value": "393216:ChC0I4W5aFI/QsFZ6x+tNSb5MGsXWcSz53YgjYRzuOfwQDm8uOXt:ZV5J2UN5hXO3YRuOfbDHuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048550, "uuid": "3c992fad-fb4e-439a-becb-addc2d7bb40e", "value": 16762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048550, "uuid": "066438a5-d8f4-4930-aa94-97480ad69a46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048550, "uuid": "2aa0d39f-20a9-49a4-98fc-9c54accfed5d", "value": "48c19ad7436f3d311e9e63327801d0a2d6d25c0d7c7bbc3d2c6a32afb95a0187.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f2328b-1949-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632056402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056402, "uuid": "8fe621ed-810c-4519-890c-b558c072b66d", "comment": "Malware payload (Mirai)", "value": "db1da2b70aa6c66949ff7848b6860c6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056402, "uuid": "138bfd59-6642-470e-9fad-42f3469a49e6", "comment": "Malware payload (Mirai)", "value": "48c84f3aaabafaa15b6cd440b945b3eb08d81122c0ca76ceece7b64d89e50233", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056402, "uuid": "c2a09862-b324-4429-994b-b38ef44610df", "comment": "Malware payload (Mirai)", "value": "7161e6157a05bdcb6a44d84b1d53decd58c53e18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056402, "uuid": "6830fdc2-2f3f-42a3-851f-67ead5db83b2", "comment": "Malware payload (Mirai)", "value": "0af490be17c31aa8d4324b2a91c135a6ef5c646d5ae2cdd961d444463beb44f99519bbb22c0ada88181300f817273f49", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056402, "uuid": "fac539ae-2dad-4090-ab4b-3c21e4d3f662", "value": "T19A434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056402, "uuid": "faa08b71-10e2-41fd-a9c4-ad37d6ca6df4", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmccDj5gk9vWnTI4eBH+4sToQLDKFv:Yn/EsW5qhSh6amBlWnU4GH+dNLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632056402, "uuid": "e097a94a-4592-4dd9-bbaa-fc8a6b6d5fcb", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632056402, "uuid": "8287f8a7-6dc6-4a54-8b84-5c48bc0215aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056402, "uuid": "a3168d47-33bc-4af6-8bbb-d64fe6a63dcb", "value": "RpcSecurity.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56286423-1937-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048600, "uuid": "8c3a701b-e516-4cc2-8a01-cd557d8f2841", "comment": "Malware payload (RemoteManipulator)", "value": "7bfc811817cf16b079035897482a63a2", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048600, "uuid": "f9e5aa46-73a9-44fa-92e7-e8f4535e29fc", "comment": "Malware payload (RemoteManipulator)", "value": "49fbf9884299fbc6b09e640449fdc834f82a752908d381a68e2057a9861e3618", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048600, "uuid": "6690ca76-0aeb-4888-97e6-f2a1d887966c", "comment": "Malware payload (RemoteManipulator)", "value": "588edb3b76ae941403b0e81774713693c54a8fb4", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048600, "uuid": "926a8057-54a8-45ae-8537-e8c89a9dc3fa", "comment": "Malware payload (RemoteManipulator)", "value": "67c5acac5f0c26f798a3cfafe7484904392d51a5c6ffc0d01b8bf12cb0b6913e2553df65b00e9116eef4ee54497b35f2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048600, "uuid": "903ab73a-86e6-4bcb-a2b8-20e42a7b22a8", "value": "T13F0733C3E7F04819F8FF427289F64F0C5B3AECA95B65170D1AD4F225A4A38970866397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048600, "uuid": "b7ec5a2a-f09f-4e82-8a24-2f368d9384a6", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048600, "uuid": "e5cb8907-8916-4c6c-9f8d-0c7d600de9c9", "value": "393216:VwuopWl0rL60i1KALzLGscMsgxJHCCExd5Q:VwuGWlY6f1KePAMsiiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048600, "uuid": "51a4a1cc-19bc-451b-8a4f-09ce1930bba0", "value": 18245632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048600, "uuid": "98f8cd80-239f-49f8-b3e4-63524215a4bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048600, "uuid": "222b81a8-408f-4fdc-aeea-bb91fdecde60", "value": "49fbf9884299fbc6b09e640449fdc834f82a752908d381a68e2057a9861e3618.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b1d592-1900-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632025237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025237, "uuid": "806f1644-61af-4eec-8dec-567af35ac6c7", "comment": "Malware payload (RaccoonStealer)", "value": "40db010e422ec1c59c69bb09d3641bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025237, "uuid": "a22c80d1-a819-499f-99e4-fc98901b70df", "comment": "Malware payload (RaccoonStealer)", "value": "4c85f183c091968be8557537f44b8c96a6e350e383ed7aece8c73ed0607b3597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025237, "uuid": "01683ee4-5653-4199-a0e1-87c9109717f0", "comment": "Malware payload (RaccoonStealer)", "value": "c34d49eef9a3faea64845b8af3750fa1dd187712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025237, "uuid": "6c1de208-1b42-4e07-92ee-15b66f7c853b", "comment": "Malware payload (RaccoonStealer)", "value": "8bfe536edd22caef1fc1d423328716bb2bc5f17bd889ca9b02158a99b622cf80165dbb1eccd4ab97493888c9d90c4be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025237, "uuid": "a2e75b1e-c59a-474f-bd39-f114c8be8894", "value": "T187B4F120B7A0C036E5B702F855799379A53C7DB09B3451CB62DA2BFA16382E4DD703A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025237, "uuid": "16d1116d-fdb6-4b5c-964d-0805ce1edf65", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025237, "uuid": "d9716307-005f-44cb-8d39-43f4f72512e6", "value": "12288:1ZtMAGKdYDEOfhlkwLtMsaN6yXTrQRUK35eRC2Dtbv:1/MA4zow5f464TyUocw2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632025237, "uuid": "43483528-7cad-4f5d-8235-0d3186c1cdb6", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632025237, "uuid": "5d7d5fcd-ac82-4006-b1a4-08a0503df678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025237, "uuid": "deff4725-5cb0-4c69-a971-e175038aee6c", "value": "40db010e422ec1c59c69bb09d3641bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c0e76e-1910-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1632032114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032114, "uuid": "277fc0c6-e76a-462a-ac62-b0996007e0d8", "comment": "Malware payload (Stop)", "value": "d138604f0e9a81a12622bbccc1169024", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032114, "uuid": "a3a4499e-0869-434b-971f-0d6d94f2192b", "comment": "Malware payload (Stop)", "value": "4cc8bff20f9320c5ad0a543d3a7d97f05b4b6ad83de1dab439e25ec06671efbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032114, "uuid": "9ce7e9cc-e878-4576-8baa-4c545b86670b", "comment": "Malware payload (Stop)", "value": "12650e73c514e6022423e2e5fee9759486276def", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032114, "uuid": "2f62b976-146e-4be5-b83e-1ddcb3ff1a4c", "comment": "Malware payload (Stop)", "value": "ef4c8a8cf69b013a575c73975589d52656a7441f8982fe6584b2b1ecfa0b852fd274e5286e1a264c959f2653ae7a7e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032114, "uuid": "87dc31c5-2b76-4916-8555-74c74e56e0cc", "value": "T1E1F40220AB90C035E1B711F859B983A9A82D7E714B3051CBA2DA16FE67347F8DC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032114, "uuid": "2ae86556-63bd-4adb-a3d2-e40bb4e37611", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032114, "uuid": "2ea2af55-7cc0-41ee-932a-d349648d2834", "value": "12288:EZMczCXuUrhQMM30fAzKf/Kxh4jBH59FH25hFK1zAbvfD:EGcz50AOxHbFChFae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032114, "uuid": "51535c99-cac0-4d4c-9bae-36cff025a26b", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032114, "uuid": "d3603887-b9ef-4aef-a40f-d022b46d5b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032114, "uuid": "9c2622f6-7a22-4107-9cd6-3f660b9ff264", "value": "d138604f0e9a81a12622bbccc1169024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca382fe4-1988-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083584, "uuid": "e1811f17-c870-41bc-8900-046e32d74e1d", "comment": "Malware payload (Mirai)", "value": "8e646bb2f593195c9076aab6c621350b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083584, "uuid": "90dd5b7e-1884-45a9-bcaf-f49fa7498781", "comment": "Malware payload (Mirai)", "value": "4e7ed722e405d2237c2b8e578c374f3354f493d40b9cc6ac8ced96a606871632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083584, "uuid": "2d6c50e0-b1a2-4127-a907-196d85550b88", "comment": "Malware payload (Mirai)", "value": "444b29843c34261c8ee1b8ea6b4d677be8678d9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083584, "uuid": "7fa2eea2-0137-4f4b-8a9b-4ab410a2b4a8", "comment": "Malware payload (Mirai)", "value": "42f4f8ca0837d2c0a24fb516b8bf602f55e15cca0f8f1f4d11f0632a42b89f126f592f910d179a4bc85c145a98e0f6d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083584, "uuid": "3bff4918-6cda-492c-811e-7f9faf7d77a3", "value": "T194B2D0AD59FCE9AECEECECFCA0D60E546544A08C7358578D8762881C313466AF1CD0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083584, "uuid": "5f3e6d4c-b6aa-446a-b394-afcf01fdd008", "value": "384:SnPxNuRTN/gJ7nrL2T27MJS8XVdzxDqjT6d2GQok0+VxKA8dTes+zhRWGVCz0Nvk:SnPxNOenrL2TqMQ8XVdVY6d2G7k0wKr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083584, "uuid": "685365b0-7d00-4471-835d-39b508465148", "value": 24548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083584, "uuid": "fe0fd58f-b7fe-46bf-adc3-c68c95ebd232", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083584, "uuid": "470896ed-4b5e-4de5-be2f-5b85f3b92cb7", "value": "8e646bb2f593195c9076aab6c621350b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d049cb21-1976-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632075863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075863, "uuid": "983187c2-21ad-4ce7-b55f-9e37e487bcf4", "comment": "Malware payload (Mirai)", "value": "81e9763160c3d310038331320c6316dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075863, "uuid": "8cfb23ef-6f87-4e46-945f-21b925068ded", "comment": "Malware payload (Mirai)", "value": "4eeb1d34b87edd5cb9a3bdaeb3191b5f07e2aa9bb5b8e470b3f0556703395cea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075863, "uuid": "bc9221f1-1adf-48f9-b5cd-bf8ede48b524", "comment": "Malware payload (Mirai)", "value": "972a59cfef65785bf5059b2c3fac822c28645dd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075863, "uuid": "30f063a0-5d82-46ab-9b59-211fedb4d33c", "comment": "Malware payload (Mirai)", "value": "5542f82adfd2087203a44d1d69752365c51bb8a4a48f82784c1c9e522119832ebc8df5c8c7958654dd3f450b5e6b7273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075863, "uuid": "5c72904a-55be-49de-9ebe-1831fee3ebb5", "value": "T152636CA6F800DCBDF896D73B44230A057530B3600B921B37B766FD67BDB21A49466F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075863, "uuid": "23bdc2af-c86e-4d3b-bccd-2f45d3152ed2", "value": "1536:P/a9/jAbhdujEVpNQm8fbIJPimXFnr8bwLG2vhCQ:P/a97A9jbNQvm1n4uhCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632075863, "uuid": "9f7979a9-242a-4d6a-b622-04caffdb74cb", "value": 72964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632075863, "uuid": "36553f78-da37-4bad-aed0-b49149d32acf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075863, "uuid": "f4434e8a-9d81-4079-a7c1-93601d417aa3", "value": "81e9763160c3d310038331320c6316dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bb16bc-1938-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632049134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049134, "uuid": "d0e70ed1-b53c-418a-8554-e897776fdb0f", "comment": "Malware payload (Mirai)", "value": "bf0ec8a2accec938d91f7b1073a719e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049134, "uuid": "f6614276-d90a-4750-8c8b-8f23be8db6ee", "comment": "Malware payload (Mirai)", "value": "4ef285dd677d0d8c68d13217c500879974fc25e235c04d12e76db83888be9b72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049134, "uuid": "6eeb169c-7ef5-486e-baeb-7e5f1117279b", "comment": "Malware payload (Mirai)", "value": "d28a7d15816bba54747ce1aa1e9bf816f558069d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049134, "uuid": "7c1487b0-e942-47b3-a097-cfa2f5c9a566", "comment": "Malware payload (Mirai)", "value": "be569de2fef497641b2eb8f294dd314c653ef669f24a64d6eb47f2b77542af147010ade422ad00676b5a9a778a5a5c7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049134, "uuid": "3a5679d6-565e-49c8-896f-3f7332bb30b7", "value": "T176539FB7C4A89D98DE255578F21088399723E008A5A73DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049134, "uuid": "0cac8306-0a6c-4413-bb66-9f13ab37d8fd", "value": "1536:I/xN6GOJeaUV7Y3bQIf2sOqBqX4sUEfs3C+/sMDr3d3C0KQa:IJNsYjY3bQIgqBqXlf+/Lrt3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632049134, "uuid": "77a2cb41-be38-4af3-9578-8c9c77b9442c", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632049134, "uuid": "042303c8-5217-4647-8724-8d54f9b6ba03", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049134, "uuid": "5650f3a5-6845-4303-b9e6-8004f27520d9", "value": "bf0ec8a2accec938d91f7b1073a719e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "841ba70f-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632032785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032785, "uuid": "4bf79bf1-2c7d-4a2e-bbc7-a0bfa95ce8c0", "comment": "Malware payload (RedLineStealer)", "value": "69ecc02d4a9c6bd464f4ff6e5419ef67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032785, "uuid": "896e6beb-8789-42c3-ae96-4276577fc48f", "comment": "Malware payload (RedLineStealer)", "value": "50d3dfa972fb43c58c72d366db9066f59a7e0cbd62380a3447f8afe911ecdfef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032785, "uuid": "df5773aa-e0dd-4e19-93d4-ce59ac20c129", "comment": "Malware payload (RedLineStealer)", "value": "e6ef8135836f34556c8dcb08361c32853d5820fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032785, "uuid": "2619a9e4-34d5-4ec1-a25a-0a44aac5eb81", "comment": "Malware payload (RedLineStealer)", "value": "51918735dd461396d0f334d82711f48a5b5db1718e5ad5b01e7d10c9613477f098a3c09b1d6e0e3a956b45e1936c5f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032785, "uuid": "a65cb425-77b9-4aa1-86d0-e8ceaa5b1e79", "value": "T1B1D4F120BB90C035F0B712F554B993A8B92D7B719B3451CBA3DA56EE17382E89C31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032785, "uuid": "a0378b6f-0bcc-4d9c-914f-3a29b1706eac", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032785, "uuid": "7aeaf848-7eff-4263-b779-e1e77905e8c4", "value": "12288:nZq/5C8RF9z56i+SWhB4R9OEKNNpeJ/mEioLRS:nQ/5CRi7qBc9lKNNEnrLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032785, "uuid": "f208a61d-63e5-4b64-9db3-271099663b5b", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032785, "uuid": "fd9b0edf-6e1a-4189-9717-db5dbbdd83f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032785, "uuid": "27bdcf35-5f65-4fc2-907e-2522dafebe74", "value": "69ecc02d4a9c6bd464f4ff6e5419ef67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc254ae-195e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632065359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065359, "uuid": "292af1ed-2e9e-424f-9f06-eaa0cd6c1d32", "comment": "Malware payload (Mirai)", "value": "c4a2f9ee0237e572cf764dd197b52feb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065359, "uuid": "23a3c42a-b936-477c-a5bd-a38d0c435531", "comment": "Malware payload (Mirai)", "value": "50d61c90f648b6676ab7435e4d565f51c4bd20d1ff8ef2c7a80d9263ecc0a10b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065359, "uuid": "a7f7d2a1-d4e1-473f-8930-b57241546eb2", "comment": "Malware payload (Mirai)", "value": "000018910f4d75657e2288ec26a830321cc9401c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065359, "uuid": "5a1339c6-2733-4bb7-b534-0863597a1c61", "comment": "Malware payload (Mirai)", "value": "87478d09e1ddc4fe72838c4dfa06f1ce27437140140dac9ba3661f14d3e43a51df8edca6c11ef17c64acbd7489c9489f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065359, "uuid": "cd08c6e5-7e5a-4018-b443-385b1ce2b171", "value": "T11853AE31C41D5CD4CA6882B8A839CD391B63E106A6632DFB57868A64C08BFF8F55C7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065359, "uuid": "fb4f3fe2-9d32-4d99-9960-5b27c1c20229", "value": "1536:T8mpZCCwt6LEIRfhA2cQlHp0qRlCi7CwRL:YmeCDTTA2VBVlCi7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632065359, "uuid": "014d78ef-c144-4732-a8ef-04e68b9c7620", "value": 60652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632065359, "uuid": "af690353-0b55-4c4c-b877-0ea33bc1a525", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065359, "uuid": "9612a58f-5398-4e3d-a1db-d6c822bb8e3d", "value": "r.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1a9ddd-1963-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632067425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067425, "uuid": "dbd5a629-4f73-493d-bc44-4ae36c3c9935", "comment": "Malware payload (RedLineStealer)", "value": "371f93c04202cfa0b8252f31f5a2174f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067425, "uuid": "f4313149-58be-4793-9af2-096025b87efc", "comment": "Malware payload (RedLineStealer)", "value": "550c1883d2373b334bc8c47f3a63404a92789d8f5afafe95f2ed6b6a085b52a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067425, "uuid": "31c09361-98ca-4c48-a085-be3650e685cd", "comment": "Malware payload (RedLineStealer)", "value": "600126c6b9c5ed17f026d2609939ef55f2cd7ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632067425, "uuid": "da168726-4c6b-4353-b59e-6d39bd6713d9", "comment": "Malware payload (RedLineStealer)", "value": "bb54f2b9609f66918d36989077076b2e98ef851b85d242d79413fbd15b6edfbf74f328672c3c96490dc161d84cd57071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067425, "uuid": "91206208-4eee-4b37-88ab-18f1d1bd9473", "value": "T1EDF528D4361E6DCFC428C9BD9CE3E913869927FDF2348451E8E47832BA46CB514E6B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067425, "uuid": "39826874-0579-484d-a1c2-ed20b803422b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067425, "uuid": "1d7e1a7f-77b4-433f-a139-d10f2cd0ba8c", "value": "24576:7shmXZ3UhHyVq5Tc7b+9gGgKmVhsmmRGHYp0IMhL+ourvy8RKIt+KzVF076y+By+:SokUSzgTKmjHGkP7O/vimp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632067425, "uuid": "93d57b00-0529-4132-801e-3f98af138667", "value": 3369984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632067425, "uuid": "16cc9609-0a00-4790-ae81-f43453c83632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632067425, "uuid": "bcadc241-f925-4e7c-b57e-ed9ac52009f6", "value": "371f93c04202cfa0b8252f31f5a2174f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59399298-18f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632019399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632019399, "uuid": "e1bdeed9-7abd-4d92-97c0-b397db802623", "comment": "Malware payload (AgentTesla)", "value": "fb959caf58d3f08079fd3997bcc4c910", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632019399, "uuid": "4d3e1258-36ea-4b90-af64-b606bd4fc6ef", "comment": "Malware payload (AgentTesla)", "value": "566822f9c68123fc0b4a208cf222d4310d664e8a313df3461325517741dd2ba3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632019399, "uuid": "15bf3bc9-0530-4420-afb3-a58a6204050c", "comment": "Malware payload (AgentTesla)", "value": "601abb0e0cc4b29b2d3ee9d1fb7523be84c074d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632019399, "uuid": "420a83bf-7139-48d4-a0a6-c21c75b1a462", "comment": "Malware payload (AgentTesla)", "value": "e781899902ed7745de6eab00a1f4c6bdbaee0f08cc61e2850737e880baf97d81582544bb51b2dd74af15ca445936448c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632019399, "uuid": "8319bd6e-a693-4a19-8a15-7ae2005e54f1", "value": "T19645DE296D2292FFC7EBC578D48C0FDEEA61A4937B524F0AC09397D6864F60BD94805C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632019399, "uuid": "3a915d61-d4fa-40ff-b846-b09bd154605a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632019399, "uuid": "c8224b00-1ac6-4eb9-ab29-5af15998e04c", "value": "12288:RuD6aihPUNsUxvFCKRMJvypqimWmjnuCbdb+Nps36GNM1RqIzqoLQxXRD4Tw4lV9:RujihoJNdRK0v5es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632019399, "uuid": "a98a9631-f966-432e-aaae-1c8c43a0e6cb", "value": 1200640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632019399, "uuid": "0d23675c-3a6c-4ef5-937f-060c8a6ceb4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632019399, "uuid": "d7a4cd9e-3fc4-4ba3-b3a7-bc980b19a544", "value": "SecuriteInfo.com.Trojan.GenericKD.46991877.22497.2889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2594c095-1981-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632080301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632080301, "uuid": "0976cde7-0938-461a-bd4c-d3604518a8a5", "comment": "Malware payload", "value": "73491325fde5366b31c09da701d07dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632080301, "uuid": "d5ca9b9e-f8f8-47f6-a2ad-8ae182a926c5", "comment": "Malware payload", "value": "56a461a6cc8ad9c10cdc1d19a12d5deceb9ebefb0c871a3fc2eb83c466947a11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632080301, "uuid": "f3d12f31-f331-427d-ac46-24a4aadec0ac", "comment": "Malware payload", "value": "a4e1ada57e590c2df30fc26fad5f3ca57ad922b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632080301, "uuid": "94b2e366-856a-4b77-beac-68d4b7e90db8", "comment": "Malware payload", "value": "c171b76624be2faadc0c8a84e3dcb68e2b806c5ce826f5c6b082422f05007a9a0cb446ac64c5286146016058a8a05649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632080301, "uuid": "88d18c05-7249-429d-81fe-e083457232ff", "value": "T15F16332B27D810AACC4DD97030BDF32B3B1825BB1684546FC711BB9462753B69E4FB4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632080301, "uuid": "44fdb3c8-1ca6-4f9b-afc6-653eedddd95d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632080301, "uuid": "4adc0008-f731-4c8e-8019-dc9fcb1221a4", "value": "98304:yptnr0G0JYxx0zDo1bUGOrl1zfyl3zaW8+c:yLnr0L2xKObNAg5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632080301, "uuid": "bf5180ff-3aa0-4e9e-bbd7-76e1ff875c31", "value": 4214660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632080301, "uuid": "4c380b89-14ff-4f4d-9ca8-f83a608d6def", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632080301, "uuid": "463ff223-36bb-47ec-be01-82e3a3abf5ae", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3dc576-19a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632095346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095346, "uuid": "8abba588-3e1c-4c4f-894b-caa5d1c05b3d", "comment": "Malware payload (Mirai)", "value": "97b676df00c5977d2f555eb252cabefe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095346, "uuid": "4eca1bf6-96c0-45bc-8830-369f1465974d", "comment": "Malware payload (Mirai)", "value": "56ea1e30eaa0a7d69e6788b308277e4dabd62fa6ddaecec591042709bdf85320", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095346, "uuid": "158f3b28-a924-470d-9b8c-a107ea28b79d", "comment": "Malware payload (Mirai)", "value": "75d1278f5f0a3fda68aa5149718790cb38cd157e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095346, "uuid": "6dcfc585-e3f1-49e1-ac86-1d6f2f0f8383", "comment": "Malware payload (Mirai)", "value": "8cb2cb03ae162bee7782e35f6583457ee89617b0ee84554997322918146a15b7a9082c986148c7bf659722e9f6241db5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095346, "uuid": "43797f68-5c4e-49ab-be2a-1582fea0e4cd", "value": "T1F96401CBEB11BC2BD9400B7125DB0B5DB7B8DA8A82C7E181F3D4C55E3CAA285B7911C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095346, "uuid": "22679b75-d5dd-451e-90b5-08f7c1516815", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioEa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiIPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632095346, "uuid": "c4be6972-9702-4b6b-a992-d2f3d6a45ddb", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632095346, "uuid": "85ddde17-3479-4ef7-b9ce-09c57533dbaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095346, "uuid": "f7a63527-69ce-4248-9771-0148369ef00a", "value": "97b676df00c5977d2f555eb252cabefe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9163e2-1974-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632075053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075053, "uuid": "74dc5dc9-9cce-44cf-85d0-edbd693bbc11", "comment": "Malware payload (Mirai)", "value": "e064ed58c38da53e1ecb554df74bfbd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075053, "uuid": "f3cb5819-b73e-4c5d-bdc7-111a58c3edeb", "comment": "Malware payload (Mirai)", "value": "57fde6ea2026777ec985753ad0eb58ad34eab00e951e92e394e9dba1c0aa9a3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075053, "uuid": "3d4caea5-4e16-444d-82d1-d52d7b82d30b", "comment": "Malware payload (Mirai)", "value": "a4c377db74fab4634ecbfc0464115a65c7799976", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075053, "uuid": "da6ea4e7-6272-4772-813e-03529fda25f9", "comment": "Malware payload (Mirai)", "value": "c891abb1abe22d5b6eb81df58f7bd5499319703664f87b0b61a2d0163e1cfa4a454c17ab93037f4eb2a0730fa45581ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075053, "uuid": "61c76cc0-a9d3-4883-988b-e0e7671a6629", "value": "T172E2F2316B0CFA755FA82230FE2E8982612779E990A778330C582D747D45DD6337E60B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075053, "uuid": "2231158b-cbdb-49ff-a210-d133980e2fdf", "value": "768:XJyUNrrRa9IwsP29fB13CEjPlt9CTs3Uozy:ZyUNvRa+wB51S4bVzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632075053, "uuid": "87f823ab-2f52-464f-94a8-6047169ab1b4", "value": 32552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632075053, "uuid": "e8b665eb-b0db-433c-8ff9-37fd6343d21e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075053, "uuid": "8fc72df9-d810-4e26-ab5e-50d07b7e808a", "value": "e064ed58c38da53e1ecb554df74bfbd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b9dcde-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070099, "uuid": "0393fed8-f6dd-4720-ba68-7a13c5db87cb", "comment": "Malware payload (SnakeKeylogger)", "value": "e99fc76ca51170b034d64bea93130874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070099, "uuid": "eb6f23a1-77f2-4b00-8269-a9894bb823e5", "comment": "Malware payload (SnakeKeylogger)", "value": "599ed346c41bd6c8de85ce906bdf6b840f55383fa2fe25d272b30215c4331230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070099, "uuid": "ef234a25-5780-44c2-a83b-493bf4a287f8", "comment": "Malware payload (SnakeKeylogger)", "value": "70fb899f3a7da3722a470be18e3898730432e696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070099, "uuid": "af486a90-eee7-4d8f-9f82-e311b74b60e5", "comment": "Malware payload (SnakeKeylogger)", "value": "896875e809051bdc1a672a781b069b015f8fa94d25b65406201d08a07049b5b21e877d818d2b518bedfaac42bb964d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070099, "uuid": "7cc4a37a-8087-4152-a7ed-8f02508fd6f0", "value": "T13BB40761256E7E75C0786B3A477316E50BEEDC402A7ACF895B21F2BA103C6D77E42306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070099, "uuid": "58570d72-5430-4f21-be28-2c84a5929134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070099, "uuid": "c4edda29-7a38-4f6a-8016-0329ac37628e", "value": "6144:J4bujxIZJ9Oq+66IOwlnppPl4kYdTznyouSmSX7:JhlI9Sypp94kA6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070099, "uuid": "3ab2437f-ca68-46aa-9225-6d05fa77da1a", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070099, "uuid": "db7eefe8-6f3a-4dfb-b6a2-435d4a1a1d51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070099, "uuid": "389e1ac7-99a8-4d49-a3e9-1e4c5490a062", "value": "MONRAC E FATURA 15.09.2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c56cbac-1938-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632049147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049147, "uuid": "296c723e-5371-4bc4-9cf2-db777caf1e1e", "comment": "Malware payload (Mirai)", "value": "fa12522ad28a0680f45224d33b0deabd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049147, "uuid": "2f4197f9-b5fe-43e7-9c16-9f79346a1ce8", "comment": "Malware payload (Mirai)", "value": "5a28a1b2f62239ae93831a88d1c973b5b8eb5d083bf90762ceaf9719f7e1c59f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049147, "uuid": "ffd1d9be-9730-40de-923b-332e39303921", "comment": "Malware payload (Mirai)", "value": "d90b75276e55b1e31132eb56f9ca31b5823de6c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049147, "uuid": "5dc85e2f-484a-4fab-a957-b5b3bd11c16c", "comment": "Malware payload (Mirai)", "value": "aac4e8b8cacfea9b91790edb0fa1d959c06bb4040a43e3e8023ab7dbd1ed54aee5e7ff7c6ce17248cf4fb62e2ff300a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049147, "uuid": "6cf64e51-01d2-454b-98b0-c72f084e1e4e", "value": "T1A383754D3E619F7DFBAC823887B74B209249339626E1C584D15DEE021EB034E745FBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049147, "uuid": "2f59d7ef-2616-473f-8589-50677b49ef5c", "value": "1536:tR4urouZ1X56QtaDi0vRA4Q9OXwkpSCYrWNEv3zJW1/:Uuo405tQ98pSCYrWNE/Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632049147, "uuid": "3a74badb-c43b-406a-b050-365b90606658", "value": 87908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632049147, "uuid": "87d9a414-53aa-4032-afbc-47fbe0f221cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049147, "uuid": "32b8e26c-8038-4080-bc04-e750b75be141", "value": "fa12522ad28a0680f45224d33b0deabd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ffb235-1968-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632069910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069910, "uuid": "290463fd-7a66-4d35-95d9-96a8b2b1d278", "comment": "Malware payload (Formbook)", "value": "99ed5f72e5742e549a6ec78655fd3cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069910, "uuid": "99df80ab-7ee7-426c-88bf-6b1963c7cb22", "comment": "Malware payload (Formbook)", "value": "5c8f31380d956958134331ea55e63835fd16ca1f02f4c81672b69db70bc97ab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069910, "uuid": "f175abb7-3b88-4b51-8aff-313569530d34", "comment": "Malware payload (Formbook)", "value": "31a4f6fc81c45e49f4787cebe622256fa74d8a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069910, "uuid": "fff306d1-b973-4f3d-bb20-6f9b362476c1", "comment": "Malware payload (Formbook)", "value": "a594794d6c314926651a886be743a96a1dd10860747cdb3a9886b24fd9c365ce87dc0a32d68f986c94ee6de11eacddb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069910, "uuid": "173c8579-5b93-4906-9e80-c2a4e4bd0656", "value": "T120D49D86D1015D62F8364BF82031D97573A62DE66DF0AE9929D03EA33AF72835432D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069910, "uuid": "68aa34dd-6162-48d2-87e4-13c520f10081", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069910, "uuid": "d2a6461b-e3e0-48a4-bb1e-0259f81d822d", "value": "12288:l2t88/RRoH9Bh/PMkbL8YMZlSWTlvFlm8Jxct9VjW:lJ8bQv1L8YMyylpbc3VjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069910, "uuid": "c42bffee-54d8-467d-b6d3-8e9812457f91", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069910, "uuid": "d4a2e5cc-8d65-47a5-beb0-8dd92e44ee98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069910, "uuid": "ef0faddb-6f63-417f-8429-b0e01e84bec1", "value": "truck pictures.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f917d5a-1946-11ec-8fa1-42010a9c0011", "comment": "Malware payload (1ms0rryMiner)", "timestamp": 1632054950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054950, "uuid": "8a5c4abe-7d50-4152-ab83-9ec3e702b8e4", "comment": "Malware payload (1ms0rryMiner)", "value": "09ad810630e8251be546dffede1480f3", "object_relation": "md5", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054950, "uuid": "a8f8c31a-8df7-46d5-b543-4e3b8da76b09", "comment": "Malware payload (1ms0rryMiner)", "value": "5dcdd9b2e6f81b11f4e4d0cb96709286deac6c8a8385d473f17d599ee55c150f", "object_relation": "sha256", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054950, "uuid": "0359b89d-ffcf-4c2c-bd01-a6d74e526c1b", "comment": "Malware payload (1ms0rryMiner)", "value": "3e912255a14e30bc82a56d41ce3c3078bf0cd942", "object_relation": "sha1", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054950, "uuid": "0e18fd05-dc98-43eb-b245-951413a6fb24", "comment": "Malware payload (1ms0rryMiner)", "value": "81d7bd9ba52bf4a67aa0ae49125e659223bbe88431e6c816da95e7f4a59472f7feac51395fba54ec6984db9a59a6e998", "object_relation": "sha3-384", "Tag": [ { "name": "1ms0rryMiner", "colour": "#FEF34E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054950, "uuid": "c7568a16-8476-483f-bb16-165e59e578c8", "value": "T1F4349D20B7A0C039F1F712F819B993A8A93D7EB19B3051CB62D616EE26346E4DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054950, "uuid": "efda6ff7-0cb1-46e6-88e7-8a53fc0e35f1", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054950, "uuid": "68c63a79-51d5-45fc-a4b6-d1b9c9fc0906", "value": "6144:IEZQdLhb/V7MB76567iM255WTHiNK3Lrje3Zwlku:zZWb/V7MBmjM2rAHl3vsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632054950, "uuid": "40a2c9ea-632d-49e0-961b-71e992d75750", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632054950, "uuid": "40211ced-fa32-41d4-8061-c9c24a5a3305", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054950, "uuid": "9fffb93b-e24d-4ec2-b612-f9e221c037d3", "value": "09ad810630e8251be546dffede1480f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5a213d-19a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632095076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095076, "uuid": "90a4bcca-753e-4595-a6f8-33c4c6d1ed17", "comment": "Malware payload (Mirai)", "value": "1c568b53dc4eeaa749a55b06e3dcf681", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095076, "uuid": "76f5f16c-bfef-4d9e-af1a-d8d3038cc5fb", "comment": "Malware payload (Mirai)", "value": "5e23599192cd24fd0768f6539410fb42ccacf816b71e9878c1cdbb311e5f9a73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095076, "uuid": "25bf4236-ff83-47fc-a10d-8c30467e6768", "comment": "Malware payload (Mirai)", "value": "5ae1ef00143aff77c92cd58b7363ad3b04df0040", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095076, "uuid": "5471ea0d-06f0-41f7-93b7-3246ed11d5b7", "comment": "Malware payload (Mirai)", "value": "8b4e97e9d42f80b9976343a905cd059fdc6a1cd49821c04ecea0c2089bfc7bbef1b3fce6b43a7224597885d428734f34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095076, "uuid": "b5a141f9-3968-4185-ba2d-840129ceb0d4", "value": "T1F1231855BC929B66C2E0277BFA6E418C7310A3ECD2DB3253CC291BE4768552F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095076, "uuid": "76c367b0-834e-406c-b7d9-038ed70fb17a", "value": "768:wD6dZmaoGjgzGaywdZuMfHnD1NC8saEDoCerCFg+JcNbm4jNAPzI329uGpEX3TJ1:wkmaFEGarS8sxg+JcNS4jNIc329usy3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632095076, "uuid": "1fb138e0-328f-49f5-aa64-0e9a86f3c1b0", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632095076, "uuid": "f262fa30-f08e-4373-baae-293d97b8041b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095076, "uuid": "87d16936-7df5-48b4-85a5-80546f78f132", "value": "1c568b53dc4eeaa749a55b06e3dcf681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412ad6ea-18dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632009910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009910, "uuid": "115e3adb-30c3-40af-aad9-66067078135a", "comment": "Malware payload (Mirai)", "value": "da1fd47e9b4c1d266377e726761cfa06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009910, "uuid": "9c4b580b-a3a8-48ee-a49a-730719ae4df3", "comment": "Malware payload (Mirai)", "value": "6512472dbcae8f3341543ad8feca5aa23df3f9d99c1b20447ebe177f545a94cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009910, "uuid": "fcfde5d3-7347-4776-8fc5-470cd3e5bc7b", "comment": "Malware payload (Mirai)", "value": "88eab8a56c591b3544b1b3b3ca170e1cd556cfa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009910, "uuid": "46379161-68ff-40b6-8f99-4a5bca2fdc5e", "comment": "Malware payload (Mirai)", "value": "73353918336cd3e1a5547b5ae232ebf4b9825a3451b4c8ee36716b8b35b719e4e1347290754dc2263add3da13fcd0aca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009910, "uuid": "10c7f945-9da9-44ce-8442-bc63889136c4", "value": "T138E2E13D130A48E9DA70CAF425FD0B721B668EC876624C4A47CBC192DF65570F817F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009910, "uuid": "3b263f1a-0e9a-4852-8dc8-0106a5a36a48", "value": "768:ghuS4peGrP66kG2iVkNgYtnHIcsBMZzFJgGlzDpxYsK:ghcLroEcpBIcsBs/VrYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632009910, "uuid": "2662910a-c5bd-4bc2-9c63-0cc8bc9cf9e8", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632009910, "uuid": "059492aa-593d-4eb8-8701-42b673bfd0da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009910, "uuid": "48bcfd7d-d655-4d0a-a219-b483650d70c7", "value": "da1fd47e9b4c1d266377e726761cfa06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54602e41-199d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632092405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092405, "uuid": "93534382-580a-4f13-b124-2ef61642af44", "comment": "Malware payload (Mirai)", "value": "c73e464b7abc22413bce59c5c8190d08", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092405, "uuid": "1b9df099-35da-4e8c-ac62-f0ee5dbf5895", "comment": "Malware payload (Mirai)", "value": "661a7460f9821558ea3f5dd95b87079981b58e9cb3572461d58b54c535fef798", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092405, "uuid": "3c244417-c8ff-4384-9260-0bf28fbdc14c", "comment": "Malware payload (Mirai)", "value": "ad926e674950d71e73a9fc236c5c67e33125cff1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092405, "uuid": "2ff2411d-39b5-4e03-b51f-36056a98a9f0", "comment": "Malware payload (Mirai)", "value": "d3289b27ce6a5c943d7c71bc84b3bf7dd0f09e5c2a3f72313d1dedfb04b3898d91ab44c3c0cfd8c2d23938334f7352db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092405, "uuid": "9e0d6f20-0938-4fb8-a2df-b2dd9b1fc15e", "value": "T12F234AC19603DDF9DC2195752437AB368736F0F62029FAC7E39D9632D942B02BA4728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092405, "uuid": "e2e5639d-d1eb-4571-8f35-8e73fb870efb", "value": "1536:R4siMVoqpRt1+fj4btHOQdaYYZ5IwgJb4af:9VoyX1+fj4bBPM/ixbjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632092405, "uuid": "5841c3cd-bfcf-48a9-a590-a6b949683948", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632092405, "uuid": "6c8378b9-9a5e-48d7-972e-348bb34b8943", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092405, "uuid": "66fa0e4b-b864-4f8c-a73d-ab6c038f51fa", "value": "DEMONS.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ed1dfd-1906-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632027665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027665, "uuid": "c5b77f1f-b31c-40df-a21c-2c9e76754c1d", "comment": "Malware payload (RaccoonStealer)", "value": "8a1ad07b9a178cc9fb3d70b2900e37b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027665, "uuid": "8d899180-840e-4894-a275-ce85221802e9", "comment": "Malware payload (RaccoonStealer)", "value": "67e45a0c9c3de193a70eb90c5bef1464bbfa84ac7aec3ed0300b6283fd0d0ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027665, "uuid": "45479d3d-07bf-417c-9e20-7b3c5f03c2f0", "comment": "Malware payload (RaccoonStealer)", "value": "818584d924e552fc9a278ee16a92e6084bd221fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027665, "uuid": "28cc25f7-e818-40ed-af90-f2793be21628", "comment": "Malware payload (RaccoonStealer)", "value": "dc663a0457811671c60655125a65e0472fa0537387062ee90535751f61727af81f6cb940ea8185c3b76f982f3cfa3084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027665, "uuid": "ad29c750-bf08-41fc-b8fb-fcecc39fff4f", "value": "T147349E20BAA0C035E0B712F9597A93B8B83D7A709B3451CB62D616FE66357E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027665, "uuid": "9e878060-3f98-4bd7-96e2-f614e718342f", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027665, "uuid": "85aeb156-21ee-4dad-a202-b2477acf493f", "value": "3072:7eZQ1EH39hAK29LO4NzKPmlmfX/PaAK2MGzy7epUDnESPN57u60Ksbta66tyb8BX:7eZQ1G3fN20YOPmlmfX33MlZuBacQiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632027665, "uuid": "d6553ef6-fafe-4c2a-b06b-b7643ecaac0e", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632027665, "uuid": "9f5c925f-132d-4956-b726-18aa1b631e27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027665, "uuid": "4845b4bb-a899-4970-87ed-050361ec594c", "value": "8a1ad07b9a178cc9fb3d70b2900e37b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf47137d-197d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632078841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078841, "uuid": "011d259e-a1cc-4d35-9542-daf0f9f8aa00", "comment": "Malware payload", "value": "a25d4f96c5d327ec2c99c6a0b735c0a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078841, "uuid": "c0f4c87c-8c31-4bd3-8d9f-56940dac7686", "comment": "Malware payload", "value": "684de3aceb788bf2353a08a43e9743808b503013038455c07fa4a6bf9c9daabe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078841, "uuid": "acee3d4e-084c-4de3-96cf-d50ff65348fd", "comment": "Malware payload", "value": "17a02450b12ef7fc4c8a26a1ceb9654248dad0de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078841, "uuid": "f8995d56-2dc2-44bd-bcef-94c998915959", "comment": "Malware payload", "value": "f7f10fccc4565ed91ddabff5682d7e21a76bdb36e69c054fc46efee6ccf503a70ec0cb76ee618930205a9d2c915bdcd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078841, "uuid": "6704febe-e34c-4c08-b4ef-5bda12b4afe7", "value": "T17CA43628687FC01985E3EEA52EDCA8FBD99A55E3640C703701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078841, "uuid": "bbfb2c22-bb26-4324-b03d-ef7415c0f070", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078841, "uuid": "d04d1ccf-62e3-4c14-bac8-52d7ef2c75b4", "value": "12288:XklT97d3MN+ojhD/CgWKq7pxbWOBkaf88Zt3hicxi/C8vifHj1p:CajhGIGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632078841, "uuid": "8882e695-bbdf-409f-9d1a-b2a12880f79e", "value": 462208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632078841, "uuid": "ff824764-0d87-416c-832d-30379e3d8416", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078841, "uuid": "1745b868-9b81-4df8-afc3-d76f82247ba6", "value": "Perdun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f6edff-1970-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632073302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073302, "uuid": "0ec6485e-5a87-4002-bb9f-8b8e729a1468", "comment": "Malware payload", "value": "9d7619bfde8fae096e76e484f63d85ab", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073302, "uuid": "ec4225d6-1ac0-4afe-b50b-23753af5821d", "comment": "Malware payload", "value": "6a44f07ea1cb771954fa78f75a920d5c39d9f3d96c352de1e2c85da3c4392c6d", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073302, "uuid": "574d277a-0d91-4146-848a-0e79a5be797c", "comment": "Malware payload", "value": "080ee081dc3bc87c939a25d7d259cd27b2f50c0f", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073302, "uuid": "700849d9-e5e4-461f-82c4-a106017c04a3", "comment": "Malware payload", "value": "1a084a412a938c35aa0f14037d1b77c40ecf933d880b5508f13579ff7df985425ca7b78ea546f7ccf2f7078e2cd03fdf", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073302, "uuid": "dd7c7c6a-d17e-474f-ad13-c96eec753104", "value": "T146D1F478897CBCC0831C3280AA2D398510193D13CB7DEDACE5824A253D39E5BEF2539E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073302, "uuid": "cf738255-cc27-43f3-b93c-40f83c45180a", "value": "96:P04Yr+r5T6T/vXhDGR8jyhwjsFXhXUHMobrE3so74Sq3EdJIdcCtffzuEMPZh3Ne:8P+r5qvXhjyhwgXyHMCzSTaOC4Bhd1rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632073302, "uuid": "205cf7a5-792a-405e-a928-bd723f6641df", "value": 6668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632073302, "uuid": "8bf7c310-660c-4002-b32a-ff7c81d0ce27", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073302, "uuid": "f7a77a17-f50d-45aa-9419-77df78f3a9cf", "value": "Launcher.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132b2925-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632032596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032596, "uuid": "8797aa60-8881-42fb-8d0a-acd89dd236fa", "comment": "Malware payload (RedLineStealer)", "value": "d6d1b2a908378b4d104e9db304d67203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032596, "uuid": "c9ff25c8-467a-4173-b188-d8f5045faa91", "comment": "Malware payload (RedLineStealer)", "value": "6a498d84dd0cba5d8e272cbc5cb10382e7fd0da648a345e92c26414ceb5d3dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032596, "uuid": "a0d9594e-24f1-4860-acda-6b699817cce4", "comment": "Malware payload (RedLineStealer)", "value": "1144d5904f795993de335c45684df5c0a812460b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032596, "uuid": "2b7b4ae9-2e44-447a-9e14-f07df576f926", "comment": "Malware payload (RedLineStealer)", "value": "1e525f66ec04ae521d93d86346338b174070c0a96716ab1922ca849278008f56cb9a5a86309d4f9b5eb96ee95332d782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032596, "uuid": "0c22b601-c19e-477d-9dc0-4d076062031d", "value": "T117E5120E1066B3AECDB0333B9E3ADF11D7F45D298566416D39C0BA37E6B5E82427C606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032596, "uuid": "7bc7d753-fa74-427a-b7ef-95c7342c2a32", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032596, "uuid": "0dcdefcf-7f37-400a-b5e7-4968305760ce", "value": "49152:ZxBt+n3sc03YZ7afGhCrgNgvgRkJthP85bTf6foW2ASoWcX01K+e6iQTPsJV:b+n337AECENXathPAiJ2AX0s+niQDmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032596, "uuid": "0df603c6-8d81-410d-9fc1-a776c9424baf", "value": 3176387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032596, "uuid": "68960375-3772-42eb-91aa-eee6fa6b34c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032596, "uuid": "d82ef9de-b4a5-438e-b0d1-af4cab68e8a9", "value": "d6d1b2a908378b4d104e9db304d67203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec2d5ff-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632063807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063807, "uuid": "2f13c897-3eef-46db-b624-0812c812b24d", "comment": "Malware payload (CobaltStrike)", "value": "4aee4823df6c0401ed36868aa037d96e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063807, "uuid": "c5c690b4-6e55-4fe1-8c52-44ecc8ccffa3", "comment": "Malware payload (CobaltStrike)", "value": "6be74e57f4991546966aac8ea471e995755de31edda01e9382231052710d50a6", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063807, "uuid": "a1b7d680-17ae-4724-83dd-114ef57f603e", "comment": "Malware payload (CobaltStrike)", "value": "62b0fcca4c63ec80d0d1ce6fae6e2fb5d738c631", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063807, "uuid": "5dc4fd95-a7d4-4431-8764-16d5dbd95758", "comment": "Malware payload (CobaltStrike)", "value": "8e0706da00b20daa5f854d9220a97ca4501413bdc0459257c11d98347f721bc25d3081baa9d4fc64e741d61714816941", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063807, "uuid": "28d9e4a7-7a07-4b26-9992-88e8535f7ac8", "value": "T13D24D0F1C7CA7D79F9360CBB960E397E6E13DA93A1A7C98C84865D41283E1B77012748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063807, "uuid": "e0420399-e270-4c44-8016-04e1b11acb1c", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063807, "uuid": "7ba6d24d-1f35-4daa-b4f1-a9ded0f11733", "value": "3072:HnDma9lRLVXBT2DLcFywar0NXmwOrXbgB9nMWZFbaiA8krMpOSv:jmcR78IFer0N6bgBFMyFbE4tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063807, "uuid": "0d28431b-525e-4d43-8957-78a587c48040", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063807, "uuid": "a181b07b-208a-43d1-ac31-782c58632452", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063807, "uuid": "41619265-b7c8-4359-abb0-54cfaa1a8623", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc69a29a-1966-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632069011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069011, "uuid": "01b4ae35-08f5-4041-b84b-b38678426528", "comment": "Malware payload (Mirai)", "value": "73e6f66d446897f0012067474c31664e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069011, "uuid": "0f65f0b6-7029-40fb-88b2-1e9215795f90", "comment": "Malware payload (Mirai)", "value": "6c2487d273538cd1b150eabd11c6fc6ad9cab7fa7d416575659b63a2f9f0399a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069011, "uuid": "c6e7650b-d510-40e6-bd90-cd1bb0c81d61", "comment": "Malware payload (Mirai)", "value": "e6f4dc93ed1ac19ef051739e8ab8a2105d2b1526", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069011, "uuid": "9331ffbe-2be6-4811-8986-c60f77a14901", "comment": "Malware payload (Mirai)", "value": "0a498780daef503d70f868c96eb57f5b8cc6ae3f1705fc64a940584c19e6158870d003dbfbe105f57dea1d7e5af625d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069011, "uuid": "c1eecd6e-e737-4e34-bdf8-240df8b2345b", "value": "T17683C60E6E659F7CFBAD863447B78E21924C33E627D1C580E15CEA011E7024E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069011, "uuid": "6a9bbb45-e4fe-4490-a04d-0ab5f6494c3c", "value": "1536:hX9nbLi2GRXuFwWAINGFAHjR0Lg5tqwQZl/8JcK9xlaf51bMlE7jJbtg85q1RbQ:hNnbLGWAIMO0Lg5tqwQLKLK51bMlQEYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069011, "uuid": "c106083e-7bb5-41b8-a42b-21dce6cef8ea", "value": 87976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069011, "uuid": "8edbcd74-d07f-48d3-95ca-d3dc1570d5df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069011, "uuid": "d4c0dc33-d599-4551-b2a5-64bab5cf06f0", "value": "73e6f66d446897f0012067474c31664e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2c14fa-1936-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048210, "uuid": "1bfc3ba3-5eed-40a0-be6b-7cfc8fce4b7f", "comment": "Malware payload (RemoteManipulator)", "value": "dd8b9e9cb89eccf995d98d58657ea3f0", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048210, "uuid": "9afe0a77-710b-4795-83b8-aff3468bd355", "comment": "Malware payload (RemoteManipulator)", "value": "6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048210, "uuid": "8bfc61ea-d73d-477d-a320-0abc3a1e551a", "comment": "Malware payload (RemoteManipulator)", "value": "4531307bfb9ee6df43255fcadac34d2ce87d5920", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048210, "uuid": "ad375397-cf1e-42c7-a520-d7403709aa38", "comment": "Malware payload (RemoteManipulator)", "value": "b70884f88db7909a131e31cba6c7b3f72fc7700a25cb70cf97746163de6145ca66f885af10e7fa87f192cad05305dffe", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048210, "uuid": "75841b97-b5d0-48cb-b293-8891db1cd550", "value": "T1B5A633E66FCE4AB6D70350717DFB5B130C5A557C82B0284EEB82197B3960707EB2631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048210, "uuid": "141a4cbe-793b-42c8-827f-e421317a67b2", "value": "3c98c11017e670673be70ad841ea9c37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048210, "uuid": "66728791-6888-45ac-b91e-ddab130dbd7a", "value": "196608:x15JnxPfIdUMZDRxWnwwpD0ZCt8wwW8m85VL37nKbdDT3zfdt2:x1t3IFvWwwJ0ZCt8wwW8m87TszO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048210, "uuid": "80bb2b0c-bfa2-4b33-acac-1a596d6264c0", "value": 10158210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048210, "uuid": "bd6c84ff-a5a3-4f62-94c7-7ceb8aaabad1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048210, "uuid": "73434bc7-d54c-48f6-b5c0-36f34f51482b", "value": "6d1480cd5b10739af130850f9d9bfa7ebe50024c5db68dd231bc7e4bd560ffa6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a061c3a-1965-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632068363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068363, "uuid": "576f7509-91df-4544-9212-6f1ed9b8c07b", "comment": "Malware payload", "value": "7b4fe1ddc6591fde3e6766f3a94199e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068363, "uuid": "f9c3eb42-fac6-4f75-9455-3bdb9e2ab752", "comment": "Malware payload", "value": "6ed53ae2a5a8c6bb09e905f0dec2bde4241bfac936dc0f73aa3903de9d621dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068363, "uuid": "ee835467-7cb1-47a6-b42b-e62fcf8bf665", "comment": "Malware payload", "value": "192f8a115ee96dd83a72d8084059821e03f8bb6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068363, "uuid": "9349edee-a188-4974-a779-f73da4278cd9", "comment": "Malware payload", "value": "9fe88d61889a5a919f2070548a09632c9d9629c1935b2a6152fa82d31e235126bd070524cb67e1c1925b58304d1ac843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068363, "uuid": "12f03d23-b0f1-4dd5-954a-94091f60f602", "value": "T1E8E45D2AE082D473C2635A7A9D17652CFC567B902F2C495BE7DC7C3C9FB8502340B6A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068363, "uuid": "eabe2b59-a63a-414d-a2c8-a9d6b29a4e99", "value": "84d5173d5d26cfc4667a04380d7e0b47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068363, "uuid": "f7e75cde-18ec-41f3-be9e-23c0377c3e0a", "value": "12288:TSwAOcXhqsThT3P5HxB48dDyfP2+emkWgDeC:TSJfLThT/VpyX2+eIgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632068363, "uuid": "59f932a3-56f0-456b-ba87-9b774e232c75", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632068363, "uuid": "78af04b0-ff62-4fd1-8145-15a56f1384e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068363, "uuid": "76b1efb5-6242-4034-8775-f0a18f96201a", "value": "Xeudvhnnkcvhtbxbvvgixvyicvemctggzw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e6f26b-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632032756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032756, "uuid": "bad0c33f-a09c-4380-8046-9bad46700da2", "comment": "Malware payload (ArkeiStealer)", "value": "14b877b2fdf45f98a4da788b0136bcdf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032756, "uuid": "4c5d4a48-bd09-4194-b392-542bdcce3155", "comment": "Malware payload (ArkeiStealer)", "value": "7099e303fa24b50d098e9f7c435eb175e0cec28d9a3caa2db60c3a3e8e8c1d47", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032756, "uuid": "1c528b18-089e-4e07-a486-44204713e3cd", "comment": "Malware payload (ArkeiStealer)", "value": "cf42bc6d709480a3a5b28e85b286351584e17606", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032756, "uuid": "ffc01ab1-723f-4ccc-9170-73640e461dad", "comment": "Malware payload (ArkeiStealer)", "value": "390edb7375ec3f99960755aaa8aacda15c2f542ab3a6b0b9521353dcbbfa757568e83b2f5952931603438f39bf75361e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032756, "uuid": "36d5bc71-03cf-4080-90dc-3123c52eab0f", "value": "T13B95B023B2938433C67F2678BD3752689825BE112A38648A2FE51EDC5FF46413B351DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032756, "uuid": "a659d9c7-4ec6-4eaa-b766-8893a7f482c0", "value": "ec88d30de283c50d44daff3be84036bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032756, "uuid": "718df337-a597-414d-9da3-33c3b380d629", "value": "49152:k7IMK8HmWcdS8luYj6zT9SrajsO1CsSGGKE:k7IMK8GtS8YzzQrjsS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032756, "uuid": "1030d17b-f973-44b8-a5ce-8c27e5082929", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032756, "uuid": "a496704a-8b31-4e9c-ad8e-dc8a31b3ddf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032756, "uuid": "43adc6f1-f126-494b-b90f-1ddb110c7c69", "value": "14b877b2fdf45f98a4da788b0136bcdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2887fc7-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070203, "uuid": "06c6eeb9-520f-4968-91c3-2303401c4f21", "comment": "Malware payload (SnakeKeylogger)", "value": "8471bef3cbbfa2be4c9bcbd2f72b5517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070203, "uuid": "934b75f6-f125-43b6-b289-fb321ff30bf2", "comment": "Malware payload (SnakeKeylogger)", "value": "718a5e0237a666db1f1d33a2147f9b4a96a909a7b0a7301227c37305adfa6be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070203, "uuid": "23fa396d-6f39-4300-8db9-7aa6985bb4eb", "comment": "Malware payload (SnakeKeylogger)", "value": "f6af62ae163461712a372bda8f224ae62f2ac770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070203, "uuid": "4b61dc59-ca35-4623-96f4-38d5b296faaa", "comment": "Malware payload (SnakeKeylogger)", "value": "c7ae0c0b50c42819461d9c722c0b2439fce19b7f98b4069319e899ce4b2f183d23a2ce1463576371d96712719783a26d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070203, "uuid": "da7a34ba-7eca-4c49-97ad-91d0fcf2b404", "value": "T109D4C0383AEA9029F1776FB96AD075859BBAFD337603D15A0050338A4A73741CD9263F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070203, "uuid": "dc8882fd-361c-43c4-bd6b-0e37b9fe3f79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070203, "uuid": "67cd41a7-5db1-4c92-b2e9-cd344cbddea7", "value": "12288:mmfWHCM2K4CsI/yzQs2TaIpIhtP6QMiRGVGWDO7Tf+5+I:mmN3C5MIpITMiK67Tfs+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070203, "uuid": "ffa865d6-dc94-48dd-b64d-18a8c27efc0c", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070203, "uuid": "5be38548-2acb-4b3a-87dd-bf8a70503f23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070203, "uuid": "8e4f6533-2451-4a10-baa9-44e223001291", "value": "Performa Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26120be1-18ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1632017166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017166, "uuid": "3983abcc-9928-4393-98aa-948f43cefbf8", "comment": "Malware payload (Adware.Neoreklami)", "value": "76de0d09a84367c7697576b041deddf7", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017166, "uuid": "520c7015-31a3-4346-bd39-a37375e02505", "comment": "Malware payload (Adware.Neoreklami)", "value": "72339997aa5cf9d313e2c7a44b8649d343a057cd45a6b190036bbed489cd828a", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017166, "uuid": "6626f678-57d0-446c-8781-8a848c26c9dc", "comment": "Malware payload (Adware.Neoreklami)", "value": "4f530146b83fd00178f018dbaca030d84c676b5c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017166, "uuid": "f3a995cf-caef-407d-8166-880d7a81660b", "comment": "Malware payload (Adware.Neoreklami)", "value": "2467e623898b3e327f2887a6859921bc5c4463416dad4a1e0092d3364c259b78c409aa7deac83bf0f816bba233842b27", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017166, "uuid": "0a2ba7a9-9ba8-4f04-81d7-e9c63e7b9b26", "value": "T199F53321A2B3D19FE5076639781BDBA31F20AF401341AEBD7F6189999908C2FBDDC315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017166, "uuid": "a4038cb9-7075-4734-bdd9-deb3f4bfa5a3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017166, "uuid": "adbdc0d3-427e-42c9-a387-64973333d145", "value": "49152:EgMFJEQwInninyzpoVIWrcMeKkR3qdqGq2R1O4xHW4XsYoXOq0ddCZDY2EENQh7/:JMbiy18QMnkR6gGZOfYojY2EYttra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632017166, "uuid": "fae5817e-6bd6-4330-b961-96827fbfe313", "value": 3448305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632017166, "uuid": "7118e81a-f2f1-4c11-809a-6ba138466156", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017166, "uuid": "841c464b-b2af-4a5d-9867-9e99502c7cd9", "value": "72339997AA5CF9D313E2C7A44B8649D343A057CD45A6B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a59c831-1906-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632027669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027669, "uuid": "2f2a75d2-cb3d-4e3f-b41c-e2e6d25da20c", "comment": "Malware payload (RaccoonStealer)", "value": "48f4e1e5ce1b3b57074c2754167e6d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027669, "uuid": "7a1b97d6-9e60-4f10-a489-e7bec53c8959", "comment": "Malware payload (RaccoonStealer)", "value": "74432e1c870d77c7d540698ff9de6ce84c8773d67703b0aeed4aba390a599fea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027669, "uuid": "85a4f749-c22b-48a7-a365-e953727bc86e", "comment": "Malware payload (RaccoonStealer)", "value": "1bceb496fc70361eaca8babd3b5ed84e01bbda3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027669, "uuid": "6a9c6a12-2c49-476a-b9c6-c3dc3e7a4eec", "comment": "Malware payload (RaccoonStealer)", "value": "6963e0c9f051d905695d1cd0665ba5d3312acdc0dc8403226b858df7e51f2c997ae1c4732d50d16fc19d33990d161a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027669, "uuid": "4b6f1b03-b03d-48e8-8947-6830b993af40", "value": "T1A4349E20A690C035E0B712F859B993BCA93D7AB19B3490CB62DA1AFE17356F4DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027669, "uuid": "150b4815-e72d-458c-90b5-a4cb134adc2f", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027669, "uuid": "191f8821-3a54-4ee8-9416-3bbdad2f1fc8", "value": "6144:GXZQ73ufN6/2R9rkf52D23NCfaxZQ1BDCTbPk7Coid:WZ42jkf5Tcm2BuTbJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632027669, "uuid": "be9074cd-1567-473c-93f4-fc7153f1cdf6", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632027669, "uuid": "bdaffb0f-36b1-4b81-9637-e754008497e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027669, "uuid": "3aeff56f-24b2-4b41-84da-fb152e155a56", "value": "48f4e1e5ce1b3b57074c2754167e6d5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e62be26-1974-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632074866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632074866, "uuid": "eeceeeb0-1c10-41f5-9f73-65b589b9fff8", "comment": "Malware payload", "value": "7c82b7b97df1d9785f87f4b5365d3ec2", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632074866, "uuid": "a538ce33-74b6-49bd-9a15-cb61e9cc46c6", "comment": "Malware payload", "value": "7508382b8a2c8a2e59f93407e4c1f3d06c743ad963f277c724062f52dca98f6f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632074866, "uuid": "b9496675-872b-4efc-9497-d16686804f4e", "comment": "Malware payload", "value": "c9ca2c15dae4d104228f71edc585c431c76b6786", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632074866, "uuid": "fe192989-ae3b-4cf4-99ac-8cedd7dbc66a", "comment": "Malware payload", "value": "33fc3e984116261a08c8dece8868d712a174b0c47bef2bde417432a803656bd73b7e99194a715691b4d6b9ca1fb86710", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632074866, "uuid": "87ff1ade-03f5-4798-9d25-21da12dfe5c0", "value": "T130E208B2CEBA9093F35708E3EDE9BB4BA32D3A4A5D1F652FB9D02440477D59D2043429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632074866, "uuid": "578ade96-c897-47ac-a5ee-614ec2c59394", "value": "768:wkVpFBK2YDoM832NYCORBwCBARRlsSTjgeaFBwdMq19o3Tl1Cmjw/sYR8mHhAAY8:tFBKPDlarBrSnaFB3q1O3Tl1ZjwtRRHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632074866, "uuid": "8aa66e88-a78b-465c-8920-e1fe46ea2a7d", "value": 33680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632074866, "uuid": "5f94b794-1d3e-4d58-8769-a686391cffc7", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632074866, "uuid": "07d2c516-f6ef-4be9-99ca-bdd1c92df9cd", "value": "fnbs.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812e1b1a-196a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632070576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070576, "uuid": "d42a6087-d04d-4e62-b0ea-91282b1bceb3", "comment": "Malware payload (RemcosRAT)", "value": "e0ed0465c53b75d188055fdf60d7e8dc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070576, "uuid": "4da1c6e9-4dca-4fad-9917-5b8a4890cb56", "comment": "Malware payload (RemcosRAT)", "value": "75c06233ff17c7f3d32c030c71b62ec25f340c565a50d6e5bcca57ffbcb04e97", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070576, "uuid": "d1071327-3833-4aaa-9ade-a96a2a2b001a", "comment": "Malware payload (RemcosRAT)", "value": "e998425a552083a80acce00fb9ffa66be6ef52fb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070576, "uuid": "d540f904-f887-496b-84b4-25b85ec3f3a0", "comment": "Malware payload (RemcosRAT)", "value": "2693c3f2d3bc3eee6a649ed3475c20fab2b14d54f9cb0ee729a44b8185c9a725be8dff3434e8a42373a3ce5b4342171a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070576, "uuid": "191af9c9-9992-4704-b001-394bb76d1e66", "value": "T148656B66E7C29CF6F43615388CDABA94152EBCF139D55C4A2D943E046B38392393E18F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070576, "uuid": "c0da09e4-c5c4-44e9-8373-67e5f7e6ac02", "value": "12288:smnGyuE9fz9VBCY4Alz2MjbjBQHhazE2Sdvnk6LHC7WWnMvwfHVBPggseBnDz5ZE:smnZbz9e0z12HnBngseBDz5ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070576, "uuid": "1ca597b6-08d6-4c75-8fcb-fbed93e11927", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070576, "uuid": "920326c0-bd8a-44d1-a272-f5d94eeb5dd2", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070576, "uuid": "3da1e20d-db37-4c36-bbc0-86144b9f8050", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af3c1d3-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070163, "uuid": "cf07deb7-0bff-47db-8811-02d577434bbb", "comment": "Malware payload (SnakeKeylogger)", "value": "1d8fc153356e79e8c46fe1599c2e6f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070163, "uuid": "66728ffe-2842-4f1c-99de-11af4adfa435", "comment": "Malware payload (SnakeKeylogger)", "value": "76027f253ef7f7754a5813d939e23abaf53fe4bc4478d3f80bd09eada7419a49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070163, "uuid": "bb8a494d-0825-49b8-b43b-ff0ea3243955", "comment": "Malware payload (SnakeKeylogger)", "value": "f734e3767cf4d29ea9cc201fefa2d6c1fb56d9f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070163, "uuid": "d2e1a969-0ca2-4476-95f8-06e7e38e1dda", "comment": "Malware payload (SnakeKeylogger)", "value": "bd9fef0e3f3e8d06b99a3abab572e25b0bb6d829837584ef08a276647e5d889e2539e483d2135258c1688a5e3816a384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070163, "uuid": "c944f7b5-dde4-4425-9e43-af08eca75a60", "value": "T110949C242DFA5029F173AFB99ED4B4968AAFB7733607E85D284103870723F41DE9153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070163, "uuid": "0cd689ff-dd8a-4a22-a9be-4c661223bbb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070163, "uuid": "c87ea38f-0744-42c1-8575-ffc75fe4188d", "value": "12288:HWk4DbF53e0IUFLC+Br8P+wtxXNWK5sAVotfgKCj:IMxXEKiIKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070163, "uuid": "56130da3-d661-4b39-adc3-e3b8b145a65c", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070163, "uuid": "10298268-98d9-4ed3-92fc-cd0fe0e82e19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070163, "uuid": "b9651bab-7a5c-471a-90bf-78604d52a660", "value": "1d8fc153356e79e8c46fe1599c2e6f55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372ba5c9-19a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632094504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094504, "uuid": "2b094958-96f7-43f7-8659-33785eabd8ab", "comment": "Malware payload (RedLineStealer)", "value": "25a8a6d43b051bae808c0a5a4efa4f27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094504, "uuid": "4ca802f1-4451-4ec2-bd4d-02b7bc19b7fb", "comment": "Malware payload (RedLineStealer)", "value": "767af8e249f31cbc452b15460226638cf5e4e3c6f6071cc8ae9781ca65c32b77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094504, "uuid": "5ba0e85a-88b6-4748-9ff1-cb08866e7a01", "comment": "Malware payload (RedLineStealer)", "value": "7cc3661f7f6fc08682c5c368362b939a4e2ac435", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094504, "uuid": "577c4b65-79cc-4afd-a977-1c8ab8d1eda3", "comment": "Malware payload (RedLineStealer)", "value": "fda5b05e95502d57dc3b46fdc1373f9865660cfed4676875a49cc9d9130eaf5880fdb2a6156c72ed10669b08c276377d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094504, "uuid": "4f23927e-b29f-4d74-9bd4-7934f5c81490", "value": "T149943528687FC01985E3EEA52DDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094504, "uuid": "fddb998e-9279-45af-8b62-19e96aeb9aa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094504, "uuid": "4556f57c-23af-44a5-aaef-0e9cf0cba556", "value": "12288:MklT97B+VzDrjhy/LqGnQYsTM5Dyzuf87Ct3hit5RFih2wshdy:TUjhIcly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632094504, "uuid": "fdfc299f-16e9-4f51-be87-be8170065908", "value": 448384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632094504, "uuid": "ba71737d-f047-41a5-bd3a-cd4f8de0df0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094504, "uuid": "de078271-3923-4f5e-a1b2-ee33dc4896fb", "value": "25a8a6d43b051bae808c0a5a4efa4f27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1c6447-1979-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632077196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632077196, "uuid": "6d10a54e-fdfd-4f84-bb08-5b396a8e3512", "comment": "Malware payload", "value": "cbf7ac18207051de82560b4621f7905f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632077196, "uuid": "500e3974-943d-4347-8db9-f6a85ced04d2", "comment": "Malware payload", "value": "76e1b3f87e3d6e8441bf266024881f0b6631214880e03e8c654e1ae1ea85433f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632077196, "uuid": "9b0096ff-8632-4dd6-a8a6-111f2850d85a", "comment": "Malware payload", "value": "2a8f7b05ab64c3de4eba11be3c1dede748d27cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632077196, "uuid": "4f2ca68d-97aa-4a98-8dcf-ad3e0196f22d", "comment": "Malware payload", "value": "5c950d393652e1090aa569f974cd89c1e582d739600b4d916de53b51de37deca404d402b27a3a88c5cc95deab1091770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632077196, "uuid": "74c1af77-b78d-4684-ae74-064e6da99774", "value": "T18185330737505538E1434172EE7AC25C4E3BBA643A34C414726EB62EEF7A225ECCF699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632077196, "uuid": "56c7a203-1655-4db9-8406-5e988c76f206", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632077196, "uuid": "5aa797b9-181b-4def-abc9-4945085b13f6", "value": "49152:j9/Kxz5eM8JvooqXrFzYA8hVU2AGm63yjpGIcLJjmjGpfxe:Z/m5eMOooqhomhjrcL7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632077196, "uuid": "429fa24c-def7-4a2f-a393-c208b17f2fcb", "value": 1826784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632077196, "uuid": "fabf5939-2f06-4175-992a-6a38cce783ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632077196, "uuid": "373a1f9a-6339-4b80-af7d-32573ade3304", "value": "SecuriteInfo.com.FileRepMalware.3388.26122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "820b1d9a-1949-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632056404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056404, "uuid": "675e7133-92c0-48db-9635-7bf06c1c0f1f", "comment": "Malware payload (Mirai)", "value": "be4c4490cb0b5a88f6745f45dc9f04f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056404, "uuid": "1ab349dd-bc1a-4f32-b50a-f963958191a8", "comment": "Malware payload (Mirai)", "value": "7893d0c8c0bca21ccd6c40a7c24458438e3e1721cfcecd6b0396da7feb73f5b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056404, "uuid": "f01aa52d-0291-4c23-95a8-ac971f8fe26a", "comment": "Malware payload (Mirai)", "value": "8fe1f7eaccd179a1f202379a834ac968f5a879a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056404, "uuid": "8721e8ae-cb74-4f65-8754-a4ef98ae2cbd", "comment": "Malware payload (Mirai)", "value": "e8443f67b5300223d954ac38ad7ebad4f588426278255f57504ca20d583c1b31b3292b9918f6c96c419bdfe7b756c802", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056404, "uuid": "7b85fbd9-8239-4d25-b789-5f136926a78c", "value": "T180D34C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056404, "uuid": "ffba4c23-3789-4f44-b1c3-ab44926442ee", "value": "3072:BxioDMQI5nrRaO4nt3qZg2IWu6b4JX7LkDM/98PmPw/t93:DioDtI5r0nt3qZgPWjWX74DM/9smPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632056404, "uuid": "e0798177-8e9d-4530-8628-ebed6ffda506", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632056404, "uuid": "fade5dc2-a4ec-48ef-8180-1998e34bec10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056404, "uuid": "d01737a8-936e-440d-92da-a5b045839808", "value": "RpcSecurity.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae736fa3-196d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632071941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071941, "uuid": "1b1554db-34ce-4509-9212-46674331f528", "comment": "Malware payload (Mirai)", "value": "3f7bba3c37def1423e6ec46a0e6fb1af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071941, "uuid": "8b33019c-d213-436b-87f1-d62eb6ad2182", "comment": "Malware payload (Mirai)", "value": "7a5556bf7e5b0073b0b4d6a4eff5474c9d3ba08ba1e80842c52db32003946859", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071941, "uuid": "748e0627-9905-4e8a-8bfc-3e85aa4a35fd", "comment": "Malware payload (Mirai)", "value": "06c2b5a7fdf6450c7f5728e2ac54c5d961ac9a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071941, "uuid": "eb7708ca-14f5-4e8e-96c3-733fe010a67e", "comment": "Malware payload (Mirai)", "value": "19570ed627d6aa61432b725bdaa1c27f2329f0eef4e78e6a0ebafb7dda9ff698028d9befb3b8c2f1182c2cd64880472e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071941, "uuid": "d3aa48e2-a5a8-46f6-b05e-4ff38e7cb85d", "value": "T187B31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071941, "uuid": "8b17aa56-6d11-4878-9b33-76346658682e", "value": "3072:OwNUWqpCgYXlrSyWUfMNNMmH1cuEgv26uN/:OwNjqpC/G8fMNNMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632071941, "uuid": "b3512e3f-58aa-481b-bd2a-add11165947d", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632071941, "uuid": "b83cb3e1-2404-4bfe-92f4-16010a3af730", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071941, "uuid": "c2705a15-78e2-4489-80f4-4bd69690f379", "value": "3f7bba3c37def1423e6ec46a0e6fb1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df9783a-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070195, "uuid": "a15a0a0a-ea80-4a1b-98c8-40f8305a7b1a", "comment": "Malware payload (SnakeKeylogger)", "value": "c672c7d33f286f8428560a2e06ccad59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070195, "uuid": "c7ae657f-ae99-4120-8a98-48b2ee7ea87a", "comment": "Malware payload (SnakeKeylogger)", "value": "7b416c2ae38575e94c26904b88b661fc32f9ec20b43bb5fa28ba5e72092e8147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070195, "uuid": "c13a10a9-4cad-4343-b0f0-b935dbca9fcc", "comment": "Malware payload (SnakeKeylogger)", "value": "895e8bf2d94b71d7f6e593a636d548029172be41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070195, "uuid": "ce0220ae-31ee-4cd1-807b-a40a7c65c84e", "comment": "Malware payload (SnakeKeylogger)", "value": "c90e050b44a85edfee0e261489737eb2e02e15b2d881202dae06e9c8be1916f08a4051eb36c668fa1ba44849b3a4435a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070195, "uuid": "0d4f57d5-3ea6-4b20-852e-ecb45b5ccda1", "value": "T10294BF243AFB5119F1B7EF794AE475D59ABEBB333706E45D1450038A4A23BC1CE8063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070195, "uuid": "a7480b00-ac8d-4774-bc6f-0d19a5c088c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070195, "uuid": "0034a917-b7b6-4540-8bec-e2493feac5f1", "value": "12288:TWbWHCM2K4C+MLBHPaFMc1J0CNGt/+i/TJQ+:a3CJxy/w8Gt/3TJQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070195, "uuid": "91f4f8e3-80b5-4078-aecd-ea48152eaccd", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070195, "uuid": "e340caf5-4d71-4b0e-8f1f-5a82de762bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070195, "uuid": "f7b67fc0-0437-4f9c-8652-31d6802d47aa", "value": "59689-589-99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e8479a-1923-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632039932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632039932, "uuid": "d2a70959-69e6-42b5-8235-2492ff562ef6", "comment": "Malware payload", "value": "7924c098f35b7ff9e2deb0be7ee0151f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632039932, "uuid": "ddc74501-6ff1-42b5-b469-2950691210fb", "comment": "Malware payload", "value": "7cc46214e11a0cdddcd0d0ccc9565242024236c829c8bc564b8c874a16f6ec20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632039932, "uuid": "35e6de3e-dbfd-4814-8ddc-62c3e3af299a", "comment": "Malware payload", "value": "13dd0a3662b13d6a2096c92227a38769e84b20e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632039932, "uuid": "fc0dbb0c-df95-4719-93f2-ca904abcb270", "comment": "Malware payload", "value": "bb0f3cf74a7e8232e68c48e78128f30f40e70f7f53d37c06da836c081d78dfa9296f63c2c86d6a25109ed2258aab84e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632039932, "uuid": "c5409ac3-9bdd-445a-aed3-7cc76ce3bc0f", "value": "T130653347C72054FBFBC692B67B31D1C95BBEE95120CD2EC76369EA8261D5003EA4D832", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632039932, "uuid": "73725ed7-fd88-4efe-bf92-ffda379831eb", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632039932, "uuid": "884b7ed3-7424-47e1-95f3-955219a1fb77", "value": "24576:85PK8YPFIBmSxiPp5PXV98EOTxoyZIjzmm9DkZcvDRfdBISr:GKdMFQPp59bOT5ijzpvvPBISr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632039932, "uuid": "cbd27919-f41e-4d9c-bbe8-ac56514e3515", "value": 1537776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632039932, "uuid": "0d252844-2f1e-463f-99ac-f0d77dadcbc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632039932, "uuid": "5d72e6ac-89eb-4aba-b0d2-0ce64b0ca858", "value": "7924c098f35b7ff9e2deb0be7ee0151f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5761715-1974-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632075066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075066, "uuid": "d3f9c3db-c340-4d07-8f14-f9a93bce436a", "comment": "Malware payload (Mirai)", "value": "2ac88e0b16d7d66b4cae326092c9db34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075066, "uuid": "a692d209-354e-4f97-ada4-83ffa98c8d5d", "comment": "Malware payload (Mirai)", "value": "7d4868580bdd75a248ff7757a702add9f0f0cd6149628001d301d5f5ff32bb92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075066, "uuid": "b7f0b295-d897-41f3-a63d-7f15cad2fc3f", "comment": "Malware payload (Mirai)", "value": "554801452a0b9cfd7fc0089d891ce9ec5eec5285", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075066, "uuid": "3a307c4a-c626-45db-9996-27404123736e", "comment": "Malware payload (Mirai)", "value": "c4761ac0393a599f5f7b5707d891606b73adcab59d690a8249b7c4dc6692057476c3a5e3c389e288940324c2b3990784", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075066, "uuid": "54059af5-282d-4a68-b24f-6658438e14d1", "value": "T12553BFA2C9642D28DA154A747810CA749333F42487872FFAE555C37CD0279EEF1AA3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075066, "uuid": "7f6b4956-9d43-45e2-8c3e-7a5c0f062e50", "value": "1536:5aE242P221INT5xAB7diyydq5QKl7hhc5fUCHpmpyu:5T242P22ET5xA3Tj53lw5fUZEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632075066, "uuid": "d5e75005-a4c3-470c-bb4a-b88da0cd3b8d", "value": 64312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632075066, "uuid": "d6c9d45c-0acc-4084-9da3-c8484c960146", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075066, "uuid": "7a253670-f681-4b20-9274-a4014a72ea60", "value": "2ac88e0b16d7d66b4cae326092c9db34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74e674f-1959-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632063473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063473, "uuid": "e1b8fc92-647e-4eca-a9fb-d42720168c1c", "comment": "Malware payload", "value": "3333e24b4b2ccd1aab8bd3f2f71b6214", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063473, "uuid": "600280d5-6de5-4188-8734-0cd2467305f4", "comment": "Malware payload", "value": "7daddaab4c96d0c13b0dda77ae8447ff7dd592e02505258e484222384f11490f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063473, "uuid": "7ceefd08-a0c3-456e-94ae-966f78b7d5e2", "comment": "Malware payload", "value": "5611fa899d942f8af085a123230072fd92d5efeb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063473, "uuid": "55b70936-6415-4886-aca8-f76c75c4bee6", "comment": "Malware payload", "value": "033791929bad12f63c6c2cf5566050f022f6b889661990208739e070ec0f6aeccfc587ed866f9f9f5f05b6507d62faa1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063473, "uuid": "0411115a-7f68-4652-848e-d89a6a172b25", "value": "T15414CFD5C6C0678DB9C8EA1C4C29C114D2F3C9EF6446A3867B7DBA30BF32D0497A4A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063473, "uuid": "d0702e71-342d-434a-827b-31ffee0961a8", "value": "3072:4wMr2Suam7v2KMa0hDxaclv98mCq7GkXQVR3WhpBzlarZkOooYoTBQkz:IkOMcH/PgyJ0fooYoTBQkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063473, "uuid": "907cd864-0c0b-464a-b695-21a9f60b95c5", "value": 192216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063473, "uuid": "0768ec1e-a350-4f16-b951-316fec23a35a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063473, "uuid": "e859f76e-50b0-4aff-a7cb-6d2a4c34ae48", "value": "Required documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e539d337-1966-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632069026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069026, "uuid": "65f1c8bb-1f85-4b21-8d6f-2bf70dbf8cfc", "comment": "Malware payload (Smoke Loader)", "value": "9a14d0ce191e43de4127ec54197cde9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069026, "uuid": "231390f9-279c-48db-a6bd-c75cc82f06b9", "comment": "Malware payload (Smoke Loader)", "value": "7e8b713ba66a7994474b5780cea0ee63b4e9e38487dc5619287454e5937e682c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069026, "uuid": "38c90869-ab95-4055-acce-7fe339986fe2", "comment": "Malware payload (Smoke Loader)", "value": "88eef265317e6634722fea13a6b3c4e556ba6e18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069026, "uuid": "f1b61864-0c09-41f6-bdc4-fdd0f01ca8c2", "comment": "Malware payload (Smoke Loader)", "value": "3159be8c2d933c72d37b44d67339a9606316dd5374e758b1b966b4abdbfd5f1318eec6719b2778fe102f376334ea85ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069026, "uuid": "0c875751-7839-42e5-a0f3-6a2062dc54a0", "value": "T143349D20BAE0C035F1B712F859B993A8A93D7E719B3491CB62D616FE26346E4DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069026, "uuid": "012259b8-4967-4e40-bae3-c96dbbffe190", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069026, "uuid": "d4f0e51d-703d-4bd8-b7bc-ee9876f2c5bf", "value": "6144:NnZQ2Aybsccu67q4Z7LMB3a8l9pYZy4YHq:tZnbsccu6W4MBKO9mUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069026, "uuid": "15e1d4b5-70bf-44ea-9b43-1437cb5fd4c4", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069026, "uuid": "aaddbf5c-3c15-4d57-afc1-3b48a10b7944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069026, "uuid": "b475a31c-db30-4dd7-9465-533f4862f7fd", "value": "9a14d0ce191e43de4127ec54197cde9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de6f38d-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632063752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063752, "uuid": "b8dd7f60-cfe1-4c54-9f42-341ca6ee573b", "comment": "Malware payload (RedLineStealer)", "value": "3958e3d89643405f43fe3893355eb3e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063752, "uuid": "60b094b5-f2ea-4824-a79b-943ebc410770", "comment": "Malware payload (RedLineStealer)", "value": "7ea0d2fd8931d60838d30d6b619b35ce8350d092e85d336d9adacb4c50257980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063752, "uuid": "b78b68a5-baf5-4113-bee5-0d17f11dc5b8", "comment": "Malware payload (RedLineStealer)", "value": "67c479f6e9bed0227950fa6859dd007db7f425cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063752, "uuid": "9cc5ce44-b72d-4203-8cae-38dc25164813", "comment": "Malware payload (RedLineStealer)", "value": "329a88e7af6a96f1d327c15e0320773dfb1ff4c67b776d139b6034b44ecd6ffb8708ce532fa22083a22c30cd7e471911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063752, "uuid": "676a32f0-ba1e-46b0-a50d-c1857be7523a", "value": "T18EE5E7E53D97B2EFC1E3447CA4E38983E768625242408D1DD8ED3A38F5E696209CF746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063752, "uuid": "cc557348-91d8-4347-a5cc-b9c364c5869a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063752, "uuid": "b6bfedb0-3fd0-4d03-8afb-65022a1164d6", "value": "24576:0iE3ALW0/BQqIy4XQJenzqDfgE8G3yMGK66OlZAext5/07G/hzvSLjOQOb5k/4dD:0pMqy4Vzq0EF3ymj4nPJ9EMmqxQnvBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063752, "uuid": "c02d81e2-865a-42db-acb8-12623307b32a", "value": 3211776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063752, "uuid": "8ae1c32e-9992-4503-a971-d4e8b714288f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063752, "uuid": "9f2692cd-5aa5-466a-bee1-214ca7c29fdc", "value": "3958e3d89643405f43fe3893355eb3e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ef9f69-1970-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632073263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073263, "uuid": "3a7b72ea-a3d2-46cb-b887-46ba50b81e7a", "comment": "Malware payload (RaccoonStealer)", "value": "4099a079482082458b3825a879b69257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073263, "uuid": "399e520f-788d-4686-b42f-a2f8d576117d", "comment": "Malware payload (RaccoonStealer)", "value": "80f2a7613340604789afa5a7dfea425345ccdf84882218f3921924111d0481ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073263, "uuid": "79f7f3d3-3688-493b-a51b-831107831ae9", "comment": "Malware payload (RaccoonStealer)", "value": "7a9fa476330d925a86cb5b3800bd20d8a283fc5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632073263, "uuid": "273f883d-8c50-4f80-afdf-b62cd06a60e7", "comment": "Malware payload (RaccoonStealer)", "value": "d9b4742d80eb38b84cc02500cfe0c3d0051e1c3586b6a56c90758f90d21ae5598573528a755b9e2ba1a3435673922953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073263, "uuid": "a474f42c-41ef-4071-8320-e013002682bf", "value": "T1BB14CF203780DC76F05238705856EBE0567BFC31DA648917BBA5375F6E322F0663A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073263, "uuid": "7f3a4bb0-366f-427e-aacb-ac756f427121", "value": "57a1e3423c1839b1bf16ef223be9627b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073263, "uuid": "b4f85045-4933-4eee-99dc-9b069e2e7617", "value": "3072:WPg/9Lqyfhc4r1/+c5w5prReX6fmqpTjTwa/N/zxJWtk0K:pVLqyH1/+c8rRgITjTwa/RxJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632073263, "uuid": "3bcd6e3b-9695-4f3b-b338-b8bd55714c5c", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632073263, "uuid": "be1d2294-cc03-456e-856f-1cd286a6598e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632073263, "uuid": "89337056-5c7f-4704-83b7-8acf9503cb72", "value": "80F2A7613340604789AFA5A7DFEA425345CCDF8488221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bec571-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632069968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069968, "uuid": "a36ca5cd-e00a-4c26-8cbc-4c786296e0ec", "comment": "Malware payload (AgentTesla)", "value": "b573518d69c7280ffd7c39cf0c947f5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069968, "uuid": "993f3b28-4787-412c-ba79-4d43474440b3", "comment": "Malware payload (AgentTesla)", "value": "820c62207fb790251824280ec281caeb04dde02a3e0c895a9909f6e66c3fc2d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069968, "uuid": "c5b8656c-7127-48a4-9aa0-d38525bc8b3a", "comment": "Malware payload (AgentTesla)", "value": "653dccc58c4d8ccd30483d74f1baab669dc19984", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069968, "uuid": "462f7e3a-df49-4925-b686-46d8cca34f1d", "comment": "Malware payload (AgentTesla)", "value": "0533eae12337dabba70a26fa26b0c6c4c2ade0d4f17a0af36d8b3db47c2a282a343bb6030562a50715e26d47eef8470a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069968, "uuid": "dc87954c-39f6-4666-897e-f4529f7ff1ff", "value": "T1A055EB254D6696F7D3EFC32CE05C0B8EDBF5A483BB929F0E988186C6065770BE94814D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069968, "uuid": "0b79f615-8bee-4e8e-8da3-2eb01064fa51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069968, "uuid": "43b531ed-e9e7-4e52-81b3-c1fbd80b41ab", "value": "12288:Pcf8DYMhC6G3//Zos414qnCbC+tJRsw5eOpZPKbfV+dQL3j:ED2G3ZofUC+OfGZCuw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069968, "uuid": "7aa33df0-482a-4b4a-b334-5c7cdbf4bdea", "value": 1406464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069968, "uuid": "f51b3710-6004-4159-9a86-ded5896dbc26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069968, "uuid": "766abd44-9191-407c-be6f-4147465b3506", "value": "PO00299436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ff1f21-1900-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632024950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024950, "uuid": "ab7aab63-f2a0-4678-b9b7-8b41c684b8bc", "comment": "Malware payload (RaccoonStealer)", "value": "2ca4cff66420fef8393427d1856a5ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024950, "uuid": "89ce573c-3ddf-4b04-8a11-657f9a88f78b", "comment": "Malware payload (RaccoonStealer)", "value": "82b28b8a53561d8e7bfe66ec32cd62220483b8131efaac0f7eb6143cb12568ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024950, "uuid": "a0ea98de-f541-40e7-9768-8ba7f0062bb7", "comment": "Malware payload (RaccoonStealer)", "value": "b2669af53f913237093354754e2016c5fb138c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632024950, "uuid": "2c1dcc67-dec6-4d7e-802c-a825efd8ac6e", "comment": "Malware payload (RaccoonStealer)", "value": "85137178c8c004192772c4ec48fa54975649cd7e2e9010cbc62046ed07048ebe6696f2f13e052edea06571ff8f48cc50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024950, "uuid": "a68da5bd-d533-4221-9c90-f36c65527e30", "value": "T195B4E120B6E0C035E0B712F9597A93B9B82C7EB1573455CB62DA16EE13386E8DC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024950, "uuid": "b9036786-31fb-452d-bdab-6b7fb95bc846", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024950, "uuid": "38374379-462b-49c7-9faa-3ff269da0a07", "value": "12288:QZT8ReuLK2sZfqi1qluIH6xuLCXk3xum/R1x3kknXe:Qp8RAlqiCuIawYkpR1x3B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632024950, "uuid": "5bf2bbab-4aa5-4fe9-b98f-57559614a5cf", "value": 502784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632024950, "uuid": "06cbdc55-31d5-490d-8880-df41ae1d0465", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632024950, "uuid": "4a9cbc64-31f4-4f10-891a-7ab9662eda7d", "value": "2ca4cff66420fef8393427d1856a5ac1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df6a2d9-1939-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632049391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049391, "uuid": "6f50b74f-2c38-4a09-828c-9c8dd3a97e09", "comment": "Malware payload (Mirai)", "value": "212ee2d98388fc55590f0b1881b8f8e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049391, "uuid": "dd6c653f-d297-4a81-9bd4-9dbc7828928c", "comment": "Malware payload (Mirai)", "value": "83e594618afc811a97511c21a68ae2edac1008046a2337930fca5649069efc3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049391, "uuid": "837b76b1-6ffa-4a8e-b305-e2f3fb1ec231", "comment": "Malware payload (Mirai)", "value": "edd52cec5a3094cf9c748b560fb5173028e8db95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049391, "uuid": "8468f919-6972-44ce-8b2e-dae9d5589101", "comment": "Malware payload (Mirai)", "value": "053cc268b598be8e25da47b740eebdeb566953ab235b4eec2f03734f3fbf54ad180b873fe6423c6d7fe6939bc860f941", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049391, "uuid": "56c161d5-6ede-43ef-a78a-7c86ad1f79a4", "value": "T1914319827C81AA39C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049391, "uuid": "468b893a-e923-4364-bb36-1e0a57a9401e", "value": "1536:VX3kcPLAR10ydj/BTLU8GYQ0zYJBb07N5z2yYceZW8eXag:VnXPLJ0R5z2tcws7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632049391, "uuid": "be9dfcdb-6648-4917-a368-2e974f5b8b63", "value": 60180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632049391, "uuid": "181312e5-6518-402d-8965-3a313c793611", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049391, "uuid": "49dcdab8-0191-4df1-910d-68d76aeee6d8", "value": "212ee2d98388fc55590f0b1881b8f8e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f670be07-1987-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083228, "uuid": "80cd2d9b-fce8-4e0b-9c86-0f75228a6ab1", "comment": "Malware payload (Mirai)", "value": "485fa24650880b1f089604f521be874a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083228, "uuid": "5be644bf-1249-41db-9f6a-4a47c28d5cdd", "comment": "Malware payload (Mirai)", "value": "84790c499af093aac7862029c8dfff9d234b279510a006bbdd0c6379fe4e9145", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083228, "uuid": "102db471-aa61-4bd4-add4-b34bb2a3e655", "comment": "Malware payload (Mirai)", "value": "b24253c180f1c234b3bada65c7e3a7391f6388f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083228, "uuid": "73bb585d-26e8-45a1-9d24-d1710d1fc91d", "comment": "Malware payload (Mirai)", "value": "fc833cdb96f353b84f8641562570f9a5b1fd1e7f7754e5430b7d5248b69e3cb87b90c6fbe65b9852239b31376aa6c958", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083228, "uuid": "4fdc7478-7104-471a-adee-d86378d0be34", "value": "T13BA2C070C1681FD4EEBF2DA11DD9C353279143EA53B20ADB2089BF70715385AE5649C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083228, "uuid": "feacddca-19af-410e-97e0-01f676819209", "value": "384:FQswwhn+Nore50szoQYwa6Ol6jrnwbaIp49rwG7r8M4uVcqgw05LxJ9/:FQOtreCZVLJ48VukG/j4uVcqgw0z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083228, "uuid": "8a0b588a-e0e8-47fa-b5ed-14db45852ed8", "value": 22272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083228, "uuid": "7e9ceac1-96e4-4168-8b6c-6564abc77be8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083228, "uuid": "8ab932e3-c964-4127-98ae-471d72c4aeb9", "value": "485fa24650880b1f089604f521be874a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb6fc24-19a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632094787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094787, "uuid": "0c09eeb6-4679-432a-9ceb-c4fb622d8dd4", "comment": "Malware payload (Mirai)", "value": "0c56ba4624cde35820b7cdacd7064039", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094787, "uuid": "543a918d-8328-4c91-8c70-6d3840cb7533", "comment": "Malware payload (Mirai)", "value": "84f952dfaa1a49bb87dc7a5f3f035d36c5a3d9389caa88860b7103177b718984", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094787, "uuid": "c00a6c80-cfb1-4e72-8389-46585966b2b6", "comment": "Malware payload (Mirai)", "value": "41e592f0d44fdd47d866b139077721b9fb39285d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094787, "uuid": "5f5ffac1-6896-420f-be49-b2142f14f01d", "comment": "Malware payload (Mirai)", "value": "d16d600447ada12d5ef187a9a36e2ffc975c1fdc3c0ef77e3f2d9b7d6b55c56d51f969d7681518a7b64b6e9129ddb5e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094787, "uuid": "229b16b7-d777-4e40-aac8-1bfd28e746b8", "value": "T16C330796A801BD2CFD5AE7BE81160E0CB5303B6450734737A6A2FC9B5D723A49D1EF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094787, "uuid": "8e852861-4955-45b4-81e8-d78009f611ec", "value": "768:XHearpBlwVH82e4G+sdic4LR1dp/u9WeLvp6KkJTZ5aEH8GyT:3xrpAVcgGXl4Lfdp29pN6KkJd5ay8hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632094787, "uuid": "26f86f58-ec23-498f-838c-f8430ed52948", "value": 54636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632094787, "uuid": "5410425d-a153-469b-9f94-27cbdb60805d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094787, "uuid": "e490be1f-99c9-450f-b3ac-b0824d57d859", "value": "0c56ba4624cde35820b7cdacd7064039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0c6696-1987-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083234, "uuid": "e450fac0-c533-4daf-996d-8d0dc6eae191", "comment": "Malware payload (Mirai)", "value": "0f4e92700880c6ea0cd28f259a8bb580", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083234, "uuid": "6624745e-3fd9-4ad3-8511-2584b3f820b5", "comment": "Malware payload (Mirai)", "value": "85b2f6c0e5abbd6c828c7aeb180b3bdc5076962b12ec1e7e3717204f97f1d786", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083234, "uuid": "6c2938b9-b2d5-40bd-b756-72beb6df61bd", "comment": "Malware payload (Mirai)", "value": "537f7aa634b8018a701d5d92fdd167f189570971", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083234, "uuid": "3c24a93d-75d1-4310-817c-f2428839fe5e", "comment": "Malware payload (Mirai)", "value": "cf52fadd5c66ea6f6717a56f54d66590efb4b907abd3f5b74d1c6f7486450deed5c777d6eb0ec5d3e7f4596b87cef76f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083234, "uuid": "eebaedf9-263f-42c1-8a28-d19fb38698a6", "value": "T10B333CC6F401AE7CF92BD6BB4633490DB920A2548193072377BBFD93AC322A85916D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083234, "uuid": "f37d1800-2caf-462b-a1a0-dd435e01dabf", "value": "768:EceKIZ8v6XCqeOXiBIStZHxOtMnjvuTFSwQ8deE4N7l68D/FyFhL:/XIMqqVZR4IjvxwQ8dEN7o8zFyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083234, "uuid": "d2e3386e-c0e9-401a-9283-ccde89171567", "value": 52280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083234, "uuid": "2d7e71e3-d1f0-47b1-8671-0c596eedb78d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083234, "uuid": "3b151d51-b6e7-482d-a753-2de6eef543b1", "value": "0f4e92700880c6ea0cd28f259a8bb580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b152558-1968-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632069626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069626, "uuid": "020d41f8-8eef-45b8-8b72-6c5920f5a6c6", "comment": "Malware payload (AgentTesla)", "value": "ea9a240b03342768fe4548c5083ac023", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069626, "uuid": "72eede11-95f2-4cee-be58-2fde6497452b", "comment": "Malware payload (AgentTesla)", "value": "861b97ac6104aec8ba2dd1bdc408ae8ba021aae1b7a3bde00ad9ff4e4e8490d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069626, "uuid": "884d4913-e27a-4680-a29b-f30dedefad81", "comment": "Malware payload (AgentTesla)", "value": "cf16b2a75c73a103e1717ffaa7afba2d0bcbf8a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069626, "uuid": "446c7f37-b05c-4203-8f52-6cced8b5cf7a", "comment": "Malware payload (AgentTesla)", "value": "d983f943e4702c22681281176d522855b2ed13762c3b3598f4c3f82b39b1957410dff20a4aa9617c2d802d8b2cb42a78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069626, "uuid": "0c0d0a0b-bfd8-4ade-8e40-325ec42bb3c5", "value": "T1A865FC254D6696F7D3FFC72CD05C0B8EDBF5A483BB918F0EA8818686065770BE98814D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069626, "uuid": "fc800758-cf43-49fa-af36-59271ba1a102", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069626, "uuid": "bf2fe6b2-ffe3-452c-ae5a-d858f2f1f387", "value": "12288:UHQyVDXA1zDg2OWiaiRViCuV4oRUkGhlmraKCa7y:rWA9gDWiaijiCe4m/GDeaz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069626, "uuid": "944f3c62-8e4c-4196-a49f-6966a80d1bed", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069626, "uuid": "1098c5a9-4e3b-4810-8843-38731a9c3223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069626, "uuid": "b8d2e8c0-5770-47be-ab27-35fbe3a48055", "value": "PO##$5347.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba48635-1968-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632069923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069923, "uuid": "cb193a2d-e83d-4ada-9ad8-5a6603266c94", "comment": "Malware payload (SnakeKeylogger)", "value": "05cee9af6c29068437c8e44836f0e8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069923, "uuid": "ac771194-ee8a-4b6e-8aa2-6e5540167a19", "comment": "Malware payload (SnakeKeylogger)", "value": "8756a01d39eb82abc9a0b18e9d754304223e39a0fc52c85c7c53e3cb5127c0ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069923, "uuid": "a9501a36-4728-4dd0-bf15-d10e4d9218e6", "comment": "Malware payload (SnakeKeylogger)", "value": "4db3ebb7e2a713d74ad6d66c621d3743cd1a4f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069923, "uuid": "3a5eee2b-35a3-493b-91b4-ad515dfc8e69", "comment": "Malware payload (SnakeKeylogger)", "value": "da5804c538ff66c6d860aec0de388447454676077bb6db6370c2022c4402811b7d423cb3ad13727a07fbe349947ee837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069923, "uuid": "5fa12b91-bb82-4d38-ad17-7319cb0dcd74", "value": "T11C84121225B8BB20E57E07FB8946286153B6EA471B11D40F5CEB71DEA07BBFC4681E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069923, "uuid": "dafcdc65-846c-4858-8fce-ce3437a5de81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069923, "uuid": "04d05efc-374c-4d52-b2f7-63c7ea105371", "value": "12288:1XjduEZdtiwWkFXovVBF2W8c18XdrL8bxU:dZtn14vt18XdrYVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069923, "uuid": "98753c8f-feb9-4cac-9f30-7f89fe8d9087", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069923, "uuid": "21073ade-f18c-4a93-a6b0-6a4f70f74769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069923, "uuid": "8abc7df4-9ebd-482a-8f45-17dba1c22ed0", "value": "catec.cairo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bff0585-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632070138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070138, "uuid": "45c57928-763a-4751-a07d-75dbb40fadcf", "comment": "Malware payload (RedLineStealer)", "value": "549e51ddb6b22c9e5a6de97234b1de1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070138, "uuid": "d9a77328-728a-4da1-8e99-81ee6446eb22", "comment": "Malware payload (RedLineStealer)", "value": "878a04b8ecdc2bb92f8c322439d4fc21668f6dddaf9c806ce75165db8dc4facd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070138, "uuid": "522675a9-6b21-48e4-91bb-b6a5374fbfb8", "comment": "Malware payload (RedLineStealer)", "value": "6a92338ab65b3451405447072d412b0e2a6bce54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070138, "uuid": "1fccbeca-f49e-4636-ac1d-707fd7970a7a", "comment": "Malware payload (RedLineStealer)", "value": "81fe147823f00c141cad4dc491d988de44f1737cbc40807fbbe2843a2cfd88d5c074e818659a56fbf0bfb830193d8c10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070138, "uuid": "793b20ca-6037-43ba-94a3-cc2f0fbb87dd", "value": "T1C2941528687FC01945E3EEA62DDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070138, "uuid": "9c057424-f19e-4dfe-be55-7258868820ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070138, "uuid": "d56e8f25-417a-4edc-a6c8-8966b591df89", "value": "12288:tklT97iZI2k2Pjho/n48TORCMyCADrmeUUf8Jit3hiD087s3K4olnJ:Aijhqmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070138, "uuid": "4f6e2cb3-72f5-496a-a534-10d5294e86c5", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070138, "uuid": "7c63d66d-9ec6-4b96-b584-ae31c687e5ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070138, "uuid": "f88c3ecd-0e16-4485-86af-310d8503d72a", "value": "549e51ddb6b22c9e5a6de97234b1de1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71535b2a-1994-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632088588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088588, "uuid": "23ebb5e2-bb57-4626-90b6-0f15f73cb6f0", "comment": "Malware payload (RedLineStealer)", "value": "c0683ce487e2a1407ba4dfa18c13091a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088588, "uuid": "74719d0a-e81f-4df4-ad42-a3124e085721", "comment": "Malware payload (RedLineStealer)", "value": "8832cf1dd4faca7dbfad5d6629a6a5e6feab4e15f97655179f91283283a4d51e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088588, "uuid": "1905675d-0165-419d-8754-d1f3edfb208f", "comment": "Malware payload (RedLineStealer)", "value": "a7cbe43fa202d938e645c411f2b368c962424a1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088588, "uuid": "ad36e83b-6c2d-46a6-865b-4cea5824dbef", "comment": "Malware payload (RedLineStealer)", "value": "15caef0e530d7c84b8ec1b5d5c64b99b1a1c1bb089dcb69844fe4322b694f4059b7e7cad30cdb7e326231759a3548d3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088588, "uuid": "2813cb30-e8de-4494-857c-9b8a119b25d3", "value": "T1DE64BE20AAE0C035F4F752F859BA93A8A93D7A715B3090CB52D616FE27347E89C30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088588, "uuid": "d4a740d5-cea9-4207-a3e9-3c3bd1b038c9", "value": "8291a520c0f405cf4a58a301dc5c7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088588, "uuid": "07d40bc4-f766-4554-ac4e-6da87e9301bf", "value": "6144:2hZQ16qcCTnFlFtG72Hn0lWVrijSdygd3vFcKpDhVWv+oY:UZ+TnFlFPHnm++SosNcKJhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632088588, "uuid": "f4ab13df-02ca-466c-b6be-fab2f01c15e5", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632088588, "uuid": "134a21e4-77de-496e-ae3e-baf7e2b06912", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088588, "uuid": "b6f4c69d-e22e-4e7a-bd52-9ed314c4a58d", "value": "c0683ce487e2a1407ba4dfa18c13091a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f77b48-1968-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632069827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069827, "uuid": "1fe49470-7342-4cea-8617-6c421452096e", "comment": "Malware payload (SnakeKeylogger)", "value": "030154def3df42a5b08d5478fbf85c79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069827, "uuid": "1686d6bd-03d8-47ff-a540-7185fef2d67d", "comment": "Malware payload (SnakeKeylogger)", "value": "8ab316ea3019d06369ef8f60dd9a350fd77fb05915d3711a9db59d4a0463bbb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069827, "uuid": "08b433c3-2478-4c50-a492-783ce93ef5d0", "comment": "Malware payload (SnakeKeylogger)", "value": "de2c68ee87322c03dc1d065e1f1b9c27e8ee5946", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069827, "uuid": "70b5ba21-9a5e-43d9-897b-6f2dbd5ee536", "comment": "Malware payload (SnakeKeylogger)", "value": "cf3eae9767080178682c0ec4f1a388a2b51b98b3a0337a891181eb8d79edaff2f29b6aaac8356ca2809094d81313afb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069827, "uuid": "40f567c8-6139-4a25-aee5-a9e77e6dc00a", "value": "T1A17412053678CF38C1BF77FE7A31915243B4A1826036EB581EAA59F801B77818B65F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069827, "uuid": "ed2d4361-82dd-4a58-a25d-9f990b656646", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069827, "uuid": "94764f65-2b65-4a4d-b5ef-a69c996305ed", "value": "6144:96RgxxscwRzzX2ND4rW6bGRz7vvS4CgKOI/2Jgzh55pU1A5s93ePW:9nxNWmND4rW6Cz4h+JIhW1c23eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069827, "uuid": "001bd3ac-e832-4720-9e9f-5997676a012b", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069827, "uuid": "418bde37-7d05-46be-9bf2-87fe6db28e87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069827, "uuid": "7f5377bc-6f16-46fd-80f2-cbfba18b9cd5", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4652ed53-1941-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632052868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052868, "uuid": "1df69ec6-9e94-4f51-ac88-224cfe1cbff2", "comment": "Malware payload (RaccoonStealer)", "value": "fba42ce0edf22080a3e18e7cb2601ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052868, "uuid": "652d99fd-7173-4ed2-aa21-7f6f825017f8", "comment": "Malware payload (RaccoonStealer)", "value": "8cfde1b7c76e2116c8fc6542d73b21f9351740fb8e304a2d8f4bdf1975546bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052868, "uuid": "93a770db-be14-4dc0-9b79-f3db70818cca", "comment": "Malware payload (RaccoonStealer)", "value": "4041cbbdeb758e3abaee481aba6e405e16ec7f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052868, "uuid": "f7f37679-24b4-43a2-a062-cd3376f1203c", "comment": "Malware payload (RaccoonStealer)", "value": "56209cbf93606d116b47b535986d9057572671ced3a380d47886f0cefef53d9d505f6054384d4e6729b90b2794ddd42b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052868, "uuid": "027b37f0-8806-413c-b986-26ab7e7ae5e3", "value": "T159B4F12076A0C035F4BB52F9497A93B8B93E7AB24B3454CB52D662EE1734AE4CC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052868, "uuid": "f3378a53-8656-4eb8-b933-39c089219665", "value": "8291a520c0f405cf4a58a301dc5c7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052868, "uuid": "803c315c-9f68-48c4-b9bc-8e06846a882c", "value": "12288:JZACWX3mUounhUQPE9T22DOAaeFOgbjoLGOthjBP5Dz:JuCWX3m09c9JDBbOmjYT7BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632052868, "uuid": "c34db9ce-b599-4007-8aaa-3a6970e560dd", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632052868, "uuid": "0e75e390-d9dc-4856-84df-fef9b062bdbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052868, "uuid": "e4127a39-ae70-46a3-bdf4-7172822f7405", "value": "fba42ce0edf22080a3e18e7cb2601ddb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c30eac-197d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632078858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078858, "uuid": "c281824d-92ad-4b2a-a8d3-247f3d7769dc", "comment": "Malware payload", "value": "cf9103c3643f099ff2b4bf9d7258c54f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078858, "uuid": "41934a04-709b-4a31-98b9-ba303062fa06", "comment": "Malware payload", "value": "8d5183e16553bfad76d68b950d94144e5d57633c716074ca3d76cf6e6903918f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078858, "uuid": "eefcf987-8ac6-4aaa-b966-bf810287e49f", "comment": "Malware payload", "value": "d9783a2381c3da1cf394844ee35d6662992e0766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078858, "uuid": "3557507d-3542-4a26-aecf-a1a21c5d4b7d", "comment": "Malware payload", "value": "c8281d682e7755fc6878e2728e8e681f536fcff7dfcd976edaa646438ce5386320b4ebc43797fdf9a9279e118e5b60c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078858, "uuid": "64d249d1-e8cb-4707-bef4-b52d35587e36", "value": "T1B4E512D530C97C8BF3A20C31E75758953264CE07CBBB9161390AF7C6BAB64B49226D4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078858, "uuid": "ff9808d2-c046-419d-8d7a-fdc696445ab9", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078858, "uuid": "8058d007-0098-4b51-a1b3-241066c17ac8", "value": "49152:Zgw8gCbfwf3saJZrvyu2nJZ7s1lEgx5tmOfy8RuiOkO9G0rgf/VXiPo1LHkqdi8:Zf4w/saJpGJJs1jx5fyouR7G0UnVSPyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632078858, "uuid": "37a8b4c5-bb65-47e7-bdbe-066a01558dba", "value": 3106816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632078858, "uuid": "cff40562-99c4-4e94-af89-4d4e4fbf0732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078858, "uuid": "8da70c6e-efa9-46cc-9a50-f8112283aebf", "value": "RedFlame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bafa0b8-1965-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1632068446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068446, "uuid": "dc60bd2f-93bb-4bc6-a2d2-79742867638a", "comment": "Malware payload (GuLoader)", "value": "2799f8c3f80d27c6db8831e20fb2373d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068446, "uuid": "e86e0e16-5ac2-4e47-8f2a-a1a515791a59", "comment": "Malware payload (GuLoader)", "value": "8f75fa4ea447c25737832e7b7e15d0153957bd2637665e41e6d4ba42d955aa1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068446, "uuid": "508b959f-83c4-4228-b33b-0c18aef26716", "comment": "Malware payload (GuLoader)", "value": "d43b4270add067a117bc208b9158100a1ba8deb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068446, "uuid": "7382e2d3-09a3-40ff-94b1-eeda5f807145", "comment": "Malware payload (GuLoader)", "value": "f91de698dfb7e4ebbffbdea424202b97d0daafecd528f18002363439ef44f9bb881dfc94e719f08cd15975d26a902308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068446, "uuid": "6b1cf485-5f15-4a4d-a646-87b50bbb52a0", "value": "T100445B916AE4EC58C74489B8C845C8F9C2577C14E812453B34BB7F7FF436E6A19392C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068446, "uuid": "226e12bc-e6df-4f3c-83c6-dbf12b67c674", "value": "f543d8ff08f052bb72db712aafa3ab4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068446, "uuid": "dab664b1-6fa4-4e73-89cd-77b4d1ddb013", "value": "1536:lx4l2XlQ3wuHAH0ELqVVThjI8wTDWWsU3CZpugbW42ZiBon84o4CNr6/C/Hz2Xlh:DaLgH0vhjI8mDWXskW42ZJo4wsC/ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632068446, "uuid": "b720948e-7546-4637-b436-80307b110e75", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632068446, "uuid": "a58051ff-277e-42d2-9ae8-50fd00f4f3c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068446, "uuid": "caf94995-42cb-4e46-8af9-b229e8f13356", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11557de-1974-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632075059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075059, "uuid": "3f10b29d-6a06-4af1-bf0f-7f6540cda55c", "comment": "Malware payload (Mirai)", "value": "367d5463acea5249631856530102b3b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075059, "uuid": "c436e98c-74b4-48d2-a87f-4cc94a27a394", "comment": "Malware payload (Mirai)", "value": "945cc7b30041d485e305eded4f4bf4e4af9bdc06556606f560f7bb464f66b8f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075059, "uuid": "dae98de8-2b7a-4310-b860-7df624ef5647", "comment": "Malware payload (Mirai)", "value": "d350815f87dfff96d00a9ae1ea173f222255c6f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075059, "uuid": "c8286b29-6142-447e-9df8-09a0562e8c92", "comment": "Malware payload (Mirai)", "value": "838f137cea0617937e4fae22c8e143bf5a57b266db1ff964292a0e6636505259f5b0f3d9da1c68ca1fca3473c8082cab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075059, "uuid": "701259b2-883f-4935-a2b4-0c65cd558812", "value": "T1D6F2F164D346F4F1CEE16C7994BC918947B0A73CA0DF3023579CA9943991C51DE93B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075059, "uuid": "782615ca-f957-4e97-b890-dd070bbaff9c", "value": "768:pNh95VARrqykAHTCM/WsLGoflM/97o/rAkcTX9q3UELbeD:pfhoGYpdC/iLiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632075059, "uuid": "a32fd6fb-f4d4-49a6-9e96-4143f8859b1f", "value": 37248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632075059, "uuid": "f27b90b2-0ce1-44f0-bdee-47db6b34c241", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075059, "uuid": "39b0a4c5-d084-4a34-aaea-16bc83ac3ae9", "value": "367d5463acea5249631856530102b3b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7d49b3-1974-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632075076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075076, "uuid": "b228023d-991b-4a2f-b715-cb9676549a91", "comment": "Malware payload (Mirai)", "value": "48b2a0bdcd8c915252ef8c66e712dcf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075076, "uuid": "30a517ac-6f35-4990-829c-d8a550715bee", "comment": "Malware payload (Mirai)", "value": "972f4452616b857bff6b9cd9e62f5b83fd954cc2bf08d43424142fc14d3a1c0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075076, "uuid": "84973399-0a99-461d-b592-249bf80c2d5d", "comment": "Malware payload (Mirai)", "value": "1a3f5fbe37dd0c2c2231549318dab4e4d7b34a8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075076, "uuid": "8bfd1a4b-75fe-47fe-8ce6-9e0e8baecc46", "comment": "Malware payload (Mirai)", "value": "580c4aecedd9348405cfe6f85b4241d1332364ae5de589980938ad3908ec0781d95fd404309d0f0592178045d050302f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075076, "uuid": "08ef90c0-1bf8-46d0-ac99-482653c1dedd", "value": "T115E2D02C260D18F7F9BEC171A9E50B616E908EA36600EDC1F475DB82BB87B856D035D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075076, "uuid": "585607b2-7ea3-47c5-9fb8-9f75adb24e3b", "value": "768:Pgc55Pi1VnMhaAKazJ73/CQWozLCJgGlzDpbuR1JY:Pgc3k1MhaAKyVBWMLGVJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632075076, "uuid": "90bf0f76-63b7-4f78-b026-bdb8e467b888", "value": 33380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632075076, "uuid": "a39bc609-f046-4ab7-95d6-8c070d62c652", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075076, "uuid": "797e9c6c-e461-4010-88eb-bcdf77fd8cfa", "value": "48b2a0bdcd8c915252ef8c66e712dcf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cacece6-18dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632009902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009902, "uuid": "a10e245a-7029-4502-8e09-cab94788bc1b", "comment": "Malware payload (Mirai)", "value": "b6107738bbe53c1668bd91a0807bd1f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009902, "uuid": "69319045-9a3e-49e7-b203-e07d886b2faf", "comment": "Malware payload (Mirai)", "value": "982493217891f562eceb9505103db43cafba8f08cfff75b25fb57670eb0c5065", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009902, "uuid": "83aa86c5-c0a6-4980-bb24-24a46697b7d8", "comment": "Malware payload (Mirai)", "value": "7ecf6148b082c4b0e2d00b780ffb0a50adca93f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632009902, "uuid": "64038332-65aa-41ab-9506-ed155f405cf0", "comment": "Malware payload (Mirai)", "value": "a50d32388c5938c361a839d635989b1eed5bb548b83edc10a67bb90f6c994546d24953db15601ddedac8f9071eaf865b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009902, "uuid": "e414d269-a737-4644-8c79-c27b60edc4ad", "value": "T191E2E10F79292564CCAD8E3D40DA13E3ECC671C03395EB4D23915D656736807B8AE46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009902, "uuid": "063d8569-cd9c-4e71-a243-70fd608129e2", "value": "768:y1TR7Bvp/Sph+094jif6bkgC6YX/PsyHpl/WMAm+/WRR:yJLouUfUlk3syHj/WM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632009902, "uuid": "dc0195ff-5d40-4828-8b46-e53325d95b90", "value": 33988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632009902, "uuid": "7407c9d5-43da-412f-bee0-da6f212ef732", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632009902, "uuid": "345c907b-8196-4bbd-980d-ec36ac613801", "value": "b6107738bbe53c1668bd91a0807bd1f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452e8774-1907-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632027955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027955, "uuid": "796797d0-0865-429a-83c3-d402f9474002", "comment": "Malware payload (RaccoonStealer)", "value": "3bed62488c0dd70730c2445669b64b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027955, "uuid": "c3f5c15a-c292-443b-9287-118100e943f3", "comment": "Malware payload (RaccoonStealer)", "value": "990fc57523f695bbd5814b6b66bf0e3caecd7ccd66900c41faa2edb9ec3e3ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027955, "uuid": "647bee4b-329d-494c-8ebd-b11c1f986f57", "comment": "Malware payload (RaccoonStealer)", "value": "23f6ae640b04ce17afe8aaae5c912fdcacb100f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632027955, "uuid": "c79f24e9-0bf2-44dc-9b6b-3a525bf8c1e6", "comment": "Malware payload (RaccoonStealer)", "value": "a73d2cddb5abf83eea8840644085daaaf2805f33b8d97d002d8f428b1b64b7acf754ff2e986c45b762a7697fcd6f8e32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027955, "uuid": "0590aa25-4bf5-4f8e-ad3a-3ee17911d1e2", "value": "T166B4E120BA90C035E4BB02F959B98368B82C7DB19B2485CB63D656FE53387F49D31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027955, "uuid": "e6fdbb6f-0591-4f55-8339-36e6360ac38f", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027955, "uuid": "6c27a9ba-118c-4eb2-877c-41fb9e39f75a", "value": "12288:0ZyxD4yq0mdMEfrTg5gjLbuf/ODCY76p+FiEpeWYE81o:0QxD87Tyg6fml9ner", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632027955, "uuid": "519faeaf-657f-4a83-891c-89008dcb9d53", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632027955, "uuid": "16d01df1-46d9-4de4-9167-edd39fae4578", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632027955, "uuid": "8b657a99-db13-4aa3-a23a-a93c511a9434", "value": "990fc57523f695bbd5814b6b66bf0e3caecd7ccd66900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f03690-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070200, "uuid": "74f65194-22b8-4b5e-9bd3-31d8531c2ba4", "comment": "Malware payload (SnakeKeylogger)", "value": "2037ddf64782c00747fe2834b256e4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070200, "uuid": "7a43de3e-008c-4bc0-9e21-99f2fb93cc3c", "comment": "Malware payload (SnakeKeylogger)", "value": "9c2da9a2124af3cca14134cd848769702fd59d4d639245d881940d5b777e22d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070200, "uuid": "837499b9-0494-4df8-9976-6eb6751cfab0", "comment": "Malware payload (SnakeKeylogger)", "value": "455feae71bdf87cecf427f81f76a7f57d1d2ff45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070200, "uuid": "448db51c-c213-4693-94c5-4910ccba425a", "comment": "Malware payload (SnakeKeylogger)", "value": "395ff07b2d9a8d852a3c9df9df4dd71240d929d2554c11338e7b40ae86c5058ab25c3cddc60cc127b83e0025670fd150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070200, "uuid": "b45a28a3-5532-4bbd-a63d-1147c27c55d7", "value": "T1EA74028E3765FF6FE8B80AF9C5E115241B70506A6181E3C64CE051EA66C7BE85703ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070200, "uuid": "194d6534-81ea-4f83-a4de-bdeb86818a42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070200, "uuid": "8906201c-f18b-4b9d-bc38-1722f3fb3fb5", "value": "6144:xUMcwfvPmxMyno2xijbbzLhw5nhbZ0/5BALmOxMsOy7YWgqzBjo6:xUM9vuxMXt3bzLhwNhe/5BALmS3Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070200, "uuid": "72132799-996b-4974-b3f5-c7af2e488098", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070200, "uuid": "0d7ba8f5-9614-43d4-922f-b736dde13545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070200, "uuid": "64f1d5fe-c724-4e17-bc18-3b251d2b741b", "value": "2037ddf64782c00747fe2834b256e4f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9484f82-1936-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048336, "uuid": "d38fc0de-39d4-4227-84af-eb6601be0553", "comment": "Malware payload (RemoteManipulator)", "value": "414b6d9c4129d65711ed8f2978e8e678", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048336, "uuid": "f80de997-0e22-4504-bc13-915f7051efbe", "comment": "Malware payload (RemoteManipulator)", "value": "9d34f653edf948d9f46522081ff00dddf2f4b62b18d138c49e3b281ca953aeb1", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048336, "uuid": "1881678f-9a87-4bb1-968d-2ad1ded7c7f8", "comment": "Malware payload (RemoteManipulator)", "value": "e99eb25f269749fdb4f9d3e78c905c59a33f0c4a", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048336, "uuid": "c85dcffb-490c-4c2e-83bb-f1a5106ca35d", "comment": "Malware payload (RemoteManipulator)", "value": "6ff3f227f319b62daf5216199ee0a090d9ab68b6e27571a165d43bcbe7a52c74b3a6a038722541af71394235f26b2db0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048336, "uuid": "3c635153-f909-4365-b6b8-afad2eafdfef", "value": "T15E0733C3FBF00429FABF0672A5FA5F184A26FCD8AA75130E16D4B245A063D460C667D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048336, "uuid": "eb05673f-f8af-4f88-aef1-02240ae1f6ed", "value": "19b321cb7a9ce31c90397152f38b67ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048336, "uuid": "9d8bdc35-dab6-4aff-9295-84ef0b699265", "value": "393216:p8xCR5x8WLx1IEMaVS+UstJLKAV6MOrgfg6saiwgIS4/v:p8ERoIhMKS+UQL9V6drwg5aPgIS4/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048336, "uuid": "70a0cd0d-a844-45b6-912f-45b377f2453e", "value": 18164224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048336, "uuid": "1bbdccc2-44ad-4f42-be56-a90cd065a32d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048336, "uuid": "ece708a0-2d28-4860-9fe8-bd79db035ad4", "value": "9d34f653edf948d9f46522081ff00dddf2f4b62b18d138c49e3b281ca953aeb1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27651647-197c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632078156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078156, "uuid": "b981b1bb-0a50-4761-a35a-59d838a2d109", "comment": "Malware payload", "value": "077824d166b694addfa6236f176320a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078156, "uuid": "2305c768-8899-49ee-9c7b-cbfb92264e54", "comment": "Malware payload", "value": "9dc7f9c0d0554a9523ffbf163b42fe1396b6257a79eea2e0b35315923a47c9a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078156, "uuid": "3cc96865-e2d5-48cc-bf82-29d8bb42e8e3", "comment": "Malware payload", "value": "5496be6cc9cf51018c8f6da779be115563b0615c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632078156, "uuid": "4ddd8cdf-9ba4-4251-b30d-d2d09e5382a2", "comment": "Malware payload", "value": "52aec810382f02dcb884a6c55c12a2cff68555a8ec6bea3a4af1fa345e28cec6526548dd4cbb13ff18d9f7ce14a94830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078156, "uuid": "f93b34ac-5ac4-4cf8-94b3-9e947647f5eb", "value": "T1BC349D20BBA0C035F5F712F859BA93A8A93D7A716B3051CB52D616FE26346E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078156, "uuid": "613d5d0c-e3b0-4865-a14e-f89d83ae2623", "value": "84b4e1608c2b803bd96f193ead776993", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078156, "uuid": "52bd84f5-5c0a-40a0-a0c4-c22df2495190", "value": "6144:hnZQ6iwz9py6BNiZGFMUQ9xk1bFXJzKBomuS+sc8:tZjz9py6BEvUQP4FlHS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632078156, "uuid": "b2909a45-23c5-4c7a-8574-5a2bd00973aa", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632078156, "uuid": "41461616-d923-43a3-83cc-4a8706e34716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632078156, "uuid": "0856c2ce-e67b-4855-817b-549a3ff6ccab", "value": "077824d166b694addfa6236f176320a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f55133e-19a3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632095081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095081, "uuid": "0c2d49e9-6b71-4491-9d48-e714fd5e0335", "comment": "Malware payload (Mirai)", "value": "47e0337ee29aa82aeaec71411a9381f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095081, "uuid": "b48caa0f-8667-4fc6-9275-53c037ff1eb3", "comment": "Malware payload (Mirai)", "value": "9e4959295c0be39419a584541729747025d948785d80bb6a4193860433e22b70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095081, "uuid": "297b4e0d-6fea-4513-89e0-24154db698fc", "comment": "Malware payload (Mirai)", "value": "7b5525d1ce5fe902cf22fa6b25b89c0bffd6a503", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095081, "uuid": "f61e46b4-01bf-483a-99fd-b9ac66bf59f7", "comment": "Malware payload (Mirai)", "value": "f008ede3a796c1c6337fbd3ef36e3928fd5f49fe316d45326857331ec79f0768c1c2f85e92a9593b0921a85813385552", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095081, "uuid": "5787f7a8-a029-4b96-8369-8c63b47888f4", "value": "T11E237CB198FAADD4D148C674A9248A780B53E402C6472EF95A4AC356504FFFCF62D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095081, "uuid": "910536f9-b5cc-4625-bc68-ba739c8890f1", "value": "768:UaKtUwth8ANVYhxneqCBvV9grHnl/fLiMd7/qBDCIm4owE4JCrLAm:UaUUwtO1MErHlXB/qBDewBJCrL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632095081, "uuid": "423df9b3-161a-4364-9af3-30f9585f957a", "value": 48784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632095081, "uuid": "9c569fe2-5836-4e5e-b386-caf1b7c18381", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095081, "uuid": "040e00dd-5897-4496-9475-fc8f35e4dad5", "value": "47e0337ee29aa82aeaec71411a9381f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e197e3aa-1966-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632069020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069020, "uuid": "2ee78066-7b03-4e12-ba5c-bdd48b50624f", "comment": "Malware payload (Mirai)", "value": "2d94a0896e1992e5b9b9d108b2cc3aff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069020, "uuid": "4c66861c-a2be-4574-8177-67b848ef9611", "comment": "Malware payload (Mirai)", "value": "a138d320e2a0a01daba672646b13b12f9d6d0153b410b19a99b436f75d709186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069020, "uuid": "480559da-0f19-449d-be5b-504de3161faa", "comment": "Malware payload (Mirai)", "value": "b99ef0f0596ca6cffeadf1beb7e70caa1b33727c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069020, "uuid": "307d1038-2c93-4980-9ba9-f09596f9ab99", "comment": "Malware payload (Mirai)", "value": "6346581affe6f3968a43e4801576dc5c37cabbef9889ac092d78a1df53c7323dcb63a24c9ec4b408636b74db7c87f131", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069020, "uuid": "d9643f5c-f033-4d97-b526-3fb5b329dbec", "value": "T1BC8382097F210FF7EC6ECD3B09E92B55248D641A22A87B35B934E818F64B25F15E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069020, "uuid": "7d6fc612-d304-4554-baa9-f328d9384ef3", "value": "1536:LDZK619INlDGrvqPBRZhHbrqtB4b+i6/Qm:L/GNlDHBRZhP+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069020, "uuid": "b2bef461-799f-49ae-902f-d00abef37b2a", "value": 88632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069020, "uuid": "b7c10985-6bb0-4a80-b914-c94593acbf90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069020, "uuid": "58f8dd4b-e364-47cf-956f-f1a390a947a1", "value": "2d94a0896e1992e5b9b9d108b2cc3aff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925ba0d2-196f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632072752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072752, "uuid": "4ae8952e-293f-4bdf-a7aa-04e97ead6f50", "comment": "Malware payload (Mirai)", "value": "f188b5e9a541627078c536a1615f59f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072752, "uuid": "f4d567b5-62b4-4d36-8c48-c3bca2867e78", "comment": "Malware payload (Mirai)", "value": "a2f41e6b55612ef03ad1efc994051baf2474166e4fa2df3a133bb8f75b302a82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072752, "uuid": "8969c826-32e4-4a94-bbcb-1600b914d295", "comment": "Malware payload (Mirai)", "value": "5cd9b167860055bdb9a9d39462190650fab34df0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072752, "uuid": "9248c78f-98cb-4b50-97d0-526e674a7c16", "comment": "Malware payload (Mirai)", "value": "e205a3f8b7c5357403d24ea04bcc591113b4a6865a3676ae76fb966823c24c7b22746431965cd7493475ace09a66f6dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072752, "uuid": "8ac160f9-3c78-4054-ad4f-9aaf552861c8", "value": "T1F1F37436B7619E77D80ECE7305A985121C8CD98712D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072752, "uuid": "03ade4bc-17b2-4d18-8fac-73d445dbb03d", "value": "3072:1LNqrhHZ0P6bRFBQiifRjHkLwmrThPaLEne7rNb:1Lsrr0PeRTJ8gLwmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632072752, "uuid": "2da88ed5-1e58-4d25-9945-0b7c03b271d8", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632072752, "uuid": "37980c36-b8d5-41a6-9b76-4258fedb6ab4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072752, "uuid": "34eb30ff-2c86-4727-b48a-3f4680381ca4", "value": "f188b5e9a541627078c536a1615f59f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b13670-1989-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083905, "uuid": "be19425f-6d54-49d4-a3b0-1692be6bf208", "comment": "Malware payload (Mirai)", "value": "07cf4b144d1bcbadab76f4c8c15e5e05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083905, "uuid": "b5fe73c2-ef50-4f1d-b385-55452db00548", "comment": "Malware payload (Mirai)", "value": "a4eec3d7fd48bf47944d8ffea2835a0e04837e30d6cf8c059e765b569447e86f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083905, "uuid": "d1b32cd7-eb23-4ad4-803c-b0e18ab291fa", "comment": "Malware payload (Mirai)", "value": "39cd9a18ab62f4be7b4cc0caff0630f7cb3a408b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083905, "uuid": "0f821b3b-db13-45be-a72d-64ccf8205228", "comment": "Malware payload (Mirai)", "value": "5345cfd18d93359b6420ff75aefdceb6074299ab6ddf1e73537565737dd65dd5222a79b9435b7571129d94b05adcc6aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083905, "uuid": "76fbfa74-06f1-4099-88c8-41046251cacb", "value": "T1ABC2E154946CCEF1C4B1E632FC628542BF8B0BBCD43FB67321B4776885E245B4969583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083905, "uuid": "ab163bed-b754-4b35-965a-7f878fdaa838", "value": "384:m/Y5xJwu712RW27d8U+ynuwKt8UTTstzymzg9fyymSk06orMJpUnenTKImh7qmd6:6scWgZHCxTcbK7lk0puewm9q3UELK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083905, "uuid": "5a52c120-475e-4b37-8a37-52fa21ad7f43", "value": 27488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083905, "uuid": "a46bdf89-82a5-472f-a063-ea4a3a5acf7a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083905, "uuid": "95686cde-aace-4aca-83d3-73171685fd0e", "value": "07cf4b144d1bcbadab76f4c8c15e5e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5393918-1903-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632026452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632026452, "uuid": "4d40a1f3-bbb9-4632-a41a-f086efd041f8", "comment": "Malware payload (RaccoonStealer)", "value": "7bc61d6a7226a2e9832a54a517af5313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632026452, "uuid": "30faa812-3659-4bfe-b28f-9dccf1ac961f", "comment": "Malware payload (RaccoonStealer)", "value": "a56a640c907fb37b76e27091785c28b2b182967cf7c3c9f2a78d5e72fd754e99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632026452, "uuid": "657c80a5-e90a-4ca7-82cc-98b85843e770", "comment": "Malware payload (RaccoonStealer)", "value": "36e6f224b23a23c8efaf435927b53b9997aaffcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632026452, "uuid": "50ffeda7-a0f4-4e8c-9e68-b8ce46196612", "comment": "Malware payload (RaccoonStealer)", "value": "5a44818fe03b2b503e7e37626e66ec9f5d942839f41d2796fc8adb39e0bf66e683a2af2f7f3a82415cc150fc140b1e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632026452, "uuid": "9ac84336-c28f-40dd-b043-ba77fe62ec33", "value": "T1CAB4E020ABD0C036E4F712F859B993A8B43C7AB09B3450CB62D656FE17386E49D31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632026452, "uuid": "254bbf43-8b20-436c-9405-5935374c12bc", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632026452, "uuid": "e7c5c438-9412-485f-bccf-b79c2442d604", "value": "12288:vZ10YrrVnFkq3ngzWStFfXLZgbPbFAgKN/FTQVY2tlR9u+A:vH0Y9aSST7ibP+9EVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632026452, "uuid": "064ce0b3-ec40-445e-b472-d69a03d03e43", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632026452, "uuid": "9fc6c97b-9169-489c-b497-c8251f7edfd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632026452, "uuid": "e3f6832c-b0f7-4f11-a4b1-08f40b795489", "value": "a56a640c907fb37b76e27091785c28b2b182967cf7c3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1357aaea-18fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632023147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023147, "uuid": "6650e131-97fb-49fd-bb3f-02272f10906e", "comment": "Malware payload (RaccoonStealer)", "value": "bd12d2b1de210e35bda86aeb1ed93990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023147, "uuid": "ad911e25-04df-4d3e-bc51-0ecc631b375d", "comment": "Malware payload (RaccoonStealer)", "value": "a6138bfb77064ffd88eaa2d1afa62a211608237ccd4f8192ebbd48ac99fc92a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023147, "uuid": "730718ae-2cc3-4382-94a8-7faf60badc7b", "comment": "Malware payload (RaccoonStealer)", "value": "57d4d0af89cf3f8d179b4fc9d4457fcf446d730f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023147, "uuid": "68dac5ff-7d7d-4882-8c74-72bb81334148", "comment": "Malware payload (RaccoonStealer)", "value": "81a288394da7460c6fdaf0b71de1db2f7dff36c8e0afbbcd4f68f2d0286d984d688465bb1e73aec276c797c1d966fb7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632023147, "uuid": "a4dbe035-0330-4694-a193-f159fbee375b", "value": "T1E1349E20BB90C035F0B712F959B993B8A93D7AB19B3450CB62D626FE56346E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632023147, "uuid": "f4073553-9b30-40e7-a8e4-d5ba91c35411", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632023147, "uuid": "8c26700c-4047-4523-80cc-67c5aeb396f8", "value": "6144:HaZQ33l9xrXhYQKoZ3mkv7XMXqAMNlunEyyx:6ZorXhYQMkvzMaAMNlGE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632023147, "uuid": "c9795fa7-c4a6-4022-9d03-fc4d5a59cb41", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632023147, "uuid": "383b2692-8c28-4ace-a6ea-89acad23128c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632023147, "uuid": "09e2fbf9-858e-4162-a01a-2d499e8fca64", "value": "bd12d2b1de210e35bda86aeb1ed93990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46504097-199c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632091952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632091952, "uuid": "bcb33297-8bf4-483b-a10e-0cd6dac41e33", "comment": "Malware payload", "value": "c15386d29ee15f6e62fcedf9e09c36d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632091952, "uuid": "3903ae45-2449-41d3-bb63-b50f27ab98ea", "comment": "Malware payload", "value": "a64593eda5475dfe88df519417b82923962411cbcfcd2997e93ac9daf6ada420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632091952, "uuid": "0b94ef82-5059-4bed-a9d2-566f95e446c3", "comment": "Malware payload", "value": "78f9fd16194ea205e902889153bd7976067b9506", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632091952, "uuid": "03678574-0d33-4b40-bb42-3c5b144b43dd", "comment": "Malware payload", "value": "03a5bda22f21f663346f8dfddb05259c1b6d6596badcf3b98c1459db8102754b4ceb86d3fd3d05b489ad58269a023d1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632091952, "uuid": "44113eb3-89ef-4291-9676-429ba2b33d9b", "value": "T1D6263310E7A0C0B5F0BB05F9B9F6936A281A76B26F745ACB62C556FE52307E85D31303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632091952, "uuid": "1fcc6896-7eb0-4cae-b989-07487771291f", "value": "9b494192bab1e0e5f914d8f6d610f95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632091952, "uuid": "bd0cfefe-a299-4345-b92c-106ff2191ad8", "value": "98304:YWhS3aXklA/XlZ9ry34r6q2C7rUyx3jXG6aV:30D0RryeNPUaC6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632091952, "uuid": "91012a4c-00d8-4444-9bea-82c749cb75b1", "value": 4632616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632091952, "uuid": "ac758c04-5183-44fa-9629-4322fac075c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632091952, "uuid": "c2e45190-55cb-47d4-9741-c2d39c72f776", "value": "c15386d29ee15f6e62fcedf9e09c36d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f76f8b-195e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632065368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065368, "uuid": "1d0b26ae-8f47-4a15-8d03-c46fb572c7e2", "comment": "Malware payload (Mirai)", "value": "81fd6110d6c551d4760e7e1f05dafabf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065368, "uuid": "df019dd4-107f-465c-b692-5b311a0bb281", "comment": "Malware payload (Mirai)", "value": "a8d9f92b47daa1a64721f93b86a0c34596e4300f04bc12363743a83ef9d42698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065368, "uuid": "d653588a-07de-45d2-beea-01feafa7e289", "comment": "Malware payload (Mirai)", "value": "eb28270fbddaf41275e3600e666c8508adf78146", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065368, "uuid": "6d8a5c5b-d8c6-461f-bd24-49be509e0098", "comment": "Malware payload (Mirai)", "value": "3ad39ecee11db571faa1f939944dc2ffc3d199299b450abb6102d2747c002b69263f990e5bf954ae7145a21d107fde1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065368, "uuid": "abc54938-aa62-4d27-8c7d-740d44fa0681", "value": "T1B7D2D15165E58785DC1A94F92E7EBCC84D70F308510885F2FCE871BB68B7E9886FC211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065368, "uuid": "babf6d7d-37ad-4319-93de-d49d21fd6919", "value": "768:xu10uwKSUh7UaQIFjnqajSPwOTFOZ5jAnbcuyD7U4yqy:s10EQaJhhSDFOZNAnouy8Dqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632065368, "uuid": "44ca3861-2993-440b-9215-67ef5c8c1e21", "value": 29580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632065368, "uuid": "c18241ce-1ec7-408b-a44c-a8f70679893e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065368, "uuid": "fceff08b-64a2-4bec-8037-1244f209091c", "value": "r.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501f16e1-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070064, "uuid": "8ca28f97-767b-4a09-bb80-28e776414a5b", "comment": "Malware payload (SnakeKeylogger)", "value": "3786b1738161070d3d7d36f4c1a43ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070064, "uuid": "42c7172f-3563-4ce9-877d-ee0e2ac8673f", "comment": "Malware payload (SnakeKeylogger)", "value": "a937ea15f15c9ea7ac496b540ff4243276746550d72b908d2151c2b4f9fc76bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070064, "uuid": "5b3da216-d700-4591-b5b6-1e9280de5573", "comment": "Malware payload (SnakeKeylogger)", "value": "0c5459bcb35db7e1437184db251e0f5b41ea43f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070064, "uuid": "c831ffa6-55cd-478b-9cdd-0838fcbb0cec", "comment": "Malware payload (SnakeKeylogger)", "value": "a090fbe2a3e3f7c06004da345b1bdecc08d5b875dfdfa4b2b53e9eb97a46ae7a13b14af9fd3d848c74edd515c8a97ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070064, "uuid": "4a7d5433-0a55-4684-90bf-04e409d24ede", "value": "T140B41860156E7D75C0746B3A477357E50BEEEC402A7ACF896B21F27A103C6DB7E4220A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070064, "uuid": "c75bf64c-6c5b-4237-9fa9-fd1c5815dd79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070064, "uuid": "43c7c659-c112-419d-a7ce-cfab0bb4b9b5", "value": "6144:U8b9UM7P7EvKjW8sUqGJkTznyouSmSX7:UkUMM78Xq0U6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070064, "uuid": "725ae524-cc26-4d6a-9994-c05a67963325", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070064, "uuid": "77b1aaaa-492c-4871-8e66-900bb699c334", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070064, "uuid": "1322bddd-df5f-4cc9-bd47-d8eef5dfa75f", "value": "21168 PI CMI 03092021.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715f462a-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632032754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032754, "uuid": "23a6704b-4c8b-4957-8f36-6bb88c5b9638", "comment": "Malware payload", "value": "3d7c017e57dd44b576c6b93ac9d3f481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032754, "uuid": "829576c6-71ee-4190-9e6f-f5693af8e9e6", "comment": "Malware payload", "value": "a997b3b74212edb73869768c7645f7126206dcd92ace612afbec132f0e40cf6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032754, "uuid": "8a41b3f3-a65e-4682-8356-58383f610205", "comment": "Malware payload", "value": "fbde5445bf2f22259a8c0e278eec352f1db61641", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032754, "uuid": "1f0f2bd3-a2b4-41bf-9d1a-626b98a28df6", "comment": "Malware payload", "value": "621a82cdf2229ec43e2f3068649fdd5deea9d370700a533f09c8a6ed09c95b0614f0f0975f8d4836ba45fc55d8c547e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032754, "uuid": "c92e5399-fbb8-4623-9ad9-87d5225f9ef1", "value": "T188268D117395943EE06B0F3648FB9B759C3ABB612A13CD4BA3F40A4C4F356417A3A267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032754, "uuid": "e4123f17-5eb8-481d-9c94-bd37d9d1d0f1", "value": "873ed796302b95e0f8f1631d0b4ad085", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032754, "uuid": "fff1455e-f699-4ace-a872-16949ad3a02a", "value": "49152:RNk5Sje623zostEc/t3SLzmSAjOZMe7R636tYnykSpSx9KIAT4H02TR:R+toov/tiplO6tYnykScxR0yR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032754, "uuid": "c2a3f2c1-96ab-492a-9129-bebcd4920cdc", "value": 4531892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032754, "uuid": "8e39d14e-5936-4f58-9ceb-7b0f008009ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032754, "uuid": "9a6de6ed-a5cf-4c3c-b5f7-427c3e522b9d", "value": "3d7c017e57dd44b576c6b93ac9d3f481.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5351815f-199d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632092404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092404, "uuid": "f71f1b06-0cc2-41b6-99cc-a5bf3a5147fd", "comment": "Malware payload (Mirai)", "value": "690d250ea966afc44b8952068ae7d185", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092404, "uuid": "12e46e49-e48e-41ba-9103-e83069bc3f7b", "comment": "Malware payload (Mirai)", "value": "a9a0aa1987051b5248d0c00c396a6876bfe22c9222acda07b1956530f9642f95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092404, "uuid": "71dba602-b9e4-479e-acd0-3fdb35cb6945", "comment": "Malware payload (Mirai)", "value": "1e139083e190b1531d0aeb0c761fe2c8b2b994b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092404, "uuid": "5cbdcacc-1f62-4d87-9bcb-9fe5a4b0fa13", "comment": "Malware payload (Mirai)", "value": "b7c8b340b8e21d171b720a4c7ca50e37056e96971b8614620e524ade3ffd134820a69ba9e8032c07d3e84562a39c1e56", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092404, "uuid": "8a0981d4-e210-4bee-9814-49c5d57c88aa", "value": "T1ABC33A46FA418B53C4D51B7AFAAF41493322E798D3DB730689186FF43F8666E0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092404, "uuid": "9368fff1-29a2-4cb7-8589-f140e1b1f3e0", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl7D1+b2L8M/91ce/:skHK8uz4hlVPqRJd2NSb2wM/91ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632092404, "uuid": "bd91c4ae-9e14-4cf9-955d-908772cf7bf5", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632092404, "uuid": "d8b33678-5576-441c-a9a3-6f46ae9a8f96", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092404, "uuid": "e13d3579-e644-4eb2-8637-7e03c7fb1a6e", "value": "DEMONS.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d7460c-1982-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632081003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081003, "uuid": "d54882a9-9947-4f8e-afb6-b3e5372cb1f7", "comment": "Malware payload (Mirai)", "value": "ba8d4ec4bc23bacb8e7545c2b466dcf2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081003, "uuid": "b5c8fe8f-01c6-4248-ae84-4253862e0809", "comment": "Malware payload (Mirai)", "value": "aa6b4674202df0743265e78f9f040876e6f4e7908c1f757e912d0813fe943dff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081003, "uuid": "619160bc-499e-465f-9cf8-a9f6699701ec", "comment": "Malware payload (Mirai)", "value": "fb24a7241f6fbd46be48e025974bc7df48b064fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081003, "uuid": "19eb6b9f-18d3-40d1-9510-cad9ae7e0d80", "comment": "Malware payload (Mirai)", "value": "c243cdb6130d329db27378afb41552e17e677d479bbd63909d4919284683b5b36328ab5bcadfdc476d584d5e85346f5a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081003, "uuid": "1ef6d3a8-201e-466f-9ea6-bf8aa4c15b9a", "value": "T1ECA2E2D5AD725C6BEEB6E0376BAEDC4683804DA2427813D9E66EC19231FD21E1051DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081003, "uuid": "4b0fb87e-afb3-433a-96ce-410078cafe74", "value": "384:MvX206yHsN1bGmfzgce2fYtoUz6iISkwyHYdQ/ACPbyCXnk+rQNyWB:c2/Wmf75YtoorpyHjDbyCTWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632081003, "uuid": "15905818-2e5a-496f-990a-a546dc8e431b", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632081003, "uuid": "691adf9c-50f1-4961-b51f-7eabb30ddb77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081003, "uuid": "a5f2d664-50a5-423a-a21a-10a52e4f5b27", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a44629e-193f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632052096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052096, "uuid": "87d1b60c-a2ed-4c3a-93ef-c6941a82ce83", "comment": "Malware payload (CobaltStrike)", "value": "5178d80dfe34058a67f13335fe81ae00", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052096, "uuid": "8fd573d4-e4f5-46d3-8f10-89c3cf3fc2ab", "comment": "Malware payload (CobaltStrike)", "value": "aa9838d662bdea0874c2c4f4b83f6bd8c970c7799734ac409bcc58095d2cb714", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052096, "uuid": "6be0ba5a-8ac4-47bb-a8ea-82f3acf9516b", "comment": "Malware payload (CobaltStrike)", "value": "8b29b6dc2cb4d457970322ee64bf566b5628c38d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052096, "uuid": "25276138-809a-40cd-a1ef-22a3594fec84", "comment": "Malware payload (CobaltStrike)", "value": "42c9125069b8fbc6079123b25cd49919313996add6deca4598cd017859abebc13c3e36bcb768b5940d73cfad924aea04", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052096, "uuid": "886b5046-85d8-47cf-80bd-8194b7fc0fb6", "value": "T18424E036229721BBD08D8A79C0EDDC256EF9D217DD39849BCBC20440A8DF3496F75AD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052096, "uuid": "a87afd61-5cc9-4f59-a070-968f328b280f", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052096, "uuid": "0698067a-26bc-482d-aa4c-f4a38c8c155d", "value": "6144:FTsX9h+QwGv6tuY0eami/izTLLL5syhP:ReQQwpL93LLL5VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632052096, "uuid": "0aadbd37-9f5a-4d23-b852-4768e1bcb638", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632052096, "uuid": "87b7d183-ef02-44ce-8d54-0dae0927f790", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052096, "uuid": "b76d535d-b8ee-4c23-93f0-faf2816108d6", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc35d37b-19a2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632094781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094781, "uuid": "249c7ced-29b1-448e-b477-352126ff49c4", "comment": "Malware payload (Mirai)", "value": "fb68067760338ee5399e4aa8cf1ea30b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094781, "uuid": "f646d541-0513-4234-a60b-a8ff105c1190", "comment": "Malware payload (Mirai)", "value": "ab2f2e5c7161526c8ab2c0094a6e8f6b2d607a1402a2ede0f974bbece65da137", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094781, "uuid": "a02cccf9-9702-4f71-ac33-2ef0fdb685be", "comment": "Malware payload (Mirai)", "value": "13c0e1f13db708de3fff03e8bab7f423f8801010", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632094781, "uuid": "b897747c-2b99-43a7-aeb2-31e0d8080876", "comment": "Malware payload (Mirai)", "value": "e144555f2fae3bd82029bdd1d072d622f5e639e8704f775d4c6c05ab68e517030a773fb80b54c7ac3a18f0164f4d1a8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094781, "uuid": "2826daf4-8705-4331-a79a-c6e81afbcd26", "value": "T11763970E2E35CFADFB69863583F74A205654339522E5C649E26CFE015EB070D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094781, "uuid": "756b822a-bb2c-4700-9d8d-07f6e26011df", "value": "1536:t0NTVpDuVo/JxlBifnKurBoLiLXabIvl8euz1HmJH:mNT/DIa+KunwIvl8vz1HUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632094781, "uuid": "9fb6fd42-511c-432b-ab40-cca8ba405752", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632094781, "uuid": "e55748ec-a908-433a-afec-cd60f6e0320d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632094781, "uuid": "22588f78-bd17-4dfc-959a-3a99ac6d9895", "value": "fb68067760338ee5399e4aa8cf1ea30b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d32b67f-1940-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Numando)", "timestamp": 1632052423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052423, "uuid": "afa15db7-980b-475a-97e0-d6fd1ea6a47b", "comment": "Malware payload (Numando)", "value": "511f4e49af5641f2f7eb78c85948272b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052423, "uuid": "bf075995-57d7-49ee-b74e-d434654b6c69", "comment": "Malware payload (Numando)", "value": "ac85d354d06dd7f223d7908a24264d10a0c7663b23d18814e843c9548427e8e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052423, "uuid": "ed9f0fb6-4882-4b9d-924e-92b7e9779a47", "comment": "Malware payload (Numando)", "value": "e69e69fbf438f898729e0d99ef772814f7571728", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052423, "uuid": "aa7a9e06-fb7f-4cd1-8c4a-c810e7f846d8", "comment": "Malware payload (Numando)", "value": "67010b09d7ee0d353495993f9b4e0ae6cbb272387d9e18670061180e9236b5d5c21ede30ae946b47afde785fb0308d69", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052423, "uuid": "d7945801-a322-46b7-818e-e65ecf3a1b67", "value": "T1B1D58E13B2C4553FC06F0A35552B9668A93FB7612662CC5B67F0884CCE367812E3AE5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052423, "uuid": "04093cdc-f332-4b55-a54b-f1a42d8e496e", "value": "24576:xRF56glGHqZB8MvxqbFckXTnQAIe76eEhBKSI6X5QHq7Ww7nvh7Xu0TZDajLBBYG:xRf/p7vhgSfiHy9T+LBBYM+vw07RasA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632052423, "uuid": "93b5065d-99bb-459d-b9b7-730eb3d04bca", "value": 2999808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632052423, "uuid": "696239e4-e10d-4c47-bb02-4f7899a19888", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052423, "uuid": "5cae49b6-8ea2-4e69-88d7-e7ab44d990c7", "value": "ac85d354d06dd7f223d7908a24264d10a0c7663b23d18814e843c9548427e8e6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83df5184-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070151, "uuid": "43cac707-8e95-4475-ac1f-c023701b391e", "comment": "Malware payload (SnakeKeylogger)", "value": "43dae041e750892c11d22ec7422748ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070151, "uuid": "b442d3e6-be23-4451-bc96-58f1af3e5b7f", "comment": "Malware payload (SnakeKeylogger)", "value": "af41223eb9daa98fea5555e90a232634848bcc1801315a6f47edf20bbe086d3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070151, "uuid": "4226cc40-98b2-4a99-9b79-6f319bd9812c", "comment": "Malware payload (SnakeKeylogger)", "value": "bdb49a7414926d44d81c2e2a579be53701f7f1d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070151, "uuid": "b654184b-87ed-47f6-94f7-9e5b100095aa", "comment": "Malware payload (SnakeKeylogger)", "value": "fe26a71651669702e4023fca7a3cea58226e04976e5200b24babccbe425eeef1202ef8ad35c746325956bee5187cebad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070151, "uuid": "0c1c42a1-0bb3-4205-9295-e0b5b4c01332", "value": "T10CB42861166E7D75C0746B3A47B357E51BEEEC402A3ACF896B21F279003C6D77E4220A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070151, "uuid": "9b2430f5-d4ac-446e-aede-e0b9d4716f67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070151, "uuid": "c574fbe9-5e9f-4d52-a51e-8924c4088d7a", "value": "6144:0zbMk0CNDKxughuAB4bJE9a2oiy4TrTznyouSmSX7:0p0CNDKxuquAQ276k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070151, "uuid": "71a1dd24-fb45-4ac1-858f-3d680b519155", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070151, "uuid": "5d715c40-3fc9-47e8-b08a-edf7c2dba11e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070151, "uuid": "28d38aa4-7208-4c15-9160-3be6b2d2f3b8", "value": "doc03589320210903102516.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87dd1c5-196e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632072360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072360, "uuid": "8190fe46-ad2b-43ef-b155-9da7f124c6bf", "comment": "Malware payload (RaccoonStealer)", "value": "3a7ec50b3c48596288bac9c22417a59b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072360, "uuid": "1a4a4a65-b918-4f0f-bd11-278e20404ef0", "comment": "Malware payload (RaccoonStealer)", "value": "af6355e9d23ab7ede7f7163c3e4a57a77683aeeb262df643dd0c010339cc0997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072360, "uuid": "877b32bc-cfe2-4868-92c9-8ddebf81457d", "comment": "Malware payload (RaccoonStealer)", "value": "ca20249940c509ceca3273ce4bb563474a03293d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072360, "uuid": "196cad0f-1226-4817-8275-d3ee5036e6a6", "comment": "Malware payload (RaccoonStealer)", "value": "43459e22bd8e2e1bd1edaa9f57d830fafe38e9a52c26c1384febb87e1621bb8e36447908a2b96d22b2ae7c376fdb558c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072360, "uuid": "273da351-717e-41ad-ae2d-698a3aafbd60", "value": "T1A4B43960A350E3B1F19709FE11A65FB939281838CB98FCEBAF905D05E6241DD727127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072360, "uuid": "66b85c94-b4be-4361-a98a-5b48a5fd2761", "value": "fa60387d0028b4d3797a377f8f49d1bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072360, "uuid": "b090dfe5-24be-4d50-b771-4caedc9ae754", "value": "12288:VIWpmGcWBCu+m8jhqb7/J2xnwIjmTbpq:VIWpCtqb7CwDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632072360, "uuid": "5746c8a6-b332-48c7-bcbb-b3ba20f8cf14", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632072360, "uuid": "df64706f-d01b-4d06-80cf-8e1204ca3b7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072360, "uuid": "254d1493-9e4f-4642-8c54-1b11bbb07eaa", "value": "ca20249940c509ceca3273ce4bb563474a03293d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2985ab4-1987-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083222, "uuid": "6eea6e67-ccd7-4dba-95b0-593640b681aa", "comment": "Malware payload (Mirai)", "value": "9403384df712faad8bbc7a5ba651b448", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083222, "uuid": "43af6ca0-da8e-497e-9447-776b152bd404", "comment": "Malware payload (Mirai)", "value": "afa36dde3fef37cbbfa9e83ead65450ec4c1da4ff6cc7e1ef9dbd1edf39cd6e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083222, "uuid": "6218b848-0dd4-4aef-8545-77458aa3f31a", "comment": "Malware payload (Mirai)", "value": "8d7b7c77bd72533df3d35e32e319cfc2bd858e79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083222, "uuid": "664168a4-b968-4bea-bd6a-0734b0b1785e", "comment": "Malware payload (Mirai)", "value": "f253e6ec85d9c7a65468ffc2fcdeffd376252211ccea4870cf83fd1ab87c9ff91bb956177d3268e2a339c3988322a68d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083222, "uuid": "be9c7642-9d12-4c46-8c43-07f2c0075a0e", "value": "T108A2D0615180E051DA64383E8CEED5912E1A0ABDF2FE73723D4536F839DD60E36B9193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083222, "uuid": "3a40ca93-773e-4426-888c-eecd88f5cd26", "value": "384:SkzZKN+SRvuvDUkF/J2ydkY5bpC1aj0SWA5BanRMbgWhymdGUop5h5:VAZWDUK/mY5XVN/8Ws3UozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083222, "uuid": "4673581d-e325-4214-8432-e7d1e0f24df6", "value": 22476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083222, "uuid": "019ea950-3140-4174-a4ba-8cdfa3cac3aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083222, "uuid": "164e58da-73d5-4205-9540-8c6381915730", "value": "9403384df712faad8bbc7a5ba651b448", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8972b5a5-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632032794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032794, "uuid": "59bd81a6-1173-4a2e-a65e-aeae3d6dd55c", "comment": "Malware payload (Smoke Loader)", "value": "ad707d954ec4db7afc39aa4cd925b57e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032794, "uuid": "7c125d9d-7d2d-4465-af13-c9269c06bcea", "comment": "Malware payload (Smoke Loader)", "value": "b01667abd1c334db22823ae76b21136d35a17aa4ca6d88d8fb138f1925ff8b26", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032794, "uuid": "a752126f-911a-4109-aa42-9aedc224be4e", "comment": "Malware payload (Smoke Loader)", "value": "df358665bb5f2f3b45c20707d4726c60f6242117", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032794, "uuid": "3238d364-81c4-4f87-9aea-1367cbe7e132", "comment": "Malware payload (Smoke Loader)", "value": "e430be6f1994c9f2ac42f3f5ff6e18012cf00177f8bb9da196028bb83c99e77e222b5784bf5232e0a5de1e3f87a22627", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032794, "uuid": "faed6716-9bd9-4ffb-8808-1806ef96ab1f", "value": "T1EC349E20B690C035F5B712F9497A83B8A82C7EB15B3490CB52D616FE67346E8DC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032794, "uuid": "163b7b2f-8837-42aa-b12b-c74b208f9d26", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032794, "uuid": "bbc673ff-b8f6-4125-8396-649fab397d56", "value": "6144:huZQxmXjXZ4QDFKHO3FMoEeBMTQl9ACgPmbx:sZpZ4QDFbMo52TQl9ACpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032794, "uuid": "ef30941f-fc79-4c17-b775-2b2d1f5ddf66", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032794, "uuid": "560f65c9-b22d-400e-9c19-1d3937ed9259", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032794, "uuid": "cd9cdb9d-5822-40b4-a16e-ade857dc677e", "value": "ad707d954ec4db7afc39aa4cd925b57e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03bbe93-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070199, "uuid": "e1a0126f-a510-452a-909f-a0ed1f5895ce", "comment": "Malware payload (SnakeKeylogger)", "value": "e5b2e4dbe4bc66452124df6dd59fac93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070199, "uuid": "0bb7c41a-c80c-407e-8eb4-651aebb54371", "comment": "Malware payload (SnakeKeylogger)", "value": "b05d83bf5f35094c854c623854124b6f73b0f4b87720300efa5e6aa25ccf1804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070199, "uuid": "188f957b-b209-41de-85ee-0829a7495878", "comment": "Malware payload (SnakeKeylogger)", "value": "231005b69edff594148761f64ac9bd2e8c19e5c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070199, "uuid": "1ada2673-5bda-4799-8546-71ba04a11332", "comment": "Malware payload (SnakeKeylogger)", "value": "91a64bc5f04c32a5cae9aa95d81e33540ea8c24ff475b48f52ec6d605ff63ea575251bc8334d8133c33f8b809fd7d698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070199, "uuid": "f3ab2354-edab-466d-8068-f1e532ac006d", "value": "T18A440103E0C9AAF6C556C8B41D77BA35F736AD2881505D0B0F993C29EA3044746BBF6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070199, "uuid": "9f9a682e-4ffe-4913-9a10-ab7730b72a20", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070199, "uuid": "61d5dbeb-34ac-458c-9559-143a490460d3", "value": "6144:B8LxBQUKdrkH9kKzv79bRxogBPjdjh/QPb8P+upQ+9RvtLem9:zUoK/9bDxPpuPb8P+upV979", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070199, "uuid": "bb37bfe2-f3e9-4b87-b539-2be5661b5ab8", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070199, "uuid": "87c70971-fc1a-4bb7-a3e9-7d66ae2f897d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070199, "uuid": "e70471f3-ef18-498b-9cc8-82375f565441", "value": "Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d14423-1982-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632081004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081004, "uuid": "e56790bc-835f-4c5d-90c8-484f3e548463", "comment": "Malware payload (Mirai)", "value": "6eb7fd49ad8477482bdde0bff6025314", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081004, "uuid": "34bdf5a1-f1f8-47b1-bbc5-665a5cf4227e", "comment": "Malware payload (Mirai)", "value": "b2825dcf89a31d3be295405bf195268c16ba046e4eb99481d176e1cd8638b05a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081004, "uuid": "c77fa082-bdae-44f4-bf73-dbcef95c0558", "comment": "Malware payload (Mirai)", "value": "2f84c4084ec0f2ba78c8bffa18951a48ca1fa4a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081004, "uuid": "0d5610d3-663b-4061-9ddb-101d3c1bfa7d", "comment": "Malware payload (Mirai)", "value": "454aac6e2e9e1d63dc7e74727bef6fb9bfc656c188cc17e8f572a2c7868a9d29f297c1d679295bbe5a51aa0bb1af27a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081004, "uuid": "d16aca97-fec9-4d5d-979d-1943be2d8357", "value": "T1C12302461B246401CBA12E7FEA94C3139B5B2B76D0A93AE07AA845473F41E9335D8FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081004, "uuid": "f93ef981-4153-4099-84d5-ce10ce3d765c", "value": "768:EHq8XdG1zv6dgQqzo/8r0Ak6DOXz9nDKaR9q3UELbyBZRUpjx6+KNn2CaX:EHq8XdKziiQL/8HKXND7ELbSUpk5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632081004, "uuid": "799b7ace-94c6-409e-a3e1-c18c06bfd3b7", "value": 46848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632081004, "uuid": "0574a9b8-f7f4-4f19-b9d7-a3c4e58af092", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081004, "uuid": "87b95ca5-b1c3-450f-b971-6a9777f6cf6d", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5572f3b9-199d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632092407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092407, "uuid": "03b279a6-062e-4e6c-8473-48de4e549c67", "comment": "Malware payload (Mirai)", "value": "a5d25e9130ba72d5ba9b98ff81e58c13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092407, "uuid": "4fdd912a-ec1f-4277-99c5-40b5fd10eb54", "comment": "Malware payload (Mirai)", "value": "b336bb9b35e5533d68f01e70ce8954484b975f36b2762ed72d87306545d952ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092407, "uuid": "3136be92-83e4-4d4a-ad6b-3adb1266afab", "comment": "Malware payload (Mirai)", "value": "d5bb26f62b480288ea9586a1420961652e55c3b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632092407, "uuid": "803a9e2b-db0a-4d7f-ad4e-50f77825d613", "comment": "Malware payload (Mirai)", "value": "70c17e4eae1a8474b51e10d1a5837111f3b8b03df69efd98fa3630ac6258d81d8dd4615c4660aade78e4370eca5d9937", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092407, "uuid": "b37e255e-a8e7-4985-96c5-aa52a7591a57", "value": "T117431854BC929A26C6E4277BFA2E418C731563ECD1EE3202DC292FF4768582F0D6B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092407, "uuid": "32954cb3-3ab2-46f9-ba80-16b81d5bba1e", "value": "1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5ss1:wXYWyCc90TIQp2xyR6s1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632092407, "uuid": "e28fe613-799e-4a81-9746-596d7f222dcf", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632092407, "uuid": "c21c21da-cfd1-4c9a-9321-bc19ce3f13bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632092407, "uuid": "7208ba0e-ae92-457c-a8b8-88891bf7a606", "value": "DEMONS.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6f4fa6-18e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1632013227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632013227, "uuid": "3da5c254-dac3-4058-a341-448735a2aa8c", "comment": "Malware payload (RemcosRAT)", "value": "7d5253655d6b9137193c9eb1876c1aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632013227, "uuid": "906837ca-3407-4a7d-82e6-8fc3de5e451a", "comment": "Malware payload (RemcosRAT)", "value": "b484a4cb667f840e50d5fe91ed76752a5db90759ed1cac25ec965ce5751da9e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632013227, "uuid": "239364c5-5a32-4364-a632-c8023b29457a", "comment": "Malware payload (RemcosRAT)", "value": "b230f6d6c9afe11c7a88da8e6a8b87288d78fd10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632013227, "uuid": "76bccce4-f3e4-4650-887d-a25c9306bbc2", "comment": "Malware payload (RemcosRAT)", "value": "6ae777621d5fe75c7ae652ecac1f01244b3a51536e5d1adaa8f2d2572030cecc5f8fe2d0af133ea90b1e2ee846f5e407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632013227, "uuid": "63a8b437-8e65-48e2-b541-5f495dbab858", "value": "T118F45C6A63424C76F427A43DCCEF5694223AFDF23D511C4A5E992B982B29BF13D0C187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632013227, "uuid": "64ae0152-47bc-4ccb-ab67-dc3aabf737fe", "value": "fb0fb50fc7c6eefdc89f28e9331a4c3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632013227, "uuid": "c77790fa-652c-4fa7-aa75-29298d02347b", "value": "12288:8ISLoNauMjmGZaHe3YCMFPitHq9U2dvnk6LHC7WWnMvwfHVBPggseBn5:8Iv4jmTHeoVKBq22BngseB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632013227, "uuid": "279a48d3-0e61-478e-b669-efa3909fd257", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632013227, "uuid": "8457af17-34ce-404e-9916-11574e4251be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632013227, "uuid": "9fce9a2f-5fe1-4ca0-88ff-dbdf47afd511", "value": "SecuriteInfo.com.Trojan.Win32.DelfInject.6c9c1654.29864.26219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408f758e-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632063596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063596, "uuid": "b15abc15-bac8-4943-8f4a-55accf47d991", "comment": "Malware payload (RedLineStealer)", "value": "0b7347aac3b4513ed12c31ba4b78013e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063596, "uuid": "81054a60-83d9-4f5d-b066-44f6800976fa", "comment": "Malware payload (RedLineStealer)", "value": "b557b6faa529023d009474b88f16f8e6400a3592d959416f434d366c0018f433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063596, "uuid": "1a797f88-14f3-4ad8-883c-3321f9067637", "comment": "Malware payload (RedLineStealer)", "value": "d712cd45e095232a776af5ee019f226291ba129b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063596, "uuid": "9b8780ee-26bd-420d-a0d4-df01eb558873", "comment": "Malware payload (RedLineStealer)", "value": "5fdfa1b41ca52e67d41c3ee1d38e1b74eada705f6d74f98c30d9de20f0fcb9c7537bc59c8e12ac198d278181b5971ec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063596, "uuid": "d487087e-448a-4a5a-943b-0b1067445e29", "value": "T1AEE5F8A0370656BBD24E2CF8D5DB9FC2A71802E04219D919B89EF475FB43D134A93BD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063596, "uuid": "bf4cb041-8d1d-47e3-819e-cba833ca721b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063596, "uuid": "1ac27ec1-aceb-4e05-90aa-14e4822226e0", "value": "24576:XEQ6S8srOXIX1OwC6YEHQhEz4r4t2owjPwdDFUVhRlKPvCqrlZkecb9iiaa5x/QT:XCS8sa+sJwHeVqG5cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063596, "uuid": "d3d72d3f-5af5-49b3-a9bb-fb4805695838", "value": 3268872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063596, "uuid": "7bd276af-5115-47f2-9474-b32c09e8cae4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063596, "uuid": "d6c76fea-f1d2-4f9a-93e4-a6f3d16564f3", "value": "0b7347aac3b4513ed12c31ba4b78013e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbc6a55-1970-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632072956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072956, "uuid": "808b2caf-c1b6-4487-91ee-01686b6ebf10", "comment": "Malware payload (RaccoonStealer)", "value": "d46b03320b0adb34a2b2b2f67e0d069a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072956, "uuid": "5b900154-35f7-4173-a7ba-90211400cf75", "comment": "Malware payload (RaccoonStealer)", "value": "b6b0254090db9c960db5dbd2d5d6e1f4f7e295e69721328fbed71d16e6ffc5fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072956, "uuid": "dc45183b-5217-487f-91e6-ec7d3c46e5e0", "comment": "Malware payload (RaccoonStealer)", "value": "179ef8e5caa3e2ada7b3e996d335b30aaf0fea6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072956, "uuid": "09b355c3-685d-488a-86d4-c793326f07ac", "comment": "Malware payload (RaccoonStealer)", "value": "470e2646631d141e1176701d0e389eea5859a058d4d24ffec8a9ff36f5ef0f100e712c5075bf3f14aeb4f1a122a392d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072956, "uuid": "fbac8fe6-bcef-4eb3-b0a2-6bd9ab311aa9", "value": "T111B4E120B6E0C035F5BB16F849B98768B92D7E71AB3090CB62D616FE26346E4DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072956, "uuid": "91c7701e-2b88-48a3-8993-41104e555b2a", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072956, "uuid": "4bcf4358-6f10-44f3-90d9-d9005421921b", "value": "12288:LZ9jrtrIhWLkLK637JDeE3dg22VyqRVsosVdgcNFveRp:LvjrtOKIDeyd/gMoKup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632072956, "uuid": "60a7a7b6-afbe-406d-8a01-11e17ef0f4f9", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632072956, "uuid": "8c179220-6b8c-49fc-a919-89900621f666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072956, "uuid": "4d571a3e-9c8a-4987-98ff-c60546d7bf2c", "value": "d46b03320b0adb34a2b2b2f67e0d069a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5953a8-18dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632010170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010170, "uuid": "268aaa32-8354-43dc-a8ac-cb12e3f3c2dc", "comment": "Malware payload (Mirai)", "value": "6ffb59bc5fba2fa473ddd7514ff1631a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010170, "uuid": "ff9b94d5-8741-4fbb-914c-b47672c81e0b", "comment": "Malware payload (Mirai)", "value": "b894c269ff11a1c633ab683b786844ab12713fd6042111a2034770f55f1e0aa6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010170, "uuid": "4f979c30-a4c2-43a8-bef7-8033a7159cd8", "comment": "Malware payload (Mirai)", "value": "20fdf737ec3acd5347712c14c4459dcad80627d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010170, "uuid": "cab29dac-5004-4707-9a79-421d54e2e5c6", "comment": "Malware payload (Mirai)", "value": "918ce8c256a65e4b1ece66d60e9d13b9dda1f595f9e86d1f247de74d84f9d2a5d94e1d6a13e5aa60c131680ad143339f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010170, "uuid": "9c1270e2-2123-4410-ab6c-63ad6095fcbb", "value": "T1B382C030564A64F1CAB13DBBD8DD81CA33124AECD9CE32B3693A6A6DAF8541152E4C16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010170, "uuid": "1580fa46-44d7-449d-b299-1edd3b252778", "value": "384:Fl47uDHsrZa5418sZ/c8wnk3Su46RE/eDxBQmdGUP/Sb:FlLMVg4dZ/cyCT6yeDxBQ3UXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632010170, "uuid": "0facf006-4d22-42ca-8e6b-646bc995c892", "value": 18796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632010170, "uuid": "8f1313c6-1e3b-4695-ac8d-0a9c59914a7a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010170, "uuid": "f278c23b-f1bb-47ee-ae07-d68235abaf3c", "value": "6ffb59bc5fba2fa473ddd7514ff1631a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0c37cf-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632032562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032562, "uuid": "a2012a93-00ed-4f15-a379-8e8682b33350", "comment": "Malware payload (ArkeiStealer)", "value": "cfcf30e6f7b22044cff8c51bc9d6a9a6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032562, "uuid": "21eb56ef-d4fd-4f6c-b9f4-ca5d69723b5a", "comment": "Malware payload (ArkeiStealer)", "value": "b8fd9da7f1b35abc5725425a0f36e26cd53d6030a67572cdc9744f23200c6962", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032562, "uuid": "f27a9c2e-d1e9-427e-8e4c-fff5a37c6ecc", "comment": "Malware payload (ArkeiStealer)", "value": "0074783d26b7087efd85b6a97c42dcd74e2d2b34", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032562, "uuid": "14c82696-69b5-4d00-82d8-5d34e0cc3d24", "comment": "Malware payload (ArkeiStealer)", "value": "c5603a1915ab60a86f10676ca9a229d9fac218d801d3d78d423160c7d86b4ff4497aba038274a5a7b05d564c28508042", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032562, "uuid": "dfa5ca36-9e45-4cb5-9be7-4f263b418386", "value": "T10D95B023B2934433C67F2678BD3752689825BE112A38688A2FE51EDC5FF46413B351DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032562, "uuid": "1c4d857f-6dcc-4154-aca0-b0efb224dcda", "value": "ec88d30de283c50d44daff3be84036bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032562, "uuid": "d9310521-dcb4-434f-8806-1b9450e391bb", "value": "49152:k7IMK8HmWcdU8luYj6zT9SrajsO1CsSGGKE:k7IMK8GtU8YzzQrjsS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032562, "uuid": "dd0a9d80-6576-4fc1-b803-337eee246a5a", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032562, "uuid": "0f5b878d-274e-4842-abef-5bc382003008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032562, "uuid": "3fd904e1-afb1-40d0-83e3-6655187f1c4f", "value": "cfcf30e6f7b22044cff8c51bc9d6a9a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ffb9dd-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070205, "uuid": "fcc7adfc-5f95-49ff-b353-d0985f706a70", "comment": "Malware payload (SnakeKeylogger)", "value": "cf78f7b86e52c82c78e0d9ed6ecddf9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070205, "uuid": "b35b394c-74d0-4cd0-87dd-e5712ed940dc", "comment": "Malware payload (SnakeKeylogger)", "value": "b9d01829b9d5233da5130de21dfdcf57843549565c32401f734e612c674ec3f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070205, "uuid": "162d89c8-e5c9-4993-896b-e00658eb6bad", "comment": "Malware payload (SnakeKeylogger)", "value": "b6e5cfaac2e13dab6a91fafa979a2bc223b2ed1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070205, "uuid": "60b19bf2-52b8-4481-93ca-3ca5c08a8cca", "comment": "Malware payload (SnakeKeylogger)", "value": "c7cb480ec6595024c01ae138c1bd87ae363177fcfa19bf3a579194a2cf5aee63d8d88d2daa9352a9a1dd3829b73daac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070205, "uuid": "caf89c41-f9f6-4e07-a0ba-35b70aba66b6", "value": "T1BA74F141359D443FDE0D06FE41636040D3F399273AC6FB89FCBD5099AA267D683A1AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070205, "uuid": "bd52c0fa-8fe1-4e72-9461-b2b227864b6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070205, "uuid": "36814acc-83a3-45a7-bf20-7efe5ddb9412", "value": "6144:8/ul7DeaKhkMmgQsU1AnzmUESe4JmbzIhRFDRaPuWZTNVvAyfzHFk0mt:+BaKGdbsU1AzC9b8hXtABV7fjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070205, "uuid": "451c75c9-73b7-4b62-911b-4ac981adb3db", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070205, "uuid": "ebf9b9e5-ceb3-4c3b-8266-7bbcf383d106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070205, "uuid": "8c3efd92-252a-42ae-932b-afd3f3573680", "value": "dFFHjYOuICF2IOc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47128a53-195b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632064036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064036, "uuid": "c734d679-343e-4823-8978-2229c61b5797", "comment": "Malware payload", "value": "dc70792e3bec9dbfd00abcceee8d849e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064036, "uuid": "aac872de-1999-410c-8438-154f6d5855a5", "comment": "Malware payload", "value": "ba15278f7ee4ca3519f945f491abaf7234a48bcdb1baec7f471e59d6ee19fc91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064036, "uuid": "dfafc0ea-6106-45e7-a55a-8e81dff0623d", "comment": "Malware payload", "value": "4003a071bd2e9042f9991b290dfb1f5d42838f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064036, "uuid": "54a0905a-ed04-42ed-b02d-acc2a8b6e5b4", "comment": "Malware payload", "value": "6ee18bb37d14f589ef9b151507a48149e6422dcb9e5b49d90de4abe8581e046c2f61fa30ac4e37e7cdd8fc6e1944f08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064036, "uuid": "453e9bab-db0d-4dd8-b0c4-f1fdcb082c2c", "value": "T12E558E4AA36901F9D0ABD178CA529607E7B17C0103309BEF17E55B5A2F23BE15E7E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064036, "uuid": "33a9f712-d828-4e97-a898-da02d79d8f03", "value": "0e0b1327b851d652046461e0a8be7593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064036, "uuid": "c0cad8d4-7b9f-4841-aef0-ad15aa7cf010", "value": "24576:HAFnWzNUe3a9nvOvk+/QBNFjmDWTe2c6Ek:yWzmeK9n2FQbFBTq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632064036, "uuid": "8dcddd9a-8c97-4f0c-baff-9320eef718ae", "value": 1408000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632064036, "uuid": "c46b3555-1f63-4802-8b27-3bb3cd981395", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064036, "uuid": "fb801b3a-8ff0-4033-b76c-3b5393974fd9", "value": "dc70792e3bec9dbfd00abcceee8d849e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb2df83-195c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1632064722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064722, "uuid": "34fc9f9f-528e-4914-9efa-71e413f1b21e", "comment": "Malware payload (Socelars)", "value": "bfb7564768b7ee01d5a37f5218e7e24b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064722, "uuid": "b03680a6-a294-467f-a4af-ff623683c078", "comment": "Malware payload (Socelars)", "value": "bb2f8271421f7efce162d363ca662a4ea189a38af2fbcbe1f6d21396f9b7ec00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064722, "uuid": "7e43e3ff-404d-45ea-a978-c7d2e828e2c5", "comment": "Malware payload (Socelars)", "value": "65454f586cb1fe8eea347bb1a0793c44c051e503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064722, "uuid": "d7f7c224-eb45-4217-8927-649708f5f0b9", "comment": "Malware payload (Socelars)", "value": "e8e7fc46e27badd2a66e035437ba7333d0819c9bea3057fcb6cc15573dcff23e2c8b5428f2f3677c5f02169d2f1bc773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064722, "uuid": "e4d91f55-7f7d-4c98-b134-f4b622506779", "value": "T1EC659F21F6429036F8E310B286FE477E9D6CBA21031894D7E3C41D699E719E27A3B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064722, "uuid": "fb627667-3de1-4107-a155-312fd311f775", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064722, "uuid": "2ec0eb95-54bc-44d3-9f55-6fdfc892af54", "value": "24576:QIVFA1pqtg/TnMbX0lwyh0FVmEBy/1EwFYyOsiJBovsSZe0wQHYfNJ:xFA1pvTMbOwa0TmzyMYEq+vsSZ4QHYlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632064722, "uuid": "493cb882-019d-49a1-92fc-1623349a3e70", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632064722, "uuid": "b7197b54-b663-428f-935e-579e20b5c746", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064722, "uuid": "7c223cd5-8893-448a-8bc5-e7f08b1d6a19", "value": "bfb7564768b7ee01d5a37f5218e7e24b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bd4e7f-1965-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632068386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068386, "uuid": "9f81328f-482b-47de-aad1-cfd7d2206893", "comment": "Malware payload", "value": "d7f8db2b35e9742decfb158d11ba38b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068386, "uuid": "6cd2b2ce-b4ab-4ec6-adc3-dafa3e1a6f43", "comment": "Malware payload", "value": "bb58c6ace7fa3e1dd344b41ee8a8f98236b0615e103acb7f24b4948d1a7d4454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068386, "uuid": "c8c59759-af4a-4285-b0ee-c36723f1577e", "comment": "Malware payload", "value": "f467e6f657d7f30c271b75e5d8e4b737ead9c055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068386, "uuid": "652d1ada-4785-4839-ba4f-0071598a59fb", "comment": "Malware payload", "value": "2090de10a2b193060f4dd75b076a560f86679794bde60beebef2b5c2a4f0255f5e48f2b5ad84348c59fd0ba242b2b169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068386, "uuid": "58aa8fa4-5243-45c0-8405-801918af5995", "value": "T1E3D30287F59B1161F80C2DF85A65D33B41F4A8F48C74267F9D8CDB674309BB86A12EA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068386, "uuid": "66ed017e-5b8c-46eb-a9d7-9f81687b4d1d", "value": "9c0050334da711b5147027326c52827d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068386, "uuid": "4c970c32-48cd-45a3-a1cb-2c3c5480e6fe", "value": "3072:wiQLje+aQYPj3bo0fn1B2fUsojCYH/wOfFh3bo0fn1B2fUs:wiw8j3nnPqUsojCY4OfFh3nnPqUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632068386, "uuid": "643dfd4c-5599-4d03-9acd-161a55cbec38", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632068386, "uuid": "0c6c5cf4-9433-424b-a29e-3b8624aad96b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068386, "uuid": "bf8e0dc3-8982-4445-ace8-815f13350433", "value": "superimages.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec94b05-18de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632010604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010604, "uuid": "c729abf5-c080-449e-83b0-c706e31ca2b8", "comment": "Malware payload (AgentTesla)", "value": "3f38aa00881ac4c40cee13da262dab68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010604, "uuid": "45866891-9945-4d15-bd52-62cf08435ba9", "comment": "Malware payload (AgentTesla)", "value": "bb5bf783fff90373b8c80783ecaad30c3d9ee82e55898cd2355bee081e5f158b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010604, "uuid": "afc63786-0bf3-4160-aaac-fad23bc7bdd5", "comment": "Malware payload (AgentTesla)", "value": "96274597f6032385b0e0e79bf9ff98212bbb6a3e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010604, "uuid": "1231483e-4be0-41c6-aa9a-82a072cf56ae", "comment": "Malware payload (AgentTesla)", "value": "439f13c2dc053645061b3cba5cce28ea3f81dd3c1bb406998c50bab6d78551b37e4262cd37220ec7f7468f01195f86ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010604, "uuid": "bb4eb0f8-4716-41b3-b6b3-78d3dc0e9662", "value": "T11345CD296D2292FFC7EBC578D48C0FDEEA61A4937B524F0AC09397D6864F60BD94805C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010604, "uuid": "492b76e3-79d5-4b97-8a96-4a7098f6789d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010604, "uuid": "b9126cd6-3076-4aa6-9741-fd0537003485", "value": "12288:i7KwtgbJ2529avQXLkQWfcGbjjhFV4cyKwBVwf+hOsIWRxSXVFTo3pn9M3KKG9mI:KRWJ82ZXLkQDaXucF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632010604, "uuid": "c681eb41-c68a-45e0-b13d-ba292597b734", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632010604, "uuid": "00cfb4b0-12e0-4f00-89b4-9e65b76568b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010604, "uuid": "53e15d08-a51d-4a04-b39c-37bb0f4f9866", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb65f561-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632063829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063829, "uuid": "7fc7cdd1-3877-4c7c-9978-3eae3a8a9ee3", "comment": "Malware payload (Formbook)", "value": "5843743df61209f9b5e598fb876c8a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063829, "uuid": "ddaf6862-0092-4e42-aee5-065897687a92", "comment": "Malware payload (Formbook)", "value": "bb913402040958a639d6c22b1df958de0aa304d51c00eb5aaa106077edb85310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063829, "uuid": "86e73e85-3bb3-4d2e-9891-d4cd9f18dcd7", "comment": "Malware payload (Formbook)", "value": "8a11d30d66c6c1c3b535c8a3aa3d58376dff08f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063829, "uuid": "b50b5b87-fa84-4faa-b457-502b9361841d", "comment": "Malware payload (Formbook)", "value": "c3a5d5b608acbde6cb45a3d623ece0404748512a908232e23701f3778d33d08ddfcd26cabb3e45f17766270a66d8ac66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063829, "uuid": "08ef5a0e-60e4-4866-ae97-804671d1527b", "value": "T1319423402BE96B34FB7E0BB8FA5704424BF0691B6E49F7281D5390F95417781CA68BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063829, "uuid": "53491542-9b16-444e-aa3f-91f6b83215d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063829, "uuid": "eaa295f8-c9e0-49b3-b4f5-53c9ae4df26d", "value": "12288:blxBd6B+eJZMthggHaOWAOwkVHHGv1fa:bHB90shggHaOWmkVGvpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063829, "uuid": "f278090c-6d35-4e02-9f21-6dc14084fb62", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063829, "uuid": "6216a991-872b-4b57-855f-fef25637fb3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063829, "uuid": "d429e4db-49ec-449d-914c-017fd9481707", "value": "5843743df61209f9b5e598fb876c8a95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67d372d-199e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632093026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632093026, "uuid": "b5fdb9ca-f9d9-4133-9f85-7f7af3208279", "comment": "Malware payload (RaccoonStealer)", "value": "a0cc0d91f353e5f132837a71e5c92457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632093026, "uuid": "3549994e-f01c-4dd2-b705-a9c548fb6e4e", "comment": "Malware payload (RaccoonStealer)", "value": "bc138287ed714ea942a062c9efc9775f6eaaefdb778b6d091d2dff02b284b8ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632093026, "uuid": "c1ee84ac-b42a-472c-973b-8ab6a7ffabce", "comment": "Malware payload (RaccoonStealer)", "value": "3a2bcc28808c7a5b3767e6461d2fd383cd174c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632093026, "uuid": "a8a8a147-18e8-4606-a599-c5be234594ae", "comment": "Malware payload (RaccoonStealer)", "value": "8c944f42f80f48d94794a16ad8b109b37def92f7614718f61fc358c770a1d2243c671f69d738c3e1cbe45def3d17be3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632093026, "uuid": "ce9b4efe-dbbc-48f4-936d-69192778c3b2", "value": "T133A4011134F0E832C25A46707867C6A1597BB8F56A3CD2477BDC3B2F3FE12926A36215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632093026, "uuid": "dec85909-6ef6-4936-b02f-b62d68d46e9e", "value": "0e5928597ea1bd6370095e212766ea54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632093026, "uuid": "5142893b-91aa-462e-84d2-e0f0877eec3e", "value": "6144:nTMlDBYOBjhqNy6p/n0wDj3dG6HWZMULJOh8BsLllCt6Nafe5e8Xt6urz5JH1Pch:oBBvhqt0wv34SUnBeotIafe5zEuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632093026, "uuid": "94fbd8dd-9264-4d56-9718-d8ee0bdacf02", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632093026, "uuid": "0e14d8f7-7c27-4607-86ef-5ab694071ccc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632093026, "uuid": "9726d2e7-ea3e-4ecd-b8bd-24154655e2f0", "value": "a0cc0d91f353e5f132837a71e5c92457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612adec6-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632063650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063650, "uuid": "029538d3-951c-4afd-a957-122d118ecb6d", "comment": "Malware payload (RedLineStealer)", "value": "114f53aedbefc65374162d5e79547ee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063650, "uuid": "a8e8feed-2fc6-40f9-8566-882dac890271", "comment": "Malware payload (RedLineStealer)", "value": "bc622f5729f264d9943fdbfda5bacb5f8654c7bbbeada1a58da252434dee4f1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063650, "uuid": "b584a431-f7d3-4202-9406-a1a6cd1efb34", "comment": "Malware payload (RedLineStealer)", "value": "dbe37f5ea6d2a22a40f8c3d4370939b049baf9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063650, "uuid": "6c608063-a5e6-414a-b42d-384a1561aff7", "comment": "Malware payload (RedLineStealer)", "value": "ba7a866863417b6714de5d22412c80ace9993c8ebc67e121da8cd3c4db36f962cb5a470d7ab20b5b88115666054b59b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063650, "uuid": "1513acff-c9fb-4a4e-8ecd-2a70e1a50a0e", "value": "T1A964CF20B7A0C035F5FB12F818B987A8A93D7AB15B3091CF62E516EE66346E4DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063650, "uuid": "9d785047-c092-45b6-b56b-ed4176c3875a", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063650, "uuid": "4ab95de0-a37b-457d-b8ba-faebc7de8905", "value": "6144:5DZQpFevrcLxU76C7N/0EaSJBoaDfK1ytes3sp8iKUP2mKu0YtXV:xZvvrcLxUmC/05Auae2eVKSt3L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063650, "uuid": "cbae1a9e-3301-4f32-ab7f-c5466dca604c", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063650, "uuid": "a0f85685-7259-44ad-90d7-5a993ccc7855", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063650, "uuid": "8f872e03-240a-4813-81a5-26e0e3edf3cc", "value": "114f53aedbefc65374162d5e79547ee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85453fc6-1989-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083897, "uuid": "a5982931-b747-453b-b68e-adfdb72bc35b", "comment": "Malware payload (Mirai)", "value": "465f957af60f29f9ff34d983dadb006a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083897, "uuid": "2900eb39-1bd2-4951-ac20-f6e28a3a6b20", "comment": "Malware payload (Mirai)", "value": "bd9c69a6048125674efdd529748b7f8036fedae0b1982dc761f4fb3f22ff2564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083897, "uuid": "4d78138f-150a-40d4-8278-25664956e1ff", "comment": "Malware payload (Mirai)", "value": "e84994b799c5a8aa633b40640f1d44260fba9e7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083897, "uuid": "97d52dbd-c26d-49de-9f97-51f28105ad3e", "comment": "Malware payload (Mirai)", "value": "0c36b44dd18048c7b6b34ac220c732f4b393eddac19cd5f4b706b7c9ad2ad00cdd65e55814e3cc2df38c38c1c2a294e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083897, "uuid": "bfae9e6f-8a85-4418-ba43-e7ec334f9eef", "value": "T1E4334B25BA791D53C4E8647A62F7432AB2FB124E20B88F5D3D720F9DFF64580A9071B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083897, "uuid": "55b703cb-67fb-4fb5-8752-ec2f53226f11", "value": "768:hoolq0kR/1NW181Y1aXd5jqxrAqJiLO+rSopoISEgZ:hob0kR/1NM8mkXDjuJiPrSfIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083897, "uuid": "d8c6c908-845f-43d1-970d-2bdd181c8724", "value": 52776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083897, "uuid": "27fa5178-0a9b-4a0d-b29d-4ec7ca3b81ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083897, "uuid": "cdd85fa5-6533-4820-8eab-a938074702c9", "value": "465f957af60f29f9ff34d983dadb006a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a966dbd5-1949-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632056470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056470, "uuid": "214a04b1-4904-4268-b52e-88ee4bafa75c", "comment": "Malware payload (RaccoonStealer)", "value": "db1bd07f496c5b69c4d78fb37f8fb99c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056470, "uuid": "4ef7ba3e-ce6b-4665-960d-174e93c028ec", "comment": "Malware payload (RaccoonStealer)", "value": "bdf737ebe428090dc14434f31c606094dcc85e552bd361e48c16fc6b2a74329a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056470, "uuid": "d459e988-b17e-410b-8a35-289c59b8d11a", "comment": "Malware payload (RaccoonStealer)", "value": "6a2a3fb49e67872782d2f2ff2f580b6172b92ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056470, "uuid": "87674b84-b9dc-4277-97b5-a7bf45ca7e2b", "comment": "Malware payload (RaccoonStealer)", "value": "35dd931a72040b38f8aa93a352bcb5556f997525011374b752733a0856d3f0ae8f226c28b6b05a0231f6fb02b9311726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056470, "uuid": "cf1acc51-2134-4497-bd1d-461045b1f5db", "value": "T1EBB4E020B6A0C035F4FB16F849B693B8A93E7AB16B3450CB22D652ED16387E4DD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056470, "uuid": "0a45b6e5-f102-4ff6-a5e0-36a854610041", "value": "8291a520c0f405cf4a58a301dc5c7202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056470, "uuid": "e4aedf31-5509-457a-a2f1-8f65ea74855b", "value": "12288:hZvnCKI0CvdGQUvguR5UftU8hTz5OvSWJCeeHQzSt+:hJnCKcoguHutVPOvdCeKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632056470, "uuid": "86ec7246-30a4-40c2-ad91-dc4ca987cff0", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632056470, "uuid": "ae8646f4-cc65-43ba-8442-bfde695a2ac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056470, "uuid": "0f171e3b-5122-45fb-a761-21b57ac58ff4", "value": "bdf737ebe428090dc14434f31c606094dcc85e552bd36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d9f335-1917-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632035092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632035092, "uuid": "0f10e61c-50d3-4143-93af-f02141491b78", "comment": "Malware payload", "value": "aedf3c4f22d1690bb9967c1e89abc951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632035092, "uuid": "2c60a535-9ea4-4cfa-88e6-6a88b5da8a44", "comment": "Malware payload", "value": "be1b28af061471c02bd6efaaa45d8d4af9686251db4b0179fcd22c9edfed4c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632035092, "uuid": "0e7c9ed1-0b7d-4bd5-8a5a-d64147a8be80", "comment": "Malware payload", "value": "d60f4be13613f6a2956e463d8c12d34121285da5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632035092, "uuid": "c540f19a-0d9c-441a-b6f5-b54cf426e58b", "comment": "Malware payload", "value": "e4af234bd30c7da273d734728a06bf37bffb0913f15c4a0f7f34bd0a7f493a6e7c60eb83e0e532794811742f92bb072a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632035092, "uuid": "92a9ac1f-baa6-4e2e-a93d-a41786ee7d33", "value": "T1AB846CA26D99D13DE2AE707BD8482FF14214B4381EDC56FB760B47A8523CA81B21D53F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632035092, "uuid": "27fa378f-5523-4de2-9892-ba951f17d779", "value": "3b97afa05f9af4726d1491fa3df117b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632035092, "uuid": "dc79b056-2db8-40f8-a46e-9de4686fcb8e", "value": "6144:GOEzu3m19VC4Dtrv4PYXLEdg6hrVjIWdPMgQGBf44hIH7:jEem19V3r4RpLQP4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632035092, "uuid": "55475c19-56ed-4ad5-a828-210b2bf5071a", "value": 395192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632035092, "uuid": "b9ff3d6d-a336-40e6-b554-017ed534f607", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632035092, "uuid": "7d951898-26fd-4a33-b285-62bfc79d71c4", "value": "aedf3c4f22d1690bb9967c1e89abc951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ad0b8b-196d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632071954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071954, "uuid": "5f2e7d61-9036-48e0-bb48-c55218a597d1", "comment": "Malware payload (Mirai)", "value": "1babb69be590292352688a8ef1fcf928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071954, "uuid": "c0dd60d8-a9a6-4a7d-a462-041fa5b3f5df", "comment": "Malware payload (Mirai)", "value": "c0741109951950a67b0b882cde91be39855f8f6301586afdcefb1e199c0037a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071954, "uuid": "eebc4899-baeb-48ab-8f7b-3b44df59ad5b", "comment": "Malware payload (Mirai)", "value": "2700b75a659b6867abb487555a4164eeb01eb00a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071954, "uuid": "f0b7a913-0a3f-4083-8f4b-90df4ecdb69d", "comment": "Malware payload (Mirai)", "value": "847b264e3e56540c3b9614e4de1bdae34c8d9334ca575687d2791ffec27c75949f15ece21bd252562f56700e3a0b9d0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071954, "uuid": "09000489-d333-4772-bd70-b44be0dd423e", "value": "T16AA30731A641C973D14305F211A7DB620D32FEBB1A6AAA96E36D3CB0DE360C1B561F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071954, "uuid": "40576a4b-ce50-4d7c-91ae-7d087d8bdac6", "value": "3072:gjtwgA6UlYzZveohR9kIE+fdGZmmFVcqq0G27ZT:gjhzt3mIE+fAmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632071954, "uuid": "d67e8544-91b9-4118-b7e6-7139133b8c67", "value": 100267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632071954, "uuid": "208e9b66-ba04-4fbd-b430-842bd8aebfac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071954, "uuid": "7d925b7c-f81f-4d32-8ddf-8c4bebf9d858", "value": "1babb69be590292352688a8ef1fcf928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0e093b-1930-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632045606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045606, "uuid": "4c2d1715-4028-4138-9567-d75c62498391", "comment": "Malware payload (Mirai)", "value": "1fe07db1bf64acf61c2f3083431ff40f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045606, "uuid": "f201ac56-8fea-4730-89d4-a74e25570a3c", "comment": "Malware payload (Mirai)", "value": "c2154d7d1b761dfa038ac9af37f302208052185a4a152456531b5fd0827327d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045606, "uuid": "da4d85f6-cf17-488b-97ac-62614663f8f3", "comment": "Malware payload (Mirai)", "value": "0a1933ea1c42d93d676df20fcc0ce6d9d0b190a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045606, "uuid": "13779fb1-748b-4bf5-8314-5b58cce6a3ff", "comment": "Malware payload (Mirai)", "value": "a3320f657b85baf9e78cf02b252939a85b6f4b90298e41035a20b10a1727e9ddaeb02d4e7485d4139ce38ab4a2de5bde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045606, "uuid": "1b1b7cee-89dc-4334-9160-b56e5b46bcf2", "value": "T1ADD34B86EA408E13C0D51B76FAEF41493322D755E3DB73068D189FB43F86A9E4E23645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045606, "uuid": "c652c6e5-ae22-44c4-b5fa-851768843229", "value": "3072:wybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8Jyve4hL5AJI4+3jJNx13Q:jbUEGniGQYtOR7aPk9mrsplDKZUmQBKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632045606, "uuid": "8f0236d5-bd67-4e36-aea3-915ba3f71233", "value": 142435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632045606, "uuid": "49a26a1c-5197-4c4e-9f5c-9c5be115b42f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045606, "uuid": "8e6d58e9-9acb-429a-a58a-75684517dc00", "value": "lessie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85aabfaf-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070154, "uuid": "a9046b70-4304-4fad-ba10-e1b3b5363481", "comment": "Malware payload (SnakeKeylogger)", "value": "5d880dd04c31a1ad338e4843d74ce7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070154, "uuid": "4abd560f-86ff-4843-9cd0-69fb7520d22b", "comment": "Malware payload (SnakeKeylogger)", "value": "c42fd1850e75b18ebacdb8e14d9c612d4c5cf554d0206ce0a7a4735f5fedd591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070154, "uuid": "f5b3d53e-a2c6-4e4e-90e4-e77359a9fc8d", "comment": "Malware payload (SnakeKeylogger)", "value": "3202c4cdfad93f3e0bdaffd0c99d9f05c9ecc545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070154, "uuid": "4599f765-5c3e-4664-ac07-4f138a5e9a62", "comment": "Malware payload (SnakeKeylogger)", "value": "432dd44fe28a6461f48e9fe2eb0d4b713eaeaf728990240d7c412f7eed624d0b457bf0d38208beca52445efbc0593320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070154, "uuid": "f09643a7-a511-49d2-a9f9-763d570a5e84", "value": "T18BB41760166E7D75C0786B3A477357E51BEEEC402A7ACF896B22F279003C6D77E42206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070154, "uuid": "a0f0bb73-ba3c-4117-9bfb-aa7c27587d2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070154, "uuid": "14f8e046-c35a-46d3-ab11-fb738a31aa38", "value": "3072:odbL5EJZPqo3I3Lk+24C2J1LUN2ZwSeWJH3cluTznvUPh0kudnd9caTFt9Gqlcis:odbQZPqoqLk+/LOSteluTznyouSmSX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070154, "uuid": "f5037df6-bdf1-487d-892c-3994194372dc", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070154, "uuid": "75f71c07-aadd-45b7-b738-1e98b8c9191c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070154, "uuid": "62de0854-684e-4ae1-94b6-f8fa55666759", "value": "doc03589220210903102454.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab076b16-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632063774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063774, "uuid": "3f7c22d9-a230-4bdc-bf1c-1092392e9954", "comment": "Malware payload (ArkeiStealer)", "value": "7f82288cda32f1f5e20d28cb07486c5a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063774, "uuid": "32149ab1-8b21-43db-9f8c-a0b5bcf6dbd3", "comment": "Malware payload (ArkeiStealer)", "value": "c456fe04ee50e4816038ca556e02ec2adae117665d9874dac92d64bd1899d904", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063774, "uuid": "ceb67264-222e-4425-b86d-7d61250d4ae1", "comment": "Malware payload (ArkeiStealer)", "value": "4f2f196a89ae3796ed5ea601ab858e0c4d2ac9d1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063774, "uuid": "6889637f-5e95-4c27-9c3a-5872f088f35a", "comment": "Malware payload (ArkeiStealer)", "value": "d5e6f1d4cc7ba3102c2c05a98a6e9a3f7af00a55e360d6c6b7ae1238c05d758ea9430c16b3d848e512111926150dcf06", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063774, "uuid": "b7ae0e45-6f39-483f-ae77-70df033caf16", "value": "T196E401207790C036F5FB12F449B993A8A83D79716B3455CB62D66BFA22343E88D30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063774, "uuid": "47b294cf-c31f-40fa-b149-cf1b40c960a9", "value": "0a50d73f84b858f7a49d0d60fc59dfef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063774, "uuid": "ea05fd4c-9a45-487d-bbf8-a47cb2f480b2", "value": "12288:5ZCwq2oDPUxeoXKcPW8///DLxRzPCLRmZt4onKMDRQV4FCV:5UwqDsK0/vxcFmf4onKYOy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063774, "uuid": "a0389715-cdfd-45cd-b715-284882fed1d3", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063774, "uuid": "6b24321e-bef9-40f0-9e9c-8f897ac76e47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063774, "uuid": "f135add0-fd56-41e9-81ef-74ce4a5ded7f", "value": "7f82288cda32f1f5e20d28cb07486c5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f855fa5-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070198, "uuid": "a1bb4a77-98ff-42e8-800a-6a56225126b6", "comment": "Malware payload (SnakeKeylogger)", "value": "56a389e56d62b78061c403dc746ff935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070198, "uuid": "06844b2f-6d7b-4dd5-a77c-b7e41e4f00ce", "comment": "Malware payload (SnakeKeylogger)", "value": "c556da9003cd49700989bdc21ea4b13aa1d81bc2020bc82fba2c833fb67a4158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070198, "uuid": "769d7653-cc5c-4604-8122-dff898279232", "comment": "Malware payload (SnakeKeylogger)", "value": "2211b50bd217a5b41ef443687c5fd5accb31a8a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070198, "uuid": "4e2cdfd8-769c-422a-a7f1-f7c213f62a29", "comment": "Malware payload (SnakeKeylogger)", "value": "baf4ad580f650679e7bcfc7dad5767ccd762aa56a01828477d7f6269e949ddc164f6bc22dfa31097a1cf1ed1b4f7f73d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070198, "uuid": "1563316b-0d67-4531-8eb0-a929d9eb9d98", "value": "T103C49D30179570D5E3327AB08BB3E042F5996D32AF9D92D93843F64DC2B3642E973A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070198, "uuid": "5c8122dc-9c89-4d25-9c15-dadf67385b23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070198, "uuid": "b816abc0-1e7d-4822-9a6b-0a38266e1667", "value": "12288:sjYxaM8KuQgbDYN1a1ZPauCzqIOTsmrOu4w:GjQgbDYW15Czq3TrrOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070198, "uuid": "43ff285b-9e06-467d-b061-0a6dfd8e75f6", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070198, "uuid": "2f67493f-5652-48e3-bbfe-249c015936c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070198, "uuid": "67a879bb-aca5-4023-b3c2-f266dc145aa2", "value": "JANRn4TNT3XXTJm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b65d59-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070233, "uuid": "713473a5-25c5-421e-af08-6d66e3fead2d", "comment": "Malware payload (SnakeKeylogger)", "value": "3b27e2dcab3629791076f5840e8f9bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070233, "uuid": "612a1e42-bde8-4d3b-9e2e-2819f986c4ad", "comment": "Malware payload (SnakeKeylogger)", "value": "c5906798e0f552c113e6a8d92a634fa72bbc5844ddd06bb2f1c859fff425187d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070233, "uuid": "cbdcdeb9-f4ba-4546-94c2-02d147adf76a", "comment": "Malware payload (SnakeKeylogger)", "value": "5a7ee605e881766c5d743b163e71e5a4d7c55144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070233, "uuid": "4c660109-9357-4b21-a3cd-4f0e17171b2a", "comment": "Malware payload (SnakeKeylogger)", "value": "48d645dcdea20a70fdfbdb8499a0f14b912d0fb6e0feed4160db354341f2382f69cf7a88ec158f89a76294e80d9b4d7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070233, "uuid": "e958fda5-a732-42bf-a8d3-f8428e8d90b4", "value": "T1FD94AE343AEE8419F173AFB68FD975968A7EFA733707D8192095038A4613B80DD8153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070233, "uuid": "3b9726e0-2eaf-40e5-b52b-d4401233d1d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070233, "uuid": "c4f714c9-5a85-4b58-b4d1-36382b503ab2", "value": "12288:JgqcWHCM2K4CNt05FJ67fIKwqSnQL/+h0lG:A3CknJ6rbwqS50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070233, "uuid": "83aa160e-ee6f-4c54-b412-e23ed043d5fd", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070233, "uuid": "774f86d6-3080-4e13-81a9-f3468192e85a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070233, "uuid": "d3569d76-99af-49cb-99b4-850742cfc1ae", "value": "r1DQMRFhNghY3LC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa394b9-18ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632017101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017101, "uuid": "d54c2afd-0760-4a63-89c9-fcfea75999a5", "comment": "Malware payload", "value": "439922750727948277e21e70d589c4ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017101, "uuid": "76474cbc-5a37-4aec-a69f-4d101cf71983", "comment": "Malware payload", "value": "c6275c5c18eb08e498e75fc6fc1ffb328a50633c0a6199f90d0d826dc9b53cb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017101, "uuid": "d535b0a9-aed2-4658-91db-d08289546d46", "comment": "Malware payload", "value": "d1f53438657c7d4bf5c64f31e6b61a9c44458849", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632017101, "uuid": "8282bd94-c5b3-4050-83a4-819757af889d", "comment": "Malware payload", "value": "9846ec91506e113cd97e7918a019e5c143f04891ff7445ac39bcc43c3d774e24a4b570651d4b30b7dc664889e18ac786", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017101, "uuid": "60f8ffd7-ca9a-4218-abd1-3dd66de99d9e", "value": "T14E3623775374028AD0E1CC3D8A3BFEE431F7137B8B81A87864DD98C625669E8E653943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017101, "uuid": "d9cb4ff7-a2b2-490c-8ac4-fee8119992ea", "value": "f9e61196cbf799259ee40ecd8a6e5c8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017101, "uuid": "55dbc962-016a-4f94-9d48-61deca3702aa", "value": "98304:ht6gxD7k/9f1wTSWTc2SLlycuDhTyj1pXiVoZ7rjszkZV:hwcnkVfErh7VM7TZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632017101, "uuid": "f615ecd5-5a81-468e-93e9-9758d5d661e6", "value": 5007048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632017101, "uuid": "38984f54-f20d-45ac-a732-41ae939479cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632017101, "uuid": "4b0a611f-e868-42a6-90f4-668cf950351a", "value": "439922750727948277e21e70d589c4ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b03c96-1976-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632075874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075874, "uuid": "58d2f758-34e8-4444-a205-e14ed96148ca", "comment": "Malware payload (Mirai)", "value": "1ca392307d58427651de195d99437fd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075874, "uuid": "4477aae2-747c-466e-a374-aba8b9b216af", "comment": "Malware payload (Mirai)", "value": "c643f2ba55189669286a4ef62507d5941a48176e048282c814303a5ccf1dc2c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075874, "uuid": "bb9128e6-6b19-44f7-b592-1fedff17ef6b", "comment": "Malware payload (Mirai)", "value": "da32c15fc6a7dbf6dc15ccbc9b5b754d168a6c78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075874, "uuid": "b25da450-989c-405b-b4a0-26c3fcdf68f9", "comment": "Malware payload (Mirai)", "value": "d1cd00f5e2b7c8738abc106bd54804709334700258b78001ba356ffbba40a6d69314d7512884d9e2b9b0a901845c7988", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075874, "uuid": "af857c69-cde1-42f2-8b59-5ebfecb042af", "value": "T1B4D2E199F0511EEBEFB669300E15DFD11B650F5F9FB6C5F020C12F13134AB622A52A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075874, "uuid": "bca08867-e002-4b2a-b3b4-e383ff88ffe3", "value": "768:54QB6uvdQTYwkCUNKO+wk87OeRDqYuNDzcoFb4uVcqgw09V:5BHFM7Djn7AOeNqYuFd4u+qgw09V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632075874, "uuid": "3ac47429-4b38-472d-be9f-dd0efb1b7acd", "value": 30616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632075874, "uuid": "6c0bb0db-b601-4d0a-8be6-52fba2d2eb14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075874, "uuid": "b1605bdc-2006-4482-af6c-992959c9757e", "value": "1ca392307d58427651de195d99437fd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d64d52-1988-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083628, "uuid": "66690b2a-7041-4ced-9fd0-47b2ce7e5609", "comment": "Malware payload (Mirai)", "value": "ca9e3555e45588ee250ae8fc70463f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083628, "uuid": "201516b3-8a3e-45af-b61b-3b9ce1504233", "comment": "Malware payload (Mirai)", "value": "c6bbc25ccaa0dd3ef393ae70a1e6904a5694480a2e827d9c2b5891c8fc3c06ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083628, "uuid": "32ee3066-bd1e-4a1a-943f-82d86b68cff2", "comment": "Malware payload (Mirai)", "value": "fd68f85362835b3937f7ca52996acfc2f094a214", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083628, "uuid": "27b9273e-e78a-4852-b97c-b8f04fc41c11", "comment": "Malware payload (Mirai)", "value": "6295de641459858ad83bf5da6e5ccd18714138cdbc976785cc891dc3d8094d9575a16bde2459f39cd7685d2b98ec8eb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083628, "uuid": "0d604d52-27ec-4eaf-b91a-ed49dffcb43d", "value": "T1FFB2E03C465705EDEE63D4B463E90B701EB84B27E8418C4B988DCB871F8B1D8B88399D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083628, "uuid": "bff0923c-cc6d-449f-ac10-c7a3de21e735", "value": "384:TRtPJjgJUbyselGZ81T98eL9kwIKUQTL3cF0t0gSix0pRzZTChNe/FJgGlzDpH7o:3PaUJelGC1LK1FQMc0XV2S/FJgGlzDpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083628, "uuid": "3a727e51-9b6b-4ba9-849f-22a41865c52a", "value": 24052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083628, "uuid": "2fcf55b7-ba22-4ed5-8a6c-b7743ecc2299", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083628, "uuid": "b298867a-da8f-41bc-9e63-eac839265a5e", "value": "ca9e3555e45588ee250ae8fc70463f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c7dc9b-1982-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632081006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081006, "uuid": "58d3e75c-8442-438a-ab63-bedd60295388", "comment": "Malware payload (Mirai)", "value": "5a6326b9097b15fbbc6d0eba705b0a55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081006, "uuid": "f97164c0-8ec2-4090-aac0-01ddea9d4091", "comment": "Malware payload (Mirai)", "value": "c749e0f90716ee5e48bfb10009b0fdea6984da1bd61a832b80a2e53fb7f106ae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081006, "uuid": "87afcdb1-95ea-478c-8a7b-b30915a04f29", "comment": "Malware payload (Mirai)", "value": "28d86343a598cc0cd44461b6f60d82e52349170b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632081006, "uuid": "36c5589c-71a0-4ceb-b465-abcd13f663fd", "comment": "Malware payload (Mirai)", "value": "d1776d77ee628bea6d5e02eb3d6e0847046639b7a7836f88c90a2c6cecef9a595144d3ff139b554de9b1d6bba73b0ed9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081006, "uuid": "70211833-1936-4f9c-a238-6adf87b5e30f", "value": "T13BA2CF30607CA87BD6729C3BC9FEC18657690EEDB3D12A632406877CBD4A355487836B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081006, "uuid": "250de7b2-796c-4b23-b110-b68d2635111c", "value": "384:RyEdLVqASt9VNo8FY+3eZc08qTQ0ksn26j09Ho4QLhymdGUop5hk:c0LVq193FYfW0/sTsN0Jms3Uoze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632081006, "uuid": "77497876-eae3-42e5-ab4c-c8330d08a244", "value": 22496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632081006, "uuid": "462821eb-5bfb-43a0-8799-1b3050a546e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632081006, "uuid": "0dce330d-9bbe-4a7c-83f8-8bdf721515ef", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7a3d47-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070085, "uuid": "3aeb7290-2021-464e-9972-ff3e0f09fa2f", "comment": "Malware payload (SnakeKeylogger)", "value": "e6d057c86f6672abc8af4e9b313853b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070085, "uuid": "ff7f83f3-389a-4c78-8af1-3d242a511d54", "comment": "Malware payload (SnakeKeylogger)", "value": "c7519e85ba8c38a0882ab66e85425e4c7f0fcb2ca5d3bece35aca308493e9204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070085, "uuid": "925727fa-5155-423c-8b5a-53ca4d3ccfd9", "comment": "Malware payload (SnakeKeylogger)", "value": "98063ff313afb505a2fabce4dc2cba1bf903030e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070085, "uuid": "e85b7467-63f4-4a54-933e-b2a65140d0ec", "comment": "Malware payload (SnakeKeylogger)", "value": "193bbab37809cc1558ec8630df0d503d1a105fea856931b3c2547a3a3f26ca9049859d89eccbe93cca6b805e0a8dcdb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070085, "uuid": "cc4bbb79-c039-4a7e-b656-f1fc2b9b3ab4", "value": "T13A84BF343AEAC419F173BFB58ED575969B6EBB633703D82E209103860613B81DD8167E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070085, "uuid": "9e3bb921-0f7b-4e2c-a5a7-12b9c724a9e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070085, "uuid": "30b44bbb-a3d5-4c42-9cef-3fe6ddb87855", "value": "12288:pHPUf4WHCM2K4CWxsCqHm6b+BF1MkbTTZJIYl/OPphAId:JUfg3CsV51Mk7Z6cwpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070085, "uuid": "2f5531ff-603b-4190-81f7-bc0413f674be", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070085, "uuid": "cc63f8fe-6bf0-400a-bfcf-fec80f7c7fec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070085, "uuid": "a01ad1a0-dc0a-409b-bfef-2bf016593e34", "value": "HKN63102008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a6edce-1948-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632056162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056162, "uuid": "e3664edf-4074-4159-968e-4919939ce9f9", "comment": "Malware payload (CoinMiner)", "value": "cb764a9c6003a3b922571ec796904152", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056162, "uuid": "2895c1da-9af1-485f-a6b1-79d0258a4bf1", "comment": "Malware payload (CoinMiner)", "value": "cbbd811dba00f28e1cb627f78b40535ae246edb9d9dcf1e9a6ff877960e98113", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056162, "uuid": "522c5ed6-7c10-4825-bc0d-c10e026e6ce7", "comment": "Malware payload (CoinMiner)", "value": "1f35dca64f39a5689175b0f6c0c8e8efbd155dc9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056162, "uuid": "8f0c5e5b-fd2a-453f-8b2a-e14fde599a71", "comment": "Malware payload (CoinMiner)", "value": "bf3fcc9a6440dff01ec2227950eba24f0123a06a0c279c3efc2c7387cb57014a18b14a7f2de12f236befd7bee1c87cad", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056162, "uuid": "f46722a2-5e6c-46ee-a1d2-6e7b38e9bb9f", "value": "T1E2348D20B6E0C035F5FB12F859B983A8A83E7DB16B3051CB62D616FE16386E49C31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056162, "uuid": "1eb42709-cffa-4009-a6d1-60fe5fec77d5", "value": "2b14341588588a7736588af3b9a80be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056162, "uuid": "c3366ac9-f892-49c0-9dfb-bb72cab4cdad", "value": "6144:krZQYx3VK7EwUf+oCJ7jLt3dzHLrWqysc80s6Afv4:gZG7jUf+FLtNLegc/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632056162, "uuid": "6755b199-03f1-4c54-b69a-40225d269514", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632056162, "uuid": "1de0f1fd-aaff-462b-8dda-69711af1afbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056162, "uuid": "215352a5-5458-41b3-94be-472456ccf739", "value": "cbbd811dba00f28e1cb627f78b40535ae246edb9d9dcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a694c9a7-1967-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632069350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069350, "uuid": "c03b072b-3836-47eb-bf2b-f1b1b24ff382", "comment": "Malware payload (RedLineStealer)", "value": "25b544886f92efc35d16afae0ccbe885", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069350, "uuid": "4a2f924c-614f-48a5-bcda-b5c68ae6ed2c", "comment": "Malware payload (RedLineStealer)", "value": "cd517a0b8edbf878a10147ece991468cd24a8e8dc17ad7afa098c82894a7ee63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069350, "uuid": "94bdec1f-60fc-45cf-ab3c-3bd2bc8aa38e", "comment": "Malware payload (RedLineStealer)", "value": "26742f013ed7392323d2e39fc98cc5cb08e7083f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069350, "uuid": "8aabd3db-46ef-4829-98e1-835cd28212bf", "comment": "Malware payload (RedLineStealer)", "value": "7a8efc02faa1c516337179debd522163a07bbdebfadfbb1b8c7d17f5ea2cc534adb8de7c18150ab01959f6196e193c60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069350, "uuid": "35ee99a4-3432-4e6f-b047-40c120e2ab96", "value": "T1B064C020B7A0C035E5B712F859BA97BCA83D3AB19B3451CF62D616EA13347E89C30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069350, "uuid": "1061410c-4db6-496a-82bf-9bbcd62518f4", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069350, "uuid": "81ae9d50-5b08-4aea-b57b-b3002f8d07d6", "value": "6144:nJZQqHG9EOclBo6k3uoCfr2afGK5mAYK6Q3zLgjVIYSZ09:JZ3OclBoaoCfrHfG5DqMOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069350, "uuid": "683ed40a-9ee2-458b-9ac6-13058fc902ec", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069350, "uuid": "7b6afeea-52f7-47d7-ad3e-aa137558bb73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069350, "uuid": "bcb05c29-769d-4b11-96aa-53966203cbc1", "value": "25b544886f92efc35d16afae0ccbe885", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce352b1-193f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632051966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051966, "uuid": "a414a4bf-85e0-4afd-b5c1-5bff4017aa1b", "comment": "Malware payload (CobaltStrike)", "value": "bc6bd2e4fcd5dab92645db7de802fc1f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051966, "uuid": "4e2f3893-a471-46bd-9d13-272fd6493394", "comment": "Malware payload (CobaltStrike)", "value": "cdfb66966eb5254d45cf921b25ff0243bb952d7ee11d9b98544e9a590316b408", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051966, "uuid": "80e6d0ec-3815-4bb4-b9b0-3a36b9c89f8c", "comment": "Malware payload (CobaltStrike)", "value": "2055c8b417183c59bd234f4566042a03b8444250", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051966, "uuid": "20553dff-7218-4a20-896b-2d33244be5c3", "comment": "Malware payload (CobaltStrike)", "value": "0a5d061e46d386dd7427357580d6192fe57488ed1c9d313693c6494276be95cbcdff181911053e66090f74cb2dd8ca3f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051966, "uuid": "d011cb20-df01-4d47-a37c-fa37085a5916", "value": "T11324E0B6497B7960EA61D4F611F7B47D0E3187F3E037782FA7081199A018163AB1E2F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051966, "uuid": "56880798-6109-48e0-bbb4-99779bed9493", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051966, "uuid": "78f30c74-0d82-43e4-8426-dd445e2f7570", "value": "3072:HdUQzhzvfZecn/8yrTxDNmfK1LLFLfq/h4m1pP3WTaKQEorSVEqPyZZFIBO:9fzBXZecDs/hN15k3o+NaCBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632051966, "uuid": "7b80d912-ed68-442f-8e67-8e0b8733bafd", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632051966, "uuid": "c21f516f-ed55-478a-8e2b-ed17fa725154", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051966, "uuid": "d70a7e32-deca-4352-88f1-4ca74cb5de59", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8ab417-1994-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632088827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088827, "uuid": "52436613-68da-461d-865e-485c7d7ed894", "comment": "Malware payload", "value": "6b018f3d9770c08020db1cd20a75b30d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088827, "uuid": "d6ef8366-1a12-4757-9a91-68e4cca74a62", "comment": "Malware payload", "value": "cf2520dcf0df45be39612ab801dd1bb9923c83b21fc781be782e89e3a48e27a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088827, "uuid": "78bfad58-5303-4f7a-ae57-dc936f3a80f5", "comment": "Malware payload", "value": "224e209f49fc211557341d6ce22b791af6bb7b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632088827, "uuid": "68b04dd1-eb5d-4930-b02d-aeb0d33ed266", "comment": "Malware payload", "value": "11dcf070c6213a47dfa341dfadecc026ed2b33d4c6646a68554908e2da55a291e061b5ecb668c9ec28dd9af1fcb3f53e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088827, "uuid": "df12017b-ec29-4961-a639-9e357889cf14", "value": "T142A533F970FD4601C6CB20382342308EFBE025105C9654DAB999B9BEB4F2BA5F93B557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088827, "uuid": "3b7d0ac1-6c0b-4cbd-a7a2-31029420e421", "value": "4f0265512a1363fc11fe0c410b950baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088827, "uuid": "dcf8d07c-74c5-4c41-80d1-71a11c68e9c7", "value": "49152:1i1C/rfNqNiX2sEwLTpMdP8OYRsD2X3Kd+lf+Aw6mBTszQPz/:4QrkshE4SP8OGXa4vCTsUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632088827, "uuid": "8aeeecf1-5eeb-4d95-b0c9-09817cbccd5d", "value": 2241024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632088827, "uuid": "703ebc78-27bf-48c3-ba9a-4f3b80fd06a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632088827, "uuid": "3cb93f71-d6b2-4a0c-8ccb-280cf70fbc38", "value": "6b018f3d9770c08020db1cd20a75b30d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f5761b-1901-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632025547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025547, "uuid": "c4c0e24b-a08f-4572-b0b7-dfbeb316cac3", "comment": "Malware payload (RaccoonStealer)", "value": "f3981eb8ee9ca35ad75b80e2498b0cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025547, "uuid": "4c24a749-8602-4a1b-b0be-53c2630dc1ad", "comment": "Malware payload (RaccoonStealer)", "value": "cf3956f0cb019c9576a5d113928bff1f83964b8118bd8bf1f43c3b52cec01bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025547, "uuid": "a8e78edc-1f30-48aa-b284-06d7218af53a", "comment": "Malware payload (RaccoonStealer)", "value": "b3c901991fd906dfa2b15f5ea54ac88cc556de00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025547, "uuid": "0edbd70b-72e6-4725-994e-194325695ca0", "comment": "Malware payload (RaccoonStealer)", "value": "bf51e87532ddc5108e301c8d9cc7377c3fcf4ff6adebd95534fa5a0d0cd73a6057c951f164d4f503297c3e417924682e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025547, "uuid": "136ba1eb-eaf9-4a8b-a644-8fbd387db0dd", "value": "T1B2B4F120A790C036F0F712F959B993A8A82D79719B6454CBA2D517FE27383F49C3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025547, "uuid": "bda43348-f5e5-4fa0-9447-c5765b714580", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025547, "uuid": "fc496b78-4dee-4f6c-a464-c5326d6354f1", "value": "12288:aZeuAQXdgOEbQPYQg3oqgnG0PaqFKx5P2oRrEuPurQzUHQ:aMuA94PYQgYqgGw1212oRwuPur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632025547, "uuid": "53b1a749-adaa-403b-b16f-0064b214ec6f", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632025547, "uuid": "e2cac8d9-a5c9-4612-957c-4e2fff4384fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025547, "uuid": "49b13d26-d1c1-4f3e-97e2-c1eac86a16f3", "value": "f3981eb8ee9ca35ad75b80e2498b0cce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f0765b-196f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632072738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072738, "uuid": "af78b822-0ab5-4ae7-9e16-1b51ab4f8af0", "comment": "Malware payload (Mirai)", "value": "afa2f0b2655a1a9df6ef41110cf8801e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072738, "uuid": "3780bac9-1b80-483e-bd55-28726b667b95", "comment": "Malware payload (Mirai)", "value": "cff5e7d7dc91a26b47ce5b67a33f1096fc112a9815e0f39371563e0401193131", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072738, "uuid": "f309a8d8-323b-4cfb-99c3-184571587a36", "comment": "Malware payload (Mirai)", "value": "9be1cbc5c7a615c2f011e672ba05395b3318fcbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072738, "uuid": "ba5e2137-8f27-459d-ae25-46e0f1ce4f17", "comment": "Malware payload (Mirai)", "value": "3cb5147ed1276a1f5930908cffafeac96412d6390c91eb0b5819a3062ac1efe7dbb359ca0b60509f59d327dd2db6f373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072738, "uuid": "5259291a-9e2d-4b24-8cb7-9a0dc1e57ec0", "value": "T1B5C3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072738, "uuid": "fa07d278-7377-4c74-88e4-83fb107ac4a8", "value": "3072:FDcYVLWKlAQTv+mYdbpl2m7/L7QsvmGugiNb:WYVxlAk9YdbH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632072738, "uuid": "6e397ecf-a021-402d-b66d-2946b7b6c4ca", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632072738, "uuid": "4a92399c-46ad-4a42-a853-c05cb68f952b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072738, "uuid": "49d1fc7f-2e56-4cf7-8cb0-ad30ece6b0ae", "value": "afa2f0b2655a1a9df6ef41110cf8801e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a90b5b-1945-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632054667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054667, "uuid": "ff91191c-a564-48fe-90fd-64baa10610b9", "comment": "Malware payload (RaccoonStealer)", "value": "5750d7c6e2477ec1e4f11c796d139e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054667, "uuid": "61df63d5-eabb-4812-a824-549959713b48", "comment": "Malware payload (RaccoonStealer)", "value": "d04192edea5666de37069ff927274531642cb6b82dbfcb21a52ea2d20085e640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054667, "uuid": "42fc5299-12ed-499b-97e8-b79208d12e6e", "comment": "Malware payload (RaccoonStealer)", "value": "6b07b08962d83f7cbd5dfc2b49eeff1be9a0a91b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632054667, "uuid": "e69a1427-5f82-422c-b697-733869ea0089", "comment": "Malware payload (RaccoonStealer)", "value": "03d6c8e66d0257dac0686eb64b349b5f83680b4faad10c45f02d1b2e09aac063d4b18b8125885ec772f8abdfb5c75d83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054667, "uuid": "58b7b6a9-5e4b-4ae5-9a89-676d3442c5d5", "value": "T1A2B4E02066D0C035F0B752F419BA93A8B83E7E71AB3050CB62DA56FE52786E8DD31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054667, "uuid": "8959c54a-4bef-4ecc-8105-8eadfb649a96", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054667, "uuid": "d4551b08-1adf-4907-8f28-97a3e3d51904", "value": "12288:xZ3Dajh//2JfDvS5kXLrVzNJGZYZM+oo/lpjMwMYrml2:xtDajqqkXLxzYYdRPMwVrmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632054667, "uuid": "853ae4f7-742a-4a15-a331-9cee51564f5d", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632054667, "uuid": "7c59d557-b006-4cbc-b232-84b5e225238f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632054667, "uuid": "d9fdc89b-7b65-4cd5-81d2-049420429dd9", "value": "5750d7c6e2477ec1e4f11c796d139e1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb13536-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070193, "uuid": "9b799905-aa79-40f4-a674-4301e1c1afaf", "comment": "Malware payload (SnakeKeylogger)", "value": "22a4ba1b75f74cc994145f46cd916e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070193, "uuid": "574d8e31-5183-445e-b16a-7578d2709d1d", "comment": "Malware payload (SnakeKeylogger)", "value": "d34ce3ed5c0542283b795f72c631083cf83c6f03791a08b642056c258e8c17b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070193, "uuid": "4725ae8a-6556-4676-8203-88fd106c65c3", "comment": "Malware payload (SnakeKeylogger)", "value": "ef5c97319d29937398ecdd5d9dd49f7da9e07ae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070193, "uuid": "b67df3a0-2699-46a5-b565-fbbc8189831e", "comment": "Malware payload (SnakeKeylogger)", "value": "5f53ba06e882bb992675738e22d7b3b338c42e686377b18f2b14bfd28599d20f69bba63c8e5f492ad47befa6f847b1a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070193, "uuid": "c6ce6ba4-b47e-44a5-bf73-08a4b13d48b4", "value": "T15FD4D0383AF69029F1776FB95AD4658597BEBE337A03D11E1050338A4A33B41CD9263E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070193, "uuid": "cbad4734-1a5d-42fc-9ed9-c9c19b7e6af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070193, "uuid": "293d027d-d190-423f-b3c0-a0e94aa89752", "value": "12288:CZJWHCM2K4CnI/yzQs2TaIpIX7J/g+Mflna3FkFTEdI:CZ73CcMIpIX9Vqh+mcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070193, "uuid": "27791c5b-536b-4433-8776-d8095495264d", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070193, "uuid": "0f56cc86-34ea-4d02-ad1f-c9a5f0ffe0f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070193, "uuid": "7f9f1ede-d0d2-48ce-82fd-9f5b59aea568", "value": "87667-987-98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9a6123-1915-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632033956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033956, "uuid": "99835f3b-f8d8-47d6-a992-ab2dc6ac1072", "comment": "Malware payload (RaccoonStealer)", "value": "521815f678de45768aecc8aaac6303bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033956, "uuid": "88161c34-aee4-49af-a961-33e1770f55d3", "comment": "Malware payload (RaccoonStealer)", "value": "d40c3e6502c12f700c690bde568525959d6134d874235a0b107a9d57ec124fca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033956, "uuid": "9b004aca-7a46-4677-a02c-ad0b1401a7f4", "comment": "Malware payload (RaccoonStealer)", "value": "04f6ead98124a754abf53aa348b06136ead27be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632033956, "uuid": "2d8c4351-1e84-42b0-890e-62efc5dc8e6a", "comment": "Malware payload (RaccoonStealer)", "value": "9aa6a8ad91227fb21af78e3af2a6cdb9d865e3dd10d4dac0630b4f490325f9183e73f71a838a2cf157cd0b6f9b4b9877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033956, "uuid": "25653869-ad35-4923-957e-ce81483ca423", "value": "T16AB4E130B6A0C031F4B712F959BA9768A83D7A719B7440CB62D616FE27347E88C31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033956, "uuid": "18f9710b-d132-414f-9df5-8997b03669b8", "value": "cdb03a4e2254d408c7ca16b00224de31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033956, "uuid": "f9880983-d89f-4b29-b9ec-f3ed437db633", "value": "12288:WZZRf4ncPTcngGc2aru8MK4rvCQ+hzloPGCew:W/RfNJMKvzJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632033956, "uuid": "c864b325-7e14-4b01-963a-117627acf3ab", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632033956, "uuid": "8ac9f182-bc2d-4dfe-bda8-7952c72fbec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632033956, "uuid": "92d6068b-5d93-43d1-96c5-5eacd4be866b", "value": "521815f678de45768aecc8aaac6303bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696f3bf3-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070107, "uuid": "fb5fabe9-33ea-4ab3-8a56-1a44fc7a6d19", "comment": "Malware payload (SnakeKeylogger)", "value": "cc7db44f47c327ae05717f8512ba6f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070107, "uuid": "b04448bc-8f42-4707-9df8-8ab583a8844e", "comment": "Malware payload (SnakeKeylogger)", "value": "d450fa292bf23dec073eb50aa84ee811f05e3cb68e6f06b545f4241b9d2f7b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070107, "uuid": "a3942f07-f278-49f0-8919-6e2d30791d7d", "comment": "Malware payload (SnakeKeylogger)", "value": "49eba037338ffe00fe2bc8cfa2fd1f1ff766cd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070107, "uuid": "69aa6355-7f6f-4e76-b624-d43830faf5bd", "comment": "Malware payload (SnakeKeylogger)", "value": "42d59e9c6f7aa16167eea3ca12114976af2e5ce9a99a657d871eda8560e7dd912ce23a166ecf7dd8620485f1f755f389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070107, "uuid": "138bb7e6-aab3-4641-9732-471f9ee3c6bd", "value": "T1C0B42860156E7D75C0786B3A47B357E51BEEDC402A7ACF896B21F279003C6DB7E82206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070107, "uuid": "b57953d0-7deb-4c03-9dd2-3fa5b440e807", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070107, "uuid": "ed31a9de-6535-40fd-b461-91f30e2f37b8", "value": "6144:5obB8XC2X9S25SquioGetxTznyouSmSX7:5xy2X9FSquiwJ6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070107, "uuid": "21e421f4-4801-4d79-acfa-6ef2e8110876", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070107, "uuid": "b3dd683f-cfc3-442d-af2d-a3069213c84e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070107, "uuid": "91e43af8-863e-4e59-b78f-d632499d591a", "value": "21168 PACKING LIST CMI 03092021.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef800669-1900-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632025235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025235, "uuid": "81c455e8-a104-4340-b575-34732929c8b5", "comment": "Malware payload (RaccoonStealer)", "value": "2f75351d942309de61e263beb996827c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025235, "uuid": "a0f81c88-235f-4cd7-af6a-b94c7ed79d34", "comment": "Malware payload (RaccoonStealer)", "value": "d4b5d768430676a90e7ab7cfb44d3f775fa759c2bc7f5aa1a7a92b351696295b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025235, "uuid": "c974894e-27b5-408e-8b43-8e901571c497", "comment": "Malware payload (RaccoonStealer)", "value": "6383566300e370f48b94c87cd8d70b3971920b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025235, "uuid": "3914ebc8-2c65-4a46-88de-06f1d08bd72d", "comment": "Malware payload (RaccoonStealer)", "value": "31340581aa5c8d87039639a8c7f16f1809a38ca3cf151ff83f89d5649e9c0d74d0340148a0441cf2ae808677a651e600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025235, "uuid": "3a49142c-917b-4a64-8916-e5899a69149f", "value": "T1C3B4E020B6A0C035F4BB52F859B697ACB42C7EB18B6440CB63D616EE17346E4EC31797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025235, "uuid": "15a11c75-1c99-4f65-842e-1c68e51f3efc", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025235, "uuid": "a92b6687-127f-4c62-995b-9ffd9ce6981d", "value": "12288:/ZL9rHEc3bc+A+TB4it0iynbMJeJbZLFKDyqZ8dMI1d:/p9rbPmNiybiGdkDo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632025235, "uuid": "13aba57b-4c12-428e-9087-9c663b786d36", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632025235, "uuid": "9e062c72-5f5c-431b-8902-8d39ba740a93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025235, "uuid": "779900d7-6832-47d8-97eb-7dbacf514513", "value": "2f75351d942309de61e263beb996827c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7722c793-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632070130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070130, "uuid": "0273a54a-0c91-45e9-a7b0-9314394ec6c4", "comment": "Malware payload (RedLineStealer)", "value": "96ff8ba929c9de23b8c3aaafd9e32165", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070130, "uuid": "3368372a-0542-49b7-aff7-515d71c1ed78", "comment": "Malware payload (RedLineStealer)", "value": "d5a7c6129c06b47ea91b7f93b0f3f424cfa641e6afbd6ceb95e559850270fd22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070130, "uuid": "46d1cce9-b9f6-46cd-a0a5-32f758312306", "comment": "Malware payload (RedLineStealer)", "value": "5dede9263435a4983483d6bba00e7525ca3b67d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070130, "uuid": "cc974836-7901-432c-b291-8134bc608417", "comment": "Malware payload (RedLineStealer)", "value": "a0f41aa9b52e28f7459a97e6804d8eeef077df4650a20f521185506a749c2bf0022c1ecd5ecbaa1dc7c7a255c016da68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070130, "uuid": "fe930276-79d0-4f8c-ac88-dbbbdb44eede", "value": "T17194142864BFC01984E3EEA52DDCA8FBD99A55E7640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070130, "uuid": "bc074bea-e600-480f-845b-ebf709e3e898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070130, "uuid": "1f800850-eab3-430e-bcd2-ee8910629c60", "value": "12288:lklT97iRDz9aRjhV/2GiCcvX7xxVyP5XvPf8uDt3hipACIF+/5Pm:oJjh0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070130, "uuid": "510cb058-8b26-451b-b6a3-470937cc447f", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070130, "uuid": "78f8ece2-5fca-4233-9afa-edc3b6c9e723", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070130, "uuid": "a9030c6d-def6-4ffa-8fc8-be13492db596", "value": "96ff8ba929c9de23b8c3aaafd9e32165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac97a3f-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632032501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032501, "uuid": "dec39bd3-5f98-4bc3-9f0f-6b3f4c5fc201", "comment": "Malware payload (ArkeiStealer)", "value": "16138a96c35216846e4691971556143f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032501, "uuid": "4f8a430e-ca74-4e7f-b6aa-a506d511e688", "comment": "Malware payload (ArkeiStealer)", "value": "d7eb6070c9e914e2241c3c2043d1755744d8cbe238b43cc1ab7769cf7ba932bd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032501, "uuid": "d8c0bc87-51df-40db-90d0-8e5ae688dd60", "comment": "Malware payload (ArkeiStealer)", "value": "7ee3061056ff64d98c2f135c13aa1777d37ed5e1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032501, "uuid": "78304745-32ce-41c4-8964-3ec36119cd49", "comment": "Malware payload (ArkeiStealer)", "value": "6fd3fda0859e17237bdf194f354a5a820a77979c08ed37a54643e0d01d3e461175102790db13720742085b8b840d4c5b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032501, "uuid": "9cd46d01-1a57-4a0b-8809-b91f6805e92f", "value": "T1E995B023B2934433C67F2678BD3752689825BE112A38648A2FE51EDC5FF46413B352DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032501, "uuid": "76a12853-1d9d-4648-bc0b-3d68ef9eed20", "value": "ec88d30de283c50d44daff3be84036bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032501, "uuid": "76b9325e-cefe-4440-8796-44765833f710", "value": "49152:k7IMK8HmWcdA8luYj6zT9SrajsO1CsSGGKE:k7IMK8GtA8YzzQrjsS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032501, "uuid": "59527bee-b5d9-4b9d-b3ca-0ae663b049da", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032501, "uuid": "53045cb0-8388-4937-83f7-41913a013ab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032501, "uuid": "53fe3f79-a130-4375-bb7b-09ae138eaad8", "value": "16138a96c35216846e4691971556143f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfceae25-18dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632010176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010176, "uuid": "6a64f7d7-8223-4bee-8a1a-0da8b808ad5b", "comment": "Malware payload (Mirai)", "value": "74e575ab01d6ad744d0783982ff68c04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010176, "uuid": "a753dbac-8eb8-4fa8-ab3f-158258d16525", "comment": "Malware payload (Mirai)", "value": "d82275fbaa1b1d6bf02943e1ab51244f38b114d8b0baef947fcbbb2f7afe4c87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010176, "uuid": "5b383951-a967-422a-b053-162dae103024", "comment": "Malware payload (Mirai)", "value": "a4da17fa7a4b6890b67691c1e4755dc17de06205", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632010176, "uuid": "b7042710-3041-4382-9ada-38b1657bf3ea", "comment": "Malware payload (Mirai)", "value": "8d12cf0a1857afd3af8ee80496cbd399c8725a999f10dc7ec60eb80a3f4edd43c8d1adb25591d67b308327fc70c93299", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010176, "uuid": "336da1bc-bfb0-496f-a412-ea0fc912d963", "value": "T1D0F2E1261798F967C0B84C37D9E9049BD21C2FF9F4BE36159332EBA45FE2941425A03A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010176, "uuid": "11088825-0190-433a-8809-79bd7355aeeb", "value": "768:P+00uNWHXSkENmscWtVoJvApJpCyBcCXL0APuDtZAbmf+e7b/VeC6V2/3Pbq3U7x:P10uNWikEcsntoypLjbPUZ+ON7ReCO25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632010176, "uuid": "f0074a74-c4b9-4f92-a993-3c1ce67eedfc", "value": 36744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632010176, "uuid": "68d29f5e-9647-400b-ab32-9594b2e0530b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632010176, "uuid": "2bfc2455-f124-4884-881a-e0ab4ad069f2", "value": "74e575ab01d6ad744d0783982ff68c04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f040fc9-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632032643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032643, "uuid": "b0a348fa-70ad-46eb-aaa5-bb6685e60582", "comment": "Malware payload (RedLineStealer)", "value": "921e836b1612b2e43eecedd0b0aa44e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032643, "uuid": "ed57cf11-88c5-4f69-b91f-0facde021f30", "comment": "Malware payload (RedLineStealer)", "value": "d8b8bba9880d2b162e945873f1ad1d048b6fc2c78b2501a0ad08f46aec0ed559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032643, "uuid": "211a8e8a-4df5-4f79-8f36-f89f75e5d71e", "comment": "Malware payload (RedLineStealer)", "value": "4ae7527784be61620504ea2c587934f81c397345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032643, "uuid": "41dcea22-edce-460e-bdbf-2c222d372799", "comment": "Malware payload (RedLineStealer)", "value": "076eae7fb6deb2bcc5e7eded29d9a21f531aeb87d34c1754a5809632f28c4f0db3048c82281eb5bb8802fff19d121c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032643, "uuid": "ea0b31d6-9346-4426-afe3-3c48be6a270b", "value": "T1AD64BF20A690C035F4B712F859BA93B8A83C7AB09B3451CB62E656FE17347E4DD30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032643, "uuid": "5d138da6-e94c-4fe7-8e33-bce115c5ab92", "value": "42558e76cb0191e50d5255e5f863e8b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032643, "uuid": "01c23016-7c3b-486d-968e-bffb6b95ceb5", "value": "6144:+5ZQGnmDRnv8PII2d3Yo1gH76yKyRNgQDu7WoQciP:EZcv8PII/o1a7Fd6rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032643, "uuid": "3182a005-8d8e-41ca-9a3b-ae1488c45b06", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032643, "uuid": "2822b0f6-a5a2-46fb-acd0-c7bcd468ea2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032643, "uuid": "e041db1a-1e9a-45b9-99dc-702ba1131646", "value": "921e836b1612b2e43eecedd0b0aa44e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a653d506-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070209, "uuid": "51883dde-66de-4997-89b9-3aab52d17dfb", "comment": "Malware payload (SnakeKeylogger)", "value": "78196d6000761d64958f0fe190ae96fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070209, "uuid": "22682953-bda0-4907-8a30-1f609eb89007", "comment": "Malware payload (SnakeKeylogger)", "value": "da31a3a4db7eb99f440846b2c6f892ddac49ae7dd8fdec33cb6feee0a520bf9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070209, "uuid": "2cc58347-2588-4c4e-9a63-13d83ddea56c", "comment": "Malware payload (SnakeKeylogger)", "value": "e128d5fc4eb5a3892f210ae3ab13a9179d754355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070209, "uuid": "d4186ce4-ed7c-4eb2-a3fc-bfd6fca28ba3", "comment": "Malware payload (SnakeKeylogger)", "value": "169ecd186bdd189c34ff41e1c180408fdad46c7fd1ab6f01332fa3773a02b44c3630c1f022c1dfb606cbe27abc98ddb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070209, "uuid": "61ea03a3-c04e-4e2e-8f4e-ca938af47fd0", "value": "T19154E11B65EA33E2E5BA0FF89E21B20007797DE11C47EE6A1E8170D91572B0152B1F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070209, "uuid": "10133b16-ae47-4a26-a796-a74ccb7bd62c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070209, "uuid": "a467ccb4-c561-4f74-8014-6637a4e2a1c7", "value": "6144:zttvJ/xapAJJ3Kf3DYFc8rRcgUe6mgIyJpfVvfKfxnA:z3FxkYJ3AYMWdyD9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070209, "uuid": "12ce9109-e10f-4d76-bb97-b9a0f356e9e1", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070209, "uuid": "0a614622-0f14-4a3a-96eb-a913b7f88392", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070209, "uuid": "86a89467-4976-4aad-ae97-cae74e4786b0", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f011e05c-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1632032537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032537, "uuid": "6afc027e-2013-4371-9af6-a5af35d17800", "comment": "Malware payload (CoinMiner)", "value": "0ee1da65aa031ddeeff76e47566f25fe", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032537, "uuid": "e08a2b20-21b7-48b1-a8eb-a5a200cfd674", "comment": "Malware payload (CoinMiner)", "value": "db2e0387321f6901c75228564c23c7d55a4d05e5b9bbe54a7f11a85b3d187dab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032537, "uuid": "ddc17d19-68bd-4232-a646-0e329d4729e4", "comment": "Malware payload (CoinMiner)", "value": "e07e0a00cb6c7b4e13b7f9135f141d3fd0f58d7e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032537, "uuid": "131f93a7-acb0-413b-9813-fdb30f899668", "comment": "Malware payload (CoinMiner)", "value": "c6bd841635c56aabb851da0bb5d3cdbb0abc1d278d7375fbfc7aeaf43bbdb49f625ea91cf33062bf958a1d7cb80093f0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032537, "uuid": "e6f7d10b-eee0-4646-a129-8561fb0d267e", "value": "T14A14E07A72EA0FADD39F46B10960B6406E30E286D543FF9A685D031B1B423DE16E72D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032537, "uuid": "347f7426-8911-414a-9bdf-6a73193e72f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032537, "uuid": "c35d4c68-188c-4eae-8894-9731872541a1", "value": "3072:wiSk4dtfubZkNVYxyrfyuq5mUF5eWEFb3AgM34udq9Y9fNgbec+1+F3t2OYD1Duv:VSvrubOAfet3Agp0q9ygbX+1RzDU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032537, "uuid": "702ebf99-c733-4cb3-b1e9-1333090e9fa9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032537, "uuid": "f874fb78-9291-49a5-8ffb-3a0e987f7cb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032537, "uuid": "d9adc98a-ac50-42ed-bb78-1c196bad0631", "value": "0ee1da65aa031ddeeff76e47566f25fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3906dd-18fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632023295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023295, "uuid": "bf987953-3b83-4376-aba8-73c6fa10e1fc", "comment": "Malware payload (Mirai)", "value": "03a401d7ce22587388279f6f84d73658", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023295, "uuid": "f673c9b8-9e1c-4509-9612-f59f5c3f9d8b", "comment": "Malware payload (Mirai)", "value": "dc5f128ed6e35a5c85b265689aa3b96c35bccc4e1b637ff8cd116bb80ae1e277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023295, "uuid": "bcee021a-a1aa-4bf1-87a9-948c94a0eae7", "comment": "Malware payload (Mirai)", "value": "09e5a7a60e0fc8aaa2de016909cf1a003ddabc32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632023295, "uuid": "40fb8131-909e-4b7e-82b4-06ec05355f8e", "comment": "Malware payload (Mirai)", "value": "0b043c53afc94205cc3c0b4aa177f9b82caf92cbe76a04d49d9a737c34ff3bc96ac44e0b47f7633c1065d65164f983a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632023295, "uuid": "c8d9b3ff-468e-42d7-99d9-f796901c55b3", "value": "T1FC6401CFEA51BC7AF99A477035670B0AB7F4D5C9D2C3A590B268C5843CBD281E7606C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632023295, "uuid": "042f1174-c9e3-44d1-8d35-e8212aea3673", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6coYa5POdOQ33Q:7O/QJHZweEL/NOjCHm7FZZncYPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632023295, "uuid": "fabb82ac-0b63-4a66-931e-d3ad976e8e64", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632023295, "uuid": "413a48c0-384e-4c98-b6fd-f7a69badd8e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632023295, "uuid": "350fff76-3665-49e5-8ecd-adaab1ae3912", "value": "03a401d7ce22587388279f6f84d73658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5763b8-1923-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1632040210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040210, "uuid": "497a14a3-3022-44f1-81d6-36c5116916f1", "comment": "Malware payload (Glupteba)", "value": "53f8dfd7e8609a8a57bff84049e3c815", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040210, "uuid": "45c1dee0-89c3-4439-9190-17c26661f69c", "comment": "Malware payload (Glupteba)", "value": "dd4cd014bf67de3e7820783f35dd3810a6ad0a15985d3c2701abccf26e748bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040210, "uuid": "a231203f-c010-4a3a-a5b8-c14e186d7f3a", "comment": "Malware payload (Glupteba)", "value": "adfa2dc63042156efc170627e0353b4168f46212", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632040210, "uuid": "2cd480d4-bf62-4824-aecc-d50d29645eef", "comment": "Malware payload (Glupteba)", "value": "0d04459a6fa09abfb7aa4e836f0f1409e96bee16149daf3c280c7b7a3fea08cdc79fb962ab8a34d62acf94044fb52b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040210, "uuid": "83f12353-8ef0-45e7-8a2b-4a4797a8e1d4", "value": "T1EF26332079A1D039E4F729B998A6A62C6C2D3EF15B3482CFB1D105EC433A6E4EC71757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040210, "uuid": "b323278e-93f2-4ec0-9ba0-7441a4bbc1bc", "value": "2b14341588588a7736588af3b9a80be5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040210, "uuid": "b328dccb-c09d-43a3-a8eb-fd42f240e2b5", "value": "98304:g+pBXABU2RBF8HP/zmpSYeMVWYXEiVDHcbHu3aFd3F8gKyFRcdnZ8:YUu83iiMsY0iYuKFd3u4+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632040210, "uuid": "acc0a024-9d23-45eb-ab92-4d3758a1bbf1", "value": 4631592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632040210, "uuid": "ed1bd00f-a431-4595-9a44-d50989a6b787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632040210, "uuid": "8ad3feb1-6d92-45d7-a9fa-eede117a8971", "value": "53f8dfd7e8609a8a57bff84049e3c815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922ca773-193e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1632051707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051707, "uuid": "e0aa0897-0775-4517-bbc5-7bf0a0e53038", "comment": "Malware payload (CobaltStrike)", "value": "8f66abe19b2d78d1486a74f3ca651db5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051707, "uuid": "1595b31c-6f23-4f96-8c01-ebe71387ae05", "comment": "Malware payload (CobaltStrike)", "value": "de1ec20f816bc6054721b2fba2fb3d9d713d8a17838035e518542e95749e9064", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051707, "uuid": "78b64435-1137-40e0-9a0a-02a27755ad41", "comment": "Malware payload (CobaltStrike)", "value": "be9c3ca50969354fcfe1ee5abc60bda8ba4d5643", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632051707, "uuid": "3927cb2e-f127-4163-b158-51d76535c8ff", "comment": "Malware payload (CobaltStrike)", "value": "51be37582c79dceba49421f1d22535ff03d6c3e712e42d799d3ae57b71bc5f8b80fde360b857be717bfd09c1c4536a17", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051707, "uuid": "ce9dc71d-1cc7-4d62-a09d-541113b7dae7", "value": "T1FA24E036229721BBD08D8A79C0EDDC256EF9D217DE39849BCBC20440A8DF3496F75AD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051707, "uuid": "9948a291-deb8-4746-b4a4-e8472709d6e4", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051707, "uuid": "ceee98f7-7831-4dbe-81b5-64af210527c2", "value": "6144:RTsX9h+QwGv6tuY0eami/izTLLL5syhP:9eQQwpL93LLL5VP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632051707, "uuid": "287cf259-9445-45ba-a43f-42d84898b861", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632051707, "uuid": "a6c7400a-9399-4e6b-b4cc-4177f63fb285", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632051707, "uuid": "14b2b7cc-82ad-46ec-b48e-a1357c366078", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d49619-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070206, "uuid": "dca2077e-ce4e-49ed-a0b0-2e414ab9efad", "comment": "Malware payload (SnakeKeylogger)", "value": "5bb95383ef28e91bfbedbb7a87ad9ef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070206, "uuid": "0d10a10c-4727-4dca-b883-ce8c61a8c792", "comment": "Malware payload (SnakeKeylogger)", "value": "de9299ddc3106928a1e3f6aaf680df5a32e6f4e421b341e5553fe1b57ab60f03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070206, "uuid": "1c1ff2ba-6367-4da0-8106-56d3aebd1510", "comment": "Malware payload (SnakeKeylogger)", "value": "aa71bec5f46f9086d3329ac9c9935fee27ac3449", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070206, "uuid": "ebc39e9d-019d-443a-aa37-fda21b08da19", "comment": "Malware payload (SnakeKeylogger)", "value": "49e16aa1e45228ec73822c45ae00790ed9801f45ad73bc51a8c72166151866378b832e179044058025fdbecd675c0dee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070206, "uuid": "c7a41797-eabd-4742-a997-50f3c47bbde7", "value": "T19625128D77E9147BC38E02B5B462918453F1FC216993EB8E6D097CF965F33609A02B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070206, "uuid": "b8b5b95c-c8aa-40a1-bdf6-c966db965616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070206, "uuid": "5468d024-2f45-46c8-9a68-9d5d89770b0e", "value": "24576:goIlIK65yn1PhU5UAo9qKbZThjT0ZCt9lLsRQrI0:gB1PhU5URlThjT0ZCtDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070206, "uuid": "30054eed-78a8-4ee5-be1d-876a98e85691", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070206, "uuid": "089b5d56-0895-40c1-a990-f572110ca8fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070206, "uuid": "c1b33e7c-a6ae-4a78-8277-310cc9b1de5b", "value": "Mechanical Engineer-074143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8ed91d-1916-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632034469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034469, "uuid": "9c518789-aa06-47ec-a410-9575fdcc974e", "comment": "Malware payload (RaccoonStealer)", "value": "7ee997c2d1d1b95d93f506e633d3cb8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034469, "uuid": "e8bcd191-4c05-4184-85bc-0cab73dfb394", "comment": "Malware payload (RaccoonStealer)", "value": "e021c2eeab7d9fa1bfafa82502b1d9b5e4bea406ee10193fa0d7d2e8ee535efd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034469, "uuid": "87c9adf7-5199-4459-804b-3d5d49600a07", "comment": "Malware payload (RaccoonStealer)", "value": "f6170ddf49b14b913c932fbc39e96f7870edd065", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632034469, "uuid": "133508a8-488b-499d-9e53-989e5dfaee08", "comment": "Malware payload (RaccoonStealer)", "value": "2e9ed1525c67b84260db3444c51901a66f52a5746c9c96ffc7bdb95cccd0500338420ea75980f7c1d1d76c9b37c59e79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034469, "uuid": "60798f84-ae7e-4a66-b4d8-3e5345bb6347", "value": "T1D7B4E020A6E0C035E0F712F9497693BCA93D7AB19B3450CB62D616FE26346E8DD30767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034469, "uuid": "5a5529cd-d9b5-42d7-966d-62831af20668", "value": "cdb03a4e2254d408c7ca16b00224de31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034469, "uuid": "9cd7bc77-79d2-44f1-896f-147573933ecc", "value": "12288:EZakGZs/uG8tRkxG6lQhGu/9WbE1ReXEjXW8EqhBAul:EUkGZT8OMULe0jFAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632034469, "uuid": "21ec85c5-9459-44d5-9893-bc971a78ed71", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632034469, "uuid": "a0ae64af-4448-41cb-af04-eef3e87c8a66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632034469, "uuid": "b63ac00e-0f7d-4615-86dc-4cbdcf9535c5", "value": "7ee997c2d1d1b95d93f506e633d3cb8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87161b7-1985-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632082238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632082238, "uuid": "4dc758b4-9ab9-42d4-a9d7-5789587d105b", "comment": "Malware payload (RaccoonStealer)", "value": "f74a8a1bdd8d6d90d34f94442a64d05d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632082238, "uuid": "2e9f9114-2e2f-4b9b-a617-93bacdfe61e3", "comment": "Malware payload (RaccoonStealer)", "value": "e05d2dc3425849dd155458956711878eb262bc5937d58a164868641e0da0cb0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632082238, "uuid": "198e1c56-ffbc-4725-8a19-a846dd55b641", "comment": "Malware payload (RaccoonStealer)", "value": "87f69ae1d8a586beaacf150bd7b219d6c79f326e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632082238, "uuid": "d85c01ad-9d42-498a-ac33-332e1606d316", "comment": "Malware payload (RaccoonStealer)", "value": "2f67002414cec3493f6476892b029a12e34b1246061eb82faedfe30a289958df17f9727ff94bf06926721f901e24c637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632082238, "uuid": "60652547-9a23-466c-a63a-b85217ec7beb", "value": "T1A4B4E020BAA0C035F1F712F9597993B8B93E7E71AB3490CBA2D516EE16346E49C31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632082238, "uuid": "533f0d1d-b7cf-4332-a16d-2a9f704ae58c", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632082238, "uuid": "1cbdef6c-2e9d-4209-aee4-41de6c5d5196", "value": "12288:SZKjLNLpBWrk3qkK5ppbkEzrkf4g67RaHlgTDQM9AdqC:SQjLNLqj5pJ4glNkU6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632082238, "uuid": "5c2abe8a-8a73-463f-81a5-a59bb5d88796", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632082238, "uuid": "4f415ba6-f8be-439d-aebc-e6a8144531ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632082238, "uuid": "6af9b991-47ca-4366-8bd4-4b81ba408c41", "value": "f74a8a1bdd8d6d90d34f94442a64d05d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dc09b0-195b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1632064054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064054, "uuid": "e6911e2e-4d53-432b-9793-8ad1b763248f", "comment": "Malware payload (ArkeiStealer)", "value": "c2abeabe1d311c80336149b36c05ba3f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064054, "uuid": "a1186fe5-dcda-42de-9eee-a1fcc5def909", "comment": "Malware payload (ArkeiStealer)", "value": "e0caf6fb02b0ef2bd64b0e04e1793a502b4a3b350a5be41c1baea88842530383", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064054, "uuid": "b57eb632-43ce-4320-9f06-2ff306ef248a", "comment": "Malware payload (ArkeiStealer)", "value": "b0482a0a10265953f2a123e5b9ef0544514463dd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632064054, "uuid": "e36ae1fe-25ba-42e1-b297-32246dc0246a", "comment": "Malware payload (ArkeiStealer)", "value": "f8853d4e7688ca6509a3853b3dc7f3fe65265d1669bb4ea4ba14dffb066770a5089138145eb0bd90d0b65e6daa07c711", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064054, "uuid": "fb371792-8d9d-41d9-a5e1-852e1ceb4b32", "value": "T1DE348D20B6E0C035F1B712F849BA93A8A93E7A715B3491CB62D616FE56346E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064054, "uuid": "7f7d4cbb-bff3-4f3f-adc8-7f69b282a64b", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064054, "uuid": "1bc379be-07e9-4476-8f6b-4f7fbadfde2d", "value": "3072:QP6ZQFLitlpT7zj/KDPNUrXr766dr/f3oLyH748ZjD+ES7w5TGbmshQaA4RcIdyo:e6ZQFoFzr4lUrr766d7QLyUWtYcHRI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632064054, "uuid": "5227a586-5d47-4c30-9e8b-2a8ed7c9c568", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632064054, "uuid": "8799306d-ab51-476e-b517-5d4d3dc5688e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632064054, "uuid": "012ad0e9-8e5e-43db-a571-bc2a55fb5a40", "value": "c2abeabe1d311c80336149b36c05ba3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7185d2f3-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632070120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070120, "uuid": "4904c35e-2136-43f9-849b-b677287dd8fc", "comment": "Malware payload (RedLineStealer)", "value": "2744d06ccec54b48efc46c31a4260dbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070120, "uuid": "84cbe617-9103-4bb7-ae01-0a799e4b972c", "comment": "Malware payload (RedLineStealer)", "value": "e1c28898b21fc1e5a82b89636b9ce0f50251bd8c3188f6e4bea7841c6a4e9888", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070120, "uuid": "dc49b488-ee2e-4cec-96d6-8533fd9aa4e9", "comment": "Malware payload (RedLineStealer)", "value": "2a6d6fe718f8c97fb541ef31f4702dcb24297abc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070120, "uuid": "ff358982-fbf5-4266-8a79-05e92c9aa5be", "comment": "Malware payload (RedLineStealer)", "value": "23ba3071eb65c3483cdabcd40ef2547a0fdef5faa0c5ff7660e96a45d54b4b8ef4c72e5e27d415f6f13cd00210803064", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070120, "uuid": "0c8e52e1-0143-4f59-bf8b-39019cff4aa7", "value": "T1DB94332864BFC05944E3EEA52EDCA8FBD89A95E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070120, "uuid": "563f0b93-2be3-4b12-957a-1235352b4b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070120, "uuid": "bf817695-1d0d-48a0-bc08-304b735bf2ca", "value": "12288:TC7b94xVNtXoYLDdrq6Tm4qRmNXoD0hxTfUZW6uowJt:I+PLDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070120, "uuid": "4fd56074-56ea-4100-9fe3-65749a659b37", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070120, "uuid": "78ef7ff4-3308-4c9f-ad49-6b18a575a452", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070120, "uuid": "31d2115a-a557-4e6c-b32a-e23faae58926", "value": "2744d06ccec54b48efc46c31a4260dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ad1f17-1969-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1632070201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070201, "uuid": "524811b9-be88-480d-9bed-00ee5004053d", "comment": "Malware payload (SnakeKeylogger)", "value": "f2a1930bf642028ccc3d49a6d092a5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070201, "uuid": "66038232-1f56-48f0-86be-14779e4ae745", "comment": "Malware payload (SnakeKeylogger)", "value": "e3abd6542705cce1c0ba2727c681f7bfbeeac628a5f040024bf3edec0d8ad1fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070201, "uuid": "7830c863-dfd2-4b7c-8502-87ce331423bb", "comment": "Malware payload (SnakeKeylogger)", "value": "84aa5c2bd89a1b20bc720f8f2697a46108ca44ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070201, "uuid": "5b4d25d5-7102-4bc6-a424-0e84712e6023", "comment": "Malware payload (SnakeKeylogger)", "value": "ef89ce433c8e3e57936620003eb92bac172f8db29a901f93d322a503cac77da09abe7aa83e0ae9c63ef64cf411af0064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070201, "uuid": "1614340b-0963-4e46-9c80-5db038cb9cc7", "value": "T1B454E02265E933E6D8AA4FFC9D21B21017387DE15846EE1A1F81B0DE193170156B1F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070201, "uuid": "431ddac3-80cd-4700-b0ca-406a17accb9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070201, "uuid": "43eacf05-e325-4cbb-8594-9dacce7eb165", "value": "6144:vbtvJ/xaWAJTs5CPIVI6QAYZnptuc2JpfVvfKfxnA:vZFxzUs5CN6QAYBz52D9vfKfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070201, "uuid": "5ef331df-1f11-43d3-b920-0ba9e943a9e2", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070201, "uuid": "9c917d75-7763-4883-bb68-74edbbcb0a74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070201, "uuid": "58dcf708-5307-4ab9-822a-82c895813032", "value": "purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d504c53-1940-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632052558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052558, "uuid": "0a034e6e-a840-49aa-8925-099e271e8c97", "comment": "Malware payload (RaccoonStealer)", "value": "c0b10f85c540838790a054fb9340a928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052558, "uuid": "3e8f6c12-af43-4f5d-b103-e8bc869a6f1d", "comment": "Malware payload (RaccoonStealer)", "value": "e43a9203ce9b7398946020198e343d697bb2dd9190fe9c36b209a3db35872d7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052558, "uuid": "46025521-a5c8-4af6-aab2-d95b944252b1", "comment": "Malware payload (RaccoonStealer)", "value": "ae6f843aab51628e9e32b59925275ec1eb96a950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052558, "uuid": "096bef60-f92f-4130-8011-c345147172e7", "comment": "Malware payload (RaccoonStealer)", "value": "18d75555b6afacec412575a234beec4417b5a875384fe375225c5c5b490397f6983a6da235342479f93d4e25ca69521a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052558, "uuid": "56c664a9-241a-4dc8-93cf-5b9b62198286", "value": "T18DB4E020B6A0C035F1FB12F859B89369A83D7EB1AB3491CF62D656FA16346E4DD30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052558, "uuid": "1bb32816-124a-4cc7-b0c1-f73726db5758", "value": "a738f70ddfe8b728e3a778b20cdcc17b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052558, "uuid": "99ab4262-bd2b-4ff5-8278-755b8e77c5a5", "value": "12288:EZ2bG8Ljim/EecEElAfeXWAq/D+2JkHaw3H2k7mD2PwQN:EAbG8TPqetAq/i1HayWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632052558, "uuid": "2d576660-8722-46ec-811b-88b61317d588", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632052558, "uuid": "09e5b5f1-8709-49e1-b710-b94215fe11b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052558, "uuid": "8b02c674-3c67-4f95-b18f-3e24365132ee", "value": "c0b10f85c540838790a054fb9340a928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf4dd62-196d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632071935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071935, "uuid": "af695c6d-3f8a-46e4-a2bb-a4885cb373c0", "comment": "Malware payload (Mirai)", "value": "c6502787de75c6efda3cc599e76d84c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071935, "uuid": "fd1e9552-546a-4a3b-a880-7ae9179998bc", "comment": "Malware payload (Mirai)", "value": "e48f06244eee8734e041111a7743598c9c34f8bac952f7a3f09b0e50cfb0e9d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071935, "uuid": "f0273c21-3fc8-4d3a-b68d-3a01f07440d8", "comment": "Malware payload (Mirai)", "value": "cde65f5c6c23c4faf0b40df09d51e32817f8d2ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632071935, "uuid": "5cd11eec-8730-42b0-b1ed-a5f2f37d7f52", "comment": "Malware payload (Mirai)", "value": "105e9d34a0c4c4ac3aea0f63b673d7187f54496cdee285d527ac305c05c14caddec12b7d0ac8e07e1dc6f41bf84c5086", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071935, "uuid": "14b3dd2a-259a-4937-b852-00e56c1570aa", "value": "T1ACD3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071935, "uuid": "b6fdf6a5-202f-4f60-bd5b-b5cde449d1f7", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+pnAOhmm/QMurB12CGNb:RrUlknXmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632071935, "uuid": "0325e1ec-6027-44a5-afa9-ff4ce0e85e4e", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632071935, "uuid": "22bcf6d1-c719-408f-95f2-c1de470521ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632071935, "uuid": "e0359cc1-5386-4ba4-a16c-14b86380ba7a", "value": "c6502787de75c6efda3cc599e76d84c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd8fb23-19a4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632095592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095592, "uuid": "829d1b4c-44ba-4308-b27c-d794ef849b63", "comment": "Malware payload (Mirai)", "value": "b051c775850e34358cc2966f99fa47eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095592, "uuid": "d94dd43a-98d8-463c-bb6c-bb5d4356dea1", "comment": "Malware payload (Mirai)", "value": "e54d1457819041ba0ccfe2df198185844fd4f97beb3d6d7cc8324f752a5a2464", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095592, "uuid": "0f244713-7cdc-4edb-a5a7-0387ff6bf833", "comment": "Malware payload (Mirai)", "value": "414575006ca073e2ae62f1aac11599261280ad1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632095592, "uuid": "5572b7ec-ebd4-401f-bd98-154c8323da53", "comment": "Malware payload (Mirai)", "value": "b45a394bb06b011ea65c6a0239a522e482c8699c4ccc29e1a1d966a5810982d3e42050331f53883db96f4d006e95fc9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095592, "uuid": "c4d57a39-8c6a-40c2-b654-ed0c61e2371c", "value": "T15F43382579BA3E13C0D4A4BE16B34F15B2E0377E30A4C62EBC721F9DEB50950664B6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095592, "uuid": "eb1a465d-b5da-426f-8455-4b16ca8a67ed", "value": "768:BZoDGT9zOq9yaf7luDysHqf4zB+g2J+7vlGvpO+PpBaA2y:BZ8GT9zOSyaf7luDBKf4H9gp+Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632095592, "uuid": "93f48a38-86a1-4811-873c-9cfcf8d3272a", "value": 58604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632095592, "uuid": "107cefb4-bf1d-43d1-bafd-8d65dd9d72e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632095592, "uuid": "2a681024-ebbd-404d-bc95-4cd179fc7316", "value": "b051c775850e34358cc2966f99fa47eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77223b1-1955-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632061621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061621, "uuid": "abfe6387-1edb-49e4-8df9-5a7c911254b6", "comment": "Malware payload (AgentTesla)", "value": "3a4c0867efaa7d4eeda91debedd4ca0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061621, "uuid": "a2e7c1fc-4976-4194-9b19-451cb330da5f", "comment": "Malware payload (AgentTesla)", "value": "e6db3b87b0baaae5362426062156828de499822d72f00854c353bd99b977bead", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061621, "uuid": "c86e9cf0-a47c-42e2-b36c-0b093d819238", "comment": "Malware payload (AgentTesla)", "value": "8d335334b6deca836324da2d17faa48612a50db1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632061621, "uuid": "ffa8f816-2863-4791-a1c7-4521550ad6d6", "comment": "Malware payload (AgentTesla)", "value": "961e04023527f8c6fe3078287cd364c7681d9a5242f2f51380d367b7050b89b571e5149726dbda88e5da71f86f1de734", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061621, "uuid": "61123988-b804-41d8-9ff2-ec312cf02321", "value": "T124650C254D6696F7D3FFC36CE05C0B8EDBF5A483BB918F0E98918682469770BE94814C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061621, "uuid": "4b96e247-2044-48e6-8409-6bf877a69ab8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061621, "uuid": "94651bda-81d1-4168-9310-951569897ff5", "value": "12288:dHQyVDXA1KWFQSdV1QGDEJfS4tRRZ7aLYslMEksTA1gL1F:KWA9F5V1QGDEJzRRFaLVMEksTAGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632061621, "uuid": "da65b57e-4c96-4234-b7d0-bd59b86b5e26", "value": 1457664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632061621, "uuid": "d5903e1a-fc3b-4b1c-85ae-5fbbd9644781", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632061621, "uuid": "ea3220db-c181-4406-8608-4474eb17c29a", "value": "TT_remittance advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b78f7f-1995-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632089139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632089139, "uuid": "00cf45af-6fe6-41f4-b29a-1d9c3f1d6792", "comment": "Malware payload (RaccoonStealer)", "value": "a3c7a433206ddbf762652daeb1b2eb3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632089139, "uuid": "b9cd8233-adfa-463d-a794-788f957d51fa", "comment": "Malware payload (RaccoonStealer)", "value": "e8018798a95c46edf4dd057dc0f53e887644941ab5174ccd4019cd7ac39e9a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632089139, "uuid": "8043adf8-8af6-4b95-989f-d41e9ede5a26", "comment": "Malware payload (RaccoonStealer)", "value": "96aa37bef779bf6762e946a62f7e3df5d87a4aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632089139, "uuid": "8290228b-e25f-45b5-8b14-b4bd520aac1e", "comment": "Malware payload (RaccoonStealer)", "value": "0e9c8da477398b810d7852df8040826a6bf77873d4ffb16babc954a1bab58088685274c62e6589b3d40fc60bc2cf4029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632089139, "uuid": "7061d4f6-cb68-4147-bbd2-125510b644c4", "value": "T117A4F14078E1E071D39665B46837C6A0997AA9E5387C41BB37A73B6EFF302816B35343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632089139, "uuid": "45bc95ac-d283-4b62-8411-b2e82fbad94b", "value": "410705447b2186b51cd6d6e90a878e3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632089139, "uuid": "2d8085b5-d503-490d-afc0-9159b73beaeb", "value": "12288:0Lm9FuBuisyEzbBGGNA59M93y5CiG3pwh2H+:jFuBuivEzbBGMs9Mior3pwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632089139, "uuid": "1320caa0-6358-4f74-b364-b13f59cf1f6f", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632089139, "uuid": "c3c31fc6-b0b4-4712-8348-a1639ae6a129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632089139, "uuid": "17ff96c1-bed1-4646-afd6-6b19b29ddd1a", "value": "a3c7a433206ddbf762652daeb1b2eb3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d23de8-1938-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632048886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048886, "uuid": "1a56e733-17f9-485c-ab22-59f91a62eef3", "comment": "Malware payload (Mirai)", "value": "d0c4329bc243a3d39a77d3deb06a76cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048886, "uuid": "a9381db5-9a1f-4c16-bfba-79f4b4a9212f", "comment": "Malware payload (Mirai)", "value": "e802d93c80afabd9965500f40c1d4812517bc5dc78e2e7ab5dc6101a4103cf9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048886, "uuid": "3a4d398b-ea3a-4646-9682-975531ff6067", "comment": "Malware payload (Mirai)", "value": "c713af83ed2777b9bc1d21447b20265d23f3010b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048886, "uuid": "952dc8aa-5cb3-42dc-a7b3-92a221c77400", "comment": "Malware payload (Mirai)", "value": "ed87859305aac5690ae719cb7fb15ebde63c02ceae49e09f61f656e0ae12fa6fb5757276347ce60ff35eb2e00f745af2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048886, "uuid": "a5350482-6189-42db-a6f6-052e7e11d3d7", "value": "T13F535C02B3684E0BF9E61AF5243F1BD483EEED8025E4B585A90FD7464235F33459AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048886, "uuid": "a18b2bef-4776-4e8d-a70b-593420039a7d", "value": "768:zipbi/131WUsTETbl1T9Q9n5pY5eEgGsllk5MDZH0a26lBHW2tdFsDMUQSDAYT7h:zT93Egl1wYAzk5a+8NbK1DVnGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048886, "uuid": "1c09d143-5151-4f4b-9aea-84b17b26c321", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048886, "uuid": "56f92d3d-7738-4111-ab10-c05a3d4d1a98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048886, "uuid": "833f27c4-4ebe-42cc-a5a5-dfe5e72d49de", "value": "d0c4329bc243a3d39a77d3deb06a76cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeed189-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632063882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063882, "uuid": "6c6ae463-4769-4b1e-98a9-383ba3116866", "comment": "Malware payload (RedLineStealer)", "value": "7c466a137ce24b6d254713639335cf0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063882, "uuid": "1a8ec2f7-04c3-463f-8e47-8fa61eef38bf", "comment": "Malware payload (RedLineStealer)", "value": "e81604994f95ef3f2c0c79b64b37664b55075a06b4bceef35b9ea5f160b5bd94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063882, "uuid": "1c8ae4ba-6730-4b05-954e-fff5aff33d4a", "comment": "Malware payload (RedLineStealer)", "value": "61f968802ca36b35d1a7a81b9e00630fd6b6799d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063882, "uuid": "efa824b9-29e9-432f-a694-756e66c6e814", "comment": "Malware payload (RedLineStealer)", "value": "25119ac8b208d5eba58b715e8e8bfc2cfc6dbb2fabd07cd4e4b27a4b699530393279c64531a9d340eceec524d6a38a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063882, "uuid": "e42d273d-2c62-40d2-99a0-ee63ce9ca7fb", "value": "T1DA64BF20B6E0C035F0B752F859B997B8A83C7AB15B3490CB52D616FA27346E8DC30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063882, "uuid": "f7bba5d9-a8f2-4105-bafa-a923bbcc1950", "value": "cdb03a4e2254d408c7ca16b00224de31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063882, "uuid": "d5847df5-afa4-45b7-bc3f-8d2ef37982ab", "value": "6144:zWZQJNpGZ/1szSeI3wIzkKkoQJJkqYeuuprmPfQ:CZn/1szSQIzP8rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063882, "uuid": "55dafe6e-7bcb-4ef7-9bd6-b0e84be504ad", "value": 320512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063882, "uuid": "3ea1940f-9ce6-48bd-8e4b-12a330c3fcc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063882, "uuid": "3f9941b4-9a65-4155-be26-5e65e13043a5", "value": "7c466a137ce24b6d254713639335cf0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceaa0dd-1960-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632066462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632066462, "uuid": "2cf5546f-a003-4397-8d01-6cd9554fdc79", "comment": "Malware payload (RedLineStealer)", "value": "5d270754f01dc386e2fd92d17b712089", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632066462, "uuid": "bb4ecaf8-2281-48c9-8d1a-9f29e7fb5438", "comment": "Malware payload (RedLineStealer)", "value": "e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632066462, "uuid": "0a169871-4c1a-43a4-b5f1-8762bc7bdb77", "comment": "Malware payload (RedLineStealer)", "value": "54f3dfbd240c1d386b5dcdf40c992fbe5ec6c54a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632066462, "uuid": "92b2f2e1-f60b-4460-b0be-445b6a294f0b", "comment": "Malware payload (RedLineStealer)", "value": "9bf451adef4473cf746eec80378d02db5c6b4a1baec7090df64d98c9d059b0f1ae077a0c35d8322acc0fd821a1632398", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632066462, "uuid": "56fdb447-7af8-4de5-897b-95c51bb2943c", "value": "T170942528647FC01985E3EEA52EDCA8FBD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632066462, "uuid": "83f09eab-a1db-4daf-b04f-c902c23bb387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632066462, "uuid": "aa36f529-bd4a-48b3-97f1-d183e9b7a845", "value": "12288:TXklT97inNquAILkjhV/HheHmOkmfTMUvNsgr/GUUf8Cit3hitMIF+/5P:WpjhFRgr/GUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632066462, "uuid": "bc23ce1c-3b5b-4368-a1c4-2f29013e75d2", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632066462, "uuid": "05dd40a3-911f-4146-8c94-c27a9f801c30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632066462, "uuid": "e93eb37b-e8a1-4459-80cb-3cce640779a0", "value": "5d270754f01dc386e2fd92d17b712089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e61fe5-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632063838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063838, "uuid": "52374166-3ee0-48ff-bd85-76de22062a91", "comment": "Malware payload (Formbook)", "value": "ae7b3dc7cbc2202855418718b8cc9c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063838, "uuid": "2d9f6e95-60bc-421c-9734-e1f920d486bb", "comment": "Malware payload (Formbook)", "value": "e94b8626361ef2ef783dbb4c5662c62a2f27f79e7453b0831805a04541e0ac12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063838, "uuid": "d88c8518-4ba2-473b-b468-0170734fdfa0", "comment": "Malware payload (Formbook)", "value": "cac4bddaa47b50256006da8a4bf2c6bb3528bcc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063838, "uuid": "dbae621c-33fe-40a8-b52a-63574dfc6e6b", "comment": "Malware payload (Formbook)", "value": "b9092834a2d72ce844083283f0aacba9c575425b957c70b948e7cffdc14fe0b71a7a8de5717eb86318001577783f5b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063838, "uuid": "e6676cbf-b1eb-4b1d-83d7-b1fb9bd5f9e3", "value": "T16594121812ACE751D57C5BF920521540E370A36B7231FB4B8EE7B9CA56EEFA04325E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063838, "uuid": "2611f1db-07f5-449f-bf54-dcec411e2ea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063838, "uuid": "14590896-f964-469d-ab85-bb2b43df1f96", "value": "6144:cs+R7vMU8KWV+ZV/a+jzGZYybgpXYrupYy1dBCqRy86QQ0qDdCXWlMrL6fZi8Jx:cs9PV+aAiZYgUXRp96T8E0cdCmzi8Jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063838, "uuid": "c3574103-cc6b-43c3-b82f-60d3f7ed15f6", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063838, "uuid": "c7b8a2ac-7bfe-4c7c-b37b-945be9b8025d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063838, "uuid": "effb7730-9190-44f5-818f-b91c49e53dfd", "value": "ae7b3dc7cbc2202855418718b8cc9c3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57275d6-1988-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632083602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083602, "uuid": "b2bbf6af-8654-49e7-83d3-621239f88003", "comment": "Malware payload (Mirai)", "value": "c7fbf441ad3bf4c5ed17df0517848bc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083602, "uuid": "44b68957-37eb-4aab-8050-5920dfa78e08", "comment": "Malware payload (Mirai)", "value": "ea630359e80b0197eca498f994291c7929ea906891cdd7594b815c185bee9d3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083602, "uuid": "0cdd3990-0280-4515-b4f2-657248725ce3", "comment": "Malware payload (Mirai)", "value": "55df35787d54a2048199d6b8dc188eed577f79fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632083602, "uuid": "bd6c5150-28ad-448b-9fc3-4ead7a550655", "comment": "Malware payload (Mirai)", "value": "88ccdfc2729df7106687ebc18b0f13dcbb1d13670ba786bed7c3c356c20d2735012bba074da412634a5e256ae6f91063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083602, "uuid": "de6e2ece-8bb7-4a01-a86e-23d714d8c6c2", "value": "T17B238E77C8A91ED4D7958574A12CCA3A1733D418A29B2EFA1A07C579A00BFECF1093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083602, "uuid": "d38c2097-2210-4f9c-848b-3f82759476e3", "value": "768:Sa6Z21e8mofzVh/9VPHLLCWuWo3BOlzMCYAu42/:Sa6ghXzVh/9VHop38wCYB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632083602, "uuid": "c95fa7b9-dcec-4df4-8a27-7913293986ee", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632083602, "uuid": "8663a1e8-65bd-4be2-9865-2e01ed1b88e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632083602, "uuid": "02dd1f65-a2d1-4ef1-8ff5-0f3fc06aad88", "value": "c7fbf441ad3bf4c5ed17df0517848bc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af847a1-1939-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632049386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049386, "uuid": "fdad489b-900b-4633-bbae-30de299c57f9", "comment": "Malware payload (Mirai)", "value": "4fec31ec30f21a9087a50634e74a359c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049386, "uuid": "1d9e3d9f-6c39-4de1-a610-4c2e15b7e0ab", "comment": "Malware payload (Mirai)", "value": "eae8d52f1421472948261a9b659e5f90ec184485ff35946bba2c279fe95aabf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049386, "uuid": "49479f3e-2283-4090-a415-f7ba72e1c0b0", "comment": "Malware payload (Mirai)", "value": "b2ce2149be68dbf602267f17961176dbdce77304", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632049386, "uuid": "e6667cda-1618-4d49-9189-5c1846ee463b", "comment": "Malware payload (Mirai)", "value": "d995a565198e1f63b7d61f978feb66dce59998ae94c5cb5a1776ba4e67b94fafa8be5c397ac665b76009809d7f61fe4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049386, "uuid": "6fc61fbc-9894-4c31-b6b7-c8ae6328ad65", "value": "T179735C34A97A2E26C1D0B13F22FB8761B2E5260E25B4865D7CB60F4FFF2065464172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049386, "uuid": "1c83f56e-9149-4c19-9c08-b20782c039a7", "value": "1536:Azvh+FNkgj5cXlkqFfjzYWcSrGhQxV6vVgFpqxfQFxm:LtIYWc+8vVfxfEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632049386, "uuid": "4687c91e-e929-4e0b-a0e1-5a0c8530dbd0", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632049386, "uuid": "6bb11a94-60c4-4efe-9aac-0b83ca566734", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632049386, "uuid": "3f19b406-31a3-4164-9092-f94b50789ea4", "value": "4fec31ec30f21a9087a50634e74a359c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7975929d-1912-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1632032767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032767, "uuid": "9ab629a9-26d3-4020-838d-f3f4c6c72e0b", "comment": "Malware payload (CryptBot)", "value": "076810b909fadd7de64a172e5f5ca349", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032767, "uuid": "e7a8f6ba-95c9-49da-b889-12b9ed3dda26", "comment": "Malware payload (CryptBot)", "value": "edf429e26636ba7c240cc68f30a4a22360fc97156b8855c1cd7bde74c78082f2", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032767, "uuid": "23785f8a-2032-4644-a099-3bc43ef60a00", "comment": "Malware payload (CryptBot)", "value": "5a4b3cbc623065487f9c593729df6bea7873cf5a", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032767, "uuid": "a79154c8-b0b0-4386-9a24-447a33b9956a", "comment": "Malware payload (CryptBot)", "value": "15662f4996d717fdea1a06570c390df13c6967d0e09f4527f67b50dab621ba752c2cb5239e280d52240dda6052915e7b", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032767, "uuid": "e91be4f3-1155-475c-882b-eb0d7f615297", "value": "T10464CF20BA90C035F4B712F959BA93A9B93C7AB05B3450CB52E626FA17387E4DD30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032767, "uuid": "d21bd401-b5eb-44d8-a4a8-e1aab7e03241", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032767, "uuid": "6c2d71a8-66c4-4d7e-a71c-ce6cd896d587", "value": "6144:9TZQsCR1RkrzX9L6K3DrpI22NitVTjMUhXeisWEhu32chY:9Z8mrzX9L1rpI2njMUhXeisX8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032767, "uuid": "800328b6-ae50-463f-8fe5-a990019430f9", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032767, "uuid": "0ca2ec13-b47b-4f0e-8dea-9acb2b5895f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032767, "uuid": "e892cf01-714d-43a4-b510-35c0b347c280", "value": "076810b909fadd7de64a172e5f5ca349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8422a11-1974-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632075044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075044, "uuid": "6edae282-9d18-46d7-881f-efa678b420ab", "comment": "Malware payload (Mirai)", "value": "52390c4d9df5770b12898ab4a2a902bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075044, "uuid": "84ef536d-c777-40cb-8dec-de78cca9fbf9", "comment": "Malware payload (Mirai)", "value": "ee9a0aa8270b976a46b9c15e3bf578153b32db35cfb79155d516ad13dcf56992", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075044, "uuid": "6fdf768e-e7bb-460e-b3c9-a5466234b6ed", "comment": "Malware payload (Mirai)", "value": "3d5031196a2871afde06cda9a08d13e420623ecb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632075044, "uuid": "ef422660-eb2c-4503-99b8-23a1a46a928e", "comment": "Malware payload (Mirai)", "value": "3f1d7b9d4fa39dd5b8268a7e28ff535904a1568d9b3f202523d525ef4bfc5cbc75a3f576c351af829200a81e859669f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075044, "uuid": "0a183586-7b96-4a18-9879-785bf5faeaf2", "value": "T156E2D18DF840DCD1C9BA8D36525E2AA0AED551F950BA4BBCF3060D45FB2488BF19C6B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075044, "uuid": "9ec3af83-5931-4e78-906d-cbc976593444", "value": "768:IrRKG+yWmYI0ibJrP8p4lGo6mM6oYWDM2aW3:IEGfbH0ib9P8alGKM6oYi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632075044, "uuid": "b92e43ee-81bc-47b8-842d-1649dca1dac5", "value": 33980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632075044, "uuid": "d5f9f65b-e613-42f2-9029-5e7fcca1f237", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632075044, "uuid": "1867efb9-8ea3-4ec9-94ff-499191f31ff2", "value": "52390c4d9df5770b12898ab4a2a902bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430ce73a-195e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632065318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065318, "uuid": "1af18472-0eb5-47c3-a2f3-4c3def43c095", "comment": "Malware payload (Mirai)", "value": "65853f10010b8a948232b09e12c23050", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065318, "uuid": "6212cacc-47d4-471c-9a0e-6e1bc60e688f", "comment": "Malware payload (Mirai)", "value": "eed7bd4d1233c5cd34375ede143bc9033859f9eef6959c0790b2e4d6f6503815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065318, "uuid": "52ce7739-47ce-4276-9ebf-2ffc0958e26e", "comment": "Malware payload (Mirai)", "value": "a8ef250324c6d1498ea790f090a4bb2b8608180e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632065318, "uuid": "1a443f1e-68a9-4615-9c50-b277c7b230d8", "comment": "Malware payload (Mirai)", "value": "70c9846a3ba8ea3c00bdb315500a9225e1ced20c604e487301adfd87cdc528d136b817b681ae0cd0722381c7c9a372b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065318, "uuid": "7fb6d8c2-7bae-418e-b751-1046ae064ab5", "value": "T11F03F206A1115651E4A32972F87D8402737BD6FDD95B3F3811AC872638AE603DBF9B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065318, "uuid": "60a6443f-5579-4a1b-b696-767ef0ae77cf", "value": "768:5xRteLv2kDo/3VUdYe1lYMfaRS2nATaYVf8gW6Vq3UIl:X2J4V416Mt7BW6yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632065318, "uuid": "f59bb1d2-45d0-49af-a0d7-85836775fe68", "value": 39448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632065318, "uuid": "363e5ade-b15d-48d4-ba9f-ba5a64ee1907", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632065318, "uuid": "fcd57418-2ceb-4aea-8766-f65339dccb05", "value": "r.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adef7188-1978-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632076664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632076664, "uuid": "af261e0d-be72-4e0b-8b61-9f38f301ccef", "comment": "Malware payload (Mirai)", "value": "33d5a5ce8e50c3a1c0644e41161d7aec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632076664, "uuid": "39e67bac-349a-4eff-8736-04bbd71a2256", "comment": "Malware payload (Mirai)", "value": "f031d4a781e9006d8c22f470470f4ecd748a19976f3e3d1ab30a45b18ea2ef6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632076664, "uuid": "28ee14cb-ff0d-4b1c-a345-5149fa42c53b", "comment": "Malware payload (Mirai)", "value": "a7aa421e2ae12e42168b87f1e61059307a9d642b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632076664, "uuid": "bfd05c21-d04d-4eea-af0b-03c3f2ed4c55", "comment": "Malware payload (Mirai)", "value": "62031f2b527e9566c7491578cadf1c43f132c770a29f6715f91642a750eada1030309ac4f767fee944fecd34fd4c83e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632076664, "uuid": "f2580fdf-bef7-4d66-9af6-41689136189b", "value": "T12F734A32AE651D27C4D4A27A21F78220F2F6531E22B8851E3CB10E9DEF74A4471677B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632076664, "uuid": "bc266356-9a3b-428a-b5f8-247c7d5ecf33", "value": "768:zsnoEjo/rmgbRg4etlasrnvQXYUcSTEzZO+75HGkg2cCd1tMFRmIH:Anjjo/CgbRg4wAmvROO75k0tMFRmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632076664, "uuid": "88d46345-59f7-4eeb-b4e1-6ed78c8c4067", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632076664, "uuid": "b3ed5885-c29f-4df8-8419-ce49890647f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632076664, "uuid": "edf1e803-ff82-45d4-8faf-c6b530b3a4db", "value": "33d5a5ce8e50c3a1c0644e41161d7aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419757c6-1968-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1632069610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069610, "uuid": "ce7c969b-1c2f-4d03-a739-6fa8146c81c8", "comment": "Malware payload (Formbook)", "value": "7e28292ea46332386d0094bcf7cdf25d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069610, "uuid": "7f657ed5-75d7-474c-91f9-ac6695d06533", "comment": "Malware payload (Formbook)", "value": "f03d8c2b07e6437f3a9ea53bb967367a2302705084f4d820e01ed3fb14205e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069610, "uuid": "72d553fc-d9f4-4bb3-94da-2912d1aecb60", "comment": "Malware payload (Formbook)", "value": "530b477e43266541373f5f434142a2404b86cb61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632069610, "uuid": "983d0243-4420-4d05-b557-d3fffe7731f3", "comment": "Malware payload (Formbook)", "value": "dc94ee9f1d663ee22c3708192bb006d4398311700a5ac5cf01be4afa34edd32f1bda8d3c70549e7fbca38a2a58a261f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069610, "uuid": "53d8ba54-2b44-4a8d-aeb3-bc611810a8f4", "value": "T100742313B7A19D77D6E545308DFE2A1FF37A8298232315971FD4AD2A39221C6850A3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069610, "uuid": "b5a93793-b0b7-4d92-84c4-41d792ccd5ea", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069610, "uuid": "8892f121-3d7f-4054-be8e-a192858fca88", "value": "6144:58LxBMGKmUL5s9IENpm7zCfYUOuC/2GFKjPE9U2WdyDF5hgD+HaRyQ5AN2:/ANpynX/2GFQ+zhbq+HHQ562", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632069610, "uuid": "a37cc12e-72c4-4ee5-b138-eaf3cd52971f", "value": 343608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632069610, "uuid": "b2115327-2b4c-4385-b505-67d75c9d198a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632069610, "uuid": "d9846aa0-e9e2-42f6-8827-cd98a391f801", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836b215f-1949-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632056406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056406, "uuid": "8d3e1ae6-007b-4c61-a7db-1b363a3489f8", "comment": "Malware payload (Mirai)", "value": "ebea8239367883b080ae30bde7d188c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056406, "uuid": "b7ab96fc-ddcc-40e9-8029-cdb90146913c", "comment": "Malware payload (Mirai)", "value": "f1ad72890b16798d3ff5834637a5b966712c6c27116ea2b4c58bba3e64a805f1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056406, "uuid": "57682ee2-9a83-4415-8a74-e62f256a6423", "comment": "Malware payload (Mirai)", "value": "460c86ce1731312b0ed8bd70735ffcebeebe5f3a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632056406, "uuid": "0d08a538-8768-4fdd-9ba4-d87eb838b1e2", "comment": "Malware payload (Mirai)", "value": "64fe1bb786e7e138850e5ea56214dfdb1c1a130e47ab6aa7849e076760d2f0927369dc3134f4fc4f78573d8f8c99fc9a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056406, "uuid": "e49c9dee-9a75-4b08-9535-ddbfb4efd1b4", "value": "T14C533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056406, "uuid": "a59e94bf-8387-412a-b400-dfe05f984df5", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyygGhd2G4NMiplImpcvwJZY10UoZvBqJ:0aHuAzgjjfUKU0NONyygG+7XtJa10fB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632056406, "uuid": "73b7c780-2798-45b2-91dd-1417b5673fc0", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632056406, "uuid": "94b30c3b-126f-4794-a4c0-2ea7395e9923", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632056406, "uuid": "3ac8618c-a8f9-4604-8a5a-fa1d982d6f6b", "value": "RpcSecurity.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb869b40-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632032556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032556, "uuid": "d40fc206-7e25-4693-8bbd-bdc2c4c30c12", "comment": "Malware payload", "value": "369807f9c37c4f71af8ec3a9dcc9eb06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032556, "uuid": "afcc450f-921c-4cb5-91ca-0353c304885e", "comment": "Malware payload", "value": "f209641462dfac4501ff2b7d79ae2c04cff1041d2ae7a74d3137aaf535ff625b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032556, "uuid": "9db03659-a9cc-4a04-a4fb-d56fc9a0bd3c", "comment": "Malware payload", "value": "c7034c63eb4c04265bb9ca104badbbbfd2367db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032556, "uuid": "26737ae3-fe48-4087-9e17-c819a41af64b", "comment": "Malware payload", "value": "14a76ccc400972c1ce54f3cbbdbbf9525187e526f8dfe2d7fc329cc7d0798162b7b3eb6ec5e1843da71555eda62b12cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032556, "uuid": "e9b55fa3-fdd5-4797-aac4-55d01ddcb717", "value": "T1FE2633A7BDA93078E44903310FAD9906EA5ADF5F0C604757FA8431BC7563BD4F8A8B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032556, "uuid": "653ffce8-6aac-41ff-b911-f5684c27f8d0", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032556, "uuid": "1166bc1e-c102-4947-b14a-038e3bb003f4", "value": "98304:3ZWQcy9gX4QDmnqFXTA9PeJX9lMg48EVNa5a1oe4ZPrAi5tf7ofoA6g1uPFl:3sA44QD5lTA9PiagVMa5VbrAiHiN60uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032556, "uuid": "d2a5fdfa-0f66-4d8a-8d81-27bb0edeac71", "value": 4599777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032556, "uuid": "c9b734e5-128b-4bc0-bf81-40c3f6c863a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032556, "uuid": "aebc55f3-7385-4256-ab15-844a8910b783", "value": "369807f9c37c4f71af8ec3a9dcc9eb06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8206ba-1925-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1632041119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041119, "uuid": "d14e9bb3-c56f-4c5f-8b57-e699e3ad4b2e", "comment": "Malware payload (Smoke Loader)", "value": "7b4b44cc869a8b0f51ace918cef015ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041119, "uuid": "5746bdc0-dec3-4320-ac9e-2f3b3a6f2d74", "comment": "Malware payload (Smoke Loader)", "value": "f38f738f52674e3f4689cdb299e82d40a6446ccec24abd4cac244fe64cdc07ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041119, "uuid": "2ddb8967-8c69-4bca-92b6-6ff76bc3d3cd", "comment": "Malware payload (Smoke Loader)", "value": "7b59d8a253c17d658eddbb32fe139c969aee8962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632041119, "uuid": "6b862149-e40d-4f3b-b45c-c15c92cbbec1", "comment": "Malware payload (Smoke Loader)", "value": "4854e88d1435535ebb5d09a8cbb24f8ecd03ac33323b7a43cfbf6b9c9dffa9169424587976cc87e59dce9cf20ff28477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632041119, "uuid": "9e62a298-214b-4e67-8895-569bd5223217", "value": "T123263315F5705A3FD1B6027AFE810EF10963886519B64BCABFEA25CE3279841A3CC771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632041119, "uuid": "da25cf44-d131-4ca5-bc74-b30d97850be4", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632041119, "uuid": "a8aa16aa-aa5b-402e-b2e2-0924e7ded943", "value": "98304:yQynEE4xoywYyqnPYedo+Qd5gNaGNJ0DobXlZCf7FFoe1P3tyk:yQwX4hwiPY69IoJZCD/oehdyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632041119, "uuid": "92b05aec-f179-4ef6-9908-2620d28f53e7", "value": 4505976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632041119, "uuid": "a4bba00e-47ec-4f56-93a2-9cd22252213d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632041119, "uuid": "4a6d1066-097f-4e00-90bc-24bc125d1896", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ebe006-1902-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632025859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025859, "uuid": "e556b119-a2b8-45fd-8d93-0d3c8597cc04", "comment": "Malware payload (RaccoonStealer)", "value": "ef4ff5e7ea7017c3f0bc35f69cc04892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025859, "uuid": "4b222deb-41d5-4677-b0d5-1149c18933f4", "comment": "Malware payload (RaccoonStealer)", "value": "f3bd82cf4cb11e038ec6494fa5dbed8c227a0c012127fe75eefb7345cf83d917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025859, "uuid": "5c41c3cd-351e-4d31-a720-580955d79de4", "comment": "Malware payload (RaccoonStealer)", "value": "2af74b51847e36639282069624e8bde31884abdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632025859, "uuid": "5ba334b2-64df-4998-9d9d-3843bd95b0b2", "comment": "Malware payload (RaccoonStealer)", "value": "0725bef20b525fe566113ce634a8794c5df232f353f375575365f2141b19150d9ce31762cd4632e3e5214efa297a05ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025859, "uuid": "580ccc5d-dc9f-4482-b4f5-9184fbc33214", "value": "T11AB4E1307A90C035F0B712F959B94379E92E7A709B3494CB61DA5AFE26346E8DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025859, "uuid": "b81b106b-0e6b-413d-8a4b-2c24c569eb76", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025859, "uuid": "aae2ca43-5506-42e0-98b0-af9b052e713c", "value": "12288:2ZeMgrf9jNEJRqh/vz8fcodgoLfuoBkOI:2UMgNzD61dgobkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632025859, "uuid": "ffef932e-4f55-4e20-946a-6ab5f64bf166", "value": 503296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632025859, "uuid": "f59d956e-d853-45de-b668-5122b569756b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632025859, "uuid": "7a0965b5-f760-485d-a707-edc692f89dba", "value": "f3bd82cf4cb11e038ec6494fa5dbed8c227a0c012127f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d933d17-1940-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Numando)", "timestamp": 1632052451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052451, "uuid": "5255501e-ce1b-4844-b1d3-975786cf0306", "comment": "Malware payload (Numando)", "value": "c7d18c4670aebfa94bfbe270f651f424", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052451, "uuid": "cfb869c4-3323-41d5-afe1-5a8abb528283", "comment": "Malware payload (Numando)", "value": "f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052451, "uuid": "9a3a936b-82ba-4955-ad55-33a9d6df1072", "comment": "Malware payload (Numando)", "value": "4a1c48064167fc4ad5d943a54a34785b3682da92", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052451, "uuid": "03f21e88-86da-4a02-a296-5f2e7afd9540", "comment": "Malware payload (Numando)", "value": "2b3eb3f8bbd936d8665f36a7e693cab46d18d19ae6309252141a6f30eeac20513a34bf25ced6dc9f47569d0596820fe1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052451, "uuid": "465a7665-8b1b-45a1-bb9a-e295ed0aaf38", "value": "T12C46121239CACA36E93E45706569CB3B14FA7FE00BB198EB53E4992E0E705C14276F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052451, "uuid": "69bee7f6-92f1-4617-89e4-e7347705f90c", "value": "98304:hYvlZAmmLpUU8UfhnrGyMcslQoJzy84YUM6CVrP8leD4YyVqXAo23bqtq7IIFtCL:oOf8Uf1GnruGy84YP6Cyl44olgmtqdFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632052451, "uuid": "9938bede-eeb7-44b4-ac86-f380c6053631", "value": 5510144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632052451, "uuid": "8cd2fb07-5935-4c8e-af68-57442492dd61", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052451, "uuid": "85b86eed-c2f5-49eb-967c-7b61c720d7db", "value": "f3e180897f615a8d54fbe97faebd15e80be7358a3d4aa7ea8511a73285b3fe85.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b365e85-1940-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Numando)", "timestamp": 1632052474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052474, "uuid": "287c1f23-da3e-478f-9792-dcb92e16e924", "comment": "Malware payload (Numando)", "value": "473b4e622b982a92cba1ba8afcda8273", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052474, "uuid": "3bb1debc-7a56-4645-b823-82ffecd1e332", "comment": "Malware payload (Numando)", "value": "f47bc123831a1855a959fbf51b4138683af7bbbde13ad9f164594d2aa6516791", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052474, "uuid": "de5e6a52-5e49-4e35-8ed8-487299796939", "comment": "Malware payload (Numando)", "value": "9a7a192b67895f63f1afdf5adf7ba2d195a17d80", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632052474, "uuid": "d1fba834-bc64-4efb-843c-4bf136090f71", "comment": "Malware payload (Numando)", "value": "565c9fc7a358175193ddb8319fe45d415126ccfffa23af6f8cca95d02fe04490b02de36ddfbcff7d572202c3eb69cc30", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052474, "uuid": "88d1957e-318a-43ce-8812-3a8e510e29f3", "value": "T1AA764AA2750BA5CFF34A07B49C72DF42841ECFA54A25BB05E85CB4F9FEB3C851189A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052474, "uuid": "b4e584a7-27c1-4bf6-a2f5-6cc995b0e027", "value": "7af08f99615676f8d82d430cdcd95f61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052474, "uuid": "3e5aed5a-e87c-4cf0-8f61-b7f05f2fda7d", "value": "98304:rcWt5qfcRS1lVAXbxeLQl8dLLAYqFxgVfHUUgzUhKsoAbtiwCG:gW5RS1lsDFcHULzUhKso8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632052474, "uuid": "f2343cf7-3302-482f-875f-4a88d0b2409f", "value": 7431936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632052474, "uuid": "49ce64f6-2ff0-415a-9038-b4cec3fb7def", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632052474, "uuid": "f64b1cd7-0319-46bf-9cb5-dce342dc204b", "value": "f47bc123831a1855a959fbf51b4138683af7bbbde13ad9f164594d2aa6516791.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba8f521-1936-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1632048072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048072, "uuid": "a1534499-fc97-4d02-a58b-28e972cdf0be", "comment": "Malware payload (NanoCore)", "value": "abfe0efd590a26075fe26c642f5591ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048072, "uuid": "ec435d90-c2ca-4530-a9e6-cb45c48de297", "comment": "Malware payload (NanoCore)", "value": "f5f12d936f0e29a6e3ed94dfb1341fbb92f84ae8849c2c764f9210c76d9ffb14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048072, "uuid": "26521fab-11d9-49f7-ab93-312881710321", "comment": "Malware payload (NanoCore)", "value": "81f63da98ada084007199c56f7f77149c95c5a0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048072, "uuid": "107c147f-3e21-4d16-83f2-509f989647d1", "comment": "Malware payload (NanoCore)", "value": "f17fabdd8b8886a07c923ce450fe57fbb0bafa10ad4cdf2dc63612ae7aba70cad3af16f5bf474f31bada115386926161", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048072, "uuid": "2ed5c651-91b9-48eb-8da0-2e4b9d1c04e4", "value": "T1E0C4F111617C9328DCB59BB56422487153BBBE6A3939F66D4D813BCE2BBBFC50802D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048072, "uuid": "d3c04126-bf11-4b17-aaf4-1898279130ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048072, "uuid": "7795f151-9d17-4776-8352-2fa0e43c9eac", "value": "12288:TpjFQgUUgGchRsvuF00b3vhiSHXJ0jYx8rx7s:Tb5nvuF0ifGjJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048072, "uuid": "7583a42c-253e-4b45-b690-49e3fa500a45", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048072, "uuid": "4c7bfdea-3c68-438c-936d-742f0b45ddc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048072, "uuid": "af7439f4-f776-4538-9f23-2e1bce10d947", "value": "2543535442543098786554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d8bbb2-18ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632015662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015662, "uuid": "77435a27-0737-43dc-8ddb-0d239fe3d889", "comment": "Malware payload (RaccoonStealer)", "value": "133493169e6ca0b4a7d9857e4de62549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015662, "uuid": "fa889f06-92e1-4291-ae42-34be8c50b032", "comment": "Malware payload (RaccoonStealer)", "value": "f75b89253bbf8eecc196711871f889a51685a9d2b8c15f98fab03f0230731f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015662, "uuid": "4c31c5e9-0dd8-4543-a5af-fe7e50ea9934", "comment": "Malware payload (RaccoonStealer)", "value": "33178ce714260970c326f33101aa28efa0d680ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015662, "uuid": "ca1c972e-1208-48bd-b375-64bc1d2a9fa5", "comment": "Malware payload (RaccoonStealer)", "value": "0b3eb88aa29ee96ca7500795f1f7bcda81bdea838c2d5e386e80dd0b741ce3ef07fca00c18e5742dcef4b6f00c9884db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015662, "uuid": "2755c89e-592a-40b5-b7ad-3c409b28fcc2", "value": "T159B4F130BA90C035F4BB12F955BA9368A83D3AB1573055CB62D626FF12386E8DD31793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015662, "uuid": "9abdef93-b7be-4992-aa8f-bfd76754b353", "value": "1bd6d269463cc591268b8d14694f5ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015662, "uuid": "b832d30c-a05b-443d-9b4a-f8acd217f0da", "value": "12288:VZMaqlPHZF8g/dDtRWq4WMHZK74+CizXyXxNw30Jr:VuaqfLZXWq4Y7Rzih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632015662, "uuid": "bada8c2a-50b9-4ebd-8785-3a94f22db9c0", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632015662, "uuid": "fdf649c6-4622-433a-b05e-c1369f84c82e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015662, "uuid": "db70ceaa-aac3-41da-ab66-206aa6fb3bbd", "value": "133493169e6ca0b4a7d9857e4de62549.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd045f40-1959-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632063482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063482, "uuid": "8b00553c-ca50-47bb-beff-631599feb2da", "comment": "Malware payload (AgentTesla)", "value": "21ae2b83c06a6f6a16ba60d8394a8f73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063482, "uuid": "6754362e-0072-48c4-a065-1fdcaa920782", "comment": "Malware payload (AgentTesla)", "value": "f82e7241cf49759096f5d3a02c2a516462eabaf07133ec61d61ad1496ae8bd66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063482, "uuid": "e7013257-f37a-47d4-9c33-45b00336b8c6", "comment": "Malware payload (AgentTesla)", "value": "89b7e5ee8b6fef3f6fcedd44de03127cdeb5cbd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063482, "uuid": "6b9020bc-e3ce-4d87-921d-43bab45486b4", "comment": "Malware payload (AgentTesla)", "value": "13846ba52a5408b721fc305e1c889be180d12303661fb07f7d8c5bb708ec40b8327701a99ab54cde518469c7bae670d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063482, "uuid": "9af1ef42-9bcb-4d78-8de9-21df30ba4374", "value": "T15F8575F19143BDC58A6D29A0123D3DE9BCB5A85B573EC75BEBC104A138170F9EE2D092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063482, "uuid": "9c2cb1db-88b8-402d-a68b-675a74102e64", "value": "12288:z2DyGGdHe4U5jGwWjMLAnyjwsuQx7GlBUaDjtoifQU6UVmGLvglwOrS8:zrL+4qvL8ny9JmjbfQU6UVmGLvglz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063482, "uuid": "9f16e4be-783a-4dd3-a0ae-e1e4ad165858", "value": 1866951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063482, "uuid": "49e8c8ed-2466-44c2-be7b-3ea694968f0b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063482, "uuid": "c291422d-59ab-4433-bb3e-6cbcd1809c84", "value": "FOB NEW IMPORT ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c3bca1-1936-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1632048255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048255, "uuid": "c9c1b2f7-6dda-4873-85af-a8f3ec7a2817", "comment": "Malware payload (RemoteManipulator)", "value": "dfff3efb5cb31f71c9f23944d8d8dbd2", "object_relation": "md5", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048255, "uuid": "1f3f6783-4f77-44de-b758-cf43ca9c7412", "comment": "Malware payload (RemoteManipulator)", "value": "f98b15b7d9550610415c55202d067c0ab6d59c50e55d6a299d7127ead6f6151a", "object_relation": "sha256", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048255, "uuid": "4503116c-2c53-4a0c-b864-317ad6770ba9", "comment": "Malware payload (RemoteManipulator)", "value": "7579ca56e549f57d558de90ac255e13d693ab9da", "object_relation": "sha1", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632048255, "uuid": "bd71a9f8-ba7e-4758-8784-a18f992eea52", "comment": "Malware payload (RemoteManipulator)", "value": "484eb1868d2e069ff0149d3c44d608c1da652e99d37e2f85216a8c4476f4c5893ceb264eebfe5b12fcdb396a7775ac5d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkOxide", "colour": "#C1F3AE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048255, "uuid": "cfdec1b8-cec5-4223-9294-188e8512ec7c", "value": "T125C612C2F760052AE99F077296F79E1C593AEDBC9B60234F5CE0730924B3892197B587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048255, "uuid": "798da50f-da8b-4979-a44e-8d2fee398bda", "value": "196608:aJC9RH7qwA5x6uo0kLzJzZyLQVsmNR3wvpxX1JG9yjSkMJc2we0:8+Ql5x6sk/JzZy+N81FTMJc2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632048255, "uuid": "742777fb-04c8-4643-bfe1-5e1890f32e6e", "value": 11901952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632048255, "uuid": "c093259e-240c-41af-ba56-62715114adf0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632048255, "uuid": "56d03391-2eaa-4fed-a413-8e2947c6e37f", "value": "msi.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630d1d08-196f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632072673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072673, "uuid": "d5d4fef9-173f-4c8b-8407-32f8828d84cf", "comment": "Malware payload (RaccoonStealer)", "value": "464c37ca126363e0251c8d7cbdadabaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072673, "uuid": "6201a250-b3da-42aa-b985-26f37d13a4e0", "comment": "Malware payload (RaccoonStealer)", "value": "fb4ee55f6d4868657b33a834fa135aa874b26d98e84398b7b8b72da06064e070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072673, "uuid": "c4033dd7-3a15-40bd-bb64-cba8fdcda20c", "comment": "Malware payload (RaccoonStealer)", "value": "8180531787c6ebc8a248c5f2274b96bf1f1c72e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632072673, "uuid": "f8ea7f78-7c7a-4747-be3f-33e241f37feb", "comment": "Malware payload (RaccoonStealer)", "value": "8279d89eb8c2bcba911bab5b3aea073c8cd330105ff8e208e0a92678e7e6881d8a940bd89b2f8df04faecac1206b6019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072673, "uuid": "d8135615-7ffa-4e64-9f4f-3b876e436710", "value": "T148B4D020BBA0C03AF1F702F949B597A8A93D7EB16B3051CB62D516EE16346E0EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072673, "uuid": "10a6b788-21c4-4d2a-b6a7-0ea75d015d62", "value": "7be124dd1509e56149d37e4e5fc24f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072673, "uuid": "ab2917f3-88ad-47fe-a895-eeb71ad8e8b3", "value": "12288:bZlri/mSdWz/67trjoV76r5RXWKAkvnzLscBlU4rphYBpfesl:bvri/TloVURXWKTnfBtkpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632072673, "uuid": "c0c39d43-4898-4c13-beb7-0eec2cc4de8b", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632072673, "uuid": "0043d3df-f5b3-43b1-93d8-03eeae4dd8a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632072673, "uuid": "7a207d00-d6ff-46c8-8619-7bdf6b951861", "value": "464c37ca126363e0251c8d7cbdadabaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd49a06-1930-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1632045604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045604, "uuid": "b133c5e3-1f1d-4051-afb7-d1735e2d63b3", "comment": "Malware payload (Mirai)", "value": "88b7b6da2a73b36c92ec8e03510cfaa1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045604, "uuid": "7bc63b36-27ec-4b1a-9124-8ba67a1c89d9", "comment": "Malware payload (Mirai)", "value": "fb77432705a177ccbd331b94aa22f0b4551fe1d66d2ac2659bd4da5c28a7c56e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045604, "uuid": "e7df1d33-c0ff-4e31-84e5-db4adeacd92e", "comment": "Malware payload (Mirai)", "value": "3a1597d26325bac5680a419e9dd9a816f6c58b05", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632045604, "uuid": "d3da0ded-1679-4137-a19c-cf77c3f73043", "comment": "Malware payload (Mirai)", "value": "a8c7308cccf7bd350211e2660a494d8a2b99820bba1e6a95b411e3094842436ff766c154a1933b1ed4de767f114e4da1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045604, "uuid": "9949d15b-bbf0-418b-ad85-33bff5569093", "value": "T180532AC8E0E3E8F5EC14097D307A6F629EB3F13BB076E99BC7D95463A942602D00665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045604, "uuid": "42aaec5a-fa72-4ebe-b2a2-584065bd7a10", "value": "1536:Cqvi+GXggf/bICZtbXYlakrSWf/iTErtT5aqvC3WRx:CpXggf/bICZtbXYlaGSWf/kEBT4qqmRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632045604, "uuid": "6fe6403e-c664-487a-9a99-a85b4dd7d6bf", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632045604, "uuid": "4f920349-d21e-444c-9b31-2b51ef7a3b6a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632045604, "uuid": "7bd1317d-7ec2-415c-8fbd-c5ba7f680453", "value": "lessie.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f6bc01-1965-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632068351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068351, "uuid": "82ffc354-00aa-4524-a931-afc3306e5d69", "comment": "Malware payload (AgentTesla)", "value": "4528ea1b5d39770bbccdcf904c37194d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068351, "uuid": "c0647b1b-3697-4fb4-bd31-dc401932dada", "comment": "Malware payload (AgentTesla)", "value": "fb81339d0f0f69f966566b9253f11d6b2d3ba3929f4c7407a6e046362334b1ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068351, "uuid": "0ccf5a31-815b-40ca-ba76-b6a0cba833bc", "comment": "Malware payload (AgentTesla)", "value": "fd54460ed6b682d6041f7d73029b3803e82b46e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068351, "uuid": "77e5c8e3-21d0-451e-bc25-f93502cd3446", "comment": "Malware payload (AgentTesla)", "value": "4820ca52c697ae06483fc9ce6a7eb356730482c07b098cf8921f95ea5818b979ffee275f6e19c02e39cb7ec09d715682", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068351, "uuid": "21069107-54e1-43a1-85b7-5bf090f19264", "value": "T178B4E03A32599372EB2907F02840645163B93C262E60DBDD6E887FDB35F672D0611B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068351, "uuid": "a3901672-4563-4838-8948-d73b51b6dcd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068351, "uuid": "8c440127-1422-4af9-9eaf-612e13f46e29", "value": "12288:vgzCjz4/eTnYoBZbqUzW2FxDWqrxjup3u3m8hx:vrjyeTnxBcUyIRup3u3pT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632068351, "uuid": "0593a193-ee9d-41c5-8030-85cd357d42d1", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632068351, "uuid": "ba7155eb-fe7d-41b1-af2d-a5f5eb4809a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068351, "uuid": "41002a9b-202d-4301-936c-87a67d2a089d", "value": "order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb713ac-197f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1632079670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079670, "uuid": "cc0cef24-d3e9-4c89-a6b8-d90ff48f272a", "comment": "Malware payload", "value": "1d7e9b5fc063594ad8d1a0b5dc27ce31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079670, "uuid": "d8f5f412-3612-4d52-a58a-fc2cd206bf4f", "comment": "Malware payload", "value": "fbd71dd3d78d16deaf4b5581b76baddbd260a92bb803530ed8397bcab37c5c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079670, "uuid": "307b3cc4-7c23-4f09-a864-c24e98a7ad98", "comment": "Malware payload", "value": "63cd3e3bf949153677feaa79b0cad2c3dc56108b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632079670, "uuid": "49b2f179-0ef7-4f15-8cd7-ca29c9ab57a7", "comment": "Malware payload", "value": "51d794112f5ca2180b09f66f0f59ed6d7875607f5088f8cc2e663d4576fac494fe03ec0578182e63360ca3dd65870986", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079670, "uuid": "3e6c3ed8-9890-4971-9670-8fa722b25507", "value": "T155055BB023E88E14EDFE1731E074C64402F6FC866239D3AFD98575A91DBAB458D533A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079670, "uuid": "ab51da9e-3924-45e7-bb4f-4bb6f8bb8a11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079670, "uuid": "958d052f-1cd2-4c54-b574-59d1bf6f1cd2", "value": "12288:e26Osj25vmBIPr/gecNU2zqX6lUB2AkeQlQ:hgjSvmeP8DNgWUB2Ake", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632079670, "uuid": "56eae8d0-2f46-45f5-99de-6788c79483f6", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632079670, "uuid": "981c3e33-4a90-4439-a1ef-ad1861a1656f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632079670, "uuid": "3cb94da9-5015-45ac-9301-dd0dac9e15f3", "value": "HEYZ MOD V3.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78d4902-18ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1632015665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015665, "uuid": "94adfb9c-6bae-454c-81b6-61b250b768b6", "comment": "Malware payload (RaccoonStealer)", "value": "a026a3878a2737bbcbd76471de185d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015665, "uuid": "68be5ed3-f4fb-4220-b6c4-20af65f19844", "comment": "Malware payload (RaccoonStealer)", "value": "fce2ff57454ef95f46025d3b8c6de03866e6c1d2f66f7fa2926db1a1914e8ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015665, "uuid": "1b430850-428d-4057-966d-b22852bf495f", "comment": "Malware payload (RaccoonStealer)", "value": "92b48a7f98af100a8100ce6612f9412e04f0f4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632015665, "uuid": "6d8be48d-9575-4c4d-bb51-1e4db2870a6b", "comment": "Malware payload (RaccoonStealer)", "value": "c03346883c0e7771daafa1bccb927f7b079b43c59076238f4d0e0d81baa70c65b83462a877343e8e8c03fb8ee3d25696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015665, "uuid": "e129f108-44e0-4b80-97fd-fdc71a0d7218", "value": "T184748E30BA90C035E4B712F849B6D3BCB92D7EA0A72450CB62E53AEE56345E5EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015665, "uuid": "d297a5a0-0057-41c0-8e78-3b7819ba703c", "value": "30c914cabff5c83a8c4da774eead18fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015665, "uuid": "4187d7fd-c0bd-41d0-ab65-a63db0de4310", "value": "6144:92lWIh/8dxvVAFMCDi+nuM5nOAA2vPGEDPwyRGCOxRc/h:kWIh/4xWFMCD1r5OAA2mYYvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632015665, "uuid": "a1288afa-dd84-40fb-85c0-9826fc862d24", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632015665, "uuid": "6a45d367-d245-41ce-bdf0-5bb096620070", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632015665, "uuid": "1ee63066-75e1-4668-8e3d-fd362a59fb9a", "value": "FCE2FF57454EF95F46025D3B8C6DE03866E6C1D2F66F7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24acb0b-195a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1632063787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063787, "uuid": "fc318b68-bba0-4658-a140-0fce470b23ad", "comment": "Malware payload (AgentTesla)", "value": "d11169998cc347a644bb886cec7d5fc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063787, "uuid": "282d8f85-54b0-4c5e-8fba-63db4197d23a", "comment": "Malware payload (AgentTesla)", "value": "fe0f394e06eecf0854560d2cfc1a07bce9f56851e95e9fcb33ebdc7ed7c89b0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063787, "uuid": "edc51696-49c6-4912-9185-5d671a81acba", "comment": "Malware payload (AgentTesla)", "value": "77d42015b5b0ef713de9e90719105d5170530363", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632063787, "uuid": "e34de959-145c-484c-a492-de50b00a460c", "comment": "Malware payload (AgentTesla)", "value": "0a4585609daf909fe75ae3655d62352fc49c3729d80615facecdf35ff6cb7ec3a27b0422947eb682ae5404d49fd3f774", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063787, "uuid": "0c1fab28-1a87-4c49-a55c-13b851d06800", "value": "T1EC94121116FCD356D0794BF0E20024449776B3677B21EA8C8FC6B5CD0AFABA94964EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063787, "uuid": "3e1361a5-19a5-4d21-9cf4-455b4f632d3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063787, "uuid": "1d9de62d-66a8-4957-b050-3aa07a5c6aa1", "value": "12288:YmdhOkOJfxblG/dbvPRJqvgN9tGQiygL8zx:Y4if8lzrqwtFXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632063787, "uuid": "ec9f79ed-4a31-4d58-a56e-c088854f0b37", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632063787, "uuid": "37c63f64-5f54-4299-affd-d842538cb0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632063787, "uuid": "556d9c8c-3d1d-4bc5-b560-137afc2eeb5b", "value": "d11169998cc347a644bb886cec7d5fc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b7cd71-1911-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1632032543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032543, "uuid": "176d9ff2-e78f-4d6c-a8c0-0dda2f77d9dc", "comment": "Malware payload (RedLineStealer)", "value": "c6c2d7338dd1be3e3cf4b8882ac58514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032543, "uuid": "0c34d4a7-bae3-4f45-8dfa-a04b8161b2d0", "comment": "Malware payload (RedLineStealer)", "value": "fe42adc8284f0845ce123a0c8c3d82affa84643dfa9da2f7cf727a2ec0005525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032543, "uuid": "b9c761d0-d1a5-4cdd-8269-1a0455503b81", "comment": "Malware payload (RedLineStealer)", "value": "cd572edcde0df984b669cf710ee320627c08f242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632032543, "uuid": "e83ea448-4c2b-41dd-8295-73ae7c1b5371", "comment": "Malware payload (RedLineStealer)", "value": "278d9cc0730553a76e4b9d23613c550d4e1eccb8da50ab7fe840fb9bec48786272c2fcf83065891e4bc0aa4ea0ce5dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032543, "uuid": "6d954674-7d1c-4fc2-9800-c2ca95098314", "value": "T1ACF529B2B62DE6CFC41A00F4A4CFA9838FB447A4560418B5DDFC387479B2D6A5DC4B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032543, "uuid": "46cc5840-c071-440a-8cf3-338fa112c4a0", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032543, "uuid": "d124346a-8ae6-4d9b-80dd-580ed8633c45", "value": "24576:3BBccwIzpU1e5jfJ4stJ6nUx7dzGF7gKH+oTxc+WszWSWJH08IfNihfsoSQZXqWk:3wopplf7trdW3qu2mr5gvnypZHQjo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632032543, "uuid": "610c6def-e3dc-4cc4-a666-95e74e0bd0b9", "value": 3467264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632032543, "uuid": "68b5bab9-3434-4856-aa75-948eabe958b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632032543, "uuid": "289263b8-7f31-4bc4-a4a9-578822305dab", "value": "c6c2d7338dd1be3e3cf4b8882ac58514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640d969e-196a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1632070527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070527, "uuid": "fd866636-f950-4cec-b6e3-1e31cfcb19e0", "comment": "Malware payload (BitRAT)", "value": "c2e214a664c86f020cf01a65753f2279", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070527, "uuid": "5f290c5c-8bd3-4efc-8a6b-bcb6d81be6a3", "comment": "Malware payload (BitRAT)", "value": "ff28079581ca00e790039ab9d81ab6330df81a2ab58e1836f3dcf60011696823", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070527, "uuid": "71b088b5-205b-4715-964d-ef13bb522b79", "comment": "Malware payload (BitRAT)", "value": "3d8687cd7bdee5b3042006b42f0302710067c97d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632070527, "uuid": "7df3d54f-4c0c-4b5c-a0d4-0190862aed41", "comment": "Malware payload (BitRAT)", "value": "e1a7eae0e2f6d1a427c02c5fa209203a0c3fa761f9773ef77ee5f42082038c3ae44a42b8bbb5baf6a15dd9a0a0ee3ac4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070527, "uuid": "311eb393-36ef-4953-9bb7-b47dc158a572", "value": "T1E2058E16B3844CF5F931193A8EDAB7913929BDF028A95D4F6DF03E1429647A2393C48F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070527, "uuid": "2d3aa46b-489c-4cc9-9195-b1573ab5269d", "value": "96d68413d52ee291c9b444b7006f0bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070527, "uuid": "d0d89dd6-2e19-4283-af5d-ed6f001a56d4", "value": "12288:mmnGyuE9fz9VBCY4Alz2MjbjBQHhazE2mdvnk6LHC7WWnMvwfHVBPggseBnDz5ZE:mmnZbz9e0z12HLBngseBDz5ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632070527, "uuid": "2a5ca810-71bc-496a-8260-1cc3a06c4da9", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632070527, "uuid": "b828417a-f19f-4c42-baa8-d4eb1681f0d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632070527, "uuid": "470cd8bc-f7ef-4446-9952-3ddc9e9096b5", "value": "UAEHBADS.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a26c0c3-1965-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Socelars)", "timestamp": 1632068471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068471, "uuid": "be0462bc-d717-49c8-8a38-d24fdec4640c", "comment": "Malware payload (Socelars)", "value": "17afc550a07ac77a70c6001303f0b8ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068471, "uuid": "05356ba6-3e22-45d1-96f1-cd8bde653cbb", "comment": "Malware payload (Socelars)", "value": "ffa6cfe4adc1c79864e266a9c2619bbea440fbfad5aaf1891877075ff8cc6f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068471, "uuid": "eb7e1e85-24b1-47b8-9b8b-98d36d198713", "comment": "Malware payload (Socelars)", "value": "a1224b860094359bb9d1738a480c4cec2305b2c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1632068471, "uuid": "5f5ae3ee-2eb7-4e2c-8257-19c8d7b600c9", "comment": "Malware payload (Socelars)", "value": "73a70e45efe204adb4870f6a10e87b82c85acd67b517f3b499e5d78e5d97d3e912261231a55bc328c84a9c62cc08976d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068471, "uuid": "e93052d6-42d0-4bd1-ad09-9a465a285752", "value": "T139659F21F6429036F8E310B286FE477E9D6CBA21031894D7E3C41D699E719E27A3B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068471, "uuid": "e14a9249-ccdf-470a-96e1-f987776347c8", "value": "4f0608b5638c60342069764638589dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068471, "uuid": "80f01aa1-fc0b-4291-863f-5b7a3d52063c", "value": "24576:LIVFA1pqtg/TnMbX0lwyh0FVmEByU1/wFYyOsZbKOnrSSs9OfQMYfjJ:qFA1pvTMbOwa0TmYJMYEtHnrSS9QMY7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1632068471, "uuid": "55064073-5fa3-4f16-9110-abbfa72d0c89", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1632068471, "uuid": "d5fc4d9d-9bec-4017-b057-35f2f511bf4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1632068471, "uuid": "e4b7e82e-41ec-4c73-b996-ad70325a653f", "value": "17afc550a07ac77a70c6001303f0b8ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }